# Abblix - full reference for language models Source of truth: https://www.abblix.com. Last generated at build time from the same content the site renders, so nothing here can drift from the pages. ## What Abblix is Abblix is a small, but ambitious engineering team. Everyone who writes code under the Abblix name has shipped security-critical systems before. Our backgrounds span enterprise cybersecurity and large-scale financial services: environments where a missed edge case becomes an incident. ## What Abblix builds Identity infrastructure. OIDC Server is a NuGet library for building your own OpenID Provider on ASP.NET Core, certified by the OpenID Foundation. Account is a free cloud authentication service built on it. We run both in production ourselves. Next up: AI co-workers for service businesses, where AI takes repetitive, customer-facing work off the people running them. ## How Abblix works We track OAuth Working Group and OpenID Foundation drafts, so support for a standard is usually ready by the time it reaches Final. We aim for code that is simple, readable and self-documenting, built on the standard .NET tooling and patterns every developer already knows. The repos are public: your issues are read and answered by the people who write the code, directly. ## Abblix OIDC Server OIDC Server is a certified OpenID Connect & OAuth 2.0 library for .NET - deployed inside your perimeter, on keys only you hold, with no vendor lock-in and no geopolitical risk. Built for banks, telecoms and enterprises where compliance isn't optional. - Runs inside your own infrastructure; user data never leaves it. - Distributed as a NuGet library for ASP.NET Core; source is public on GitHub. - Certified by the OpenID Foundation across the OpenID Provider profiles. - Documentation: https://www.abblix.com/en/docs/introduction-to-abblix-oidc-server · Repository: https://github.com/Abblix/Oidc.Server#readme ## Pricing Nothing is switched off, even in the free tier: CIBA, DPoP, mTLS, PAR, JAR/JARM, Token Exchange, dynamic client registration, resource indicators and automatic key rotation - plus unlimited client applications and users, and free deployments for development, testing and staging environments. ### Community - $0 For companies with under $1M in annual revenue and under $1M raised in outside funding (investment, grants, sale of a stake), plus non-profits, educational institutions, personal projects and non-commercial open source - and free deployments in development, test and staging environments for everyone - All protocols & OpenID profiles included - Unlimited client applications & users - 1 production issuer, unlimited nodes - Community support (GitHub · Stack Overflow) ### Pro - $3,000 / year For companies above the Community thresholds running OIDC Server in production - Everything in Community - Standard support - reply within 3 business days - 1 conference call as part of support ### Enterprise - $9,000 / year For multiple independent issuers, large deployments and priority support - Everything in Pro - Unlimited production issuers - Extended support - priority reply within 1 business day - Priority bug-fix queue - Up to 5 conference calls as part of support All three plans are fixed prices - no "from", no mandatory sales call. Need a guaranteed critical-bug fix window, onboarding help or special contractual terms (indemnity, LTS)? Those sit above Enterprise - contact us. ## Licensing FAQ **Q: Is OIDC Server priced per user or per client application?** A: No. Users and client applications are unlimited in every tier, including the free one. You pay by company size and support level - never by counting clients or connections. **Q: What counts as a production issuer?** A: An issuer is one logical instance of the OIDC Server with its own issuer URL - the address your client applications trust and check tokens against. One issuer typically serves an entire product or company, with any number of client applications and users behind it. You need a second issuer only when you run genuinely separate identity spaces: another brand, a separate legal entity or an isolated tenant with its own users and keys. **Q: How many servers can one issuer run on?** A: As many as you need. Nodes are the servers you run one issuer on - behind a load balancer, for fault tolerance and to handle load. Every tier, including the free one, allows unlimited nodes: you scale horizontally without paying more. **Q: Is the Community tier really free for commercial use?** A: Yes - for companies with under $1M in annual revenue and under $1M raised in outside funding (investment, grants, sale of a stake). Both conditions apply: once either one is exceeded, commercial production moves to Pro. Non-profits, educational institutions, personal projects and non-commercial open source stay free regardless of these numbers, as do deployments in development, test and staging environments for everyone. **Q: Are all protocols included in the free tier?** A: Yes. Every profile (DPoP, mTLS, PAR, JAR/JARM, CIBA, Device Flow, DCR, Token Exchange, Resource Indicators, PPID and more) is in every tier, including Community. Certification and feature completeness are not restricted for anyone. **Q: Will prices or the free threshold change on me?** A: Existing customers are grandfathered: your rate holds as long as you renew, and whatever is included today stays included. Any increases apply only to new licenses and are announced ahead. The free threshold only moves up. **Q: What's the difference between Pro and Enterprise?** A: Both include every protocol and unlimited client applications and users. Pro covers one production issuer with Standard support (reply within 3 business days). Enterprise adds unlimited independent issuers, Extended priority support (reply within 1 business day) and a priority bug-fix queue. **Q: Do you offer redistribution / OEM (ISV) licensing?** A: Yes, as a separate license, for embedding Abblix inside a product you ship to third parties. Internal use stays Pro or Enterprise, not ISV - even a large company with many apps behind one SSO. ## License in plain language Some packages are under an open license (Apache-2.0): - Abblix.SecurityEvents with the CAEP and RISC vocabularies and its Minimal API adapter - Security Event Tokens, the receiving side of their delivery, and the receiving half of Back-Channel Logout - Abblix.JWT, the JWT and JWE engine, together with the utility packages it rests on An application that only needs to be told when a session ended elsewhere takes these and nothing else, whoever its identity provider is. The Shared Signals layer - Abblix.SharedSignals with its adapter and its Redis storage - is licensed by this agreement, as is the OpenID Provider itself. Free of charge: - Companies with under $1M in annual revenue and under $1M raised in outside funding (investment, grants, sale of a stake) - Non-profits, educational institutions and personal projects - whatever their size; open-source projects, as long as the project itself is non-commercial - Deployments in development, test and staging environments - for everyone, at any size A paid license is required: - Commercial production use by a company above either threshold - revenue or funds raised - Guaranteed support response: 3 business days on Pro; on Enterprise - 1 business day plus a priority bug-fix queue - Several independent production entry points (issuers) - Enterprise only Not allowed on any tier: - Publishing it as your own product or removing the license terms - Building wrappers and reselling it to third parties as an authentication service - Using the source code, in whole or in part, to develop competing products of your own Shipping inside your own product: Internal use is not redistribution: even a large company with dozens of its own applications behind a single SSO is covered by Pro or Enterprise. A separate license applies when the library reaches third parties inside something you sell or deploy for clients - and it is meant for products where authentication is one function among many, not the product itself. Wrapping the library and reselling it as an authentication service is not allowed. ## Abblix Account Connect it to your site and get a complete sign-in flow out of the box: registration, sign-in, email verification and terms-of-service acceptance. We built Account on our own OIDC Server - a live product that shows what the library can do. - Service: https://account.abblix.com · Demo: https://quorvel.abblix.com - External identity providers: Google, Apple, Microsoft, Facebook, VK, Yandex ## Implemented standards ### OAuth 2.0 - RFC 6749 Authorization Framework - RFC 6750 Bearer Token Usage - RFC 9110 §11 HTTP Semantics - Authentication - RFC 7009 Token Revocation - RFC 7662 Token Introspection - RFC 8628 Device Authorization Grant - RFC 7591 · 7592 Dynamic Client Registration - RFC 9207 Issuer Identification ### Financial-grade security - RFC 7636 Proof Key for Code Exchange - RFC 8705 Mutual-TLS & Cert-Bound Tokens - RFC 9126 Pushed Authorization Requests - RFC 9101 JWT-Secured Auth Request (JAR) - Spec JWT Auth Response Mode (JARM) - RFC 9449 Demonstrating Proof of Possession (DPoP) - RFC 9396 Rich Authorization Requests (RAR) - RFC 8693 · 8707 Token Exchange & Resource Indicators - OpenID Spec CIBA - Backchannel Authentication ### Tokens & JOSE - RFC 7519 JSON Web Token (JWT) - RFC 9068 JWT Access Tokens - RFC 7515 JSON Web Signature (JWS) - RFC 7516 JSON Web Encryption (JWE) - RFC 7517 JSON Web Key (JWK) - RFC 7518 JSON Web Algorithms (JWA) - RFC 7523 JWT Client Auth & Grants - RFC 8176 Authentication Method Reference (AMR) - RFC 9701 JWT Response for Token Introspection ### OpenID Connect - Spec OpenID Connect Core 1.0 - RFC 8414 Discovery & AS Metadata - Spec Dynamic Client Registration 1.0 - Spec Session Management 1.0 - Spec RP-Initiated Logout 1.0 - Spec Front-Channel Logout 1.0 - Spec Back-Channel Logout 1.0 - Core §8 Pairwise Pseudonymous IDs (PPID) - Spec Multiple Response Type Encoding - Spec Form Post Response Mode ### Client authentication - Basic client_secret_basic - POST client_secret_post - JWT client_secret_jwt - JWT private_key_jwt - mTLS tls_client_auth - mTLS self_signed_tls_client_auth - Public none ## Documentation - full articles Every article below in full, in reading order. Each also lives at its own URL (HTML) and at URL + ".md" (raw markdown). --- Source: https://www.abblix.com/en/docs/introduction-to-abblix-oidc-server.md # Introduction to Abblix OIDC Server Abblix OIDC Server is a .NET library that implements OAuth 2.0 and [OpenID Connect](https://www.abblix.com/en/docs/glossary-overview#openid-connect) on the server side. It was built by developers who had spent years working with IdentityServer4 in production and accumulated a long list of things they would have designed differently. [We wrote up why that history led to a new library rather than another fork](https://www.abblix.com/en/docs/we-built-our-own-identity-server). The result is a library built for ASP.NET Core from the ground up: not a port, not a wrapper, but an implementation that treats routing, middleware, model binding, and [dependency injection](https://www.abblix.com/en/docs/glossary-overview#di) as first-class primitives. ## What makes it different ### Certification across all profiles Abblix OIDC Server is certified by the OpenID Foundation across all login and logout profiles (Basic, Implicit, Hybrid, Config, Dynamic, Form Post, 3rd Party-Init, and all logout variants) with zero failures and zero skipped tests in 600+ conformance checks. The results are public and independently verifiable at the OpenID Foundation site. This is the most objective measure of protocol correctness available, and it's the strongest argument we make. ### Designed for extensibility Authentication flows need layering: consent steps, custom claims, overridden token lifetimes, tenant-specific logic. Abblix OIDC Server is structured around small, composable interfaces using Composite and Decorator patterns throughout. Each extension point is sized to the behavior you're changing, not a thousand-plus-line class you need to understand before touching. ### ASP.NET Core native The library integrates with ASP.NET Core the way your own controllers do. Standard routing, standard filters, standard debugging: no parallel middleware world to learn. Teams already building on .NET don't hit a conceptual wall when they add Abblix OIDC Server. ### Built on [System.Text.Json.Nodes](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes) end to end Claims are [JsonNode](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonnode) values, not name/string pairs. Complex JWT payloads (arrays, nested objects, typed values) work without serialization workarounds. ## What it covers The library implements OAuth 2.0 and OpenID Connect flows, [PKCE](https://www.abblix.com/en/docs/pkce-in-openid-connect), [token introspection](https://www.abblix.com/en/docs/glossary-overview#token-introspection) and revocation, [dynamic client registration](https://www.abblix.com/en/docs/glossary-overview#dynamic-client-registration), device authorization, [mutual TLS](https://www.abblix.com/en/docs/glossary-overview#mutual-tls-client-authentication), [pushed authorization requests](https://www.abblix.com/en/docs/glossary-overview#par), JWT-secured authorization requests, [CIBA](https://www.abblix.com/en/docs/glossary-overview#ciba), and the full OpenID Connect suite including session management, front-channel and [back-channel logout](https://www.abblix.com/en/docs/glossary-overview#back-channel-logout), and dynamic provider discovery. See [Implemented Standards](https://www.abblix.com/en/docs/implemented-standards) for the complete list with RFC references. ## What it doesn't do (yet) Entity Framework Core and ASP.NET Identity stores are on the roadmap for Q4 2026. Until then, you implement the persistence interfaces yourself: typically 200-400 lines wired to whatever database you already use. If you actually need ready-made EF Core stores, that's the one thing to keep in mind. ## Where to go next - [Getting Started](https://www.abblix.com/en/docs/getting-started-guide): working OIDC provider in your ASP.NET Core app - [Abblix vs Duende IdentityServer vs OpenIddict](https://www.abblix.com/en/docs/comparison-duende-openiddict): how the three .NET options compare on protocol coverage, licensing, and architecture - [An alternative to IdentityServer4 and Duende](https://www.abblix.com/en/docs/duende-identityserver-alternative): what the switch involves if you are running one of them today - [Authentication for SPAs with a BFF](https://www.abblix.com/en/docs/net-authentication-openid-connect-bff-spa): the Backend-for-Frontend pattern for browser apps, end to end - [Understanding the Architecture](https://www.abblix.com/en/docs/understanding-the-architecture): hexagonal design, endpoints, handlers, extension points - [Implemented Standards](https://www.abblix.com/en/docs/implemented-standards): full RFC reference list - [Product Roadmap](https://www.abblix.com/en/docs/product-roadmap): what's coming and when --- Source: https://www.abblix.com/en/docs/navigating-identity-management.md # Navigating Identity Management The identity layer of your application is too critical to leave entirely in someone else's hands, whether that someone is a cloud vendor, an open-source maintainer, or a commercial provider. Most teams don't make this choice deliberately. They inherit it from an early decision made under time pressure. This guide is about making it deliberately, before that pressure arrives. ## Most teams start with cloud Cloud identity providers (Auth0, Azure AD B2C, Okta, AWS Cognito) exist because authentication is hard and most teams don't want to deal with it. That's a completely rational position. These services handle password storage, MFA flows, social login, token issuance, and session management so you don't have to. Early on, speed matters more than control, customization needs are minimal, and the cost of switching is still low. For a new product validating a market, that tradeoff often makes sense. The friction shows up later. Password hashes are not portable. Most cloud providers use proprietary formats: exporting user records doesn't mean exporting the ability to verify passwords. Your users will need to reset passwords on migration. For a product with tens of thousands of users, that's not a migration; it's a user experience incident. Some providers make this explicit in their contracts. Others don't mention it until you ask. Data sovereignty is a related concern that starts abstract and becomes urgent. Where are your users' credentials actually stored, in which region, and under which legal jurisdiction? For regulated industries (healthcare, finance, government), these questions have compliance answers. For companies with EU users, they have GDPR answers. "Our cloud provider handles it" is not an answer that satisfies an auditor. Customization limits tend to manifest as the product matures. Generic flows work until your business logic doesn't fit the template: a consent step with custom conditions, a token format with claims your downstream services expect, a login experience that needs to match your product's design system at a level the provider's themes don't support. At that point you're either maintaining workarounds, paying for enterprise tiers that expose more configuration, or building anyway, just on top of a system you don't fully control. ## The on-premise middle ground On-premise identity servers (Keycloak, WSO2 Identity Server, Authentik) solve the data control problem directly. Your user credentials are in your database, in your infrastructure, under your operational procedures. There is no export step, and no vendor decides the format your password hashes live in. The tradeoff is maintenance. Running identity infrastructure means owning its security posture, its uptime, its upgrade path. When a critical vulnerability is disclosed in the JWT library underneath your identity server, you need to know about it and respond. When the framework it depends on releases a breaking change, you absorb the migration cost. These are manageable problems for teams with the operational maturity to handle them, and they're problems that exist with cloud providers too, just invisibly. What on-premise doesn't solve is extensibility. The protocol implementation you choose determines how much you can adapt it to your specific needs, and that boundary becomes visible only when you hit it. Beyond that, the server you build on must be actively maintained and backed by a sustainable model: one where the maintenance calculus is visible and predictable before you commit to it. There's a deeper risk too. Any product, however well-built, is maintained by people who eventually need to sustain the work differently. Pricing models change, maintainers move on, and support windows close. Identity infrastructure is a foundation: everything above it depends on it. Teams fare best when the identity layer is isolated enough that swapping implementations is mechanical, not architectural. ## The attraction of in-house development If you have a development team with the right expertise, building your own identity server is an option worth considering seriously. It gives you something neither cloud nor on-premise can fully match: complete ownership of the identity layer. Your token format, claim structure, session behavior, and compliance requirements: none of it depends on a vendor's roadmap or a third-party template. When a compliance requirement demands a specific claim, you add it. When an enterprise client needs a custom login flow, you build it. The identity layer adapts to your product, not the other way around. The honest tradeoff: this is genuinely difficult. OAuth 2.0 and OpenID Connect are specifications with hundreds of behavioral requirements, subtle edge cases, and security constraints that have caught experienced teams off guard. JWT handling alone involves key management, algorithm selection, and token validation nuances that are easy to get subtly wrong. A working integration test suite is not the same as a specification-correct implementation. There's also ongoing responsibility. Security vulnerabilities in the authentication layer are incidents. Your team needs the expertise to recognize them, assess impact, and respond quickly. For teams that treat security as a core competency, this is ownership, not a burden. You're not dependent on a vendor's pricing decisions or a maintainer's roadmap. For teams that don't have that expertise, it's a liability that compounds over time. ## Making in-house accessible The difficulties described above are real, but they are not yours to solve from scratch. Protocol handling complexity (the hardest part of in-house development) can be delegated to a certified library. For instance, Abblix OIDC Server is an OIDF-certified .NET library you can [take and use directly](https://www.abblix.com/en/docs/getting-started-guide) as the foundation for your own identity server - [built from the ground up for ASP.NET Core](https://www.abblix.com/en/docs/we-built-our-own-identity-server), and [weighed against Duende IdentityServer and OpenIddict](https://www.abblix.com/en/docs/comparison-duende-openiddict) if you are choosing between them. You skip the protocol complexity without giving up the ownership advantages. The OpenID Foundation (OIDF) is the organization behind the OpenID Connect specification. It runs an independent conformance certification program: semi-automated test suites that verify implementations against every behavioral requirement across multiple profiles (Basic, Implicit, Hybrid, Dynamic, logout variants). Certification is public and comparable; any two libraries can be evaluated side by side on the OIDF site. Abblix OIDC Server has passed the full conformance suite across all profiles with zero failures and zero skipped tests: 634 tests in total. Your team doesn't need years of protocol expertise to get it right. The library already got it right, and that result is independently verified: [Regular Profiles](https://oidc.abblix.com/certified-profiles) and [Logout Profiles](https://oidc.abblix.com/certified-logout-profiles). Security responsibility is shared: the library handles the specification-level constraints; deployment, key management, and operations stay with your team. That's a manageable scope for a team with engineering discipline, far narrower than owning the full protocol stack. What stays entirely yours: the data, the infrastructure, the customization, the integration with your business logic. All the advantages of in-house ownership, without the multi-year research project. One question worth asking: which decision are we likely to regret making reactively in two years? The teams that made their identity choices deliberately were the ones helping others migrate when providers changed terms. The ones that deferred scrambled. --- Source: https://www.abblix.com/en/docs/we-built-our-own-identity-server.md # We Built Our Own OIDC Library. Why? Fair enough question. It definitely deserves a good answer. I read the news in late 2020: IdentityServer4 was going commercial. The new product was called Duende IdentityServer, a paid, licensed product. The last free version of IS4 kept receiving security patches for some time and then stopped. I had spent years as a lead developer at a large IT-security company, building the authentication service on top of IS4. I'd been in this ecosystem long enough to remember when IdentityServer still shipped with a tightly integrated UI, before IS4 separated it into a standalone scaffolded project. And I had a list. A list of things the team quietly accepted because the library was free. Things I'd been telling colleagues about for years. Things I'd filed away under "we'd do this differently if we could". Now the library became commercial. And the list was still on the table. Some teams paid. Some migrated. I had my own vision. Eventually, I left to build what I'd always wanted. I'm Kirill Kovalev, co-founder and CTO of [Abblix](https://abblix.com/). This is the story of [Abblix OIDC Server](https://github.com/Abblix/Oidc.Server): how it was started, what drove it, and where things stand today. ## TL;DR After years working on enterprise-scale identity built on IdentityServer4, I had a long list of things I wished were different. When IS4 went commercial, Duende IdentityServer became the direct successor: the same codebase and architecture continued commercially. Later I started Abblix OIDC Server to go the other way: the approach rethought, the architecture redesigned, and the code written from scratch. Same origin, different answers to the same list. The result is a .NET OAuth 2.0 / OIDC library: [hexagonal architecture](https://www.abblix.com/en/docs/glossary-overview#hexagonal-architecture) with the protocol core independent of [ASP.NET MVC](https://www.abblix.com/en/docs/glossary-overview#asp-net-mvc), small composable interfaces via Composite/Decorator patterns, Result-pattern error handling, and a JWT layer built on [System.Text.Json.Nodes](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes) with no string-valued [Claim.Value](https://learn.microsoft.com/en-us/dotnet/api/system.security.claims.claim.value). Everything is assembled through standard .NET [dependency injection](https://www.abblix.com/en/docs/glossary-overview#di) (keyed services included), and wherever the platform already provides a mechanism, the library uses it rather than inventing its own. Verified by 600+ OpenID Foundation conformance tests with zero failures across all profiles. I believe the .NET community wins when the ecosystem has multiple mature products competing on bright ideas. Abblix OIDC Server is my contribution: a different take on the same problem. ## What Bothered Me Every developer who works with a library long enough builds a mental list. Things that are wrong but tolerable. Things you work around. Things you explain to every new team member with "yes, I know, that's just how it works". With IS4, my list had several things that never went away. ### The Black Box Middleware When you call `app.UseIdentityServer()`, IS4 puts its middleware early in the pipeline, before MVC. Inside that middleware lives a custom router that does simple path matching against a table of registered OIDC endpoints: `/connect/authorize`, `/connect/token`, `.well-known/openid-configuration`. If a request path matches, the middleware resolves a handler from DI, runs it, writes the response, and returns. The rest of the pipeline never fires. ASP.NET Core's routing system never sees the request. MVC never sees it. And you cannot easily change those paths either: they are baked into the middleware's internal table, not exposed as MVC route templates you can customize. This was the first wall we hit. Our architect came to me with a simple suggestion: let's align those OIDC paths with the rest of our API schema. We started investigating whether we could. Not easily, it turned out. We had to dig into IS4's internal routing, find a way to intervene in its configuration, and re-register the endpoints under different paths. The architectural choice underneath: the OIDC protocol core is tied to raw middleware primitives, [HttpContext](https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.http.httpcontext), and never plugs into MVC's controller or any other layer. It runs in a hidden pipeline, before MVC and before standard routing. The result is two parallel worlds of request handling inside the same process, sharing the same DI container, but with completely different handling models. To understand what happens during an authorization request, you read IS4's source. To change it, you figure out IS4's DI-based extension points, a separate vocabulary entirely. At the authentication service, customizing endpoint behavior meant working with IS4's service collection directly. Before writing a single line of custom code, we had to dig through IS4's source to understand how its internal routing system worked and where there was even a seam to inject into. Then we wrote ~50 lines of infrastructure: iterating over the DI service collection at runtime, finding `Endpoint` metadata objects by name, instantiating generic decorator types via reflection, removing original service descriptors, registering new ones. The actual decorator registrations were three lines. The machinery to make those three lines work was the other 47. The middleware-only approach has a real strength: it runs alongside any HTTP framework the rest of your app uses, whether MVC, Minimal APIs, or anything else. The trade-off is customization. Reaching into that pipeline to adjust its behavior means descending into the middleware's internal abstractions, not using the tools each framework already gives you. Abblix OIDC Server makes the opposite architectural choice. It is designed to integrate into your service as an organic part (not a separate component plugged in from the side), and to let you swap, extend, or remove any part with minimal code, ideally through standard DI registration. The core [Abblix.Oidc.Server](https://github.com/Abblix/Oidc.Server/tree/master/Abblix.Oidc.Server) contains the OIDC state machine: what requests are valid, what responses to produce, what invariants to enforce. [Abblix.Oidc.Server.Mvc](https://github.com/Abblix/Oidc.Server/tree/master/Abblix.Oidc.Server.Mvc) is a thin adapter that plugs that core into standard MVC controllers, model binding, and action results. This follows the [hexagonal (ports-and-adapters) architecture](https://en.wikipedia.org/wiki/Hexagonal_architecture_(software)) pattern. Protocol logic sits in the center; transport bindings, storage bindings, and cryptographic bindings plug in as adapters around it. The architecture is deliberate and documented in the [Understanding the Architecture](https://www.abblix.com/en/docs/understanding-the-architecture) guide. Through the MVC adapter, every OIDC endpoint becomes a standard [MVC controller](https://www.abblix.com/en/docs/glossary-overview#mvc-controller). Everything lives in the same routing table, the same filter pipeline, the same call stacks. Even [CORS](https://www.abblix.com/en/docs/glossary-overview#cors) and [CSP](https://www.abblix.com/en/docs/glossary-overview#csp) stay on their standard ASP.NET Core wiring. No parallel routing world. No reflection over service descriptors. When you put a breakpoint in an OIDC endpoint, you are looking at a normal MVC controller action. All of this is familiar to any .NET developer. That familiarity is a design principle, not a side effect of choosing MVC: wherever .NET or ASP.NET Core already provides a mechanism (routing, model binding, DI, options, logging, distributed caching), the library builds on that mechanism instead of shipping a private replacement. Since the endpoints are standard MVC controllers, their paths are configurable at runtime via tokenized route templates - no recompilation needed when deploying across dev, staging, and production environments. See [Dynamic Routes](https://www.abblix.com/en/docs/tokenized-routing-dotnet) for details. Abblix ships an adapter for ASP.NET MVC out of the box. But the hexagonal architecture makes it straightforward to create others. That is not a theoretical promise: a second adapter, for Minimal API, was built without touching the core itself. ### The Override Tax IS4 had a pattern of large, monolithic service classes, hundreds of lines, that handled multiple responsibilities and made configuration-level decisions deep inside method bodies. This matters when you need to change something small. Say you want to modify how the token endpoint validates a specific parameter, or how the authorization endpoint handles a particular edge case. In an ideal library, you'd implement a small, focused interface and register it. In IS4 the relevant logic often lives inside a large default implementation. To change it, you copy the entire class, hundreds of lines, into your codebase, adjust the ten lines you actually care about - and maintain your fork of that class through every library update. I call this the override tax. Every customization required inheriting (or copying) more code than you were actually changing. A new team member asks "why do we have a class that runs into hundreds of lines in our project that looks like it belongs in the library?" Answer: "we needed to change one condition in the middle of it". This also makes future upgrades painful. The library releases a new version. Does your override still work with it? Does the library provide an updated version of the class you forked? If yes, how do you merge it with your customization? You go line by line through the diff, figure out which parts of the upstream class changed, and manually reconcile. Here's an example from the service I was developing while working with IS4. We needed to change the HTML generated by the [front-channel logout](https://www.abblix.com/en/docs/glossary-overview#front-channel-logout) page: the iframe-based page that notifies all registered clients to sign out. Actually, we needed custom JavaScript barrier synchronization to coordinate the iframe callbacks, and different URL construction for legacy WS-Federation clients alongside OpenID Connect ones (weird, I know, but enterprise makes strange bedfellows sometimes). The class responsible for that logout page was marked `internal`, inaccessible outside the library. No subclassing, no partial override. The only path was a full reimplementation: a decorator of over two hundred lines, replicating the endpoint's entire request-processing pipeline just to reach the few dozen lines of HTML generation at the bottom. That's the most insidious consequence of `internal` on infrastructure code: the change itself was trivial. The path to making it was not. Another real-world example: we needed to handle `post_logout_redirect_uri` validation when the request doesn't include an `id_token_hint`. The validator for that endpoint had no virtual hook for "client not found". The decorator we ended up writing required around sixty lines of code, of which roughly fifteen were new logic; the rest was infrastructure required to intercept the validator at all. In IS4, the largest files are exactly where the business logic lives: validators, managers, response generators. IS4 earned those validators the hard way, accumulating the OIDC complexity in a small number of critical files. The question is whether that complexity is extractable into smaller pieces. The token-request validator handling all grant types was already 800+ lines. Most files are modest on both sides; the difference shows up in the classes that matter most. Abblix OIDC Server takes the opposite approach from the very beginning. The validators are decomposed into small, focused classes, each responsible for a single concern. The surface area you need to implement to change a specific behavior is sized to that behavior, not to whatever class happened to contain it. Adding a new [grant type](https://www.abblix.com/en/docs/glossary-overview#grant-type) or changing one validation rule means implementing one focused interface to plug the implementation into the pipeline - not copying a thousand-line class to change ten lines inside it. The glue holding those small classes together is standard .NET dependency injection, used at full depth. Composite implementations gather independently registered handlers behind one interface: client authenticators, grant handlers, logout notifiers. Decorators wrap existing services to layer on cross-cutting behavior such as consent prompts, token status checks, or a guard against authorization-code reuse. And where the protocol itself names the variants, keyed services turn the protocol identifier into the DI key: JWT signers are registered under their [JOSE](https://www.abblix.com/en/docs/glossary-overview#jose) algorithm names, [CIBA](https://www.abblix.com/en/docs/glossary-overview#ciba) delivery handlers under `ping`, `poll`, and `push`. Extending any of these means adding one registration; the dispatch lives in the container, not in a switch statement you have to fork. Only two Abblix files exceed 500 lines. Both are DI registrations, not business logic. ### Claim Values as Strings This one is more subtle, but it often produced bugs in practice. To be fair, it isn't strictly an IS4 problem; it's an inherited one. The JWT layer underneath, Microsoft's own [Microsoft.IdentityModel.Tokens](https://www.nuget.org/packages/Microsoft.IdentityModel.Tokens), is built around the `SecurityToken` abstraction and relies on the BCL [Claim](https://learn.microsoft.com/en-us/dotnet/api/system.security.claims.claim) type, whose `Value` is always a string - name-value pairs with no native JSON types. IS4 integrated deeply with that stack and carried the limitation forward into every token it issued. That string-based model was reasonable years ago, when XML was dominant ([SAML](https://www.abblix.com/en/docs/glossary-overview#saml) tokens, for example). The problem is that modern OAuth 2.0 and OIDC often require structured claims in tokens. Consider the `aud` (audience) claim. In a simple case it's a single string. In multi-resource scenarios it's an array. When you get the audience from a [ClaimsIdentity](https://learn.microsoft.com/en-us/dotnet/api/system.security.claims.claimsidentity), you iterate claims named `aud`. If there's one, you have a string. If there are multiple, you have multiple claims. The JWT representation of an array and multiple claims with the same name are not the same thing in all contexts. The `amr` ([Authentication Methods References](https://www.abblix.com/en/docs/glossary-overview#amr)) claim has the same shape. It records how a user authenticated, `["pwd", "otp"]` for password plus OTP, `["mfa", "hwk"]` for a hardware key. A JSON array of strings, with standard values from [RFC 8176](https://www.rfc-editor.org/rfc/rfc8176). Every OIDC provider that supports MFA returns it. But the problem goes even further. Consider the `address` claim from OIDC Core: a JSON object with `street_address`, `locality`, `postal_code`, `country`. The `cnf` (confirmation) claim from [RFC 7800](https://www.rfc-editor.org/rfc/rfc7800) carries a public key for proof-of-possession, the mechanism behind [mTLS](https://www.abblix.com/en/docs/glossary-overview#mutual-tls-client-authentication) ([RFC 8705](https://www.rfc-editor.org/rfc/rfc8705)) and DPoP ([RFC 9449](https://www.rfc-editor.org/rfc/rfc9449)). The `authorization_details` claim from [RFC 9396](https://www.rfc-editor.org/rfc/rfc9396) is an array of JSON objects encoding fine-grained permissions. And there are plenty of other structured claims, including custom ones: at the authentication service we had several in exactly the same shape, and each one was a recurring pain point. Each of these, in the string-based model, has to be serialized to a string, embedded in the claim, and deserialized on the other side. This works until it doesn't: whitespace differences, key ordering, numeric type ambiguity, arrays with a single element being serialized differently by different JSON serializers. [Microsoft.IdentityModel.Tokens](https://www.nuget.org/packages/Microsoft.IdentityModel.Tokens) has switched its internal JSON serializer more than once across versions, and each switch quietly changed how claim values were serialized and deserialized. Each switch added another layer of fragility on top of the string model. I tracked down bugs of this kind many times. The root cause was always the same: something that was a proper JSON type somewhere in the pipeline got squeezed through the string bottleneck and came out different. [Abblix.JWT](https://github.com/Abblix/Oidc.Server/tree/master/Abblix.Jwt) is built directly on [System.Text.Json.Nodes](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes). A claim value is a [JsonNode](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonnode) and can carry any JSON type: string, number, boolean, array, or object. No serialization through strings and back. The JWT payload is composed from JSON types end to end. When you put a JSON object into a token payload, it comes out as a JSON object on the other side. This sounds like a baseline expectation. With the string-based model, it isn't. ### Success and Failure, One Type IS4 handles validation failures through result types, but those types are weak. A single `ValidationResult` carries both success and failure semantics at once, distinguished only by an `IsError` boolean plus `Error` / `ErrorDescription` string properties. The distinction between success and failure lives in the `IsError` flag checked at runtime, not in the type signature. Naming convention alone tells which properties belong to which outcome: success data and error data live side by side on the same object. Remember to check `IsError` before reading the success fields, and things work. Forget, and you read garbage. Nothing in the type system forces the compiler to check that. This works in practice. It also means that the "happy path" in your code is the path where nothing has been validated yet: failures are invisible in the type system, and the compiler does nothing to stop you from forgetting to handle one. The point here is not that IS4's pattern was broken. It shipped and worked. The problem is that in a protocol library, where OAuth error responses are a first-class part of the specification, a result type that doesn't enforce anything pushes correctness work onto every caller. Abblix embraces the Result pattern end to end. Every operation that can fail returns a [Result<TSuccess, TFailure>](https://github.com/Abblix/Oidc.Server/blob/master/Abblix.Utils/Result.cs): success with a value, or failure with a structured error. Two type parameters, not one: success and failure are different shapes in the signature, not two faces of the same object. The compiler enforces that callers handle both cases. Validation failures are typed values, not boolean flags plus loose strings. The control flow is explicit: bind, map, match. And the Result pattern makes that enforcement the compiler's job, not yours. ## Why We Didn't Choose OpenIddict OpenIddict is the obvious free alternative. Apache 2.0, solid community, impressive adoption numbers. I genuinely appreciate the work Kevin Chalet has put into it over the years. I looked at it seriously alongside IS4, weighing one against the other. The tiebreaker was certification. Back when my team had to choose a library for the authentication service at the company where I worked at the time, we picked IS4 over OpenIddict for exactly this reason: IS4 was certified by the OpenID Foundation, OpenIddict was not. That wasn't my personal call. For a large company specializing in IT security, compliance officers made the final decision. "It works in our integration tests" is not the same as "it has passed the OpenID Foundation conformance suite". That lesson stayed with me. Certification became one of the most important factors when choosing an identity library, especially when targeting large enterprise or IT-security companies. When I started building Abblix OIDC Server, passing the conformance suite was a day-one commitment. ## What Was Built The protocol surface covers what production identity providers need. Authorization Code, Implicit, Hybrid, [Client Credentials](https://www.abblix.com/en/docs/glossary-overview#client-credentials-grant), Device Authorization ([RFC 8628](https://www.rfc-editor.org/rfc/rfc8628)). [PKCE](https://www.abblix.com/en/docs/pkce-in-openid-connect) ([RFC 7636](https://www.rfc-editor.org/rfc/rfc7636)), [Pushed Authorization Requests](https://www.abblix.com/en/docs/glossary-overview#par) ([RFC 9126](https://www.rfc-editor.org/rfc/rfc9126)), JWT-Secured Authorization Requests ([RFC 9101](https://www.rfc-editor.org/rfc/rfc9101)), [CIBA](https://www.abblix.com/en/docs/glossary-overview#ciba), Mutual-TLS ([RFC 8705](https://www.rfc-editor.org/rfc/rfc8705)), [Resource Indicators](https://www.abblix.com/en/docs/glossary-overview#resource-indicators-for-oauth-2-0) ([RFC 8707](https://www.rfc-editor.org/rfc/rfc8707)), [Dynamic Client Registration](https://www.abblix.com/en/docs/glossary-overview#dynamic-client-registration) ([RFC 7591](https://www.rfc-editor.org/rfc/rfc7591)/[7592](https://www.rfc-editor.org/rfc/rfc7592)), [Token Introspection](https://www.abblix.com/en/docs/glossary-overview#token-introspection) ([RFC 7662](https://www.rfc-editor.org/rfc/rfc7662)), [Token Revocation](https://www.abblix.com/en/docs/glossary-overview#token-revocation) ([RFC 7009](https://www.rfc-editor.org/rfc/rfc7009)), all logout profiles including Front-Channel and Back-Channel. The JWT layer, [Abblix.JWT](https://github.com/Abblix/Oidc.Server/tree/master/Abblix.Jwt) ([NuGet](https://www.nuget.org/packages/Abblix.JWT)), is a complete implementation of [RFC 7515](https://www.rfc-editor.org/rfc/rfc7515) ([JWS](https://www.abblix.com/en/docs/glossary-overview#jws)), [RFC 7516](https://www.rfc-editor.org/rfc/rfc7516) ([JWE](https://www.abblix.com/en/docs/glossary-overview#jwe)), and [RFC 7519](https://www.rfc-editor.org/rfc/rfc7519) (JWT) based on [System.Text.Json.Nodes](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes) using [native .NET cryptography](https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography). There is no [Microsoft.IdentityModel.Tokens](https://www.nuget.org/packages/Microsoft.IdentityModel.Tokens) under the hood. This also unlocked the broader JWE algorithms: RSA-OAEP-256, AES-GCM key wrapping (A128GCMKW through A256GCMKW), direct key agreement. ## OpenID Certification The OpenID Foundation conformance test suite runs hundreds of semi-automated tests against every behavioral requirement in the OIDC specifications. Libraries and servers can apply for official certification across multiple profiles. Abblix passed the full suite: Basic, Implicit, Hybrid, Config, Dynamic, Form Post, Third Party-Initiated Login, and all four logout variants: [RP-Initiated Logout](https://www.abblix.com/en/docs/glossary-overview#rp-initiated-logout), [Session Management](https://www.abblix.com/en/docs/glossary-overview#session-management), [Front-Channel Logout](https://www.abblix.com/en/docs/glossary-overview#front-channel-logout), and [Back-Channel Logout](https://www.abblix.com/en/docs/glossary-overview#back-channel-logout). The motivation wasn't marketing; it was proving it to myself first. When you implement a complex protocol from first principles, the conformance suite is the authoritative answer to "is this correct?" The internal test suite tells me it works. The official OpenID Foundation conformance suite proves it works according to the specification. 600+ tests. Zero failures. Zero warnings. All profiles. ## Where Things Stand The library is in production. The authentication service I built for certification purposes is now public as [Abblix Account](https://account.abblix.com/), and it is powered by the latest Abblix OIDC Server. The codebase is at [github.com/Abblix/Oidc.Server](https://github.com/Abblix/Oidc.Server), and I'm always happy to answer questions in [GitHub Discussions](https://github.com/orgs/Abblix/discussions). ## Are you trying to compete with Duende Software? I believe competition is the normal state of software. An ecosystem with a single mature vendor stagnates; one more independent player forces everyone to keep improving. Postgres didn't fade when MySQL shipped. Nginx didn't displace Apache. Vue didn't close the door on React. Every healthy ecosystem has several serious players with different visions - and that's exactly the condition that keeps each of them sharp. That's the competition worth having: not market share, but bright ideas. So, to the question itself: is Abblix trying to compete with Duende? In the sense that we offer the .NET identity ecosystem one more option, and the ecosystem benefits from it: yes. In the sense of trying to displace a working product people rely on, no. Both libraries share the same IS4 origin, and that's the honest framing. Duende IdentityServer is the direct successor of IS4: the codebase continued commercially, the same architecture preserved for compatibility with existing integrations. For teams that want that continuity and the maintainer's support model, it's the natural fit. Abblix took the other path: rethink the approach and rewrite the code from scratch. Same origin, different answers. That's a philosophy difference. If the pain points I describe above don't bother you in IS4, that's fine. If they do, Abblix is worth a serious look - and [a feature-by-feature comparison of Abblix, Duende IdentityServer, and OpenIddict](https://www.abblix.com/en/docs/comparison-duende-openiddict) lays the three side by side, while [the alternative-to-IdentityServer guide](https://www.abblix.com/en/docs/duende-identityserver-alternative) is the shorter answer for a team already running IS4 or Duende. That's our mission as we see it: to develop an alternative worth having, contribute to a .NET ecosystem that becomes richer with every new player, and let teams pick what fits their engineering values. If some pick Abblix, great. If some choose another, that's also a win for the ecosystem we're all trying to improve. ## Why I'd Reach for Abblix The ideas behind Abblix reflect my vision of software design. Hexagonal separation of the protocol core from the ASP.NET MVC binding, making the core transport-agnostic. Small focused interfaces with Composite/Decorator extensibility, so customization size is matched to the thing being customized. An extension model that is plain .NET dependency injection, keyed services and all: no plugin system of its own to learn, and every tool and technique your team has accumulated around .NET DI applies as-is. Result-pattern error handling, so validation failures are typed values the compiler enforces. A JWT layer that treats JSON as a strongly typed model end to end. Runtime-configurable endpoint paths via route templates, so the same binary deploys across dev, staging, and production with environment-specific paths. Certification across all conformance profiles with zero warnings as a standing answer to "is this correct to spec?" None of those individually is a reason to switch away from a working integration. But each one is a good reason to give Abblix OIDC Server a look. All together, on a greenfield project, they make Abblix my own choice. Abblix doesn't plan to stop at what's already built. New RFCs and an expanding protocol surface keep arriving. Worth keeping an eye on. The list I kept is now a product. The choice is yours. --- [Abblix OIDC Server on NuGet](https://www.nuget.org/packages/Abblix.OIDC.Server) · [GitHub](https://github.com/Abblix/Oidc.Server) · Certification: [Regular Profiles](https://oidc.abblix.com/certified-profiles) · [Logout Profiles](https://oidc.abblix.com/certified-logout-profiles) --- Source: https://www.abblix.com/en/docs/duende-identityserver-alternative.md # Abblix OIDC Server: An Alternative to IdentityServer4 and Duende If you are running IdentityServer4 or Duende IdentityServer today and weighing your options, this guide is the map: why teams reach this decision, and what Abblix OIDC Server offers in that spot. Weighing is the word: nobody should move a working system on the strength of a comparison page, and Duende is a mature product with a long production record. What follows is what the alternative looks like when you try it, not a case for switching. If you are here with a reason of your own, or just to see what else exists, that is precisely the reader this page is written for. See [OpenIddict vs Duende IdentityServer vs Abblix OIDC Server](https://www.abblix.com/en/docs/comparison-duende-openiddict) for the feature grid, and the [migration guide](https://www.abblix.com/en/docs/migrate-from-identityserver) for the move itself. ## Why teams look for an alternative Two events send .NET teams back to the identity-library decision they thought they had settled. IdentityServer4 reached end of life. Running it in production now means running protocol code that no longer receives security patches, which most security reviews will flag. Its successor is licensed commercially, by edition. Duende IdentityServer continues the IdentityServer4 codebase commercially, carrying more than a decade of lineage and the deepest operational toolkit in the ecosystem. For many teams that is a fair trade, and Duende is the natural fit. For others, the licensing model is the reason to keep looking. OpenIddict is free and open source (Apache 2.0) at any scale. It is not OpenID Foundation certified - a deliberate policy, on the reasoning that certifying a framework does not certify a given deployment - which can still matter where formal conformance is required. Abblix OIDC Server sits in the space those constraints define: a certified, self-hosted .NET library where every protocol feature is available in every tier, including the free one. ## What Abblix offers in that spot - Certified across all login and logout profiles. Abblix officially passed the OpenID Foundation conformance suite - Basic, Implicit, Hybrid, Config, Dynamic, Form Post, Third Party-Initiated, and all logout profiles - with zero failures in 600+ checks. The results are [public and independently verifiable](https://oidc.abblix.com/certified-profiles). This is the objective answer to "is it correct to spec?", the same criterion many teams used to pick IdentityServer4 over an uncertified library in the first place. - Self-hosted, on keys only you hold. The library runs inside your perimeter and the signing keys never leave it. License validation runs offline, as it does in the alternatives: nothing about a license leaves the host. - Security is not an upgrade. Every security capability the product implements is in every tier, the free one included, and none of them is an add-on, a paid module or a higher edition: the free tier is the full surface - [CIBA](https://www.abblix.com/en/docs/glossary-overview#ciba), DPoP, full dynamic client registration, [JARM](https://www.abblix.com/en/docs/glossary-overview#jarm), RAR, token exchange, per-client [JWE](https://www.abblix.com/en/docs/glossary-overview#jwe), signed discovery metadata. The paid tiers change the license terms - Pro for a company above the free thresholds, Enterprise for more than one production issuer - not the capabilities. - ASP.NET Core native. Every OIDC endpoint is a standard MVC controller in your own routing table and filter pipeline, or a Minimal API route if you prefer that adapter. There is no parallel middleware world to learn or debug. - Extension sized to the change. Small composable interfaces via widely known and adopted Composite and Decorator patterns, wired through standard .NET dependency injection. Changing one validation rule means implementing one focused interface, not copying a thousand-line class to adjust ten lines inside it. The full engineering rationale - why the library was rewritten from scratch rather than forked - is in [We Built Our Own OIDC Library. Why?](https://www.abblix.com/en/docs/we-built-our-own-identity-server). ## Moving from IdentityServer is mechanical, not conceptual The protocol concepts carry over. Clients, scopes, grants, and endpoints mean the same thing they did under IdentityServer, and Abblix issues standard JWTs - so resource servers keep validating tokens the same way, with no code change. The one piece of real work is persistence: you back Abblix's storage interfaces with your own database until the first-party Entity Framework Core and ASP.NET Identity stores land in Q4 2026. [Migrating from IdentityServer4 or Duende to Abblix](https://www.abblix.com/en/docs/migrate-from-identityserver) maps the concepts and the persistence work. ## The honest trade-offs An alternative is only worth choosing with its costs on the table. - The ecosystem is young. Downloads are in the thousands, not the millions, and there are no third-party admin tools or client libraries yet, so you bring your own admin UI and client-side stack. Abblix runs its own production identity provider on the library and the conformance results are public, but the community around it is still small. - No first-party database stores yet. Persistence is your adapter code against the storage interfaces - a supported, permanent path; the first-party EF Core and ASP.NET Identity packages coming in Q4 2026 remove that code, they are not a prerequisite you are waiting on. - No [FAPI](https://www.abblix.com/en/docs/glossary-overview#fapi) certification yet. FAPI matters only where a regulated program, such as open banking, makes it a gating requirement; there, Duende holds the certification today and Abblix does not, though FAPI 2.0 is on the [roadmap](https://www.abblix.com/en/docs/product-roadmap). Standard OpenID Connect and OAuth 2.0 deployments do not need it. - Documentation and samples are the smallest of the three, growing but still smaller. The getting-started and migration paths are covered, and [GitHub Discussions](https://github.com/orgs/Abblix/discussions) is where the rest gets answered. None of these is a reason to leave a working integration you are happy with. But each one is a reason to look closely before you make the choice. ## Next steps - [Getting Started](https://www.abblix.com/en/docs/getting-started-guide) - a working OpenID Connect provider in an ASP.NET Core app in under an hour. - [Migrating from IdentityServer4 or Duende](https://www.abblix.com/en/docs/migrate-from-identityserver) - the concept mapping and the persistence work. - [OpenIddict vs Duende IdentityServer vs Abblix OIDC Server](https://www.abblix.com/en/docs/comparison-duende-openiddict) - the full feature-by-feature comparison. - [Pricing](https://www.abblix.com/en/oidc-server/pricing) - the tiers, with every protocol feature in each, the free one included. --- Source: https://www.abblix.com/en/docs/comparison-duende-openiddict.md # OpenIddict vs Duende IdentityServer vs Abblix OIDC Server Three teams looked at the same problem (a correct, standards-faithful OpenID Connect and OAuth 2.0 server for .NET) and answered it three different ways. Duende IdentityServer, tracing back to the IdentityServer project that pioneered self-hosted OpenID Connect on .NET, carries more than a decade of production lineage and the deepest operational toolkit in the ecosystem. OpenIddict gives the .NET world a genuinely free, Apache-licensed server that runs everywhere from .NET Framework to .NET 10. Both are the product of years of careful engineering, and a great many teams are well served by them. This page compares these established, well-known products with a different way of looking at the same problem: Abblix's. Where the others grew into broader platforms (bundled stores and client libraries, and in Duende's case server-side sessions and admin tooling), Abblix concentrates on a broad set of modern OAuth/OIDC protocol extensions in .NET, behind an isolated core you extend through standard .NET [dependency injection](https://www.abblix.com/en/docs/glossary-overview#di): registering, decorating, or replacing its services. That is a bring-your-own (BYO) philosophy, and it runs through most of the design and architectural decisions Abblix OIDC Server rests on: persistence, sessions, consent, UI, and the client side are all yours to supply behind the library's interfaces. BYO-database is the clearest case: the server ships no store of its own, and every storage seam takes whatever database you choose (a relational store, a document store, or any distributed cache) behind a narrow interface. Abblix's own [identity provider](https://www.abblix.com/en/docs/glossary-overview#identity-provider) runs this model in production on PostgreSQL and [Redis](https://www.abblix.com/en/docs/glossary-overview#redis), so the approach is proven at least at the vendor's own production scale. Like any philosophy it trades something away: the operational scaffolding the others hand you, you assemble yourself. For a large, mature organization the gap is smaller than it looks, but it is not zero: such a team already runs its own data platforms under its own rules for where each class of data may live, and often prefers its own store behind the interfaces regardless. The adapter code, the schema, and (if needed) a queryable grant store are still yours to build and own. A ready-made store earns its keep fastest early on, when you are standing up a prototype, an evaluation, or a first deployment with no persistence code to write. Part of that focus is conviction; part is plain arithmetic. Abblix is the youngest product here, and a decade of ecosystem evolution does not compress into two years, so we deliberately choose what ships first. The protocol layer, certified across all seven OP and four logout profiles, won out; the periphery follows in priority order: some of it from our own roadmap, the rest each integrator builds for himself on the library's public seams. The rest of this page maps exactly where that trade lands, feature by feature. We make one of the three products compared here, so we hold ourselves to a simple rule: every claim links to product source or a public registry, not a marketing page. Found something wrong or out of date? [Open an issue](https://github.com/Abblix/Oidc.Server/issues) with a pointer to the code and we will correct it. *Certification entries verified 2026-08-19 against the OpenID Foundation's FAPI 2.0 OP registries, which state the profile edition, the date and the certified configurations; the summary listing of certified OpenID Connect implementations carries none of the three. Licensing terms verified the same day against each vendor's own pages: Duende's editions, its Community Edition eligibility thresholds and what each edition includes, from its pricing and licensing documentation; OpenIddict's Apache-2.0 license, from its repository and its package metadata; and the Abblix pricing page. Any vendor can change these at any time, so check the source before relying on a licensing statement here.* *Versions compared, shipped releases all three: Abblix OIDC Server 2.4 (2026-09-05), Duende IdentityServer 8.0.2 (2026-06-16), OpenIddict 7.5.0 (2026-04-22). A capability that exists only on an unreleased branch is not credited to any of the three; a competitor's unreleased branch is mentioned only where we happened to verify it, so the absence of a forward note says nothing about their plans.* ## At a glance | | Abblix OIDC Server | Duende IdentityServer | OpenIddict | |---|---|---|---| | Model | Source-available, commercial | Source-available, commercial | Open source (Apache 2.0) | | First public release | 2024 | 2021 (announced 2020; lineage to 2013 IdentityServer) | 2015 | | Free production use | Under $1M revenue and $1M raised: unlimited clients and users, 1 production issuer, every feature | Community Edition: under $1M projected gross revenue and under $3M capital access, production included, at the feature level of the Standard edition | Unconditionally free | | Feature gating by license | None: every feature in every tier, including free | Some protocol features are edition-specific (see Duende's editions) | None | | Platform | .NET 8/9/10, ASP.NET Core | .NET 10 (v8); .NET 8/9 (v7.x), ASP.NET Core | .NET Framework 4.6.2+ and .NET 8/9/10, ASP.NET Core and OWIN | | OpenID certification | No [FAPI](https://www.abblix.com/en/docs/glossary-overview#fapi) certification; OpenID-certified v1 + v2 across [all 7 OP profiles](https://oidc.abblix.com/certified-profiles) + [all 4 logout profiles](https://oidc.abblix.com/certified-logout-profiles) | [FAPI 2.0 Security Profile certified for v7.3, Second Implementer's Draft, May 2025](https://openid.net/certification/certified-fapi-2-0-op-security-profile-second-implementers-draft-message-signing-first-implementers-draft/); OpenID-certified v5/v6/v7 across [5 OP profiles](https://oidc.abblix.com/certified-profiles) + all [4 logout profiles](https://oidc.abblix.com/certified-logout-profiles) | Not certified (deliberate policy) | | First-party database stores | None: host-implemented behind storage interfaces | EF Core | EF Core, EF 6, MongoDB | | Client-side library | None | Certified open-source OidcClient + token management; commercial [BFF](https://www.abblix.com/en/docs/bff-pattern-in-oauth-and-openid-connect) | Full free client stack, 111-provider gallery | | NuGet downloads, lifetime* | ~6.6K (since 2024) | ~25.4M (since 2020) | ~25.9M Server (listed on NuGet since 2018; project since 2015) | | Team | 1 primary developer (2-person team) | Multi-person team (no public count to pin a number to) | 1 primary maintainer among 70 lifetime contributors | *\* Lifetime totals over very different product ages: read as adoption scale, not a like-for-like popularity measure; every vendor's total also includes downloads pulled transitively by other packages (most visibly OpenIddict's Abstractions at ~37.8M, but true of all three).* ## Protocol coverage All three implement the OAuth 2.0 / OIDC core: authorization code + [PKCE](https://www.abblix.com/en/docs/pkce-in-openid-connect), [client credentials](https://www.abblix.com/en/docs/glossary-overview#client-credentials-grant), refresh tokens, discovery, [JWKS](https://www.abblix.com/en/docs/glossary-overview#jwks), userinfo, introspection ([RFC 7662](https://datatracker.ietf.org/doc/html/rfc7662)), revocation ([RFC 7009](https://datatracker.ietf.org/doc/html/rfc7009)), end-session, device flow ([RFC 8628](https://datatracker.ietf.org/doc/html/rfc8628)), [PAR](https://www.abblix.com/en/docs/glossary-overview#par) ([RFC 9126](https://datatracker.ietf.org/doc/html/rfc9126)), [resource indicators](https://www.abblix.com/en/docs/glossary-overview#resource-indicators-for-oauth-2-0) ([RFC 8707](https://datatracker.ietf.org/doc/html/rfc8707)), [mTLS](https://www.abblix.com/en/docs/glossary-overview#mutual-tls-client-authentication) ([RFC 8705](https://datatracker.ietf.org/doc/html/rfc8705)), and the `iss` response parameter ([RFC 9207](https://datatracker.ietf.org/doc/html/rfc9207)). The differences concentrate in the newer extensions; whether they matter depends on your compliance targets ([FAPI](https://www.abblix.com/en/docs/glossary-overview#fapi) 2.0, open banking, eIDAS) and integration scenarios. | Capability | Abblix 2.4 | Duende 8.0 | OpenIddict 7.5 | |---|---|---|---| | [CIBA](https://www.abblix.com/en/docs/glossary-overview#ciba) (backchannel auth) | ✅ poll + ping + push | ⚠️ poll only | ❌ | | DPoP ([RFC 9449](https://datatracker.ietf.org/doc/html/rfc9449)) | ✅ | ✅ | ❌ | | Token exchange ([RFC 8693](https://datatracker.ietf.org/doc/html/rfc8693)) | ✅ first-party grant | ⚠️ via extension point (no first-party grant) ¹ | ✅ first-party (since 7.0) | | JWT-bearer grant ([RFC 7523](https://datatracker.ietf.org/doc/html/rfc7523)) | ✅ | ⚠️ client auth only (no authorization grant) | ⚠️ via custom flow wiring | | [Dynamic Client Registration](https://www.abblix.com/en/docs/glossary-overview#dynamic-client-registration) | ✅ [RFC 7591](https://datatracker.ietf.org/doc/html/rfc7591) + full [RFC 7592](https://datatracker.ietf.org/doc/html/rfc7592) management | ⚠️ RFC 7591 only | ⚠️ programmatic API only (no DCR endpoint) | | [JARM](https://www.abblix.com/en/docs/glossary-overview#jarm) (JWT-secured responses) | ✅ | ❌ | ❌ | | [Rich Authorization Requests](https://www.abblix.com/en/docs/glossary-overview#rich-authorization-requests) ([RFC 9396](https://datatracker.ietf.org/doc/html/rfc9396)) | ✅ | ❌ | ❌ | | JWT introspection responses ([RFC 9701](https://datatracker.ietf.org/doc/html/rfc9701)) | ✅ | ✅ | ❌ | | Request objects ([JAR](https://www.abblix.com/en/docs/glossary-overview#jar), [RFC 9101](https://datatracker.ietf.org/doc/html/rfc9101)) | ✅ by value + by reference, [JWE](https://www.abblix.com/en/docs/glossary-overview#jwe) supported | ⚠️ by value; `request_uri` off by default | ❌ signed request objects rejected (PAR carries plain parameters only) | | Pairwise subject identifiers | ✅ | ❌ | ❌ | | `claims` request parameter (OIDC 5.5) | ✅ | ❌ | ❌ (`claims_parameter_supported:false`) | | `client_secret_jwt` | ✅ | ❌ | ❌ | | [ID token](https://www.abblix.com/en/docs/glossary-overview#id-token-identity-token) / userinfo encryption (JWE) | ✅ per-client ⁴ | ❌ | ⚠️ access tokens JWE by default; not per-client ID-token JWE | | OIDC [Session Management](https://www.abblix.com/en/docs/glossary-overview#session-management) spec + front/back-channel logout | ✅ all three ² | ✅ all three | ❌ [RP-initiated logout](https://www.abblix.com/en/docs/glossary-overview#rp-initiated-logout) only | | `oauth-authorization-server` metadata suffix ([RFC 8414, section 3](https://datatracker.ietf.org/doc/html/rfc8414#section-3)) | ✅ served at both suffixes | ✅ | ✅ | | `response_type=none` (authorize a grant, return no code or token) | ✅ per client, by listing it among the allowed response types | ❌ | ✅ | | [SAML](https://www.abblix.com/en/docs/glossary-overview#saml) 2.0 IdP | ❌ | ✅ v8, opt-in | ❌ (third-party add-on) | | FAPI 2.0 | ⚠️ named enforcement profile a client opts into, building blocks conformance-suite-tested; no certification | ✅ FAPI 2.0 Security Profile certified for v7.3 under the Second Implementer's Draft, 12 May 2025, in the private key + DPoP and OpenID Connect configurations (the compared 8.0.2 not listed) | ⚠️ has PAR, mTLS; no JAR, no DPoP; no certification | *¹ "Via extension point" means Duende ships no built-in token-exchange grant. It exposes a generic custom-grant hook (the `IExtensionGrantValidator` interface) through which the host implements RFC 8693 itself (Duende's own [BFF](https://www.abblix.com/en/docs/bff-pattern-in-oauth-and-openid-connect) host ships a sample `TokenExchangeGrantValidator` that does exactly this). There the exchange wiring is host code by design; a first-party grant (Abblix, OpenIddict) ships that wiring ready-made, while the trust policy itself, which subject and actor tokens to accept and what to issue, stays yours to configure in all three.* *² The ✅ marks the OIDC Session Management + front/back-channel logout protocol. An admin-queryable, remotely revocable server-side session store is a separate operational capability, ready-made only in Duende; Abblix exposes session access behind `IAuthSessionService` for the host to back with its own store (see Storage).* *³ RFC 8414, section 3 lets a server publish its Authorization Server Metadata under either the `oauth-authorization-server` or the `openid-configuration` well-known suffix. All three serve both, so a client that queries only one of them reaches any of them. Abblix's document includes the optional signed metadata of section 2.1.* *⁴ Abblix's per-client JWE covers RSA key transport, AES-GCM key wrap, and direct keys for key management; the AES-KW, ECDH-ES, and PBES2 families are not implemented (see JWT foundations).* *Sources: every mark above is pinned to the compared versions and checkable in the [Abblix 2.4](https://github.com/Abblix/Oidc.Server/tree/v2.4), [Duende 8.0.2](https://github.com/DuendeSoftware/products/tree/is-8.0.2), and [OpenIddict 7.5.0](https://github.com/openiddict/openiddict-core/tree/7.5.0) source trees. Discovery-advertised capabilities (grant types, response modes, `claims_parameter_supported`, `subject_types_supported`, `request_uri_parameter_supported`) can also be read directly from each server's `.well-known/openid-configuration`.* Two caveats on Abblix's protocol support. `client_secret_jwt` requires client secrets stored with their raw value, since HMAC verification needs it: a deployment precondition to plan for. On FAPI specifically, Duende is ahead today: it holds the only OIDF FAPI certification among the three (the FAPI 2.0 Security Profile for v7.3, under the Second Implementer's Draft). And no product of the three implements [EdDSA](https://www.abblix.com/en/docs/glossary-overview#eddsa) signing, while post-quantum ML-DSA exists only on OpenIddict's unreleased development branch. ## Licensing model OpenIddict is open source under Apache 2.0: modify and redistribute freely, with an express patent grant and no license-enforcement code. Support is sponsor-oriented. Duende IdentityServer is a commercial, source-available product licensed by edition, and some protocol features are tied to a specific edition. Its Community Edition covers production use below a revenue and capital threshold, at the feature level of the Standard edition. For editions, included limits, and terms, consult Duende's own licensing pages. Abblix OIDC Server is a commercial, source-available product licensed by the size of the company and the number of production issuers. Every protocol and security capability it implements is present in every tier including the free one, with no per-feature gating anywhere in the code: [sender-constrained tokens](https://www.abblix.com/en/docs/glossary-overview#sender-constrained-token), mutual TLS, pushed authorization requests, signed and encrypted request objects and responses, signed discovery metadata and the rest are part of the product rather than an edition you reach. What the tiers change is the license, never the capability. Client applications, users and nodes are not counted. License validation runs offline in all three products: nothing about a license leaves the host and no vendor is contacted at runtime. The con of this model: one production issuer on the free tier and on the entry paid tier, so a company running several genuinely separate identity spaces reaches the top tier on that alone, however small it is. ## Architecture Abblix adopts a [hexagonal (ports-and-adapters) design](https://www.abblix.com/en/docs/understanding-the-architecture): a protocol core isolated behind public interfaces, a thin MVC adapter and a Minimal API adapter, which you customize the way any ASP.NET Core app is: implement one of its interfaces, decorate an existing one, or compose a family of them through standard DI plus a small Abblix-supplied composite/decorator toolkit (`TryAdd` everywhere). The built-in pipeline families (grant handlers, authenticators, context validators) fold into composites at `AddOidcCore`, and a single built-in step can be edited through the DI container; the extensibility sections below detail how the granularity and effort compare across all three. Duende is service-oriented, running its own middleware/router (neither MVC nor endpoint routing), with ~140 interfaces, dozens of builder extension methods, and a structured events subsystem. OpenIddict is an event/handler pipeline of ~270 ordered handler descriptors that can be individually removed or reordered, the finest-grained request-level control of the three. Its server core has zero ASP.NET dependencies and runs on both ASP.NET Core and OWIN, the only option for classic .NET Framework hosts. None of the three offers first-class multi-tenancy; all three can derive the issuer from the incoming request, but only Duende and Abblix route issuer resolution through a replaceable service (`IIssuerNameService` / `IIssuerProvider`) that a multi-tenant host can implement. External/social login brokering is delegated to ASP.NET Core authentication handlers in all three; Duende additionally offers store-backed dynamic external providers. ## JWT foundations Here Abblix parts company with both competitors: Duende and OpenIddict both build on Microsoft's `Microsoft.IdentityModel` stack (the `JsonWebTokenHandler` and its `SecurityKey`/`SigningCredentials` model) to create and validate every JWT. Abblix does not: `Abblix.Jwt`, the library Oidc.Server is built on, implements [JWS](https://www.abblix.com/en/docs/glossary-overview#jws) ([RFC 7515](https://datatracker.ietf.org/doc/html/rfc7515)), [JWE](https://www.abblix.com/en/docs/glossary-overview#jwe) ([RFC 7516](https://datatracker.ietf.org/doc/html/rfc7516)), and [JWA](https://www.abblix.com/en/docs/glossary-overview#jwa) ([RFC 7518](https://datatracker.ietf.org/doc/html/rfc7518)) itself, on .NET's cryptographic primitives and `System.Text.Json.Nodes`. The cryptography itself is common ground: signing, verification, and encryption run on .NET's `System.Security.Cryptography` in all three products; `Abblix.Jwt` calls those BCL classes exactly as `Microsoft.IdentityModel` does under Duende and OpenIddict, and nobody hand-rolls the algorithm math. The layer Abblix owns is the [JOSE](https://www.abblix.com/en/docs/glossary-overview#jose) assembly above the primitives, and that layer is no formality: historically, JWT attacks live precisely there (algorithm confusion, `none` acceptance, embedded-key trust, `crit` and `typ` mishandling). Abblix treats it as security code and hardens it in the shipped source: byte-exact `alg` allow-listing against a closed set, RFC 7515 `crit` handling that rejects unknown extensions by default, [RFC 8725](https://datatracker.ietf.org/doc/html/rfc8725) `typ` pinning, and a hard split between embedded-key and issuer-key trust models, the same duties `Microsoft.IdentityModel` enforces in its own handler; owning the layer means owning those duties, not that the incumbent skips them. Owning the layer also means owning its upkeep: a defect here (algorithm confusion, `none` acceptance, `crit`/`typ` mishandling) is Abblix's to find, patch, and ship itself, where the competitors ride Microsoft's servicing cadence (well-resourced, though not advisory-free). What bounds Abblix's exposure is the surface it covers: a closed, explicitly-hardened JOSE assembly (the checks just listed) over .NET's own crypto primitives, exercised daily in the vendor's own production identity provider. That payoff sits in the API. First, the one that matters most in daily use: a JWT is modeled directly as `System.Text.Json.Nodes`, so a structured claim like `cnf`, `authorization_details`, or the OIDC `claims` request stays live JSON you read as JSON; the Microsoft handler can also read payload values directly (`GetPayloadValue`), but the `ClaimsPrincipal` projection the Microsoft stack produces represents such a claim as a `Claim` whose value is a JSON string. Beyond that, keys are resolved and issuer and audience checked through `async` delegates, so per-tenant key lookup and on-demand [JWKS](https://www.abblix.com/en/docs/glossary-overview#jwks) retrieval stay non-blocking, and validation returns the same `Result` type the rest of the library uses, so token errors flow through one error-handling path. On signing algorithms the two stacks are level: the usual RSA, ECDSA, and HMAC families on both sides. On JWE key management the two stacks cover different subsets: Abblix implements RSA key transport, AES-GCM key wrap, and direct keys (a deliberate native-.NET-crypto-only policy) and currently lacks the AES-KW and ECDH-ES families the Microsoft stack carries; the Microsoft stack in turn has no AES-GCM key wrap, and PBES2 is absent on both sides. ## Reshaping and extending These three bend to a customer- or regulator-specific requirement in different ways, and the real split is between reshaping an existing endpoint and adding a new one. Reshaping is the everyday case: all three do it, but at different granularity and different depth of code you must learn first. For decorating or replacing a whole interface, Abblix's per-change action is a single registration through ordinary ASP.NET Core DI. Editing a step inside a built-in pipeline is a single line via the `Decompose()` cursor. Duende works at the service level: intervene through documented custom-service replacements and its events subsystem, idiomatic hooks at defined points within Duende's own service model. OpenIddict offers the finest control for the most immersion: every step is one of ~270 ordered handler descriptors you can remove, reorder, or insert new handlers between; that is maximum precision, once you have learned the handler-pipeline model. By granularity the order is OpenIddict, then Abblix, then Duende; how much each asks you to learn is a separate axis. Adding a brand-new endpoint is where they genuinely differ, and it traces to how each product routes. Duende, running its own router, requires a new protocol endpoint (such as a regulator-mandated endpoint that has to behave like a built-in) to be registered in its server pipeline, where it runs under the same conventions as the built-ins. Neither OpenIddict nor Abblix has that concept: in both, a new endpoint is an ordinary application route calling into the library. The difference is what surrounds that route. Abblix's own endpoints are themselves ordinary MVC or Minimal API routes with no server router underneath, so a custom route sits beside them as an equal and consumes the same services they do through DI: [client authentication](https://www.abblix.com/en/docs/glossary-overview#client-authentication), discovery configuration, error shaping. OpenIddict dispatches its built-in endpoint types through its own host-integration handlers (a closed enum: URIs relocate, the set does not), the same owned dispatch that buys its OWIN and .NET Framework reach. Two more axes are environmental rather than behavioral. Endpoint paths are freely relocatable in Abblix (tokenized route templates resolved from configuration in the MVC adapter, each path plus the shared `base` and `.well-known` prefixes, or an `OidcRouteOptions` object in the Minimal API adapter) and in OpenIddict (`SetXEndpointUris` on the server builder); both surface the relocated paths in the [discovery document](https://www.abblix.com/en/docs/discovery-and-well-known-endpoints) automatically. Duende serves its endpoints at fixed protocol paths under a host-set base (toggled on or off, not individually relocated), with a discovery document that reflects whatever is served and a replaceable generator behind it. And when a product's extension points run out, its license sets the last resort: OpenIddict (Apache 2.0) forks freely, while Abblix and Duende are source-available: readable and modifiable within their license terms. ## The learning curve for extensibility The workable way to compare how hard each is to customize is not to score "difficulty" in a vacuum: that number would be invented. Split the entry threshold into two parts: the domain knowledge every OIDC server demands (OAuth 2.0 and OpenID Connect themselves, identical everywhere) and the product-specific extension model each one asks you to learn on top of it. The first is a constant; the second is what actually separates the three, so the objective comparison is how much you must learn beyond the protocol you already had to know. (Learning, not build volume: on that second axis the ready-made stores, UI, and client stacks of the other two spare you the work Abblix leaves to the host; see Storage and Developer experience.) Each product also hands you a different *unit* to reason in, and a different amount of its own machinery to learn before you can use it: | Product | The unit you extend | What you learn beyond OAuth/OIDC | |---|---|---| | Duende IdentityServer | A domain service: a named interface owning one area of behavior | Which documented service to replace, plus its events subsystem (the best-documented model of the three) | | OpenIddict | A pipeline handler: one of ~270 ordered descriptors | The handler-pipeline model itself: ordering, event flow, how handlers compose (the largest model, and the price of its finest-grained control) | | Abblix OIDC Server | A domain rule or feature: smaller than a service, still in protocol vocabulary | How its rule families compose: a rule registered before `AddOidcCore` joins the family, and editing an existing step in place is a one-line [`Decompose()`](https://www.abblix.com/en/docs/advanced-dependency-injection#taking-the-pipeline-apart) cursor | Read down the last column and the axis is clear: the domain knowledge is fixed; the products differ in how much of their own architecture they put between you and a change. That is the axis Abblix is built to minimize: its aim is that extending the server leans on the dependency injection a .NET developer already uses and on protocol vocabulary, not on a model of the library's internals. What stays genuinely product-specific is real but small: learning which interface owns the behavior you need (a generated API reference and an [extension-points map](https://www.abblix.com/en/docs/extension-points-map) both help locate it, though the guided, narrative documentation is thinner than Duende's), plus the single composition rule the table names above. Duende gives you a dedicated hook at each point it has anticipated (`ICustomAuthorizeRequestValidator`, to fold extra rules into the authorization request, is one of many across its documented services and events), and where no ready-made hook fits, you replace or decorate the domain service that owns that area. Abblix decomposes the same behavior one level finer: the validators and processors a service would own are themselves a composed family of individual rules (the Composite and Decorator patterns applied to the pipeline), so a change can be a single rule inserted, swapped, or wrapped, one level below the whole service that Duende's replace-or-decorate operates on. That finer unit is what the somewhat larger learning curve buys: more points to intervene without replacing a bigger component, in exchange for one model to learn: how families compose. A few qualifiers bound the reading. The threshold inverts with depth: Abblix's low entry point is for reshaping in the common case, while the finest step-level control sits at the far end of OpenIddict's larger model. And it stays a qualitative reading: an entry threshold depends on the reader's background, so what compares cleanly is the direction and the amount of new material. ## Storage, persistence and operations This is the sharpest architectural divide of the three: not whether a database can sit behind the server, but who designs it. Duende and OpenIddict ship ready-made persistence: their store packages (EF Core; OpenIddict also EF6 and MongoDB) give durable, queryable, individually revocable grants and tokens from day one, with two different schema philosophies: Duende consolidates grant kinds into one table queried by envelope fields (subject, client, session, type), while OpenIddict spreads them across four relational tables with subclassable entities (`ReplaceDefaultEntities()`). Abblix's intended model is BYO-database behind the interfaces. Every storage concern sits behind a replaceable seam: `IEntityStorage` (a single key-value contract for all operational state), `IClientInfoProvider`/`IClientInfoManager` for clients, `IUserInfoProvider` for identity data, `IUserConsentsProvider` for consent. Abblix's own hosted identity provider, known as Abblix Account, runs exactly this way: user and identity data in PostgreSQL queried through Dapper behind `IUserInfoProvider`, with Redis carrying protocol state. The trade cuts both ways: you design and implement the database yourself (work the ready-made stores spare you, but work that scales with ambition, from near-zero for cache-backed operational state through a small durable client store to a real relational grant layer if you want one), in exchange for full control of your schema, retention and indexing rules, and data layer, with no vendor tables or migrations in your database. User data works this way in all three products: none ships a user store; Abblix extends the same model to its entire server configuration. Out of the box, Abblix ships no database store package: the host is responsible for persistence by design. All operational state (codes, PAR/[CIBA](https://www.abblix.com/en/docs/glossary-overview#ciba)/device requests, revocation marks) lives as expiring entries in whatever `IDistributedCache` implementation the host registers behind the built-in `IEntityStorage` adapter (in-memory for dev, Redis, the SQL Server distributed cache, or any other backend), serialized using protobuf. Zero-database deployment is trivial, no cleanup job is ever needed, and even the default path becomes durable if the chosen backend is persistent. The remaining trade is the flip side of stateless tokens: out of the box there is no queryable inventory of outstanding grants or refresh tokens (the default keeps only per-token revocation status, not a positive list), so token-level bulk or forensic operations such as listing every active token are not built in, where Duende and OpenIddict ship them in their grant store. The gap is enumeration, not revocation: a token you know about is revocable through the standard [revocation endpoint](https://www.abblix.com/en/docs/glossary-overview#revocation-endpoint) today, and the exposure of what cannot be enumerated is capped by short access-token lifetimes. Nothing blocks building the full inventory: a host that needs it records issued tokens at the `IRefreshTokenService`/`IAccessTokenService` seam and revokes through the same status-check path. That is genuine build-out: a queryable, revocation-synced store, in exchange for the stateless model that keeps Abblix's zero-database default. On token formats, Duende and OpenIddict both support opaque reference access tokens alongside JWT (OpenIddict adds an ASP.NET Data Protection binary format), while Abblix issues self-contained JWTs only, a deliberate stateless choice ([RFC 9068](https://datatracker.ietf.org/doc/html/rfc9068) standardizes the JWT access-token format; [RFC 6749](https://datatracker.ietf.org/doc/html/rfc6749) leaves it open). Opaque tokens trade stateless validation for instant central revocation and a listable token inventory, paid for with a server-side store consulted on every validation, the stateful scaffolding Abblix's BYO model leaves to the host. Signing-key lifecycle is Duende's clearest operational win out of the box: it is the only one with automatic key generation, 90-day rotation, propagation, and Data-Protection-encrypted storage on by default. Abblix brings no timer-based auto-rotation but resolves keys through a replaceable `IAuthServiceKeysProvider` seam and publishes multiple keys in [JWKS](https://www.abblix.com/en/docs/glossary-overview#jwks) at once, so overlapping manual rotation and a host-supplied dynamic/rotating key provider are both allowed (its own docs recommend the latter for production); OpenIddict likewise registers multiple signing credentials and publishes them all in JWKS, so overlapping rotation works there too, but it resolves them from static host configuration, so rotating means a configuration update and redeploy rather than swapping a replaceable runtime provider. Queryable, remotely revocable server-side sessions ship ready-made only in Duende; Abblix routes session access through a replaceable `IAuthSessionService` abstraction whose default adapter binds to the ASP.NET Core cookie but behind which a host can implement its own store, and OpenIddict delegates sessions to the cookie, where ASP.NET Core's standard server-side ticket store can apply. Remembered consent ships ready-made in OpenIddict (permanent authorizations) and Duende (consent store); Abblix exposes it as a replaceable `IUserConsentsProvider` with an auto-granting default, so persistent consent is a host implementation, the same BYO pattern as its other storage seams. ASP.NET Core Identity integration ships only in Duende as a first-party package, OpenIddict pairs with Identity in every sample, and Abblix has no first-party Identity package, though its docs carry an integration guide with a runnable sample. Finally, on observability, Duende instruments its endpoints with `ActivitySource` tracing (OpenTelemetry-ready) on top of its events subsystem, while Abblix and OpenIddict expose standard `ILogger` logging only: no built-in traces or metrics. ## Security posture Much of day-to-day security ([PKCE](https://www.abblix.com/en/docs/pkce-in-openid-connect) requirements, [refresh-token rotation](https://www.abblix.com/en/docs/glossary-overview#refresh-token-rotation), HTTPS enforcement) can be configured to identical behavior in all three products, so settings are not compared here; what remains are the behavioral differences no setting changes. A replayed authorization code is rejected by all three (codes are single-use); Abblix and OpenIddict additionally revoke the tokens already issued from that code ([RFC 6749, section 4.1.2](https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.2)). On refresh-token reuse, OpenIddict responds the strongest: replaying a redeemed token revokes the entire chain. Abblix answers the same way as OpenIddict and does so by default: tokens rotate unless a client turns rotation off, each grant carries a family claim, and replaying a rotated-out token revokes the whole family rather than only the token presented. That is the rotation-with-lineage model ([RFC 9700, section 4.14.2](https://datatracker.ietf.org/doc/html/rfc9700#section-4.14.2)), and Duende with one-time-use tokens configured stops at rejecting the replayed token, leaving the still-active sibling alive until its own expiry. One more difference no setting changes: what you can enumerate and revoke during an incident. Duende's persisted grants and server-side sessions and OpenIddict's database-backed tokens and authorizations are listable and revocable out of the box, while Abblix's stateless tokens leave that inventory to the host (individually known tokens stay revocable out of the box, and what cannot be enumerated expires on its short lifetime; see Storage). The shipped defaults still differ, and they show where each product leans by design. Abblix requires PKCE per client, rejects the `plain` challenge method, rotates refresh tokens and enforces HTTPS on every protocol endpoint out of the box, and it ships with the optional endpoints switched off rather than on. Duende turns on automatic signing-key management and data-protected grant storage by default. OpenIddict encrypts access tokens and rejects non-HTTPS protocol requests by default. Most of this can be corrected with additional configuration in each of the three products, so the list speaks to each vendor's defaults philosophy rather than to what you can ultimately achieve. On track record, Abblix and OpenIddict have both published zero security advisories, but for Abblix, with a ~6.6K-download install base since 2024, that reflects limited external scrutiny at least as much as robustness. What bounds the unknown: protocol correctness is independently OIDF-certified across all seven OP profiles, and the vendor runs the same code in its own production identity provider; field-hardening at third-party scale remains unproven rather than disproven. Duende, with the longest commercial history of the three, has the most established security-response process. ## Developer experience Standing up the protocol layer costs little code in Abblix and Duende alike, since endpoints ship ready-made (Abblix's as MVC controllers, Duende's inside its own pipeline; Abblix's official sample host adds ~100 lines of wiring, UI aside), while OpenIddict requires the most protocol code by design, since you write the authorization and token endpoint logic yourself (the official all-flows sample's `AuthorizationController` runs ~700 lines, UI aside; a single-flow host is far smaller, but the endpoint logic is still yours to author). For the full user-facing surface the picture shifts: Duende's templates hand you a complete login/consent/logout/diagnostics page set to own, whereas neither Abblix nor OpenIddict ships production UI (Abblix's only login page is a demonstration in the Getting Started sample), so with either of the two, the whole user-facing surface, login included, is built from scratch. The surrounding tooling widens that gap. Duende ships 7 templates (`dotnet new`, including EF and ASP.NET Identity variants) against Abblix's 2 and OpenIddict's 0, and roughly 36 client samples plus hosts and Aspire orchestration against OpenIddict's 16 official samples (web, desktop, OWIN) with 8 sandbox apps and Abblix's 4, the thinnest reference base. For admin and management UI, Duende has a first-party admin template plus a third-party ecosystem of commercial and open-source admin tools around it; OpenIddict has open-source community options; Abblix has none, first- or third-party. Documentation follows the same shape: Duende's is the broadest (a multi-product site, numbered quickstarts, and per-version upgrade guides), OpenIddict's is solid but assumes you write endpoint code, and Abblix's is the smallest in narrative breadth (~20 hand-written pages and one deep getting-started tutorial, plus a generated API reference for Abblix.Oidc.Server and Abblix.Jwt) and English-only: the multilingual pages on abblix.com are the marketing site, not the docs. On release cadence and lifecycle, OpenIddict ships a breaking major roughly every 7-12 months with latest-stable-only support, Duende documents per-minor upgrades and maintains parallel patch lines, and Abblix has had one major break (2.0) with a committed migration guide and publishes per-major EOL dates after which a line is retired (1.x to Nov 2026, 2.x to Nov 2027), with patches delivered on the newest line. ## Quality, testing, conformance At shipped versions the test counts run ~2,700-2,850 methods for Duende 8.0.2, ~4,400 for Abblix 2.4, and ~1,700 for OpenIddict 7.5.0, context rather than a ranking, since the products' scopes differ. Only Duende has browser-driven E2E, and OpenIddict is the only one that runs its suite on .NET Framework. Abblix's own quality gaps: its tests execute on net10.0 only (the same source is multi-targeted, so what goes unverified is target-specific recompilation, not the logic), and CI runs on a single OS, bounded the same way: pure managed code over BCL crypto, with no OS-specific paths. On certification (verified July 2026 against the OIDF [OP-profiles](https://oidc.abblix.com/certified-profiles) and [logout-profiles](https://oidc.abblix.com/certified-logout-profiles) registries), Abblix is certified across seven OP profiles (including the Dynamic OP and 3rd-Party-Init profiles) plus four logout profiles, with 2.4 inside the certified v2 line; Duende is certified across five OP profiles and all four logout profiles (v5/v6/v7, most recently 25 August 2024) and holds the only [FAPI 2.0 certification](https://openid.net/certification/certified-fapi-2-0-op-security-profile-second-implementers-draft-message-signing-first-implementers-draft/) of the three, with v8 (June 2026) not yet listed; and OpenIddict is deliberately uncertified, its README explaining that certifying a framework would not guarantee user deployments are compliant, shipping a conformance-ready sample instead. No product is certified for [FAPI](https://www.abblix.com/en/docs/glossary-overview#fapi) 1 Advanced; Abblix and OpenIddict hold no FAPI certification at all. ## Ecosystem and community The numbers are stark: | | Abblix | Duende | OpenIddict | |---|---|---|---| | GitHub stars | 102 | 1,609 (products) | 5,184 | | NuGet downloads (lifetime) | ~6.6K | ~25.4M | ~25.9-37.8M | | StackOverflow questions | 0 | ~5,600 (incl. IdentityServer4 era) | 516 | | Lifetime contributors | 2 | 311 | 70 | | Releases, last 24 months | 14 | 23 (IdentityServer alone) | 15 stable | | Third-party packages/UIs | none found | rich (commercial + open-source) | rich (open-source) | Abblix is effectively a one-developer product (97% of all commits) from a small Kazakhstan-based vendor with a two-year public history and no third-party ecosystem. External pull requests are not accepted by policy (in-house development for architecture and license provenance), and external issue traffic is light so far, though bug reports and feature issues are welcome. It has shipped 14 releases in the last 24 months. Duende has a multi-person team behind it and maintains parallel patch lines in practice: e.g. 7.3.x kept receiving patches after 7.4.0 shipped. OpenIddict has the largest community and the only genuinely open contribution model: a sponsorship-funded project maintained primarily by one person, with roughly a decade of history and 70 lifetime contributors. Abblix and OpenIddict both patch only their newest release line. ## Client-side and companion libraries This is Abblix's largest gap. OpenIddict ships a complete free client stack in the same repo: an interactive web sign-in handler, desktop and mobile OS integration (Windows, macOS, Linux, iOS, and Android system browsers), a gallery of 111 preconfigured social and enterprise providers, and a validation stack for resource servers (local JWT or introspection, with database-backed revocation checks). Duende ships a certified native-app client (`Duende.IdentityModel.OidcClient`), automatic access-token management with DPoP support, and an introspection handler (all Apache 2.0), plus a separately licensed [BFF](https://www.abblix.com/en/docs/bff-pattern-in-oauth-and-openid-connect) framework (session management, anti-forgery, a YARP token-attaching proxy, Blazor support) and DPoP extensions for `JwtBearer`. Abblix ships no client-side code at all: its own samples use Microsoft's `OpenIdConnect` and `JwtBearer` handlers, and its BFF story is a single hand-rolled sample without token refresh, [CSRF](https://www.abblix.com/en/docs/glossary-overview#csrf) protection, or session management; a client package family is planned but unreleased. For pure OP scenarios any standards-compliant client works against any of the three; if you want one vendor covering both sides of the wire, that is Duende's and OpenIddict's ground today. ## Summary ### Abblix OIDC Server Where Abblix leads: it packs a broad modern-protocol surface into one package ([CIBA](https://www.abblix.com/en/docs/glossary-overview#ciba) with poll, ping, and push, DPoP, full DCR per [RFC 7591](https://datatracker.ietf.org/doc/html/rfc7591) and 7592, [JARM](https://www.abblix.com/en/docs/glossary-overview#jarm), RAR, token exchange, the JWT-bearer grant, JWT introspection responses, pairwise identifiers, per-client [JWE](https://www.abblix.com/en/docs/glossary-overview#jwe), signed discovery metadata), and it is OpenID-certified across all seven OP profiles and all four logout profiles, current through the shipped 2.x line. Every capability is in every tier, the free one included, and license validation is offline, contacting no remote server. What you give up starts with operations. There are no first-party database stores, so durable persistence is the host's to wire behind the storage interfaces. Operational state runs on any distributed cache the host configures, and the client store is a plain read/write pair (`IClientInfoProvider`/`IClientInfoManager`) you can back with any database, relational or document, independent of that cache. Abblix's own IdP does exactly this in a small amount of adapter code; the schema, migrations, and indexing are yours to design, and a relational client store is queryable. The real engineering is a queryable inventory of active grants and refresh tokens: they are stateless JWTs, so nothing on the server enumerates them, and that inventory is a stateful store you design and build yourself. Signing-key rotation is not on by default the way Duende's is: it comes with the vault custodian packages, on the vault's policy or on a schedule the server drives, and a host that keeps its keys elsewhere runs the overlap itself through the same provider seam. And there is no admin UI, no first-party ASP.NET Identity package (a documented integration guide with a runnable sample exists), no client-side library, no [BFF](https://www.abblix.com/en/docs/bff-pattern-in-oauth-and-openid-connect) framework, no token-management helper: the entire user-facing UI, login included, is built from scratch. The ecosystem is young and tiny now: ~6.6K downloads, no third-party packages. The docs (~20 pages, English-only) and sample base are the smallest, there is no [FAPI](https://www.abblix.com/en/docs/glossary-overview#fapi) certification where Duende has one, and only the newest release line receives patches (as with OpenIddict; Duende alone maintains parallel lines). ### Duende IdentityServer Where Duende leads: over a decade of lineage, 25M+ downloads, a multi-person team, and parallel patch lines. Its operational story is the strongest of the three: automatic key management on by default, EF Core stores, server-side sessions with a query/revocation API, an ASP.NET Identity package, built-in OpenTelemetry, an admin template plus a third-party ecosystem of commercial and open-source admin tools, 7 project templates, and 36+ samples. Its documentation is the best of the three too: per-version upgrade guides and an official IdentityServer4 migration path. It ships a [SAML](https://www.abblix.com/en/docs/glossary-overview#saml) IdP in the same engine (v8). And it holds the only FAPI certification of the three: the FAPI 2.0 Security Profile for v7.3, under the Second Implementer's Draft, in the private key + DPoP and OpenID Connect configurations. ### OpenIddict Where OpenIddict leads: it is genuinely free and open source (Apache 2.0) at any scale, forkable, with the largest community of the three (5,184 stars, 70 contributors) and the only open contribution model. Its platform support is the widest (.NET Framework 4.6.2+/OWIN through .NET 10), and it is the only option for legacy ASP.NET hosts. Its refresh-token reuse response is the strongest (replaying a redeemed token revokes the entire chain), and every issued token is tracked in its database-backed stores, revocable wherever token validation consults the store. It ships the richest free companion stack: a full web/desktop/mobile client, a 111-provider gallery, a validation/resource-server stack, and EF Core/EF6/MongoDB stores. And its engineering is the most transparent: 3-OS public CI, provenance attestations, trusted publishing, and a suite that runs on .NET Framework too. ## When to choose which Choose Abblix OIDC Server when you need a broad set of modern OAuth/OIDC protocol extensions in one package (the Summary above lists them), with every feature available in every tier including the free one, and you are comfortable being an early adopter of a young product from a small vendor: you design your own persistence against the library's storage interfaces (full control of the schema, but no ready-made stores), and you bring your own admin tooling, UI, and client-side stack. Choose Duende IdentityServer when operational tooling and ecosystem matter most: over a decade of lineage, 25M+ downloads, automatic signing-key rotation, EF Core stores, server-side session management, ASP.NET Identity integration, built-in telemetry, an admin-UI ecosystem, the best documentation and migration guides, and you don't need the protocol extensions that set Abblix apart ([JARM](https://www.abblix.com/en/docs/glossary-overview#jarm), RAR, first-party token exchange, ping/push [CIBA](https://www.abblix.com/en/docs/glossary-overview#ciba)), or when open-banking or another regulated program makes [FAPI](https://www.abblix.com/en/docs/glossary-overview#fapi) certification a gating requirement: Duende holds that certification today, Abblix does not. Choose OpenIddict when budget or open source is a hard requirement, when you must run on .NET Framework/OWIN, or when you want the richest free client-side stack: it is a genuinely free, forkable framework with database-backed token storage and the strongest refresh-token reuse response. Its philosophy means more hand-written protocol code, and the protocol deltas against Abblix (DPoP, CIBA, server-driven logout notification) are shown in the protocol-coverage table above. Whichever way the decision goes, all three are well-built products. This page is a map, not a verdict: the right answer depends on your project needs. Study all three before you decide. If you are running IdentityServer4 or Duende today, the decision has a different shape, and [Abblix OIDC Server as an alternative to IdentityServer](https://www.abblix.com/en/docs/duende-identityserver-alternative) covers what sends teams back to it and what the switch actually involves. If Abblix fits, the [getting-started guide](https://www.abblix.com/en/docs/getting-started-guide) has an OIDC provider running in an ASP.NET Core app in minutes, the [React SPA with a .NET BFF](https://www.abblix.com/en/docs/react-spa-bff-guide) walks a browser app through login end to end, and [the pricing page](https://www.abblix.com/en/oidc-server/pricing) lays out the tiers - every protocol feature is in all of them, the free tier included. --- Source: https://www.abblix.com/en/docs/apache-2-0-packages.md # What we opened under Apache-2.0, and what we did not Abblix OIDC Server is a commercial library. As of 2.4, the Security Event and JWT packages, together with the two utility packages they stand on, are Apache-2.0. In full, the open set is: - `Abblix.SecurityEvents` - [Security Event Tokens](https://www.abblix.com/en/docs/glossary-overview#set) ([RFC 8417](https://datatracker.ietf.org/doc/html/rfc8417)); the receiving side of push and poll delivery ([RFC 8935](https://datatracker.ietf.org/doc/html/rfc8935) and [RFC 8936](https://datatracker.ietf.org/doc/html/rfc8936)), that is, accepting a pushed token and polling a transmitter for pending ones, though a poll feed presupposes a stream and the stream client is commercial; the subject identifier formats of [RFC 9493](https://datatracker.ietf.org/doc/html/rfc9493) together with the additional ones the [Shared Signals](https://www.abblix.com/en/docs/glossary-overview#ssf) profiles use; fetching an issuer's [JWK](https://www.abblix.com/en/docs/glossary-overview#jwk) Set to verify what arrives; and the receiving half of OpenID [Back-Channel Logout](https://www.abblix.com/en/docs/glossary-overview#back-channel-logout). - `Abblix.SecurityEvents.CAEP` and `Abblix.SecurityEvents.RISC` - the event vocabularies, typed payloads and event type constants. - `Abblix.SecurityEvents.MinimalAPI` - the ASP.NET Core routes for the above. - `Abblix.JWT` - the JWT and [JWE](https://www.abblix.com/en/docs/glossary-overview#jwe) engine underneath: signing, verification, encryption, the JWK and JWK Set model. - `Abblix.Utils` and `Abblix.DependencyInjection` - the plumbing the packages above stand on. They target net8.0, net9.0 and net10.0, they are on nuget.org at 2.4.0, and the source is at [github.com/Abblix/Oidc.Server](https://github.com/Abblix/Oidc.Server). Each declares `Apache-2.0` in its package manifest and carries an SPDX header per file. The package ids above are spelled as nuget.org shows them; the namespaces you write in a `using` follow C# convention instead, so `Abblix.JWT` on nuget is `Abblix.Jwt` in code, and `Abblix.SecurityEvents.MinimalAPI` is `Abblix.SecurityEvents.MinimalApi`. As of 2.4.0 the set is closed: no package in it references a package we sell, and its other dependencies are the Microsoft extension libraries plus, on net8.0 and net9.0, `System.Linq.Async`. Nothing enforces that in our build, so read it as a fact about this release rather than a guarantee about the next: `dotnet list package --include-transitive` on a project that references only these packages prints the whole set. Run it. A published version also stays published. The Apache-2.0 copyright grant is irrevocable by its own terms, so the releases you already build on cannot be withdrawn. That is a statement about the artifact and not about the roadmap, so here is the part it does not cover: 2.x is supported until November 2028 and 3.x is planned for November 2026, both on the [version support lifecycle](https://www.abblix.com/en/docs/version-support-lifecycle) page, and we have not decided what license the 3.x line carries. ## What this gives an application that is not our customer ASP.NET Core's OpenID Connect handler implements front-channel sign-out. Its `RemoteSignOutPath` endpoint accepts a POST, which makes it look like the answer, but it matches `sid` and `iss` against the stored ticket and never reads a Logout Token. An application whose provider posts one to it needs an endpoint of its own, with token validation and a replay check behind it. It does not have to be our customer to get them: ```csharp using Abblix.SecurityEvents.BackChannelLogout; using Abblix.SecurityEvents.Infrastructure; using Abblix.SecurityEvents.MinimalApi; // Replay reservations ride the host's IDistributedCache. In memory they die with the // process, so a restart re-opens the window for every unexpired token. builder.Services.AddDistributedMemoryCache(); builder.Services.AddSecurityEvents(); // Asks the issuer where its keys are. builder.Services.AddDiscoveryKeyResolution(); builder.Services.AddBackChannelLogoutReceiver(new BackChannelLogoutValidationOptions { ExpectedIssuers = ["https://op.example.com"], ExpectedAudience = "this-client-id", }); builder.Services.AddSingleton(); app.MapBackChannelLogoutEndpoint("/backchannel-logout"); ``` A word on the replay check, because its cost is not obvious. Each accepted token reserves the issuer and the `jti` together for the remainder of that token's lifetime, so the store holds one small key per token in flight and expires them itself. The reservation rides `IDistributedCache`, which offers get and set and no compare-and-set, so it is read-then-write: two simultaneous presentations of one token can both be told they are the first. Pointing that cache at shared Redis makes the reservations shared, not atomic. For [Back-Channel Logout](https://www.abblix.com/en/docs/glossary-overview#back-channel-logout) a lost race costs one duplicate call into a sink that has to be idempotent anyway, which is why we ship it this way. A deployment that wants a reservation that genuinely refuses derives `ReplayCacheBase` over its own store's conditional write, and ours steps aside. The sink is the part that takes real work, and no library closes it for you. Be concrete about it before planning around it. You are handed a session identifier, or - when the provider does not track sessions - only a subject, which means every session that user holds with you. An application on the stock ASP.NET Core handler with cookie authentication usually has neither to search by: no server-side session record to delete, and no `sid` kept from the ID token. Making back-channel logout work there means introducing a server-side session store keyed by subject and session, and capturing `sid` at sign-in. The receiver saves you the token work, not that work. Two properties your sink owes. It has to be idempotent, because a provider may re-send a token it suspects was not delivered, and may end the same session twice after a re-login. And its return value is a statement to the provider: nothing answers 200, a description travels back inside a 400. A sink that swallows its own failure and stays silent tells the provider the sessions are closed when they are not. `Abblix.JWT` stands alone as well. Signing, verification, encryption and a replay cache over `IDistributedCache`, with no OpenID Connect server anywhere in its dependency graph. Two things to know before building on it: fetching an issuer's key set over HTTP lives one package up, in `Abblix.SecurityEvents`, and the external key custodians for HashiCorp Vault and Azure Key Vault are commercial, so supplying keys from your own store is an interface you implement. With that said, if a [JWE](https://www.abblix.com/en/docs/glossary-overview#jwe) implementation is all you came for, take it. ## What is commercial The OpenID Provider itself, `Abblix.OIDC.Server` with its MVC and Minimal API adapters. The [Shared Signals](https://www.abblix.com/en/docs/glossary-overview#ssf) layer, `Abblix.SharedSignals` with its adapter and its Redis backing, which carries streams: creating and configuring them, the management API, the subject bookkeeping, and delivery from the transmitter side. The external key custodians, `Abblix.JWT.Vault` and `Abblix.JWT.Azure`. Commercial does not mean paid for everyone. Our license gives free production use to companies under a million dollars in annual revenue and under a million raised, to non-profits and educational institutions, and to individuals working on a personal project: one production issuer, no cap on users or client applications, and no feature of the OpenID Provider withheld. The free tier is the whole product rather than a subset of it. Development, test and staging deployments are free at any size, and so are non-commercial open-source projects. Separately licensed extensions, such as the Shared Signals packages above, are what they sound like. Past those thresholds the provider itself needs a paid license, and that is the business. ## Where the line actually falls [Back-Channel Logout](https://www.abblix.com/en/docs/glossary-overview#back-channel-logout) needs no stream, so the receiving side of it is entirely in the open set: the endpoint, the validation profile, the replay reservation and the response shaping. A [Shared Signals](https://www.abblix.com/en/docs/glossary-overview#ssf) integration is different. The event vocabularies are open and the token pipeline is open, but the client that registers a stream with a transmitter and reads its configuration lives in `Abblix.SharedSignals`, which is commercial - and that holds for receiving a feed as much as for sending one. If you are consuming [CAEP](https://www.abblix.com/en/docs/glossary-overview#caep) or [RISC](https://www.abblix.com/en/docs/glossary-overview#risc) events from another provider, you license that package or write the stream management yourself over the open pipeline. ## Why the line falls there Two things had to be true at once for a package to be opened. It had to be something the ecosystem is better off sharing, and it had to be something other than what we sell. A Security Event Token is an envelope: what it is, whom it is about, how it is validated, how it travels. Nothing in that description belongs to a vendor, and the validation profile it needs - the `typ` check, the refusal of `exp`, the required `jti` - should exist once rather than in every application that receives a notification. The same holds for the [CAEP](https://www.abblix.com/en/docs/glossary-overview#caep) and [RISC](https://www.abblix.com/en/docs/glossary-overview#risc) vocabularies: an event dictionary only one library understands is not a dictionary. Streams are the other half: creating one, pausing it, tracking who may hear about which subject, delivering to receivers that are down, doing it from more than one instance. That is operational machinery, and it is the part we sell. So the envelope is open and the machinery is not. ## What we have and have not tested The receiver is provider-agnostic by construction: it trusts an issuer allowlist and a JWK Set, and knows nothing about who signed. What that is worth in evidence: we exercise it end to end against our own provider, and it has not been through the OpenID Foundation relying-party conformance profile for back-channel logout. We have not published an interoperability run against a third-party provider. If yours is one, the integration is one issuer, one audience and one JWKS away, and the thing we most want back is a defect report carrying the token that failed. ## Contributions, competitors and support The commercial packages named above are the business, and nothing here says the rest follows later. The project is developed in-house, and the license does not change that: we do not merge external pull requests, including into the Apache-2.0 packages. Remaining the sole author is what keeps the licensing decision ours for future releases, including the freedom to keep releasing under Apache-2.0, which a mixed copyright would complicate. Forking an open package and changing your copy is what Apache-2.0 grants. What we will not do is take the change back into this repository, so what we can act on is a defect report with a reproduction, and we would rather have one than a patch we cannot take. The license also settles who may use the code, and that includes people we compete with. Apache-2.0 carries a patent grant and no field-of-use restriction, so another .NET identity product can ship `Abblix.SecurityEvents` or `Abblix.JWT` inside something that competes with ours. We knew that when we chose it. The patent grant stands unless the user sues over the code, which is Apache-2.0's own Section 3 and not something we added. That permission stops where the open set stops. The commercial packages are governed by our own license, which does not allow their source to be used for building a competing product, and reading them in the repository is evaluation access rather than a grant. The two halves sit in one repository and are told apart the same way in every case: by the license expression in the package and the SPDX header in the file. Contractual support comes with the commercial products, with response times set in the license. The open packages have the issue tracker and the discussions at the repository above: we triage new issues weekly and reply to every bug report. Since we will not merge your patch, that responsiveness is the thing to judge us on, and the tracker's history is where to judge it. --- Source: https://www.abblix.com/en/docs/implemented-standards.md # Implemented technologies and standards Abblix OIDC Server implements the OAuth 2.0, [OpenID Connect](https://www.abblix.com/en/docs/glossary-overview#openid-connect), and JWT standards listed below. The server is certified by the OpenID Foundation across all login and logout profiles, with zero failures and zero skipped tests in 600+ conformance checks. ## OAuth 2.0 core standards - **The OAuth 2.0 Authorization Framework**: [RFC 6749](https://datatracker.ietf.org/doc/html/rfc6749): Defines procedures for secure authorization of applications including authorization code, implicit, client credentials, and resource owner password credentials flows. - **The OAuth 2.0 Authorization Framework: [Bearer Token Usage](https://www.abblix.com/en/docs/glossary-overview#bearer-token-usage)**: [RFC 6750](https://datatracker.ietf.org/doc/html/rfc6750): Secures protected resource access with bearer tokens, including compliant authentication challenges and proper HTTP status code mapping for token errors. - **HTTP Semantics: Authentication**: [RFC 9110, Section 11](https://datatracker.ietf.org/doc/html/rfc9110#section-11): Ensures all `401` responses include authentication challenges matching the client's authentication scheme. - **OAuth 2.0 [Token Revocation](https://www.abblix.com/en/docs/glossary-overview#token-revocation)**: [RFC 7009](https://datatracker.ietf.org/doc/html/rfc7009): Describes methods to securely invalidate access and refresh tokens. - **OAuth 2.0 [Token Introspection](https://www.abblix.com/en/docs/glossary-overview#token-introspection)**: [RFC 7662](https://datatracker.ietf.org/doc/html/rfc7662): Allows resource servers to verify the active state and metadata of tokens. - **JWT Response for OAuth Token Introspection**: [RFC 9701](https://datatracker.ietf.org/doc/html/rfc9701): Returns the token introspection response as a signed and optionally encrypted JWT, letting the requesting party verify the response's origin and integrity. - **[Proof Key for Code Exchange](https://www.abblix.com/en/docs/pkce-in-openid-connect) (PKCE)**: [RFC 7636](https://datatracker.ietf.org/doc/html/rfc7636): Improves security for public clients during authorization code exchange. - **OAuth 2.0 [Device Authorization Grant](https://www.abblix.com/en/docs/glossary-overview#device-authorization-grant)**: [RFC 8628](https://datatracker.ietf.org/doc/html/rfc8628): Enables OAuth 2.0 authorization on devices with limited input capabilities (smart TVs, game consoles, IoT devices) by delegating user interaction to a secondary device. - **OAuth 2.0 [Dynamic Client Registration](https://www.abblix.com/en/docs/glossary-overview#dynamic-client-registration) Protocol**: [RFC 7591](https://datatracker.ietf.org/doc/html/rfc7591): Provides mechanisms for clients to register dynamically with authorization servers. - **OAuth 2.0 Dynamic Client Registration Management Protocol**: [RFC 7592](https://datatracker.ietf.org/doc/html/rfc7592): Enables management operations (read, update, delete) for dynamically registered clients. - **OAuth 2.0 [Token Exchange](https://www.abblix.com/en/docs/glossary-overview#token-exchange)**: [RFC 8693](https://datatracker.ietf.org/doc/html/rfc8693): Allows a client to exchange a security token for a different one, enabling delegation and impersonation flows across services. - **OAuth 2.0 [Mutual-TLS Client Authentication](https://www.abblix.com/en/docs/glossary-overview#mutual-tls-client-authentication) and Certificate-Bound Access Tokens**: [RFC 8705](https://datatracker.ietf.org/doc/html/rfc8705): Provides mutual TLS authentication with PKI and self-signed certificate validation, plus certificate-bound tokens. - **OAuth 2.0 [Resource Indicators](https://www.abblix.com/en/docs/glossary-overview#resource-indicators-for-oauth-2-0)**: [RFC 8707](https://datatracker.ietf.org/doc/html/rfc8707): Enables clients to specify the resources they want access to. - **[JSON Web Token](https://www.abblix.com/en/docs/glossary-overview#jwt) (JWT) Profile for OAuth 2.0 Access Tokens**: [RFC 9068](https://datatracker.ietf.org/doc/html/rfc9068): Specifies the use of JWTs as OAuth 2.0 access tokens. - **[JWT-Secured Authorization Request](https://www.abblix.com/en/docs/glossary-overview#jar) (JAR)**: [RFC 9101](https://datatracker.ietf.org/doc/html/rfc9101): Passes authorization request parameters in a JWT that may be signed and optionally encrypted, protecting their integrity and confidentiality. - **[JWT Secured Authorization Response Mode](https://www.abblix.com/en/docs/glossary-overview#jarm) (JARM)**: [JARM](https://openid.net/specs/oauth-v2-jarm-final.html): Returns the authorization response parameters in a JWT that may be signed and optionally encrypted, protecting their integrity and confidentiality. - **OAuth 2.0 [Pushed Authorization Requests](https://www.abblix.com/en/docs/glossary-overview#par) (PAR)**: [RFC 9126](https://datatracker.ietf.org/doc/html/rfc9126): Lets clients push authorization request parameters directly to the authorization server instead of passing them through the browser. - **OAuth 2.0 [Authorization Server](https://www.abblix.com/en/docs/glossary-overview#authorization-server) Issuer Identification**: [RFC 9207](https://datatracker.ietf.org/doc/html/rfc9207): Ensures the authenticity of authorization servers to clients. - **OAuth 2.0 [Rich Authorization Requests](https://www.abblix.com/en/docs/glossary-overview#rich-authorization-requests) (RAR)**: [RFC 9396](https://datatracker.ietf.org/doc/html/rfc9396): Lets clients request fine-grained authorization for specific operations, beyond the coarse-grained `scope` parameter. - **OAuth 2.0 Demonstrating Proof of Possession (DPoP)**: [RFC 9449](https://datatracker.ietf.org/doc/html/rfc9449): Sender-constrains access tokens by binding each one to a public key the client proves possession of on every request, so a stolen token is unusable without the corresponding private key. - **OAuth 2.0 Multiple Response Type Encoding Practices**: [Specification](https://openid.net/specs/oauth-v2-multiple-response-types-1_0.html): Encodes different response types in OAuth 2.0 requests. - **OAuth 2.0 Form Post Response Mode**: [Specification](https://openid.net/specs/oauth-v2-form-post-response-mode-1_0.html): Transmits OAuth 2.0 responses via HTTP form posts. ## JSON web standards - **[JSON Web Signature](https://www.abblix.com/en/docs/glossary-overview#jws) (JWS)**: [RFC 7515](https://datatracker.ietf.org/doc/html/rfc7515): Defines digital signature and MAC methods for JSON data structures. - **[JSON Web Encryption](https://www.abblix.com/en/docs/glossary-overview#jwe) (JWE)**: [RFC 7516](https://datatracker.ietf.org/doc/html/rfc7516): Defines encryption methods for JSON data structures. - **JSON Web Key ([JWK](https://www.abblix.com/en/docs/glossary-overview#jwk))**: [RFC 7517](https://datatracker.ietf.org/doc/html/rfc7517): Defines a JSON representation of cryptographic keys. - **[JSON Web Algorithms](https://www.abblix.com/en/docs/glossary-overview#jwa) (JWA)**: [RFC 7518](https://datatracker.ietf.org/doc/html/rfc7518): Defines cryptographic algorithms for use with JWS, JWE, and JWK. - **JSON Web Token (JWT)**: [RFC 7519](https://datatracker.ietf.org/doc/html/rfc7519): Defines the structure and use of JWTs for representing claims securely. - **JWT Profile for OAuth 2.0 [Client Authentication](https://www.abblix.com/en/docs/glossary-overview#client-authentication) and Authorization Grants**: [RFC 7523](https://datatracker.ietf.org/doc/html/rfc7523): Uses JWTs for secure client authentication ([private_key_jwt](https://www.abblix.com/en/docs/glossary-overview#private-key-jwt), client_secret_jwt) and as authorization grants. - **Authentication Method Reference Values**: [RFC 8176](https://datatracker.ietf.org/doc/html/rfc8176): Defines standardized values for the `amr` ([Authentication Methods References](https://www.abblix.com/en/docs/glossary-overview#amr)) JWT claim, enabling interoperable communication of authentication methods (password, OTP, biometrics, MFA, smart card, etc.). - **Security Event Token (SET)**: [RFC 8417](https://datatracker.ietf.org/doc/html/rfc8417): Describes security- and identity-related events, such as token revocation or account changes, as statements of fact about a subject, carried in a JWT that can be signed and optionally encrypted. - **Subject Identifiers for Security Event Tokens**: [RFC 9493](https://datatracker.ietf.org/doc/html/rfc9493): Defines named JSON formats for identifying the subject a security event refers to - by issuer and subject pair, email address, phone number, opaque identifier, and other registered formats. - **Push-Based Security Event Token (SET) Delivery Using HTTP**: [RFC 8935](https://datatracker.ietf.org/doc/html/rfc8935): Delivers security event tokens by HTTP POST from the transmitter to an endpoint the receiver hosts, with acknowledgement or a structured error returned in the response. - **Poll-Based Security Event Token (SET) Delivery Using HTTP**: [RFC 8936](https://datatracker.ietf.org/doc/html/rfc8936): Lets a receiver fetch pending security event tokens from the transmitter and acknowledge the ones it has secured, for receivers that cannot host an endpoint of their own. ## OpenID Connect specifications - **OpenID Connect Core 1.0**: [Specification](https://openid.net/specs/openid-connect-core-1_0.html): Core functionality for OpenID Connect identity layer over OAuth 2.0, including [ID Token](https://www.abblix.com/en/docs/glossary-overview#id-token-identity-token) issuance, standard claims, and authentication flows. - **OpenID Connect Discovery 1.0 / OAuth 2.0 [Authorization Server](https://www.abblix.com/en/docs/glossary-overview#authorization-server) Metadata**: [Specification](https://openid.net/specs/openid-connect-discovery-1_0.html), [RFC 8414](https://datatracker.ietf.org/doc/html/rfc8414): Enables clients to discover provider configurations dynamically via the well-known endpoint. - **OpenID Connect [Dynamic Client Registration](https://www.abblix.com/en/docs/glossary-overview#dynamic-client-registration) 1.0**: [Specification](https://openid.net/specs/openid-connect-registration-1_0.html): Enables OpenID Connect clients to register dynamically with providers. - **OpenID Connect [Session Management](https://www.abblix.com/en/docs/glossary-overview#session-management) 1.0**: [Specification](https://openid.net/specs/openid-connect-session-1_0.html): Manages user session states in identity providers with check_session_iframe support. - **OpenID Connect [RP-Initiated Logout](https://www.abblix.com/en/docs/glossary-overview#rp-initiated-logout) 1.0**: [Specification](https://openid.net/specs/openid-connect-rpinitiated-1_0.html): Details logout initiated by relying parties via the end-session endpoint. - **OpenID Connect [Front-Channel Logout](https://www.abblix.com/en/docs/glossary-overview#front-channel-logout) 1.0**: [Specification](https://openid.net/specs/openid-connect-frontchannel-1_0.html): Handles logout requests through [front-channel communication](https://www.abblix.com/en/docs/glossary-overview#front-channel-communication). - **OpenID Connect [Back-Channel Logout](https://www.abblix.com/en/docs/glossary-overview#back-channel-logout) 1.0**: [Specification](https://openid.net/specs/openid-connect-backchannel-1_0.html): Manages logout processes using [back-channel communication](https://www.abblix.com/en/docs/glossary-overview#back-channel-communication) with logout tokens. - **OpenID Connect [Client-Initiated Backchannel Authentication](https://www.abblix.com/en/docs/glossary-overview#ciba) (CIBA)**: [Specification](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html): Enables secure user authentication via backchannel communication on devices without direct web access, commonly used in IoT and financial-services scenarios. Supports three delivery modes: poll (client polls [token endpoint](https://www.abblix.com/en/docs/glossary-overview#token-endpoint)), ping (server notifies client at callback), and push (server delivers tokens to notification endpoint). - **Pairwise Pseudonymous Identifiers ([PPID](https://www.abblix.com/en/docs/glossary-overview#ppid))**: [OpenID Connect Core Section 8](https://openid.net/specs/openid-connect-core-1_0.html#PairwiseAlg): Implements a privacy mechanism by generating unique subject identifiers per client. ## Shared Signals specifications - **OpenID [Shared Signals Framework](https://www.abblix.com/en/docs/glossary-overview#ssf) 1.0 (SSF)**: [Specification](https://openid.net/specs/openid-sharedsignals-framework-1_0.html): Defines managed event streams through which a transmitter continuously shares security events with a receiver - stream configuration and status, subject management, stream verification, and delivery over push or poll. - **OpenID [Continuous Access Evaluation Profile](https://www.abblix.com/en/docs/glossary-overview#caep) 1.0 (CAEP)**: [Specification](https://openid.net/specs/openid-caep-1_0.html): Defines events describing changes to a subject's sessions and access context after the initial login - a revoked session, a changed credential, a shifted assurance or risk level - so cooperating services can react without waiting for the next authentication. - **OpenID [RISC](https://www.abblix.com/en/docs/glossary-overview#risc) Profile 1.0**: [Specification](https://openid.net/specs/openid-risc-1_0.html): Defines events for coordinating responses to account risk incidents - credential compromise, account disabling and deletion, identifier changes, and recovery activity - so an incident detected at one provider can protect the same user everywhere. ## Client authentication methods The server supports all standard client authentication methods: - **client_secret_basic** - HTTP Basic authentication with client credentials - **client_secret_post** - Client credentials in POST body - **client_secret_jwt** - HMAC-signed JWT assertion - **[private_key_jwt](https://www.abblix.com/en/docs/glossary-overview#private-key-jwt)** - RSA/EC-signed JWT assertion - **tls_client_auth** - PKI mutual TLS authentication - **self_signed_tls_client_auth** - Self-signed certificate mutual TLS - **none** - Public clients without authentication --- Source: https://www.abblix.com/en/docs/technical-requirements.md # Technical Requirements ## Supported Platforms Abblix OIDC Server runs on .NET-compatible platforms. The supported .NET version depends on the product version: - Abblix OIDC Server Version 1.*: supports [.NET 6.0](https://github.com/dotnet/core/blob/main/release-notes/6.0/supported-os.md), [.NET 7.0](https://github.com/dotnet/core/blob/main/release-notes/7.0/supported-os.md), [.NET 8.0](https://github.com/dotnet/core/blob/main/release-notes/8.0/supported-os.md), or [.NET 9.0](https://github.com/dotnet/core/blob/main/release-notes/9.0/supported-os.md) - Abblix OIDC Server Version 2.*: supports [.NET 8.0](https://github.com/dotnet/core/blob/main/release-notes/8.0/supported-os.md), [.NET 9.0](https://github.com/dotnet/core/blob/main/release-notes/9.0/supported-os.md), or [.NET 10.0](https://github.com/dotnet/core/blob/main/release-notes/10.0/supported-os.md) ## Web Server Requirements Supported web servers include, but are not limited to, Nginx, Apache HTTP Server, and Microsoft IIS. ## Hardware Requirements Abblix OIDC Server has no fixed hardware requirements; CPU and RAM should be scaled to match expected operational load. --- Source: https://www.abblix.com/en/docs/getting-started-guide.md # Getting Started ## Introduction Building authentication from scratch is a trap. We've seen teams spend a lot of time implementing OAuth 2.0 and OpenID Connect flows, only to discover edge cases that compromise security. Token validation, session management, [PKCE](https://www.abblix.com/en/docs/pkce-in-openid-connect) flows. Each piece seems simple until you're debugging why production users can't log in. At Abblix, we develop Oidc.Server: our certified OpenID Connect and OAuth 2.0 library for .NET. We've handled the complexity so you don't have to. This guide shows you how to build a working [OpenID Connect Provider](https://www.abblix.com/en/docs/glossary-overview#openid-connect-provider) in under an hour using [ASP.NET MVC](https://www.abblix.com/en/docs/glossary-overview#asp-net-mvc) and the Abblix OIDC Server solution, complete with login flows, token issuance, and proper session management. By the end, you'll have two applications talking OIDC: a provider that authenticates users and a client that trusts it. You'll understand why the protocol works this way and where your customizations fit. ## TL;DR You'll build a working OpenID Connect authentication flow using ASP.NET MVC. We create two applications: an authentication server that handles logins and issues tokens, and a web application that relies on that server to authenticate users. The authentication server uses Abblix OIDC Server, cookie authentication, and in-memory storage. The web application uses Microsoft's OpenIdConnect middleware. By the end, you'll have a complete login flow: users authenticate, view their claims, and log out properly. ### What You'll Build OpenIDProviderApp - Your authentication server: - Handles user logins with email/password - Issues access tokens and ID tokens - Manages user sessions with cookies - Implements OpenID Connect endpoints (`/connect/authorize`, `/connect/token`, `/connect/endsession`) - Uses Abblix OIDC Server for protocol handling TestClientApp - Your protected application: - Redirects users to OpenIDProviderApp for authentication - Receives tokens after successful login - Displays user claims from the [ID token](https://www.abblix.com/en/docs/glossary-overview#id-token-identity-token) - Handles logout across both applications - Uses Microsoft's OpenIdConnect middleware We'll use real credentials, actual HTTP redirects, and patterns you can extend straight into a production app. This isn't a toy example. It's the foundation you'd carry forward. Here's the path we'll take: - Set up both projects: two ASP.NET MVC applications with the right ports - Configure OpenIDProviderApp: add Abblix OIDC Server, create a login page, handle user authentication - Configure TestClientApp: add OpenIdConnect middleware, display claims, implement logout - Test the complete flow: login, view claims, logout, everything working together By the end of this guide, you'll fully understand [OpenID Connect](https://www.abblix.com/en/docs/glossary-overview#openid-connect) and have a functioning implementation using ASP.NET MVC and Abblix OIDC Server. ## Create New ASP.NET MVC Projects Here's how to create two new ASP.NET MVC projects and add them to a solution using the .NET CLI (Command Line Interface): - **Open** your command prompt or terminal. - **Create** a new solution: ```bash dotnet new sln -n GettingStarted ``` - **Create** the first project, `OpenIDProviderApp`: ```bash dotnet new mvc -n OpenIDProviderApp ``` - **Create** the second project, `TestClientApp`: ```bash dotnet new mvc -n TestClientApp ``` - **Add** both projects to the solution: ```bash dotnet sln add ./OpenIDProviderApp/OpenIDProviderApp.csproj dotnet sln add ./TestClientApp/TestClientApp.csproj ``` These commands will set up two ASP.NET MVC projects and organize them within a single solution. ### Change Default Port Numbers Setting specific port numbers for your applications ensures predictable and stable interaction between them. This is particularly important when your applications need to communicate securely, such as in the case of an OpenID Connect provider and a client application. Here's how you can set specific port numbers using the .NET CLI and editing configuration files directly, instead of using Visual Studio UI. Fixed port numbers remove uncertainty around application URLs, making it easier for developers to remember and use them. Designating specific ports avoids conflicts with other applications on the same machine and simplifies the configuration of both applications, especially for network-related settings like callback URLs and [CORS](https://www.abblix.com/en/docs/glossary-overview#cors) policies. This also prepares your development environment for production scenarios where specific ports might be required. ### Steps to Set Port Numbers Modify the `launchSettings.json` files for each project. This file is typically found in the `Properties` folder of each ASP.NET Core project. If it doesn't exist, you might need to create it. In each file, find the profile named `https` under `profiles` and set its `applicationUrl`: `https://localhost:5001` for OpenIDProviderApp and `https://localhost:5002` for TestClientApp. The rest of the profile stays as the template generated it, including the `ASPNETCORE_ENVIRONMENT` variable set to `Development`. ### Checking Port Availability Before running your applications, check if the designated ports (5001 for `OpenIDProviderApp` and 5002 for `TestClientApp`) are available. On Windows, use `netstat -an | find "5001"` and `netstat -an | find "5002"` to see if those ports are already in use. On Linux or Mac, use `sudo lsof -i :5001` and `sudo lsof -i :5002` to check for port usage. These commands help verify that the specified ports are not occupied, ensuring that your applications run without interference. ## Configuring OpenIDProviderApp The OpenIDProviderApp implements the core functions of an OpenID Connect Provider: it verifies user identities and issues tokens as required by the protocol. By setting up these features correctly, our application will be a trusted source for other applications that need user authentication and authorization services. ### Add Abblix.Oidc.Server.Mvc NuGet Package To add the necessary [NuGet Package](https://www.abblix.com/en/docs/glossary-overview#nuget-package) using the command line, follow these steps: - Open a terminal. - Navigate to your project directory. Use the `cd` command to change to the directory where your project is located. - Run the following command to install the Abblix.Oidc.Server.Mvc package: ```bash dotnet add package Abblix.Oidc.Server.Mvc ``` This command will download and install the latest available version of the Abblix.Oidc.Server.Mvc NuGet package into your project, making it ready for further configuration. ### Register Abblix Services into Dependency Injection **File: Program.cs** Here's how to integrate Abblix services into your ASP.NET Core application. - At the beginning of the file, include `using` directives for the necessary namespaces: ```csharp using Abblix.DependencyInjection; using Abblix.Jwt; using Abblix.Oidc.Server.Features.UserInfo; using Abblix.Oidc.Server.Mvc; using OpenIDProviderApp; ``` These directives make the extension methods and types from the Abblix OIDC Server accessible within your application. - After creating the `builder` instance but before building the app, add the registration for the Abblix services. Configure the options as needed for your application environment. Here is how you can insert the necessary configurations: ```csharp var builder = WebApplication.CreateBuilder(args); // Add services to the container. builder.Services.AddControllersWithViews(); // Register and configure Abblix OIDC Server builder.Services.AddOidcServices(options => { // Client registrations are loaded from the Oidc section of appsettings.json builder.Configuration.Bind("Oidc", options); options.LoginUri = new Uri("/Auth/Login", UriKind.Relative); options.SigningKeys = [JsonWebKeyFactory.CreateRsa(PublicKeyUsages.Signature)]; }); var app = builder.Build(); ``` The client registrations themselves live in configuration. Add the `Oidc` section to the `appsettings.json` file: ```js { "Oidc": { "Clients": [ { "ClientId": "test_client", // SHA-512 hash of the test secret "secret" - the provider stores hashes, never plain secrets "ClientSecrets": [ { "Sha512Hash": "vSsar3708Jvp9Szi2NWZZ02Bqp1qRCFpbcTZPdBhnWgs5WtNZKnvCXdhztmeD2cmW192CF5bDufKRpayrW/isg==" } ], "TokenEndpointAuthMethod": "client_secret_post", "AllowedGrantTypes": [ "authorization_code" ], "PkceRequired": true, "RedirectUris": [ "https://localhost:5002/signin-oidc" ], "PostLogoutRedirectUris": [ "https://localhost:5002/signout-callback-oidc" ] } ] } } ``` :::note[NOTE] This setup provides a starting point for using the Abblix OIDC Server in your application. The `options` configured in the `AddOidcServices` method are important for setting up the OIDC server's behavior to meet your specific needs. For example, the code snippet sets up a client with a hashed secret and specifies the grant types and client type. Later we will explore more detailed and customized configuration options, focusing on adapting the OpenID server to different operational requirements. The basic configuration above enables your application to interact with the client application requiring authentication and authorization services through the OpenID Connect protocol. ::: #### Understanding `AddOidcServices` Configuration **Configuration Method:** - `AddOidcServices` adds and configures the services necessary for the Abblix OIDC Server to operate within your application. - It is an extension method taking a lambda expression where you can specify various options to tailor the OIDC server's behavior. **Configuring Clients:** ```js "Oidc": { "Clients": [ { "ClientId": "test_client", ... } ] } ``` - The `Clients` array in the `Oidc` section defines a collection of client registrations, each representing a client application that will interact with your OIDC server. The `builder.Configuration.Bind("Oidc", options)` call in `Program.cs` loads them into the server options, so clients can be added or changed without recompiling. - Each client is identified by a unique ID (`"test_client"` in this example), which is used by the server to recognize and handle requests from that client. **Setting Client Secrets:** A client secret acts as a password for the client application to authenticate itself to the authorization server. When a client application requests access tokens or refresh tokens, it must prove its identity by presenting the client secret alongside the request. This guarantees that only registered and verified clients can request tokens and access user information. A secret is registered under `ClientSecrets` as a `Sha512Hash` property: the Base64-encoded [SHA-512](https://www.abblix.com/en/docs/glossary-overview#sha-512) hash of the secret, so the configuration never contains the secret itself. You can produce that value for your own secret with a one-liner: ```bash echo -n 'secret' | openssl dgst -sha512 -binary | base64 ``` :::warning[IMPORTANT] **Security Notes for Production Environments:** - Replace the placeholder "secret" with a strong and unique secret for each client application. - Store client secrets securely by avoiding plain text; instead, store their hashes. Abblix configuration is designed to prevent storing raw passwords. - Always ensure that secrets are stored securely using methods such as environment variables or dedicated secure vault solutions to manage sensitive information safely and reduce the risk of leakage. ::: **Allowed Grant Types:** `AllowedGrantTypes` specifies the grant types the client can use. With the single value `authorization_code`, the client is configured to use the [Authorization Code Flow](https://www.abblix.com/en/docs/glossary-overview#authorization-code-flow). The Authorization Code flow is a secure [grant type](https://www.abblix.com/en/docs/glossary-overview#grant-type) ideal for clients that can maintain a client secret between themselves and the authorization server (typically server-side applications). This flow is more secure than others, such as the [Implicit flow](https://www.abblix.com/en/docs/glossary-overview#implicit-flow), because the tokens are not exposed to the user or stored in potentially less secure places like the browser. It also supports refresh tokens, which are essential for applications that require prolonged access to resources on the user's behalf without needing re-authentication. How It Works: - Initially, the user authenticates with the authorization server and grants the application permission to access their information. - The authorization server does not directly issue tokens to the client. Instead, it issues an authorization code which is passed through the user's browser. - The client application exchanges this authorization code for an [access token](https://www.abblix.com/en/docs/glossary-overview#access-token), and optionally, a [refresh token](https://www.abblix.com/en/docs/glossary-overview#refresh-token), using its client secret. - The access token allows the application to request resources from the resource server and obtain information about the user. **[Token Endpoint](https://www.abblix.com/en/docs/glossary-overview#token-endpoint) Auth and Proof Key for Code Exchange:** - `TokenEndpointAuthMethod` determines how the client application authenticates itself at the token endpoint. Setting `client_secret_post` specifies that the client application includes the `client_id` and `client_secret` in the body of a POST request to the token endpoint. - `PkceRequired` specifies whether Proof Key for Code Exchange ([PKCE](https://www.abblix.com/en/docs/pkce-in-openid-connect)) is required. PKCE enhances the security of the Authorization Code flow. :::warning[WARNING] Setting `PkceRequired` to `false` might be suitable for trusted or internal clients but is strongly recommended to be `true` for public clients. ::: **Redirect URIs:** - `RedirectUris` are the URLs to which the OIDC server can send responses (tokens or [authorization codes](https://www.abblix.com/en/docs/glossary-overview#authorization-codes)) after authenticating the user. - `PostLogoutRedirectUris` define where the user is redirected after logging out. These must be pre-registered to prevent [redirection attacks](https://www.abblix.com/en/docs/glossary-overview#redirection-attacks). By specifying which URLs are allowed to receive tokens and codes, you protect the application from redirection attacks. In such attacks, an unauthorized party could redirect a user to a malicious site instead of the intended destination after authentication or logout. Pre-registering URIs ensures that the OIDC server only sends sensitive information to trusted locations. **Additional Configuration Options:** **LoginUri:** - `LoginUri` specifies the URL to which users are redirected to log in. This URI is relative, meaning it is appended to the base URI of your server. It is used primarily in scenarios where the user needs to authenticate before proceeding. **SigningKeys Configuration:** - `SigningKeys` includes cryptographic keys used for signing the tokens issued by your OIDC server. Specifically, the `JsonWebKeyFactory.CreateRsa(PublicKeyUsages.Signature)` function generates a new RSA key pair that is intended for signing. This key pair consists of both public and private components: - **Public Key:** Used by clients to verify the authenticity of the signed token. - **Private Key:** Held securely by the server to sign the tokens. Signing tokens with RSA keys lets clients verify both the issuer and the integrity of the token contents. This prevents token forgery and tampering during the authentication flow. ### Authentication with Cookies **File: Program.cs** After configuring the Abblix services, it's necessary to set up the application's authentication mechanism. Add the following code to the registration of services: ```csharp builder.Services .AddAuthentication() .AddCookie(); ``` #### Explanation **AddAuthentication Method:** - This call to `AddAuthentication()` initializes the authentication services in your application, marking the foundational step for configuring user identification. Without this setup, the application lacks the mechanism to manage user sign-ins or to maintain user session states effectively. **AddCookie Method:** - Following `AddAuthentication()`, the `.AddCookie()` method specifies that your application will use cookie-based authentication for session management. This approach is widely adopted in web applications for its effectiveness in tracking authenticated user sessions. Upon a user's login to your OpenID Connect provider, the system generates a session cookie and dispatches it to the user's browser. This cookie accompanies every subsequent server request, enabling the server to recognize the user and persist their logged-in status across the application's OIDC flows. This mechanism lets the [authorization endpoint](https://www.abblix.com/en/docs/glossary-overview#authorization-endpoint) proceed with request handling based on the user's authenticated state, without forcing a repeat login. Cookie-based authentication is also the foundation for Single Sign-On ([SSO](https://www.abblix.com/en/docs/glossary-overview#sso)). SSO permits a user to authenticate once and access multiple applications without the need for repeated sign-ins. Through the OIDC server's recognition of the session cookie, SSO lets an authenticated user obtain access tokens for other applications without re-entering credentials. ### Managing State Across Requests For an [OpenID Provider](https://www.abblix.com/en/docs/glossary-overview#openid-connect-provider) to function effectively, it must retain certain information between requests. This includes authorization codes following successful authentication, authorization requests for Pushed Authorization Requests ([PAR](https://www.abblix.com/en/docs/glossary-overview#par)), and [JWT](https://www.abblix.com/en/docs/glossary-overview#jwt) statuses to manage their revocation. The storage for these items needs to be persistent (retaining data even after an application restart) and durable, and often distributed if using multiple hosts for load balancing and high availability - a common practice today. #### Using IDistributedCache for Persistent Storage Abblix OIDC Server relies on the `IDistributedCache` interface, a standard in Microsoft environments, to store these entities. The `IDistributedCache` interface provides a framework for implementing distributed cache solutions. It helps you maintain state across different servers and instances in a scalable manner. This setup ensures that even in environments with high traffic and multiple servers, your application can efficiently retrieve and store critical data needed for processing OpenID Connect requests. #### Setting Up a Distributed Cache To set up a distributed cache, you can use [Redis](https://www.abblix.com/en/docs/glossary-overview#redis), [NCache](https://www.abblix.com/en/docs/glossary-overview#ncache), SQL Server, Memcached, Couchbase, or any other backend that supports scalable, distributed caching. These systems are well-suited for applications requiring high availability and swift data access across multiple servers. Most modern caching solutions offer NuGet packages that implement `IDistributedCache`, simplifying integration into your ASP.NET projects. Redis offers the `Microsoft.Extensions.Caching.StackExchangeRedis` package with support for data persistence and complex data types. NCache provides `Alachisoft.NCache.OpenSource.SDK` with strong scalability features. For applications already using SQL Server, the `Microsoft.Extensions.Caching.SqlServer` package offers convenient integration with Microsoft technologies. Memcached can be integrated through `EnyimMemcachedCore` for simpler workloads, while Couchbase's `Couchbase.Extensions.Caching` package brings rich querying capabilities and flexibility. Choose the distributed cache that best aligns with your application's needs and existing infrastructure. ### Using MemoryCache for simplicity To keep our test sample simple, we'll use the built-in `MemoryCache` implementation of `IDistributedCache`. This method enables quick setup and is suitable for development environments or scenarios where distributed architecture is not required and the service runs on a single host. Add the following code to your project setup: ```csharp builder.Services.AddDistributedMemoryCache(); ``` :::warning[IMPORTANT] **Important Note for Production** It's important to understand that `MemoryCache`, while easy to set up, should not be used in real-world production systems. The primary reason is that `MemoryCache` is not truly distributed and does not share data across multiple instances or servers. This leads to inconsistencies and issues in environments where high availability and resilience are required. ::: Upcoming articles will cover how to implement your own persistent storage and define custom policies for managing them, so you can tailor the storage layer to your application's needs. For now, we focus on simplicity to help you get up and running quickly. ### Using Cross-Origin Resource Sharing (CORS) [CORS](https://www.abblix.com/en/docs/glossary-overview#cors) is a security feature implemented in web browsers that controls whether web pages can make requests to a different domain than the one that served the web page. Here is the complete middleware pipeline for `OpenIDProviderApp`: ```csharp var app = builder.Build(); if (!app.Environment.IsDevelopment()) { app.UseExceptionHandler("/Home/Error"); app.UseHsts(); } app.UseHttpsRedirection(); app.UseStaticFiles(); app.UseRouting(); app.UseCors(); app.UseAuthorization(); app.MapControllerRoute( name: "default", pattern: "{controller=Home}/{action=Index}/{id?}"); app.Run(); ``` Notice that `app.UseAuthentication()` is not added here. For `OpenIDProviderApp`, authentication state is managed entirely through cookies that Abblix OIDC Server issues and validates internally. The standard ASP.NET Core authentication middleware is only needed in client applications (like `TestClientApp`) that must read the identity from those cookies. - `app.UseCors()` is required, not optional, and it must come after `app.UseRouting()`. The protocol endpoints carry CORS metadata, because browser-based clients read the discovery document, the key set and the token endpoint cross-origin - and ASP.NET Core routing refuses to serve an endpoint whose CORS metadata no middleware honours. Omit this call and every protocol endpoint, discovery included, answers 500 with an exception naming the missing middleware. The policy itself is registered by `AddOidcServices`; only this pipeline call belongs to the host. #### Implementation and Testing For initial development and testing, using an in-memory cache to store authorization codes, tokens, and consent decisions may be enough. This approach allows for rapid development and easy testing without the complexity of integrating with external storage systems. For production, switch to a persistent storage backend that meets your scalability and security requirements. Whether it's a relational database, a NoSQL database, or a key-value store like Redis, the choice should be based on thorough analysis and consultation with your architectural team. ### Creating a Login Page and Integrating It into the Authorization Flow When a user attempts to access a protected resource and is redirected to the OpenID Provider's authorization endpoint, it signifies the start of the authorization flow. The initial task for the OpenID Connect provider is to determine if the user is already authenticated. If not, the server must pause the authorization flow temporarily to handle the incoming authorization request: - The server temporarily stores the details of the authorization request. This is essential as it allows the user to be redirected to a login UI without losing the context of the original request. - The server then presents the user with an authentication interface, typically a login page, where they can enter their credentials (username and password). #### How Abblix OIDC Server uses the Pushed Authorization Request (PAR) In general, the PAR mechanism allows an authorization request to be sent to the OpenID Connect provider in advance of the user interaction at the authorization endpoint. The server securely stores this request and issues a unique ID for it. This ID, known as the `request_uri`, represents the stored request. The Abblix OIDC Server employs the PAR internally to pause and recover the authentication process later: - Storing Requests using PAR: Abblix OIDC Server uses the PAR storage to remember the initial authorization request and generates a unique identifier for it. - Redirect with `request_uri`: In directing the user to the login UI, Abblix OIDC Server appends a `request_uri` parameter containing the unique ID of the stored request. This ensures that the user's entry point into the authentication UI is directly linked back to their original authorization request. - Handling Successful Authentication: After the user enters their credentials and is authenticated, the login UI redirects the user back to the authorization endpoint with the original `request_uri` parameter. The server retrieves the stored request details using this ID and resumes the authorization flow from where it left off. Abblix OIDC Server avoids providing the full URI for redirection back from the login page to mitigate risks associated with open redirect vulnerabilities. Additionally, using a `request_uri` value instead of a full redirection URI simplifies the URLs involved. ### Implementing the Login UI Building a responsive, secure login UI matters because it is the user's first interaction with your authentication flow. While MVC is used here for simplicity, in real-world scenarios, especially for applications requiring dynamic and responsive UIs, consider using modern SPA frameworks like React or Vue. They offer more flexibility, better state management, and enhanced user experience compared to traditional MVC applications for complex interactive web applications. To implement the login interface using an [MVC Controller](https://www.abblix.com/en/docs/glossary-overview#mvc-controller) and View in the `OpenIDProviderApp`, create a new controller named `AuthController.cs` under the `Controllers` directory to manage the authentication processes, including displaying and processing the login form. Create a view named `Login.cshtml` under the `Views/Auth` directory containing the HTML form where users input their credentials. Upon form submission, the `AuthController` validates the credentials and performs the redirect with the `request_uri`, as specified by the PAR mechanism to resume the OpenID Connect flow. #### Create an Authentication Controller **File: Controllers/AuthController.cs** First, let's set up a controller that manages authentication requests. Navigate to the `Controllers` folder in your `OpenIDProviderApp` project and introduce a new Controller class named `AuthController`. Add the following `using` directives at the top of the file. Two of them are type aliases: they resolve naming conflicts between Abblix and ASP.NET Core types with the same name: ```csharp using Abblix.Oidc.Server.Features.RandomGenerators; using Abblix.Oidc.Server.Features.UserAuthentication; using Abblix.Oidc.Server.Model; using Abblix.Oidc.Server.Mvc; using Microsoft.AspNetCore.Authentication.Cookies; using Microsoft.AspNetCore.Mvc; using Path = Abblix.Oidc.Server.Mvc.Path; using UriBuilder = Abblix.Utils.UriBuilder; namespace OpenIDProviderApp.Controllers; public class AuthController : Controller { } ``` #### Create the Login Action The `Login` action in the `AuthController` manages the first step in the authentication process by presenting the login form to the user. This method also uses a parameter named `request_uri` which is essential to resume the OpenID Connect flow later. Add the code of the action as shown below: ```csharp // GET: Auth/Login public IActionResult Login([FromQuery(Name = "request_uri")] string requestUri) { // Return a view with login/password inputs and sign-in button return View(new { requestUri }); } ``` The `request_uri` parameter holds the identifier for the initial authorization request stored in the PAR storage. This identifier lets the OpenID Connect provider retrieve and continue the original authorization request after the user successfully logs in. When a user needs to access a resource that requires authentication, the server securely stores the authorization request and generates a unique identifier (`request_uri`) for this stored request. The user is then redirected to the login page with this `request_uri` included as a query parameter. The action method captures this `request_uri` from the query parameters when the user is redirected to the login page. It then passes this value to the View to maintain state between the login form and the authorization process. The login view receives the `request_uri` as part of its model data, which it includes in a hidden form field when submitting the login credentials. This preserves the `request_uri` throughout the user session and post-authentication process, so the server can fetch and continue the original request without losing context. ### Create the Login View **File**: `Views/Auth/Login.cshtml` First, create the directory structure for your authentication views. In the `Views` folder of your `OpenIDProviderApp` project, create a new folder named `Auth` - this corresponds to the `AuthController` we created earlier. Inside the `Views/Auth` directory, create a new file named `Login.cshtml`. This login form view will handle user credential submission. **Structure the Login Form**: Use HTML to construct a form that includes input fields for email and password, as well as a submit button. This form will handle user inputs and submit them to your server for authentication. ```html
@Html.ValidationSummary(true, "", new { @class = "text-danger" })
``` **Explanation**: - The form uses the `asp-action="Login"` tag helper to specify which action method on the server it should call when submitted. This ensures the form data is sent to the `Login` POST method in `AuthController`. - Input fields for `email` and `password` are marked with `required`, making sure users cannot submit the form without filling out these fields. - The `@Html.ValidationSummary` helper method is used to display any validation errors that occur during the login process. - A hidden input field named `requestUri` maintains the continuity of the login process by preserving the `request_uri` value across the form submission. This matters for the OpenID Connect flow: after successful authentication, the user can be redirected back to the originally requested resource or action. ### Implement a test storage for user accounts **File: TestUserStorage.cs** The Abblix OIDC Server provides an interface named `IUserInfoProvider`, which serves as a contract between Abblix OIDC Server's core functionalities and your application's user data storage. This interface mandates the implementation of a method, `GetUserInfoAsync`, which asynchronously fetches a user's claims based on a specified [subject identifier](https://www.abblix.com/en/docs/glossary-overview#subject-identifier). These claims can include simple and structured values as requested by the client application. Create a class that implements the `IUserInfoProvider` interface in your `OpenIDProviderApp` project. This class will be responsible for retrieving user information based on the subject identifier and the requested claims from the internal list of users: ```csharp public record UserInfo(string Subject, string Name, string Email, string Password); public class TestUserStorage(params UserInfo[] users) : IUserInfoProvider { public Task GetUserInfoAsync(AuthSession authSession, IEnumerable requestedClaims) { var userInfo = GetUserInfo(authSession.Subject, requestedClaims); return Task.FromResult(userInfo); } private JsonObject? GetUserInfo(string subject, IEnumerable requestedClaims) { var user = users.FirstOrDefault(user => user.Subject == subject); if (user == null) { return null; } var result = new JsonObject(); foreach (var claim in requestedClaims) { switch (claim) { case IanaClaimTypes.Sub: result.Add(claim, user.Subject); break; case IanaClaimTypes.Email: result.Add(claim, user.Email); break; case IanaClaimTypes.Name: result.Add(claim, user.Name); break; } } return result; } public bool TryAuthenticate( string email, string password, [NotNullWhen(true)] out string? subject) { foreach (var user in users) { if (user.Email == email && user.Password == password) { subject = user.Subject; return true; } } subject = null; return false; } } ``` The class lives in the `OpenIDProviderApp` namespace and needs `using` directives for `System.Diagnostics.CodeAnalysis`, `System.Text.Json.Nodes`, `Abblix.Jwt`, `Abblix.Oidc.Server.Features.UserAuthentication` and `Abblix.Oidc.Server.Features.UserInfo`. Note the shape of `GetUserInfo`: it answers only the claims the client asked for, and a claim it does not recognize is simply left out of the response rather than refused. This simplified implementation uses in-memory user accounts for demonstration purposes: a deliberate choice to keep the example focused. In a real application, you would modify this code to connect to a database or another service that dynamically retrieves user accounts. :::note[NOTE] **Security Note on Storing Passwords** It is important to understand that in real-world production environments, storing raw passwords is considered a bad practice due to the high risk of security breaches. For our test sample, we use hard-coded user credentials only for simplicity. However, in real scenarios, if a user database is compromised, raw passwords could be accessed directly by unauthorized parties, leading to severe security issues and potential data breaches. ::: #### Best Practices for Storing Passwords Always store passwords as hashes, not plain text. Hashing converts the original password into a different string, and adding a salt (a random string) before hashing ensures that even identical passwords produce unique hash values. Use computationally demanding hash functions designed for secure password storage, such as [PBKDF2](https://www.abblix.com/en/docs/glossary-overview#pbkdf2), [Bcrypt](https://www.abblix.com/en/docs/glossary-overview#bcrypt), or [Argon2](https://www.abblix.com/en/docs/glossary-overview#argon2). These functions resist brute-force attacks and make it computationally infeasible to derive the original password from the hash. As technology advances and computational power increases, periodically review and update your hashing strategies to safeguard against new threats. Implement policies that promote or enforce the use of strong, unique passwords among users to reduce the risk of attacks succeeding. Adhering to these practices significantly improves the security of your authentication systems and safeguards user data from potential threats. #### Register the Implementation in the Dependency Injection **File: Program.cs** To integrate your `TestUserStorage` class as an implementation of `IUserInfoProvider` within your application, register it so it is correctly configured and accessible throughout your application, including the internal components of the Abblix OIDC framework. ```csharp var builder = WebApplication.CreateBuilder(args); // Add the TestUserStorage as a singleton service in the DI container. var userInfoStorage = new TestUserStorage( new UserInfo( Subject: "1234567890", Name: "John Doe", Email: "john.doe@example.com", Password: "Jd!2024$3cur3") ); builder.Services.AddSingleton(userInfoStorage); // Use AddAlias to register TestUserStorage also as an implementation of IUserInfoProvider. builder.Services.AddAlias(); ``` :::warning[IMPORTANT] The `AddAlias` method is part of the Abblix.DependencyInjection package. To use this method, ensure you include the appropriate namespace in your file: ::: ```csharp using Abblix.DependencyInjection; ``` This method registers `TestUserStorage` not only as a service in its own right but also as the implementation for `IUserInfoProvider`. This setup ensures that a single instance of `TestUserStorage` exists in the application. And even when the `IUserInfoProvider` is requested, the same instance of `TestUserStorage` is used. In the code snippet above, there is one user account defined with the email `john.doe@example.com` and the password `Jd!2024$3cur3`. You can use it for initial testing. Of course you can also expand this setup later to include more user accounts or integrate it with a database for a more dynamic approach. ### Handle Authentication in the AuthController **File: Controllers/AuthController.cs** To manage the login form submissions, add a new method named `Login` designed to handle POST requests in the `AuthController`. Since a GET method for login already exists, this new POST method will be clearly distinguished by using the [HttpPost] attribute. This attribute ensures that the method processes form submissions rather than initial page requests. Here's the critical moment: a user just submitted credentials. Three things must happen in exact order. First, validate the credentials. If wrong, show an error and redisplay the login form. If credentials are valid, create an authenticated session by generating a session cookie so the user stays logged in across requests. Finally, resume the OIDC flow by redirecting back to `/connect/authorize` with the original `request_uri`, letting Abblix OIDC Server continue where it paused. That third step is subtle but crucial. When the user first tried to access `TestClientApp`, they got redirected to `/connect/authorize`, which paused the flow and sent them to our login page with a `request_uri` parameter. That parameter is how we tell the authorization endpoint "continue that original request." Without it, the authorization endpoint wouldn't know which client initiated the request or where to redirect after authentication. ```csharp // Existing GET: Auth/Login method is already defined here // POST: Auth/Login [HttpPost] public async Task Login( [FromServices] IAuthSessionService authService, [FromServices] ISessionIdGenerator sessionIdGenerator, [FromServices] IUriResolver uriResolver, [FromServices] TestUserStorage userStorage, [FromForm] string email, [FromForm] string password, [FromForm] string requestUri) { // Attempt to authenticate the user with provided credentials if (!userStorage.TryAuthenticate(email, password, out var subject)) { // Return an error message to the view to inform the user ModelState.AddModelError("", "Invalid username or password"); return View(new { requestUri }); } // If authentication is successful, create a new authentication session var authSession = new AuthSession( subject, sessionIdGenerator.GenerateSessionId(), DateTimeOffset.UtcNow, CookieAuthenticationDefaults.AuthenticationScheme); // Sign in the user using the authentication service await authService.SignInAsync(authSession); // Redirect the user to the authorization endpoint URL, recovering the OIDC flow var authorizeUrl = new UriBuilder(uriResolver.Content(Path.Authorize)) { Query = { [AuthorizationRequest.Parameters.RequestUri] = requestUri } }; return Redirect(authorizeUrl); } ``` This process starts with authenticating the user using the `TryAuthenticate` function. If the credentials are incorrect, an error message is displayed on the login page. If authentication succeeds, it triggers the creation of a new `AuthSession` and formal login through `authService.SignInAsync()`. Finally, the user is redirected to the authorization endpoint. The redirect URL is constructed using two tools: - `IUriResolver.Content()` - Converts route paths (like given `Path.Authorize`) into absolute URIs based on the current HTTP request context. It handles both application-relative paths (`~/connect/authorize`) and configurable route templates, ensuring URLs are properly formed with the correct scheme and host. - `UriBuilder` - Provides a fluent API for constructing URIs with query parameters. Using the Query indexer (`{ Query = { [key] = value } }`), you can add parameters without manual string concatenation or encoding, making the code cleaner and less error-prone. This resumes the OpenID Connect flow, leading to token issuance. The method effectively demonstrates very basic credential verification. In a production environment, it would need enhancement to ensure secure and efficient handling of user credentials according to best cybersecurity practices. However, detailing the implementation of such a system is beyond the scope of this guide. Our current focus is to provide a foundational understanding and implementation of authentication workflows using OpenID Connect in a controlled test environment. ## Configuring a Test Client Application Ensuring your OpenID Connect server operates as expected is important. This phase involves a thorough testing process to validate the entire authentication flow - from user authentication and authorization to token issuance and access to protected resources. Having established `TestClientApp`, we now proceed to turn it into a fully-functional OpenID Connect client. ### Add Microsoft.AspNetCore.Authentication.OpenIdConnect NuGet Package Add the necessary NuGet package from the command line. Navigate to your project directory for `TestClientApp`. Run the following command to install the `Microsoft.AspNetCore.Authentication.OpenIdConnect` package: ```bash dotnet add package Microsoft.AspNetCore.Authentication.OpenIdConnect ``` This installs the Microsoft.AspNetCore.Authentication.OpenIdConnect NuGet package into your `TestClientApp` project, enabling it to use OpenID Connect for authentication. This is essential for setting up the OpenID Connect client capabilities in your ASP.NET application. ### Establish the Authentication Schemes TestClientApp combines two Authentication Schemes. Here's how they divide the work. #### Understanding the Concept of Authentication Scheme An Authentication Scheme in ASP.NET Core MVC is a named configuration that defines the mechanics of authentication for a specific context. Each scheme is capable of performing a variety of operations, including: - Challenge: Initiates authentication, typically by redirecting to a login page or challenging an API call. - Sign-in: Manages the process of establishing an authenticated session after a user is authenticated. - Sign-out: Handles the termination of an authenticated session, usually by clearing cookies or tokens. - Authenticate: Responsible for validating authentication data (like cookies or tokens) in requests and assigning a user identity based on that data. A scheme may implement these operations itself or delegate them to another scheme, creating a flexible architecture. For instance, the cookie-based scheme handles sign-in and sign-out operations directly, maintaining the session state after initial authentication. However, for initiating authentication - known as the **challenge** operation - it relies on the OpenID Connect scheme. This delegation relies on OpenID Connect for secure initial authentication, while the cookie scheme efficiently manages session persistence. In our example, we use this approach to get the best of each scheme. #### Cookie Authentication **Role**: Cookie Authentication acts as the primary authentication scheme in `TestClientApp`, essential for managing the user session after the user has been authenticated by an external provider such as OpenID Connect. **How It Works**: After successful authentication via OpenID Connect, `TestClientApp` issues a session cookie containing the user's encrypted identity information. This cookie authenticates subsequent requests from the user's browser, maintaining the session without continuous re-authentication. #### OpenID Connect Authentication **Role**: This serves as the secondary or external authentication scheme in `TestClientApp`, designed specifically for authenticating users against the OpenID Connect provider (`OpenIDProviderApp`). **How It Works**: When a user attempts to access a protected resource without an active session, this scheme redirects them to the `OpenIDProviderApp` for authentication. After successful authentication, the user is redirected back with an authorization code that `TestClientApp` exchanges for an identity token and possibly an access token to establish and manage the user session with a cookie. #### Inter-Scheme Delegation In our setup, while the Cookie Authentication scheme manages the sign-in and sign-out processes, it delegates the challenge operation to the OpenID Connect Authentication scheme. This inter-scheme delegation allows `TestClientApp` to use OpenID Connect for handling initial user authentication requests and redirects, relying on the external authentication mechanisms provided by `OpenIDProviderApp`. #### Integrating the Authentication Schemes **File: Program.cs** Add both authentication schemes to your test client application and configure them to work together: - Configure both authentication schemes from the configuration: ```csharp var configuration = builder.Configuration; builder.Services .AddAuthentication(options => configuration.Bind("Authentication", options)) .AddCookie(options => configuration.Bind(CookieAuthenticationDefaults.AuthenticationScheme, options)) .AddOpenIdConnect(options => configuration.Bind(OpenIdConnectDefaults.AuthenticationScheme, options)); ``` This configuration establishes Cookie Authentication as the primary means of maintaining user sessions within `TestClientApp`, while OpenID Connect Authentication handles initial user authentication through `OpenIDProviderApp`. The cooperation between these schemes combines cookie-based sessions with OpenID Connect's federated identity capabilities into one secure authentication flow. #### Configure the Middleware Pipeline After registering the authentication services, you need to add the authentication middleware to the HTTP request pipeline. Add the following code after building the app: ```csharp var app = builder.Build(); // Configure the HTTP request pipeline. if (!app.Environment.IsDevelopment()) { app.UseHsts(); } app.UseHttpsRedirection(); app.UseStaticFiles(); app.UseRouting(); app.UseAuthentication(); // Enable authentication middleware app.UseAuthorization(); // Enable authorization middleware app.MapControllerRoute( name: "default", pattern: "{controller=Home}/{action=Index}/{id?}"); app.Run(); ``` The order of middleware is critical: - `UseAuthentication()` must come after `UseRouting()` and before `UseAuthorization()` - This ensures that user authentication is processed before authorization checks ### Configure the Authentication It's time to properly set up your `TestClientApp` to authenticate using the OpenID Connect provider. **File: appsettings.json** Add two sections to `appsettings.json`. `Authentication` carries `DefaultScheme` and `DefaultChallengeScheme`. `OpenIdConnect` carries `SignInScheme`, `SignOutScheme`, `SaveTokens`, `Scope`, `MapInboundClaims`, `ResponseType`, `ResponseMode`, `UsePkce` and `GetClaimsFromUserInfoEndpoint`. These are the settings the `Bind` calls above read; the cookie scheme binds its own section alongside them. **File: appsettings.Development.json** The three values that name a particular server belong in `appsettings.Development.json`, in an `OpenIdConnect` section of its own: `Authority`, `ClientId` and `ClientSecret`. Splitting them out keeps the environment-specific part in one place. Let's break down these settings. #### Authentication Section - `DefaultScheme`: Specifies the primary method of authentication. Set to `"Cookies"`, it indicates that the application uses cookie-based authentication by default to handle user sign-ins and maintain session state. - `DefaultChallengeScheme`: This specifies the scheme used when the application needs to actively challenge a user for authentication. By setting this to `"OpenIdConnect"`, the application is directed to use OpenID Connect whenever it encounters a scenario requiring user authentication without a valid cookie. #### OpenIdConnect Section - `SignInScheme` & `SignOutScheme`: Both set to `"Cookies"`, these settings govern how the application handles user sign-ins and sign-outs, respectively, linking the OpenID Connect authentication process to cookie-based session management. - `Authority`: Defines the URL of the OpenID Connect provider, in this case, `https://localhost:5001`. This is where the application sends authentication and token requests. - `ClientId` & `ClientSecret`: The `ClientId` is a unique identifier for the application registered with the OpenID Connect provider, while the `ClientSecret` is a secret key used to authenticate the client with the provider, enhancing security. Here they are `test_client` and `secret`, matching the client registered on the provider side above, where the same secret is stored as a hash. It's crucial to keep the client secret secure, especially in production environments. - `SaveTokens`: This setting, when enabled, instructs the application to save the tokens obtained during the authentication process, which may include identity, access, and refresh tokens. These tokens are useful for making API requests on behalf of the user. - `Scope`: This array specifies the permissions or scopes requested by the application, such as `"openid"`, `"profile"`, and `"email"`. These scopes determine the extent of access to the user's information allowed by the application. - `MapInboundClaims`: Setting this to `false` avoids the automatic conversion of JWT claims into Microsoft's proprietary claim types, allowing the application to use the original claims issued by the OpenID Connect provider. - `ResponseType`: Specifies the type of response the client expects from the OpenID Connect provider. Setting `"code"` indicates that the Authorization Code flow is used. - `ResponseMode`: Defines how the authorization response is returned to the client. `"query"` means that the authorization code will be included in the query string of the redirect URI. - `UsePkce`: Indicates whether Proof Key for Code Exchange ([PKCE](https://www.abblix.com/en/docs/pkce-in-openid-connect)) should be used. Setting this to `true` enhances the security of the Authorization Code flow. - `GetClaimsFromUserInfoEndpoint`: Instructs the application to retrieve additional claims about the user from the [UserInfo endpoint](https://www.abblix.com/en/docs/glossary-overview#userinfo-endpoint), supplementing those provided in the ID token. ### Implementing an Index Page to Display User Claims To effectively display user claims in your `TestClientApp` as a result of successful authentication, you will need to configure the appropriate controller action and set up a view. #### Secure the Index Page with User Authentication **File**: `Controllers/HomeController.cs` Ensure that only authenticated users can access the `Index` page by applying the `[Authorize]` attribute to the `Index` action method in the `HomeController`. **Update the Method as Follows**: ```csharp using Microsoft.AspNetCore.Authorization; using Microsoft.AspNetCore.Mvc; public class HomeController : Controller { [Authorize] public IActionResult Index() { // Retrieve and pass the user's claims to the view return View(User.Claims); } } ``` The `[Authorize]` attribute on the `Index` action ensures that only authenticated users can view the claims page. If a user attempts to access it without being authenticated, the system automatically issues a challenge, redirecting them to the login page. #### Update the Index View to Display User Claims **File**: `Views/Home/Index.cshtml` Modify the `Index` view located in the `Views/Home` directory to dynamically display user claims, providing a straightforward visualization of the authenticated user's data: ```html @model IEnumerable @{ ViewData["Title"] = "User Claims"; }

User Claims

@if (Model.Any()) {
    @foreach (var claim in Model) {
  • @claim.Type: @claim.Value
    • }
} else {

No claims available. Are you authenticated?

} ``` This view is designed to receive an `IEnumerable` as its model, which it uses to display each claim in a list format. It first checks if any claims are present. If claims exist, it lists each one, showing the type and value of the claim. If no claims are found, it displays a message querying if the user is authenticated. This serves as a direct indication that no user data has been retrieved, either due to lack of authentication or an issue in the claim retrieval process. #### Implementing Logout Functionality Now that login is working, let's implement logout. For proper logout in an OpenID Connect flow, you need to sign out from both the local application session and the [identity provider](https://www.abblix.com/en/docs/glossary-overview#identity-provider) session. **Add the EndSession action to HomeController** **File**: `Controllers/HomeController.cs` Add the following using statements at the top of the file: ```csharp using Microsoft.AspNetCore.Authentication; using Microsoft.AspNetCore.Authentication.Cookies; using Microsoft.AspNetCore.Authentication.OpenIdConnect; ``` Then add the `EndSession` action to your `HomeController`: ```csharp public IActionResult EndSession() { return SignOut( CookieAuthenticationDefaults.AuthenticationScheme, OpenIdConnectDefaults.AuthenticationScheme); } ``` The `EndSession` action intentionally does NOT have the `[Authorize]` attribute. This is important because logout should work even if the user is already logged out or if the session has expired. Requiring authentication for logout would create a confusing loop where calling `/Home/EndSession` would redirect to login, then immediately log out after successful authentication. **Why specify both schemes?** You must explicitly sign out from both authentication schemes. This is the standard ASP.NET Core pattern - there is no configuration option to automatically link multiple schemes for sign-out. ASP.NET Core authentication handlers are designed to be independent and don't automatically chain sign-out operations. By explicitly specifying both schemes in the `SignOut()` call, you ensure: **Cookie Authentication Scheme:** - Clears the local session cookie from `TestClientApp` - Removes the user's authenticated state in the client application **OpenID Connect Scheme:** - Triggers the OIDC logout flow with `OpenIDProviderApp` - Redirects the user to `/connect/endsession` on the provider - Ensures the user is logged out from the identity provider itself - Handles the redirect back to `PostLogoutRedirectUri` after logout completes This provides complete session termination across both the client application and the identity provider. **Add a logout link to the navigation** **File**: `Views/Shared/_Layout.cshtml` To allow users to easily access the logout functionality, add a logout link to the navigation bar. Open the `_Layout.cshtml` file in the `Views/Shared` directory and locate the navigation menu section. Add a second navigation list with the logout link aligned to the right: ```html
``` The logout link calls the `EndSession` action, which handles the complete logout process across both the client application and the identity provider. With the controller action, the claims view, and logout handling in place, `TestClientApp` displays the authenticated user's claims and signs the user out across both the application and the provider. ## Testing Your Applications To test the setup of your OpenID Connect provider and client applications, run both applications simultaneously. ### Running the Applications - Open two separate command prompts or terminal instances for `OpenIDProviderApp` and `TestClientApp`. - In each terminal, navigate to the respective project directory of each application. - Run the following command in both terminals: ```bash dotnet run -lp https ``` This command starts each application with HTTPS enabled, which is necessary for OpenID Connect operations. ### Testing the Authentication Flow **Step 1: Access the client application** - Open a web browser in incognito mode and navigate to `https://localhost:5002` - **Expected:** Browser redirects you to `https://localhost:5001/Auth/Login?request_uri=...` - **You should see:** The login page with email and password fields **Step 2: Log in with test credentials** - Enter email: `john.doe@example.com` - Enter password: `Jd!2024$3cur3` - Click the login button - **Expected:** Brief redirect through authorization endpoint, then back to TestClientApp - **You should see:** The URL changes to `https://localhost:5002/` and displays the claims page **Step 3: Verify authentication succeeded** - **You should see:** A list of user claims including: - `sub: 1234567890` (the user's subject identifier) - `name: John Doe` - `email: john.doe@example.com` - `sid` (the provider session this login belongs to) and `auth_time` (when the login happened) - **Expected:** The claims page shows you're authenticated **Step 4: Test logout** - Click the "Logout" link in the navigation bar - **Expected:** Logout page appears, then redirect to `https://localhost:5002/` - **You should see:** No longer authenticated (accessing `/` will redirect to login again) **Step 5: Verify logout completed properly** - Try accessing `https://localhost:5002/` again - **Expected:** Redirect back to login page at `https://localhost:5001/Auth/Login` - **You should see:** Login form asking for credentials again (not auto-login) - **Success:** This confirms logout worked: both client cookie and provider session were cleared ### Handling HTTPS Certificate Trust Issues When developing and testing web applications locally, especially those configured to run over HTTPS, you may encounter browser warnings indicating that the SSL certificate is not trusted. This issue arises because the development certificates used by ASP.NET Core are self-signed and not issued by a recognized Certificate Authority (CA). Here's how you can address these warnings: #### Trusting the ASP.NET Core Development Certificate To eliminate these warnings and ensure a smooth development experience, trust the ASP.NET Core development certificate on your machine. Run the following command in your command line or terminal: ```bash dotnet dev-certs https --trust ``` This command updates your system to trust the certificate used by ASP.NET Core during development. After running this command, restart your browsers to ensure the changes take effect. :::warning[IMPORTANT] **Special Note for Chrome Users** Even after trusting the development certificate, some browsers like Chrome might still restrict access to sites using localhost for security reasons. If you encounter an error in Chrome stating that your connection is not private, you can bypass this by: - Restarting the browser completely rather than the tab: a running browser keeps the old certificate state and will not pick up the newly trusted one on a reload. It's important to use these bypasses sparingly and only in development scenarios, as they could mask genuine security issues in a production environment. ::: ### Observing OpenID Connect in Action This testing phase offers a hands-on opportunity to see OpenID Connect in action within your client applications. It covers the full cycle from initiating user authentication with the [OpenID Provider](https://www.abblix.com/en/docs/glossary-overview#openid-connect-provider) (`OpenIDProviderApp`), through successful login, and back to the client application (`TestClientApp`) where the user's authentication information is used. ## Troubleshooting Common Issues ### Login redirect loop - keeps sending me back to login **Symptom:** After entering credentials, you're redirected back to the login page instead of reaching the claims page. **Cause:** The `request_uri` parameter isn't being passed through the login flow correctly. **Fix:** Verify that: 1. Your Login GET action accepts `request_uri` from query parameters and passes it to the view 2. Your Login view includes a hidden input field with the `request_uri` value 3. Your Login POST action redirects back to `/connect/authorize?request_uri={requestUri}` ### Logout doesn't work - auto-logged back in immediately **Symptom:** After logging out, accessing the client application logs you back in without showing the login form. **Cause:** Only signing out from Cookie scheme, not OpenIdConnect scheme. **Fix:** Your `EndSession` action must sign out from both schemes: ```csharp return SignOut( CookieAuthenticationDefaults.AuthenticationScheme, OpenIdConnectDefaults.AuthenticationScheme); ``` ### Redirect URI mismatch error **Symptom:** Error message: "The redirect_uri in the request does not match a registered redirect URI" **Cause:** The client configuration in `OpenIDProviderApp` doesn't include the URL that `TestClientApp` is using. **Fix:** Verify that `RedirectUris` in the `Oidc` section of `appsettings.json` matches exactly: ```json "RedirectUris": [ "https://localhost:5002/signin-oidc" ] ``` Port numbers and paths must match exactly: `5002` vs `5003` or `signin-oidc` vs `signin-callback` will fail. ### Invalid credentials - login always fails **Symptom:** Login form keeps rejecting your credentials even when they're correct. **Cause:** Typo in email or password, or the `TestUserStorage` wasn't configured correctly. **Fix:** Double-check the credentials in `Program.cs` of `OpenIDProviderApp`: - Email: `john.doe@example.com` (case-sensitive) - Password: `Jd!2024$3cur3` (exact match required) ### Claims page shows "No claims available" **Symptom:** After successful login, the claims page displays "No claims available. Are you authenticated?" **Cause:** The `Index` action doesn't have the `[Authorize]` attribute, or authentication middleware isn't configured. **Fix:** Ensure: 1. `Index` action has `[Authorize]` attribute 2. `Program.cs` includes `app.UseAuthentication()` and `app.UseAuthorization()` in the correct order 3. Both Cookie and OpenIdConnect authentication schemes are configured in `TestClientApp` ### Intermittent login failures after deploying to more than one server **Symptom:** Logins work locally and on a single server, then start failing at random once the application runs behind a load balancer. The failure lands at the token endpoint, and retrying often succeeds. **Cause:** `AddDistributedMemoryCache` is not distributed despite the name: each process keeps its own copy. The server that issued the authorization code holds it in memory; when the browser comes back through the balancer, another server handles the exchange, finds nothing under that code and rejects it. Whether a login works depends on which server answers the second request. **Fix:** Replace the in-memory cache with a real distributed one, Redis or another shared store, so every instance reads the same entries. The same applies to a single server that restarts: an in-memory cache loses every session and authorization code with the process, so a routine restart signs out everyone at once. ### Login fails with invalid_grant and nothing in the request looks wrong **Symptom:** The token exchange answers `invalid_grant`. The redirect URI matches, the secret is right, and the message says nothing about what the server objected to. **Cause:** The two sides disagree about PKCE. Turning `PkceRequired` off on the server does not stop the client library from sending the challenge, and a request carrying PKCE parameters the server was not expecting is refused at the token endpoint like any other mismatch. **Fix:** Keep PKCE on both sides rather than off on both: set `PkceRequired` to `true` in the client registration and leave `UsePkce` on in the client application. Beyond making the two agree, it is the setting you want anyway. ### Certificate trust warnings in browser **Symptom:** Browser shows "Your connection is not private" or certificate warnings. **Fix:** Trust the ASP.NET Core development certificate: ```bash dotnet dev-certs https --trust ``` If the warning persists after that, restart the whole browser rather than the tab: a running browser keeps the old certificate state, and reloading will not pick up the newly trusted one. Browsers also differ here, so a flow that still warns in one is worth trying in another before you go looking for the cause in your own configuration. ### Application won't start - port already in use **Symptom:** `dotnet run` fails with "Failed to bind to address https://127.0.0.1:5001" (or 5002) **Cause:** Another process is using the port, or previous instance didn't terminate. **Fix:** - Kill the process using the port (check Task Manager on Windows) - Or change the port in `launchSettings.json` under `Properties` folder ### Access the Complete Solution on GitHub If you encounter any issues or discrepancies while following this guide, or if you wish to verify your setup against a working model, the final state of the getting started solution is available on GitHub. You can clone the repository from [Abblix/Oidc.Server.GettingStarted](https://github.com/Abblix/Oidc.Server.GettingStarted) to access a fully implemented version of the OpenID Connect provider and client application as described in this guide. This resource is invaluable for troubleshooting, comparing your code, and understanding the complete implementation in context. It also serves as a quick reference to ensure that all configurations and code structures have been correctly followed and implemented. ## Conclusion Congratulations on completing this guide! You have made significant progress in understanding and implementing an OpenID Connect provider with ASP.NET MVC, using the Abblix OIDC Server solution. You have successfully configured two applications: `OpenIDProviderApp` as the OpenID Connect provider and `TestClientApp` as the client or Relying Party. Additionally, you have set up the essential services required for a secure OIDC flow. By following this guide, you've built a working OpenID Connect provider on ASP.NET MVC: the foundation you can extend toward production-grade authentication. This setup not only covers the basic configuration but also allows you to dive deeper into the details of managing user sessions, handling tokens, and ensuring user consent. ### Next Steps to Consider - Building a browser SPA on top of this? The [React SPA with a .NET Backend-for-Frontend](https://www.abblix.com/en/docs/react-spa-bff-guide) guide walks the [BFF](https://www.abblix.com/en/docs/bff-pattern-in-oauth-and-openid-connect) build end to end, and [Authentication for SPAs with a BFF](https://www.abblix.com/en/docs/net-authentication-openid-connect-bff-spa) explains why the pattern keeps tokens out of the browser. - Still weighing libraries? See [how Abblix compares to Duende IdentityServer and OpenIddict](https://www.abblix.com/en/docs/comparison-duende-openiddict), feature by feature. - Apply the concepts learned to broaden the functionalities of your OpenID Connect provider. Try out different grant types, incorporate additional security measures, and tailor the user experience to better meet your needs. - Use this foundation to experiment with new ideas and solutions in authentication technology. - Continuously embrace best practices for maintaining a secure environment, such as securing secret storage, updating dependencies regularly, and adhering to the latest security protocols. - Join platforms like GitHub, Stack Overflow, and the ASP.NET Core community forums. These platforms offer support, facilitate discussions, and help you discover new ideas and techniques. From here, try swapping `MemoryCache` for Redis, or register a second client and watch the same flow adapt. --- Source: https://www.abblix.com/en/docs/configuration-and-setup.md # Configuration and Setup ## Introduction This guide walks through configuring Abblix OIDC Server in a .NET project, on the free tier or with a purchased license. It covers package installation and the licensing options you can choose between, so you can get the project running quickly and predictably. ## Install Abblix NuGet Package Abblix delivers its OIDC Server as a set of NuGet packages available on [nuget.org](https://www.nuget.org/packages/Abblix.OIDC.Server.MVC). - Open a terminal or command prompt in the root directory of your solution. - Run the following command to install the package: ```bash dotnet add package Abblix.OIDC.Server.Mvc ``` or for a specific version: ```bash dotnet add package Abblix.OIDC.Server.Mvc --version ``` - This will add the package reference directly to your project file. ## Apply the License :::note[Without a license] If you skip this step, the server runs on the free tier: one issuer, and no limit on client applications, users or nodes. Every protocol and profile is available, as it is on every tier. The server counts the distinct issuer identifiers it sees at runtime. Where `OidcOptions.Issuer` is left unset, the identifier is derived from the incoming request, so a second hostname reaching the server - an internal load-balancer name, a health check on a pod address, a regional hostname - counts as a second issuer. Past the limit every request throws `InvalidOperationException` with the message *"The license terms violation detected"*, on every issuer including the first, until the process restarts. Only the log record is throttled, to one entry per fifteen minutes per issuer. Set `OidcOptions.Issuer` explicitly in production. You do not need a license key to stay within the free tier. A paid license is what you buy when your company passes the free thresholds, or when you need more than one production issuer; see the [pricing page](https://www.abblix.com/en/oidc-server/pricing) for both. ::: There are several different options to apply your Abblix OIDC Server license. Pick whichever is most convenient: ### Use Inline License Configuration This method sets the license key directly in your application's startup configuration. You can retrieve the key from environment variables, configuration files, or a secure vault, then assign it to `OidcOptions.LicenseJwt` in the options delegate you pass to `AddOidcServices`: ```csharp builder.Services.AddOidcServices(options => { options.LicenseJwt = ""; }); ``` The advantage of this approach is its simplicity. ### Implement ILicenseJwtProvider This method is more flexible: implement the `ILicenseJwtProvider` interface to obtain the license dynamically. The custom implementation of `ILicenseJwtProvider` can rely on services configured during startup to obtain the license. It also supports loading multiple licenses simultaneously, which lets you migrate from an old license to a new one without downtime when both are loaded. - Write a class implementing `ILicenseJwtProvider`, which lives in `Abblix.Oidc.Server.Features.Licensing` and declares a single method, `GetLicenseJwtAsync`, returning a nullable `IAsyncEnumerable`. The sequence is where several licenses come from; returning nothing leaves the server on the free tier. The body is yours: read an environment variable, call a vault, query a database. - Register your implementation as a singleton for `ILicenseJwtProvider` in `Program.cs` before the `AddOidcServices` call. The built-in provider that reads `OidcOptions.LicenseJwt` is registered with `TryAddSingleton`, so it steps aside for yours. ```csharp builder.Services.AddSingleton(); builder.Services.AddOidcServices(options => { /* configure as needed */ }); ``` ## Register OIDC Services in Program.cs With the package installed and the license configured, four registrations in `Program.cs` are what the server needs to start, alongside the usual `AddControllersWithViews` of an MVC application. `AddOidcServices` from `Abblix.Oidc.Server.Mvc` is the entry point: its options delegate is where clients, the login URI, signing keys and everything else are configured, and the call itself brings in the protocol endpoints and the MVC controllers that serve them. Cookie authentication, registered through `AddAuthentication` and `AddCookie`, is what the server signs the user in with once the login has succeeded. A distributed cache is needed because authorization codes, pushed authorization requests and JWT statuses are persisted through `IDistributedCache`. `AddDistributedMemoryCache` is enough while developing; production wants a real backend behind that interface - Redis, SQL Server, NCache, Memcached, Couchbase. In the request pipeline, `UseCors` has to come after `UseRouting`, and this one is not a matter of taste: the protocol controllers carry CORS metadata, because browser-based clients read the discovery document, the key set and the token endpoint cross-origin, and ASP.NET Core routing refuses to serve an endpoint whose CORS metadata no middleware honours. Without that call the endpoints carrying that metadata answer 500. The policy itself is registered for you; only the middleware call belongs to the host. Add `UseAuthorization` and the default controller route as in any MVC application. That is the smallest setup that will boot the server. For a full end-to-end walkthrough (defining clients, building a login UI, plugging in user storage, and connecting a client application), follow the [Getting Started guide](https://www.abblix.com/en/docs/getting-started-guide). ## Finalizing the Setup ### Verify Setup - Ensure the application runs without any licensing errors. - Check that the issuer identifier the server reports in discovery is the one you expect. For advanced configurations, contact our [support team](mailto:support@abblix.com). --- Source: https://www.abblix.com/en/docs/react-spa-bff-guide.md # Securing a React SPA with the Backend-for-Frontend Pattern ## Introduction The [Getting Started guide](https://www.abblix.com/en/docs/getting-started-guide) built two applications talking [OpenID Connect](https://www.abblix.com/en/docs/glossary-overview#openid-connect): a provider and an [ASP.NET MVC](https://www.abblix.com/en/docs/glossary-overview#asp-net-mvc) client. That client had it easy. It runs on the server, so the tokens it receives live on the server, out of reach of the browser. A single-page application does not have that luxury. Its code runs in the browser, and the browser is a hostile place to keep a token. Any script that runs on the page (an [XSS](https://www.abblix.com/en/docs/glossary-overview#xss) bug, a compromised npm dependency, a third-party tag) can read a token held in `localStorage` or JavaScript memory and send it anywhere. That is not an exotic edge case. It is the default threat model for modern frontend code. The [Backend-for-Frontend](https://www.abblix.com/en/docs/bff-pattern-in-oauth-and-openid-connect) (BFF) pattern answers this by refusing to put tokens in the browser at all. A thin .NET backend becomes the real OpenID Connect client. It runs the [authorization-code flow](https://www.abblix.com/en/docs/glossary-overview#authorization-code-flow), keeps the tokens in an encrypted, HttpOnly cookie the SPA cannot read, and reverse-proxies the SPA's API calls with the [access token](https://www.abblix.com/en/docs/glossary-overview#access-token) attached server-side. This guide builds exactly that with Abblix OIDC Server: a React SPA, a .NET BFF, and a protected API behind it. The design follows the BFF architecture defined by the IETF in [OAuth 2.0 for Browser-Based Applications, section 6.1](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-browser-based-apps#name-backend-for-frontend-bff). Where that document sets a normative requirement (a [confidential client](https://www.abblix.com/en/docs/glossary-overview#confidential-client), the authorization-code grant, and Secure, HttpOnly, SameSite cookies), this guide points it out and the sample implements it. This is an advanced guide. It assumes you have worked through the [Getting Started guide](https://www.abblix.com/en/docs/getting-started-guide) and have a running `OpenIDProviderApp`. ## TL;DR You will build a React single-page application that logs in through Abblix OIDC Server without ever touching a token. A small .NET backend does the OpenID Connect work and holds the session in an HttpOnly cookie. Then you will add a protected Web API and have the SPA call it through the BFF, which attaches the access token on the server side. By the end you will have a three-part solution: the provider from Getting Started, a React SPA with its BFF backend, and a scope-protected API. ### What You'll Build You will reuse `OpenIDProviderApp` from Getting Started and register one new client and one API resource in its configuration, then create two new projects. BffSample - a React SPA with a .NET Backend-for-Frontend: - Serves the React application and acts as its OpenID Connect client - Keeps access and ID tokens in an HttpOnly session cookie, never in the browser - Exposes a small `/bff` API for session, login, and logout - Reverse-proxies the SPA's data calls to a protected API, attaching the access token server-side ApiSample - a protected resource API: - Validates access tokens issued by `OpenIDProviderApp` - Requires the `weather` scope before returning data - Serves a `/weatherforecast` endpoint the SPA reaches only through the BFF Here's the path we'll take: - **Scaffold** the BFF application (a .NET backend plus a Vite React SPA) from stock templates - **Register** the SPA as a client of `OpenIDProviderApp` - **Configure** OpenID Connect in the BFF backend and expose the `/bff` session API - **Authenticate** from React through the BFF, with no token in the browser - **Add** a protected API, register it as a resource, and proxy calls to it through the BFF - **Run** the complete three-project solution and trace the flow end to end ## Before You Start You need the result of the [Getting Started guide](https://www.abblix.com/en/docs/getting-started-guide): a working `OpenIDProviderApp` on `https://localhost:5001`. If you would rather start from a finished copy, clone [Abblix/Oidc.Server.GettingStarted](https://github.com/Abblix/Oidc.Server.GettingStarted) and follow along against those projects. The SPA is built and served with [Vite](https://vitejs.dev/), so you also need [Node.js](https://nodejs.org/) installed. The .NET backend restores the npm packages on its first build. ## Scaffold the BFF Application The BFF is two things in one project: a .NET backend and a React SPA built with Vite, the SPA living in a `ClientApp` subfolder of the backend. We build both from stock templates, no Abblix-specific scaffolding, so every step is reproducible with the standard toolchain. Create the .NET backend and add it to the solution: ```bash dotnet new web -n BffSample dotnet sln add ./BffSample/BffSample.csproj ``` Set the backend port to `5003` to match the client registration you will add next. Open `BffSample/Properties/launchSettings.json`, find the `https` profile, and set `applicationUrl` to `https://localhost:5003`. The template also generates an `http` profile, and `dotnet run` starts the first profile it finds, so delete the `http` profile (or always run with `--launch-profile https`). Otherwise the app comes up on plain HTTP, SpaProxy never starts, and the OIDC redirect fails against the `https://localhost:5003` callback you registered. Create the React application with Vite inside the backend project: ```bash cd BffSample npm create vite@latest ClientApp -- --template react-ts cd ClientApp && npm install cd ../.. ``` Add the three packages the backend needs: ```bash dotnet add BffSample package Microsoft.AspNetCore.Authentication.OpenIdConnect dotnet add BffSample package Microsoft.AspNetCore.SpaProxy dotnet add BffSample package Yarp.ReverseProxy ``` `Microsoft.AspNetCore.Authentication.OpenIdConnect` makes the backend an OIDC client. `Microsoft.AspNetCore.SpaProxy` launches and proxies the Vite dev server in development, so you run one project and still get SPA live reload. `Yarp.ReverseProxy` forwards the SPA's API calls to the protected API later in this guide. ### Wire the SPA into the backend build Tell the backend where the SPA lives and how to launch its dev server. Add these properties to the `` in `BffSample.csproj`: ```xml ClientApp\ npm run dev https://localhost:3000 $(DefaultItemExcludes);$(SpaRoot)node_modules\** ``` Then add build targets so the SPA's packages restore on build and the SPA is built into `wwwroot` on publish: ```xml wwwroot\%(RecursiveDir)%(FileName)%(Extension) PreserveNewest ``` Finally, let the backend start the dev server. In `launchSettings.json`, under the `https` profile's `environmentVariables`, add: ```json "ASPNETCORE_HOSTINGSTARTUPASSEMBLIES": "Microsoft.AspNetCore.SpaProxy" ``` ### Serve the SPA over HTTPS in development OpenID Connect redirects run over TLS, so the Vite dev server has to serve HTTPS with a certificate the browser trusts. The simplest way is to reuse the ASP.NET Core development certificate. This is the local development certificate only, never a production or public key. Replace `ClientApp/vite.config.ts` with a config that exports that certificate the first time and serves HTTPS on port `3000`: ```ts import { defineConfig } from 'vite'; import react from '@vitejs/plugin-react'; import fs from 'fs'; import path from 'path'; import { env } from 'process'; import { execSync } from 'child_process'; const certFolder = (env.APPDATA ?? '') !== '' ? `${env.APPDATA}/ASP.NET/https` : `${env.HOME}/.aspnet/https`; const certPath = path.resolve(certFolder, 'localhost.pem'); const keyPath = path.resolve(certFolder, 'localhost.key'); if (!fs.existsSync(certPath) || !fs.existsSync(keyPath)) { execSync(`dotnet dev-certs https --export-path ${certPath} --format Pem --no-password`); } export default defineConfig({ plugins: [react()], server: { port: 3000, host: true, https: { cert: fs.readFileSync(certPath, 'utf-8'), key: fs.readFileSync(keyPath, 'utf-8'), }, }, }); ``` The `SpaProxyServerUrl` in the csproj and this `port` must agree; both are `3000`. ## Register the SPA as a Client `OpenIDProviderApp` only issues tokens to clients it knows. Open its `appsettings.json` and add a second entry to the `Clients` array of the `Oidc` section, alongside the `test_client` from Getting Started: ```json { "ClientId": "bff_sample", // SHA-512 hash of the test secret "secret" - the provider stores hashes, never plain secrets "ClientSecrets": [ { "Sha512Hash": "vSsar3708Jvp9Szi2NWZZ02Bqp1qRCFpbcTZPdBhnWgs5WtNZKnvCXdhztmeD2cmW192CF5bDufKRpayrW/isg==" } ], "TokenEndpointAuthMethod": "client_secret_post", "AllowedGrantTypes": [ "authorization_code" ], "PkceRequired": true, "RedirectUris": [ "https://localhost:5003/signin-oidc" ], "PostLogoutRedirectUris": [ "https://localhost:5003/signout-callback-oidc" ], // This client will ask for a token addressed to the API, which the userinfo endpoint then // refuses, so its profile claims have to travel in the ID token. Why, under "Name the // resource in the authorization request". "ForceUserClaimsInIdentityToken": true } ``` The client uses the authorization-code flow with [PKCE](https://www.abblix.com/en/docs/pkce-in-openid-connect), the same secure default the MVC client used. The one thing that differs is the port: `5003`, where the BFF backend runs. `signin-oidc` and `signout-callback-oidc` are the default callback paths of Microsoft's OpenID Connect middleware, so you do not have to configure them on the client side. :::warning[IMPORTANT] The configuration carries the hash of the secret, never the secret itself, so the provider side holds nothing an attacker could present. The consumer side is the half that needs care: the BFF has to send the real secret, and in a real deployment it comes from `dotnet user-secrets`, an environment variable, or a secret store, exactly as any other credential would. ::: ## Configure OpenID Connect in the BFF Backend The backend is a plain OpenID Connect client: it authenticates with a cookie and challenges through Abblix OIDC Server. Put the settings in `BffSample/appsettings.json`: ```json { "Authentication": { "DefaultScheme": "Cookies", "DefaultChallengeScheme": "OpenIdConnect" }, "Cookies": { "Cookie": { "Name": "__Host-Bff", "SecurePolicy": "Always", "HttpOnly": true, "SameSite": "Strict" } }, "OpenIdConnect": { "SignInScheme": "Cookies", "SignOutScheme": "Cookies", "SaveTokens": true, "Scope": [ "openid", "profile", "email" ], "MapInboundClaims": false, "ResponseType": "code", "ResponseMode": "form_post", "UsePkce": true, "GetClaimsFromUserInfoEndpoint": false } } ``` `GetClaimsFromUserInfoEndpoint` is `false` here, unlike in Getting Started. The reason is under "Name the resource in the authorization request": this client asks for a token addressed to the API, and the userinfo endpoint refuses a token addressed to somebody else. The claims come from the ID token instead, which is what the flag on the client registration above allows. The `ResponseMode` is `form_post`, not the more common `query`. With `form_post` the provider hands the authorization code back in a small auto-submitting form that POSTs straight to the backend's `signin-oidc` endpoint, so the code never sits in the browser's address bar, its history, or a `Referer` header on the way in. Microsoft's middleware already issues the short-lived, `SameSite=None` correlation cookies that let that cross-site POST land, so nothing else has to change. `SaveTokens` is the setting that makes the pattern work: it tells the middleware to keep the access and ID tokens in the authentication session (the cookie), where the backend can read them later and the browser cannot. Keep the environment-specific values (the authority and the credentials) in `appsettings.Development.json`: ```json { "OpenIdConnect": { "Authority": "https://localhost:5001", "ClientId": "bff_sample", "ClientSecret": "secret" } } ``` Now wire it up in `Program.cs`. Cookie authentication is the primary scheme; OpenID Connect is the scheme used to challenge: ```csharp var builder = WebApplication.CreateBuilder(args); // the template's first line var configuration = builder.Configuration; builder.Services .AddAuthorization() .AddAuthentication(options => configuration.Bind("Authentication", options)) .AddCookie(options => configuration.Bind("Cookies", options)) .AddOpenIdConnect(options => configuration.Bind("OpenIdConnect", options)); builder.Services.AddControllers(); builder.Services.AddHttpForwarder(); ``` Every scheme is bound straight from configuration, so the cookie hardening lives in `appsettings.json` next to the rest, not hard-coded in `Program.cs`. ### A Note on the Session Cookie The cookie this backend issues is the whole security boundary of the pattern, so it carries the [specification's cookie requirements](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-browser-based-apps#name-cookie-security) directly. `Secure` (a MUST) keeps it off plaintext connections. `HttpOnly` (a MUST) keeps JavaScript from reading the cookie, so a script on the page cannot copy the session and replay it elsewhere. `SameSite=Strict` (a SHOULD, and the [CSRF](https://www.abblix.com/en/docs/glossary-overview#csrf) defense here) means the cookie rides only same-site requests. The `__Host-` name prefix binds the cookie to this exact host and forbids a `Domain` attribute or a non-root path, so no sibling subdomain can set or read it. `SameSite=Strict` works cleanly in this guide because the SPA, the BFF, and the provider all share the `localhost` site. In production, match it to your topology: - If the BFF owns its whole site (nothing else shares its registrable domain, the eTLD+1): keep `SameSite=Strict` and you are done. On its own it is a complete CSRF defense, because the cookie never rides a request from another site. - If the BFF shares its site with other apps (sibling subdomains like `app.example.com` and `admin.example.com`): `SameSite=Strict` is not enough, because a sibling is same-site and the cookie rides its requests too. Keep `Strict` and also require a custom request header that the SPA sends and the `/bff` endpoints check (see Next Steps), so a sibling cannot forge calls. - If your provider is on a different site than the BFF (for example `login.example.com` vs `app.example.com`): nothing to change on the session cookie. The OpenID Connect middleware sets its own short-lived, `Secure`, `HttpOnly`, `SameSite=None` correlation cookies so they survive the cross-site callback; they carry no session authority, and your `__Host-Bff` cookie stays `Strict`. The browser holds only this opaque cookie; the tokens it stands in for never leave the server. ## The BFF API: session, login, logout The SPA never speaks OpenID Connect. It speaks to its own backend over three small endpoints. Add a controller at `BffSample/Controllers/BffController.cs`: ```csharp [ApiController] [Route("[controller]")] public class BffController : Controller { public const string CorsPolicyName = "Bff"; [HttpGet("check_session")] [EnableCors(CorsPolicyName)] public ActionResult> CheckSession() { // 401 tells the SPA to start a login; otherwise return the user's claims if (User.Identity?.IsAuthenticated != true) return Unauthorized(); return User.Claims.ToDictionary(claim => claim.Type, claim => claim.Value); } [HttpGet("login")] public ActionResult Login() { // Challenge starts the authorization-code flow and returns to the SPA afterward return Challenge(new AuthenticationProperties { RedirectUri = Url.Content("~/") }); } // GET so the browser can navigate here: RP-initiated logout needs a top-level redirect [HttpGet("logout")] public IActionResult Logout() => SignOut( new AuthenticationProperties { RedirectUri = "/" }, CookieAuthenticationDefaults.AuthenticationScheme, OpenIdConnectDefaults.AuthenticationScheme); } ``` `check_session` is the SPA's way of asking "am I logged in, and who am I?". A `401` is the signal to begin a login rather than an error to display. `login` issues a `Challenge`, which the OpenID Connect middleware turns into a redirect to `OpenIDProviderApp`. `logout` signs out both schemes: it clears the BFF session cookie and initiates an [RP-initiated logout](https://www.abblix.com/en/docs/glossary-overview#rp-initiated-logout) at the provider, so the user is signed out of the [identity provider](https://www.abblix.com/en/docs/glossary-overview#identity-provider) too, not only this application. It is a `GET` because the browser has to navigate to it and follow the redirect to the provider's end-session endpoint and back; a `fetch` cannot drive that redirect. Notice what is absent: no token handling, no redirect URLs, no [PKCE](https://www.abblix.com/en/docs/pkce-in-openid-connect) code. The middleware owns all of that. ## Configure CORS for the SPA In production the backend serves the built SPA from its own origin, so the SPA and the `/bff` API share an origin and no [CORS](https://www.abblix.com/en/docs/glossary-overview#cors) is involved. In development the Vite dev server runs on its own origin (`https://localhost:3000`) while the API stays on `5003`, so the browser needs permission to send the session cookie across origins. The only cross-origin calls are the credentialed `GET`s (`check_session` and the proxied data calls); `login` and `logout` are top-level navigations, which CORS does not govern. Allow exactly that origin, in `appsettings.Development.json`: ```json { "CorsSettings": { "AllowedOrigins": [ "https://localhost:3000" ] } } ``` Register the policy in `Program.cs`: ```csharp builder.Services.AddCors( options => options.AddPolicy( BffController.CorsPolicyName, policyBuilder => { var allowedOrigins = configuration.GetSection("CorsSettings:AllowedOrigins").Get(); if (allowedOrigins is { Length: > 0 }) policyBuilder.WithOrigins(allowedOrigins); policyBuilder .WithMethods(HttpMethods.Get) .AllowCredentials(); })); ``` `AllowCredentials` is what lets the cross-origin `fetch` carry the session cookie. Without it the SPA would look permanently logged out in development. Do not mistake this CORS policy for a [CSRF](https://www.abblix.com/en/docs/glossary-overview#csrf) defense. A cross-site `GET` is CORS-safelisted: the browser sends it without a preflight and only withholds the response, so CORS stops an attacker from reading data, not from triggering a request. The CSRF defense is `SameSite=Strict` on the session cookie, which keeps the cookie off cross-site requests in the first place. ## Authenticate from the React SPA The React side needs one piece of shared machinery: a context that knows how to talk to the `/bff` API and how to react to a `401`. Create `BffSample/ClientApp/src/components/Bff.tsx`: ```tsx export const BffProvider: FC = ({ baseUrl, children }) => { const [user, setUser] = useState(null); const normalizedBaseUrl = baseUrl.endsWith('/') ? baseUrl.slice(0, -1) : baseUrl; // every call includes credentials so the session cookie travels with it const fetchBff = useCallback( async (endpoint: string, options: RequestInit = {}): Promise => fetch(`${normalizedBaseUrl}/${endpoint}`, { credentials: 'include', ...options }), [normalizedBaseUrl] ); const login = useCallback( () => window.location.replace(`${normalizedBaseUrl}/login`), [normalizedBaseUrl] ); const checkSession = useCallback(async (): Promise => { const response = await fetchBff('check_session'); if (response.ok) setUser(await response.json()); // logged in: keep the claims else if (response.status === 401) login(); // not logged in: start a login }, [fetchBff, login]); // full RP-initiated logout: navigate so the browser can follow the provider's end-session redirect const logout = useCallback( () => window.location.replace(`${normalizedBaseUrl}/logout`), [normalizedBaseUrl] ); useEffect(() => { checkSession(); }, [checkSession]); return ( {children} ); }; export const useBff = (): BffContextProps => useContext(BffContext); ``` The whole login decision lives in `checkSession`: call `/bff/check_session` on load, render the claims if it succeeds, and redirect into the login if it answers `401`. The `fetchBff` helper always passes `credentials: 'include'` so the session cookie rides along on every request. A component then reads the claims through the `useBff` hook, in `src/components/UserClaims.tsx`: ```tsx export const UserClaims: React.FC = () => { const { user } = useBff(); if (!user) return

Checking your session...

; return (
{Object.entries(user).map(([claim, value]) => (
{claim}
{String(value)}
 ))}
); }; ``` Wrap the app in the provider, pointing it at the backend's `/bff` base, in `src/App.tsx`: ```tsx const App: React.FC = () => ( ); ``` Finally, in `Program.cs`, build the request pipeline. The fallback that serves the SPA is guarded with `RequireAuthorization`: ```csharp var app = builder.Build(); if (!app.Environment.IsDevelopment()) app.UseHsts(); app.UseHttpsRedirection(); app.UseRouting(); app.UseStaticFiles(); app.UseCors(BffController.CorsPolicyName); app.UseAuthentication(); app.UseAuthorization(); app.MapControllers(); app.MapFallbackToFile("index.html").RequireAuthorization(); app.Run(); ``` How that guard behaves depends on who serves the SPA. In production the backend serves `index.html` from `wwwroot`, so `RequireAuthorization` challenges an unauthenticated first visit before the SPA ever loads. In development the Vite dev server serves the SPA (SpaProxy sends the browser there), so the guard does not fire on first load; instead the SPA runs, calls `check_session`, gets a `401`, and starts the login from the client. Both paths end at the same session cookie. ## Run and See Your Claims Start the provider and the BFF in separate terminals from the solution root: ```bash dotnet run --project OpenIDProviderApp dotnet run --project BffSample ``` The BFF launches the Vite dev server for you. Open `https://localhost:5003`, and the flow unfolds: the SPA loads, calls `/bff/check_session`, gets a `401`, and sends you to `OpenIDProviderApp` to log in. Use the seeded credentials from Getting Started (`john.doe@example.com` / `Jd!2024$3cur3`). You land back on the SPA, which now shows your claims: `sub`, `name`, `email`, and the session id. At no point did a token reach the browser. :::warning[IMPORTANT] If the browser refuses the connection, trust the ASP.NET Core development certificate with `dotnet dev-certs https --trust` and restart the browser. The Vite dev server serves HTTPS from a copy of that same certificate; if you regenerated your dev certificate at some point, delete the exported `localhost.pem` and `localhost.key` under `%APPDATA%\ASP.NET\https` (or `~/.aspnet/https`) so the dev server exports a fresh copy. ::: ## Add a Protected API Showing claims proves the login works. The reason to run a BFF, though, is to call protected APIs without exposing the token to the browser. Add an API and have the SPA reach it through the BFF. ### Create ApiSample Create a Web API project and set its port to `5004`: ```bash dotnet new webapi -n ApiSample dotnet sln add ./ApiSample/ApiSample.csproj ``` Add the JWT bearer package so the API can validate access tokens: ```bash dotnet add ApiSample package Microsoft.AspNetCore.Authentication.JwtBearer ``` The API validates tokens issued by `OpenIDProviderApp` and requires the `weather` scope before serving data. Configure token validation in `ApiSample/appsettings.Development.json`: ```json { "JwtBearerAuthentication": { "Authority": "https://localhost:5001", "MapInboundClaims": false, "TokenValidationParameters": { "ValidTypes": [ "at+jwt" ], "ValidAudience": "https://localhost:5004", "ValidIssuer": "https://localhost:5001" } } } ``` `ValidTypes` pins the token to the [RFC 9068](https://datatracker.ietf.org/doc/html/rfc9068) access-token type (`at+jwt`), so an [ID token](https://www.abblix.com/en/docs/glossary-overview#id-token-identity-token) cannot be replayed against the API. The audience is the API's own URL, which is how the provider marks a token as meant for this resource. Then wire authentication and a scope policy in `Program.cs` (the `dotnet new webapi` template already provides `builder` and `app`; add `var configuration = builder.Configuration;` near the top if it is not there): ```csharp builder.Services .AddAuthentication() .AddJwtBearer(options => configuration.Bind("JwtBearerAuthentication", options)); const string policyName = "WeatherApi"; builder.Services.AddAuthorization(options => options.AddPolicy(policyName, policy => { policy.RequireAuthenticatedUser(); policy.RequireAssertion(context => { var scopeValue = context.User.FindFirstValue("scope"); if (string.IsNullOrEmpty(scopeValue)) return false; var scope = scopeValue.Split(' ', StringSplitOptions.RemoveEmptyEntries); return scope.Contains("weather", StringComparer.Ordinal); }); })); ``` Protect the endpoint with the policy: ```csharp app.MapGet("/weatherforecast", () => /* return forecasts */) .RequireAuthorization(policyName); ``` ### Register the API as a Resource The provider must know the API exists so it can issue tokens scoped for it. In `OpenIDProviderApp`'s `Program.cs`, add a `ResourceDefinition` inside `AddOidcServices`: ```csharp options.Resources = [ new ResourceDefinition( new Uri("https://localhost:5004", UriKind.Absolute), new ScopeDefinition("weather")), ]; ``` This ties the `weather` scope to the resource `https://localhost:5004`. A scope that belongs to a resource is granted only to a request that names that resource, so asking for `weather` is half of the job; the other half is the `resource` parameter, two sections below. The token then carries `https://localhost:5004` as its audience, which is what the API checks. ### Ask for the weather scope in the BFF The BFF has to request the scope for the token to carry it. Add `weather` to the `Scope` array in `BffSample/appsettings.json`: ```json "Scope": [ "openid", "profile", "email", "weather" ], ``` and point the BFF at the resource it will proxy to, in `appsettings.Development.json`: ```json "OpenIdConnect": { "Resource": "https://localhost:5004", "Authority": "https://localhost:5001", "ClientId": "bff_sample", "ClientSecret": "secret" } ``` ### Name the resource in the authorization request Asking for the scope is not enough. The provider grants a resource scope only to a request that says which resource it is for, which RFC 8707 does with the `resource` parameter. Microsoft's handler has no property for it, so set it on the outgoing message. Read the resource once, near the top of `BffSample/Program.cs`, where both the authorization request and the forwarder below can see it: ```csharp const string ResourceKey = "OpenIdConnect:Resource"; var destinationPrefix = configuration.GetValue(ResourceKey) ?? throw new InvalidOperationException($"The value {ResourceKey} must be set"); ``` Then replace the `AddOpenIdConnect` line: ```csharp .AddOpenIdConnect(options => { configuration.Bind("OpenIdConnect", options); options.Events.OnRedirectToIdentityProvider = context => { context.ProtocolMessage.SetParameter("resource", destinationPrefix); return Task.CompletedTask; }; }); ``` Two things follow from naming a resource, and both are why this client differs from the one in Getting Started. The access token is minted for the API rather than for the provider, so the userinfo endpoint refuses it - correctly, since a resource server must reject a token addressed elsewhere. That is why `GetClaimsFromUserInfoEndpoint` is off above, and why the `bff_sample` registration carries `ForceUserClaimsInIdentityToken`: the ID token includes the profile claims only when the registration allows it. ## Proxy API Calls Through the BFF Now the load-bearing part. The SPA calls `/bff/weatherforecast` on its own origin; the BFF forwards that to the API, and attaches the access token from the session as it goes. The browser is never given the token. Add the forwarder to the end of `BffSample`'s `Program.cs`, before `app.Run()`: `destinationPrefix` is the value read above, the same address the authorization request names as its resource: ```csharp app.MapForwarder( "/bff/{**catch-all}", destinationPrefix, builderContext => { // strip the /bff prefix so /bff/weatherforecast reaches /weatherforecast builderContext.AddPathRemovePrefix("/bff"); builderContext.AddRequestTransform(async transformContext => { // strip the session cookie: the resource server authenticates on the bearer token // alone and must never see the BFF's session (draft section 6.1.1, step K) transformContext.ProxyRequest.Headers.Remove("Cookie"); // read the access token from the session and attach it server-side var accessToken = await transformContext.HttpContext .GetTokenAsync(OpenIdConnectParameterNames.AccessToken); transformContext.ProxyRequest.Headers.Authorization = new AuthenticationHeaderValue("Bearer", accessToken); }); }) .RequireAuthorization(); ``` `GetTokenAsync` reads the access token that `SaveTokens` stashed in the cookie session at login. The transform first removes the session cookie, because the resource server has no business seeing it and authenticates on the bearer token alone, then puts the token in the `Authorization` header of the outbound call. `RequireAuthorization` means an unauthenticated request never even reaches the API. The token exists only on the two hops the browser cannot see: cookie to backend, backend to API. ## Call the API from the SPA With the proxy in place, the SPA fetches the forecast the same way it checks the session, through `fetchBff`, in `src/components/WeatherForecast.tsx`: ```tsx export const WeatherForecast: React.FC = () => { const { fetchBff } = useBff(); const [forecasts, setForecasts] = useState([]); useEffect(() => { fetchBff('weatherforecast') .then(response => response.json()) .then(setForecasts); }, [fetchBff]); return ( {forecasts.map((f, i) => ( ))}
DateTemp. (C)Summary
{f.date}{f.temperatureC}{f.summary}
); }; ``` Add it next to `UserClaims` inside the provider in `App.tsx`, and the SPA now shows live data from a protected API it reached without ever holding a token. ### When the access token expires This sample requests `openid profile email weather` and no `offline_access`, so the provider issues no [refresh token](https://www.abblix.com/en/docs/glossary-overview#refresh-token) and the middleware does not refresh on its own. `GetTokenAsync` returns the access token saved at login; once it expires, the `__Host-Bff` cookie is still valid (the user looks logged in) but every proxied call starts coming back `401` from the API. For anything past a demo, request `offline_access`, keep the refresh token in the session (it stays server-side like the others), and refresh before the access token expires, or treat a proxied `401` as the signal to re-challenge. ## Run the Complete Solution Three projects make up the finished picture. Start each in its own terminal from the solution root: ```bash dotnet run --project OpenIDProviderApp # provider, https://localhost:5001 dotnet run --project ApiSample # protected API, https://localhost:5004 dotnet run --project BffSample # BFF + SPA, https://localhost:5003 ``` Open `https://localhost:5003`, sign in, and watch the whole chain: the SPA authenticates through the BFF, the provider issues a token scoped for the weather API, the BFF stores it in the cookie, and every forecast request is proxied to `ApiSample` with that token attached server-side. Open your browser's developer tools and look: the token is in none of them. ## Troubleshooting Common Issues ### The SPA is stuck on "Checking your session" **Symptom:** The page loads but never shows claims or redirects to login. **Cause:** The cross-origin `check_session` call is failing, usually a [CORS](https://www.abblix.com/en/docs/glossary-overview#cors) or cookie problem in development. **Fix:** Confirm that `CorsSettings:AllowedOrigins` lists the exact Vite origin (`https://localhost:3000`), that the CORS policy calls `AllowCredentials`, and that `fetchBff` sends `credentials: 'include'`. If the browser console shows `Failed to fetch` with no CORS message, the browser may distrust the backend's development certificate for cross-origin requests until you open `https://localhost:5003` once in a top-level tab; do that, accept the certificate, then reload the SPA. ### Redirect URI mismatch after login **Symptom:** The provider shows "The redirect_uri in the request does not match a registered redirect URI". **Cause:** The `bff_sample` client registration does not match the BFF's actual port or callback path. **Fix:** Verify the client's `RedirectUris` is exactly `https://localhost:5003/signin-oidc`. A port of `5002` instead of `5003`, or a different callback path, will fail. ### The weather call returns 401 or 403 **Symptom:** Login works and claims appear, but `/bff/weatherforecast` fails. **Cause:** The access token lacks the `weather` scope, or the API cannot validate it. **Fix:** Check four links in the chain: `weather` is in the BFF's `Scope` array, the authorization request names the resource with the `resource` parameter, the provider registers the `weather` scope against the `https://localhost:5004` resource, and the API's `ValidAudience` and `ValidIssuer` match the resource URL and the provider URL. A missing `resource` parameter fails earlier and louder: the login itself comes back with `invalid_scope`. ### The forecast is empty but no error appears **Symptom:** The table renders with no rows. **Cause:** `ApiSample` is not running, so the proxied call has nowhere to go. **Fix:** Start `ApiSample` on `https://localhost:5004`, and confirm the BFF's `OpenIdConnect:Resource` points at that same URL. ### Certificate trust warnings in the browser **Symptom:** "Your connection is not private", on `5003` or `3000`. **Fix:** Run `dotnet dev-certs https --trust` and restart the browser. If only the Vite origin (`3000`) fails, delete the exported `localhost.pem` and `localhost.key` under `%APPDATA%\ASP.NET\https` so the dev server re-exports the current certificate. For Chrome, you can also click the error page and type `thisisunsafe` in development only. ### Access the Complete Solution on GitHub The finished `BffSample` and `ApiSample`, together with the `OpenIDProviderApp` they build on, live in [Abblix/Oidc.Server.GettingStarted](https://github.com/Abblix/Oidc.Server.GettingStarted). Clone it to compare against a working copy, or to run the whole flow before wiring your own. ## What the BFF pattern does not solve Keeping tokens off the browser closes the attack this guide opened with: a script on the page cannot read or exfiltrate a token, and there is no refresh token in the browser to steal. That is a real and large reduction in blast radius, and it is what the [IETF draft credits the pattern with](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-browser-based-apps#name-backend-for-frontend-bff). It does not make an XSS-compromised page safe. A script running on the page can still call `/bff/...` with the session cookie, and the BFF will faithfully attach the token and proxy the request. The attacker never sees the token, but rides the authenticated session as a [confused deputy](https://www.abblix.com/en/docs/glossary-overview#confused-deputy) for as long as the page is open. The BFF converts token theft into in-session request forgery: narrower, bounded to the endpoints the BFF proxies, but not nothing. Preventing script execution in the first place (a strict [Content-Security-Policy](https://www.abblix.com/en/docs/glossary-overview#csp), dependency hygiene, output encoding) stays mandatory. [Modern Authentication on .NET: BFF and SPA](https://www.abblix.com/en/docs/net-authentication-openid-connect-bff-spa) works through this threat model in full. ## Conclusion You have taken the hardest client to secure, a single-page application, and given it a login that keeps tokens off the browser. The React code never sees an access token, an ID token, or a refresh token. It sees a session cookie it cannot read and a small `/bff` API on its own origin. The backend does the OpenID Connect work, holds the tokens, and proxies data calls with the access token attached on the server, where no browser script can read or exfiltrate it. The same three-part shape (SPA, its BFF, and a scope-protected API behind it) is the one you carry into production; the architecture does not change. What you add before shipping is operational: real secret storage for the client credential, a deliberate cookie lifetime, and, because the tokens live inside the encrypted cookie, a persisted and shared ASP.NET Core Data Protection key ring so the cookie survives a restart and decrypts across every instance. ### Next Steps to Consider - Give the session cookie a deliberate `ExpireTimeSpan` and sliding expiration (the sample already sets `Secure`, `HttpOnly`, `SameSite=Strict`, and the `__Host-` prefix), and review it against the [Production Hardening Checklist](https://www.abblix.com/en/docs/production-hardening-checklist). - Persist the Data Protection key ring to shared storage so the token-bearing cookie survives restarts and decrypts across every instance. - If the BFF shares a registrable domain with other apps, add a required custom request header (for example `X-Requested-With`) that the SPA sends and the `/bff` endpoints check, so a same-site sibling cannot forge state-changing calls, and restrict the proxied HTTP methods per endpoint rather than forwarding every verb. - Add a second protected API and a second scope, and watch the same proxy pattern carry the right token to each. - Read [Modern Authentication on .NET: OpenID Connect, BFF, SPA](https://www.abblix.com/en/docs/net-authentication-openid-connect-bff-spa) for the threat-model reasoning behind every choice this guide made. --- Source: https://www.abblix.com/en/docs/aspnet-identity-integration.md # Integrating ASP.NET Core Identity with Abblix OIDC Server Abblix OIDC Server ships no user store: who your users are, how their passwords are verified, and where their profile data lives are the host's to decide. ASP.NET Core Identity is the stock answer to those questions, with password hashing, lockout, security stamps, and two-factor plumbing that nobody should rewrite. This guide wires the two together. The division of labor is the point to hold onto: Identity owns users and credentials; the library owns the protocol and the OIDC session. They meet at just two seams, and both are small. - `IUserInfoProvider` turns a subject into claims. The library ships no default and registers none, so a host must supply one; miss it and the app fails fast rather than silently, at startup in Development (service-provider validation) or on the first [ID-token](https://www.abblix.com/en/docs/glossary-overview#id-token-identity-token) or userinfo build in Production. With Identity, this is an adapter over `UserManager`. - The login flow signs a verified user into the library's session. Identity verifies the password; the library's `IAuthSessionService` issues the session cookie. Everything below extends the Getting Started sample (an MVC provider with a demo login page), and the finished result runs as the `AspNetIdentitySample` project in the [Getting Started repository](https://github.com/Abblix/Oidc.Server.GettingStarted): the same wiring drops into any host. ## One rule first: Identity checks the password, the library signs the session The tempting shortcut is `SignInManager.PasswordSignInAsync`, Identity's one-call login. Do not use it here. With this wiring it throws at once: it signs into `Identity.Application`, a cookie scheme the core registration deliberately never registers. And registering Identity's cookies instead does not help: that principal is built by Identity's claims factory and carries none of the OIDC session claims the library's adapter requires (subject, session id, authentication time). `AuthenticationSchemeAdapter.AuthenticateAsync` treats such a cookie as no session and returns null by design, so the library bounces the request back to the login page: a silent login loop, not a crash you can catch. Two cookie regimes fighting over one login is a debugging session you do not need. The clean split: verify the password with `CheckPasswordSignInAsync` (it checks the hash, counts failures, and enforces lockout without signing anything in), then build an `AuthSession` and hand it to `IAuthSessionService.SignInAsync`, just as the sample already does. One cookie, registered by the host and driven by the library's session service, carrying the claim shape the library expects. `CheckPasswordSignInAsync` also runs Identity's pre-sign-in check first: set `options.SignIn.RequireConfirmedEmail = true` (or `RequireConfirmedAccount`) and it returns `NotAllowed` for an unconfirmed account before the password is even tested. The sample leaves this off while sign-up creates accounts with `EmailConfirmed = false`, so nothing gates unverified emails and `email_verified` is honestly false in the tokens; turn it on once the confirmation mail is in place, or the provider keeps issuing tokens for accounts whose email was never proven. The generic `!result.Succeeded` branch also swallows `NotAllowed`, so an unconfirmed user just sees "Invalid email or password."; branch on `result.IsNotAllowed` to tell them to confirm instead. ## Wire Identity into the container Use the core registration, not the full `AddIdentity`: the core variant brings the user store, password hashing, and lockout without registering Identity's cookie schemes, which this integration deliberately does not use. Two packages carry everything below: `Microsoft.AspNetCore.Identity.EntityFrameworkCore` (Identity plus its EF Core stores) and `Microsoft.EntityFrameworkCore.Sqlite` (or the database provider of your choice). The connection string the `DbContext` reads lives in appsettings.json: `"ConnectionStrings": { "Users": "Data Source=users.db" }`. In `Program.cs` that is `AddDbContext` for your Identity `DbContext` pointed at that connection string, then `AddIdentityCore` followed by `AddEntityFrameworkStores` and `AddSignInManager`. The options delegate of `AddIdentityCore` is where the sample caps `Lockout.MaxFailedAccessAttempts` and sets `User.RequireUniqueEmail`; `AddSignInManager` is what puts `SignInManager` in the container, and without it the credential check below has nothing to call. Last, register your `IUserInfoProvider` implementation as scoped: the library ships none, so this registration is mandatory rather than optional. ```csharp // Program.cs builder.Services .AddIdentityCore(options => { options.Lockout.MaxFailedAccessAttempts = 5; options.User.RequireUniqueEmail = true; }) .AddEntityFrameworkStores() .AddSignInManager(); // the library ships no IUserInfoProvider: this registration is mandatory, not optional builder.Services.AddScoped(); ``` The `DbContext` is standard Identity fare (`AppDbContext : IdentityDbContext`), created and migrated the way [Microsoft's Identity documentation](https://learn.microsoft.com/aspnet/core/security/authentication/identity) describes; nothing about it is Abblix-specific. Keep the sample's existing `AddAuthentication().AddCookie()`: that host-registered cookie carries the library's session, and it stays. No `app.UseAuthentication()` is needed for this flow: the library's session adapter authenticates its cookie scheme explicitly. If you started from the Getting Started sample, delete its `TestUserStorage` registration: the adapter below takes over the claims duty, and `SignInManager` takes over the credential check. One practical step before anything can log in: the Identity store starts empty, so the sample creates its schema at startup, in a scope opened between `builder.Build()` and `app.Run()`, by calling `EnsureCreatedAsync` on the `DbContext`. A real deployment replaces that with EF migrations. The same startup block goes on to create a signing key and the client registrations in the OIDC store, for the same reason: both live in the database from here on, and the sample has to put the first ones there. There is no seeded user. A fresh run starts with an empty Identity store, and the first account is created the way every later one is, through sign-up. The handler builds an `IdentityUser` whose `UserName` and `Email` are both the submitted address and whose `EmailConfirmed` is false, hands it with the password to `UserManager.CreateAsync`, and on failure returns Identity's own error descriptions to the screen, so "password too short" or "email already taken" is what the user reads. Then it writes the display name into Identity's claim store with `AddClaimAsync` under the OIDC claim name `name`. `CreateAsync` is where Identity earns its place: it enforces the password policy and the unique-email rule, and persists only a salted [PBKDF2](https://www.abblix.com/en/docs/glossary-overview#pbkdf2) hash. That hash is only as strong as its work factor. Identity's default hasher on .NET 10 is PBKDF2-HMAC-SHA512, so check `PasswordHasherOptions.IterationCount` against the current [OWASP PBKDF2 guidance](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#pbkdf2) and raise it if needed, or swap in a memory-hard `IPasswordHasher`. The sample binds `IterationCount` from `appsettings.json`, so it moves without a recompile. `EmailConfirmed` stays `false`, which is honest - nobody proved control of that mailbox - and the sample still lets the account sign in, flagged with a `#warning` naming the step a real deployment adds: email a confirmation link and trust the address only once it comes back. The `AddClaim` call is not decoration: `IdentityUser` has no name property, so `name`, `given_name`, `picture`, and the profile claims Identity has no property for live in Identity's claim store, and writing one at sign-up is the exact path the adapter reads them through. ## The claims adapter `IUserInfoProvider` has one method: given the authenticated session and the claim names the request is entitled to, return them as JSON. The claim names arrive already resolved from scopes (`email` pulls `email` and `email_verified`, `profile` pulls the fourteen OIDC profile claims, `phone` pulls the two phone claims), so the adapter only maps names to Identity data. The single method, `GetUserInfoAsync`, receives the `AuthSession` and the requested claim names and returns a `JsonObject` of what it can answer. It resolves the user through `UserManager.FindByIdAsync` on `AuthSession.Subject`, which is the Identity user id set at login below, and returns null when there is no such user. From the `IdentityUser` properties it answers `preferred_username` from `UserName`, `phone_number` from `PhoneNumber`, and `phone_number_verified` from `PhoneNumberConfirmed`, the last only where a phone number is actually stored. For `email` and `email_verified` it prefers the values the session carries, falling back to `Email` and `EmailConfirmed` in the store, because the session snapshot is what was true at login. Everything else the request asked for it looks up in Identity's claim store through `GetClaimsAsync`, matching on the claim name and leaving the property-derived values in place where both could answer. Claims with no value are simply absent from the object rather than present and null. Two implementation details are worth copying. The requested names arrive as a deferred sequence, so materialize them once instead of enumerating repeatedly. And the names are compared ordinally, which the cautions below turn into a storage rule. Three contract points, all library-enforced: - Do not bother emitting `sub`. The library overwrites it after the call with the session's subject, run through the pairwise-identifier converter when the client asks for pairwise subjects; a provider-supplied `sub` never survives. - Returning `null` fails the whole response: userinfo answers `invalid_token`, and no ID token is issued. That is the correct behavior for a deleted user with a live session. - If a request marks a claim as essential and the adapter does not return it, the library rejects the whole claim set. Populate what your users actually have; the standard scopes ask only for what they define. Two cautions about the claim store. Names match by exact ordinal comparison, so store claims under the lowercase OIDC names (`name`, not `Name` and not a `ClaimTypes` URI), or the adapter never finds them. And treat the store as client-facing here: the `claims` request parameter is not gated by scopes, so a client can ask for any claim by name, and this loop returns any claim the client names. Only store client-safe values under OIDC claim names: never authorization data or internal flags. Custom scopes work the same way: declare them with their claim names in `OidcOptions.Scopes` (a `ScopeDefinition` per scope), and the names arrive in `requestedClaims` like the standard ones. ## The login endpoint The login flow stays what it was; only the credential check changes hands. The authorize endpoint redirects an unauthenticated user to `OidcOptions.LoginUri` with the pending request in the `request_uri` query parameter. The sample serves a React screen there, which posts JSON to its own auth API; that handler verifies the credentials, signs the session in, and returns the URL that resumes the authorize request. The handler finds the user by email through `UserManager`, and where there is one, calls `SignInManager.CheckPasswordSignInAsync` with `lockoutOnFailure` set: that verifies the hash and enforces lockout while issuing no cookie, so the session stays the library's. A missing user and a wrong password take the same failure path and the same message. On success it signs the session in and returns the URL that resumes the authorize request, so the browser can follow it. Besides `SignInManager` and `UserManager`, the handler needs the library's `IAuthSessionService` and `ISessionIdGenerator`, a `TimeProvider` for the authentication time, and `OidcRouteOptions` to build the resume URL. The session itself is built in the tail both login and sign-up share: ```csharp var authSession = new AuthSession( user.Id, // the subject the claims adapter resolves later sessionIdGenerator.GenerateSessionId(), clock.GetUtcNow(), CookieAuthenticationDefaults.AuthenticationScheme) { Email = user.Email, EmailVerified = user.EmailConfirmed, AuthenticationMethodReferences = ["pwd"], // lands in the amr claim ... }; ``` The subject is `user.Id`, Identity's stable key: it survives email and username changes, which is exactly what an OIDC `sub` must do. Setting `Email` and `EmailVerified` on the session snapshots them at login time; the adapter above prefers the snapshot over the store, per the provider contract. An MVC host writes the same handler as a controller action taking `[FromForm]` values and returning `Redirect(...)`; a Minimal API host returns the URL and lets the caller follow it. What must not change either way is the order: verify, then build the session, then resume. Three details deserve a sentence each. Login [CSRF](https://www.abblix.com/en/docs/glossary-overview#csrf), where a hostile page silently signs your browser into an attacker's account, is a real attack, and a JSON API cannot use the hidden form field an MVC view would emit: the sample configures antiforgery with a header name, issues the request token in a script-readable cookie when it serves the screen, and the SPA echoes it back. The lockout state hides behind the same generic "Invalid email or password." message, so a lockout does not confirm an account exists; if your threat model allows friendlier UX, branch on `result.IsLockedOut` and tell the user when to retry. And a missing email returns instantly while an existing one pays the full hash cost, so response timing can still leak whether an account exists: if enumeration resistance matters, burn an equivalent hash verification on the missing-user path too. Two-factor slots into this handler, not into the library, and not through the result object: `CheckPasswordSignInAsync` reports only success, failure, and lockout; `RequiresTwoFactor` belongs to `PasswordSignInAsync` and never fires here. After the password succeeds, ask Identity directly: when `await userManager.GetTwoFactorEnabledAsync(user)` is true, run and verify the second factor before constructing the `AuthSession`. Building the session after the password alone would bypass the second factor. Then set `AuthenticationMethodReferences` from the factors actually verified in this request (for example `["pwd", "otp"]`): relying parties may use `amr` for [step-up](https://www.abblix.com/en/docs/glossary-overview#step-up-authentication) decisions, so it must reflect what happened, not a fixed literal. ## Making a password change end the session Identity wires its security-stamp revalidation onto its own cookie schemes, which this integration deliberately skips, so nothing does it for you: out of the box a password change or `UpdateSecurityStampAsync` leaves existing OIDC sessions alive until the cookie expires, and a bare `AddCookie()` defaults to a 14-day sliding window. The sample closes that gap by hand, and it takes both halves: a snapshot nobody compares is dead weight, and a comparison against a claim that was never written rejects every session. Two dials close it. First, bound the cookie lifetime deliberately (`ExpireTimeSpan`, `SlidingExpiration`). Second, if changed-password-must-end-sessions is a requirement, snapshot the stamp into the session at login and check it on every request. The adapter round-trips `AuthSession.AdditionalClaims` through the cookie, so the snapshot travels with the principal: in the shared sign-in tail, put the value of `UserManager.GetSecurityStampAsync` into `AdditionalClaims` under a name of your own, `security_stamp` in the sample. The comparison side belongs to the cookie options in `Program.cs`, in the `OnValidatePrincipal` event. It resolves `UserManager` from the request services, finds the user by the principal's `sub` claim, and compares the current security stamp with the one the principal carries. If the user is gone or the stamps differ, it calls `RejectPrincipal` and signs the scheme out. Set `ExpireTimeSpan` in the same options block, since a bare `AddCookie()` leaves the 14-day default in place. A rejected principal sends the user back through login on the next request. This trades cost for immediacy: unlike Identity's `SecurityStampValidator`, which revalidates on a 30-minute `ValidationInterval` to avoid a store hit per authentication, this checks the store every time the session cookie is authenticated. For an OIDC provider that is the authorize and end-session paths rather than every page load - userinfo validates an access token and never touches the cookie - so the volume is usually modest, but if it is not, cache the stamp with a short interval or accept the validator's window instead of instant revocation. The `AspNetIdentitySample` ships this dial on; drop it if your threat model does not need it. ## Logout needs no Identity glue The lifecycle closes on the library's side alone. The end-session endpoint calls `IAuthSessionService.SignOutAsync` itself, and the client ids the authorize endpoint accumulates into `AuthSession.AffectedClientIds` drive back-channel and [front-channel logout](https://www.abblix.com/en/docs/glossary-overview#front-channel-logout) notifications to every client the session touched. The one rule holds in reverse: do not call `SignInManager.SignOutAsync`, there is nothing for it to sign out of. ## Verify the integration - Create an account first, and do it from a client rather than by opening the provider directly: the sign-up screen resumes the authorization request it was pulled out of, so reaching it any other way leaves nothing to resume. Start `TestClientApp` and open it: its home page requires authentication, so it sends you to the provider, where Create one on the sign-in screen makes the account. That is also the first thing this integration proves, since the account is created through `UserManager` rather than seeded. - Run the provider and complete an [authorization-code flow](https://www.abblix.com/en/docs/glossary-overview#authorization-code-flow) with `openid email` scope: the ID token must carry `sub` equal to the Identity user id, and userinfo must return the `email` and `email_verified` snapshotted at login (identical to the store values at that moment). With the `profile` scope, the `name` claim written at sign-up must arrive too: that proves the claim-store path in the adapter, not just the property mapping. - Change the user's email in Identity, sign in again, and confirm the claims follow. - Lock the account with repeated wrong passwords: login must refuse before any OIDC redirect happens, proving lockout runs in the credential check. - Delete the user while a session cookie is still alive and call userinfo: it must answer `invalid_token`, proving the adapter's null path. ## Where this sits in the bigger picture This guide covers users and credentials. The clients your users sign in to have their own store ([A Durable Client Store](https://www.abblix.com/en/docs/durable-client-store)), the go-live defaults are in the [Production Hardening Checklist](https://www.abblix.com/en/docs/production-hardening-checklist), and the login flow this page extends is walked end to end in the [Getting Started guide](https://www.abblix.com/en/docs/getting-started-guide). Out of scope here, each its own integration: external and social logins (the `GetExternalLoginInfoAsync` path, which meets the same `IAuthSessionService.SignInAsync` seam but not through `CheckPasswordSignInAsync`), password reset and change flows, and claims transformation; they attach to the same session service, but are not shown. A first-party ASP.NET Identity package remains on the [roadmap](https://www.abblix.com/en/docs/product-roadmap); until it ships, this guide is the integration path. --- Source: https://www.abblix.com/en/docs/shared-signals-guide.md # A Working Shared Signals Transmitter and Receiver in ASP.NET Core Two applications, one event. The first revokes a user's session and announces it; the second hears the announcement and closes its own. Between them travels a signed [Security Event Token](https://www.abblix.com/en/docs/glossary-overview#set) over an HTTPS push, and by the end of this guide you will have run it. The [Shared Signals Framework article](https://www.abblix.com/en/docs/shared-signals-framework) is the map: what SETs, SSF, CAEP and RISC are, and why they exist as separate layers. This one is the walk. Everything below runs as the `SharedSignalsSample` project in the [Getting Started repository](https://github.com/Abblix/Oidc.Server.GettingStarted), where the finished code lives; this guide explains what each piece is for and which decisions are load-bearing. ## Why the guide uses two hosts The question you actually arrive with is how the receiver knows the event is genuine. The answer has four parts: a signature, a published key set, an expected issuer and an expected audience. Put both roles in one process and all four become the application checking its own word, which teaches nothing. So the sample pays for a second host, and every check below has something real to check. The two roles are asymmetric in an important way. The transmitter decides what happened. The receiver decides whether to believe it. Almost all the code you write is on the believing side, and almost all of it is configuration rather than logic. ## The transmitter ### A signing key, and a key set to publish The receiver verifies signatures with keys it fetches from the transmitter, so the transmitter needs a signing key and a public place to publish its public half. The sample mints an RSA key on startup and serves it at `/.well-known/jwks.json`; a production transmitter takes the key from wherever the deployment already keeps its keys, a vault or a certificate store. What must survive that change is the sanitizing call on the way out. `JsonWebKey.Sanitize(includePrivateKeys: false)` returns the key's public description, its type, id, algorithm and intended use, together with the modulus and exponent, and drops the private members. That asymmetry is the whole trust model: the receiver gets enough to verify a signature and not enough to produce one. The key id deserves its own paragraph, because getting it wrong produces a failure that points somewhere else entirely. Mint the id with the key rather than fixing it in source. A receiver caches keys by `kid` and refetches the key set when a token names one it does not already hold, so a new key wearing the previous name is not fetched on that signal at all: the receiver keeps verifying against the key it has, and every signature fails. What comes back names a key, `invalid_key`, which is also the code for any other bad signature, so the log points at the token rather than at the rotation that produced it. The section "When the key changes" walks that failure deliberately. ### Registering the services Two registrations bring the transmitter up. `AddSecurityEvents` installs the Security Event Token machinery and takes two things from the host: which event vocabulary this transmitter speaks, through `RegisterCaepEvents` on the event registry, and where its signing key comes from. RISC is a separate vocabulary with its own `RegisterRiscEvents`; a transmitter emitting both registers both. `AddSharedSignalsTransmitter` then turns that into an SSF transmitter, taking the issuer, the address of the published key set, and the event types this transmitter is willing to send. ```csharp builder.Services.AddSecurityEvents(options => { options.Events.RegisterCaepEvents(); options.SigningKeySource = _ => Task.FromResult(signingKey); }); builder.Services.AddSharedSignalsTransmitter(new SharedSignalsTransmitterOptions { Issuer = issuer, JwksUri = new Uri($"{issuer}/.well-known/jwks.json"), EventsSupported = [CaepEventTypes.SessionRevoked], AllowedReceiverAddresses = [.. streams.Select(stream => stream.PushEndpointUrl).OfType()], }); builder.Services.AddSharedSignalsConfiguredStreams(streams); ``` One of its options exists because of a specific attack, and is worth understanding before you meet it. Private and loopback destinations are refused by default, and `AllowedReceiverAddresses` is how an operator permits the ones that are genuinely theirs. The refusal is not arbitrary caution: a receiver names its own delivery endpoint, so that address is input from outside, and a transmitter that POSTs wherever it is told makes requests from inside your network on a stranger's instruction. Nothing relays the response back, so this is a write primitive rather than a way to read your metadata service, which is quite enough where an internal endpoint acts on a POST. The check is worth knowing precisely, because a reviewer will ask. An allowed entry matches by origin, scheme, host and port together, rather than by prefix or wildcard. The judgement is made again before every delivery rather than once at configuration time, a hostname that resolves to a private address is refused on the resolved address and not merely on its spelling, and redirects are not followed to somewhere the allowlist never approved. Both halves of this sample run on `localhost`, which is exactly the case the refusal covers. Where that list comes from is worth copying. The sample derives it from the delivery endpoints of its own declared streams rather than configuring it separately, so the address the transmitter permits and the address it pushes to are one value. Configured apart, they can be edited apart, and a transmitter that allow-lists one host while delivering to another fails in a way that reads as a network problem. ### Declaring the stream A receiver normally creates its stream through the transmitter's Stream Management API. When the receivers of a deployment are known in advance, `AddSharedSignalsConfiguredStreams` takes them from configuration instead, which is less machinery for the same result. A declared stream names the receiver, the event types it wants, the audience the tokens are addressed to, the URL to push to, and whether the stream covers all subjects or only those added explicitly. Read the `SharedSignals:Streams` section as required rather than defaulting it to an empty list. A transmitter whose stream configuration was renamed or lost would otherwise start cleanly, deliver nothing and log nothing, which is the emptiest kind of failure to diagnose. ### Where the queue lives, and what a second instance breaks The dispatcher queues an event for each stream that wants it, and the queue, the stream store and the lease that decides who sweeps are all in memory by default. That is the honest default for one process and the wrong one for a deployment, in two ways that no log will tell you about. Undelivered events die with the process, so a restart while anything is queued loses those events outright. And the default lease reaches only inside one process, so every instance believes it holds every stream: put the transmitter behind two replicas and each of them sweeps the same queue and POSTs the same event, which is the duplication a receiver then has to absorb. `AddSharedSignalsRedisOutbox` makes the queue survive a restart, and `AddSharedSignalsRedisDeliveryLease` divides the streams between instances instead of duplicating them. A single-instance transmitter can stay on the defaults; anything that scales out cannot. A receiver that is down does not lose events immediately. The transport failure ends that stream's pass and the queue keeps its order for the next one, which is the behavior you want. It also keeps growing: the outbox has no bound and no expiry, so a receiver that stays down is a queue that stays up, and with the in-memory outbox both vanish when the transmitter restarts. Decide before you ship how deep a queue is too deep, and what you do about a stream that has accepted nothing for an hour. Declaring the streams also means this transmitter never needs the management API, and the sample does not map it. That is a decision rather than a formality. `MapSharedSignalsTransmitterEndpoints` maps the management API and the configuration document together, and whoever can create a stream can ask to be told about your users, so the API has to be guarded by scope. `SharedSignalsEndpointOptions.GrantedScopesSelector` is where a host says how to read what a caller's token was granted, and left unset there is no scope check at all: every authenticated caller may do everything. The library warns about that at startup. The warning is raised where the transmitter advertises itself rather than where the management routes are mapped, so this sample raises it too, with no management API behind it: read it there as a reminder that the selector is unset, not as a report that the API is exposed. A transmitter that only needs to advertise itself maps `MapSharedSignalsConfigurationDocument` alone, as the sample does. Which leaves the document itself worth reading once, because it speaks to strangers. It is the only artifact of the pair a receiver parses by machine, and it names the management addresses whether or not they are mapped: they are built from the route prefix rather than from what answers, so a transmitter that maps the document alone advertises five addresses that return 404. Nothing in the pair notices, and nothing can be set to silence it. Two of its other members are the host's to get right, and both default to describing a transmitter you are probably not. `AuthorizationSchemes` left unset advertises OAuth 2.0, which announces a guarded management interface even on a host that authenticates nobody; an empty list is how the library is told to advertise none. `DefaultSubjectsMode` publishes what a stream created through the management API would cover, and its default says none, which contradicts a settings file whose declared stream covers all subjects. Set both, and what the document claims about this transmitter narrows to what is true of it. ### Dispatching an event Everything above is setup. The part that runs when something actually happens is a single `EventDispatcher.DispatchAsync` call, placed where your code ends the session. It takes the event type, the subject the event is about, and the event's own payload; the dispatcher works out which streams asked for that event and queues it for each, and delivery happens on the sweep. ```csharp await dispatcher.DispatchAsync(new SecurityEventDescriptor { EventType = CaepEventTypes.SessionRevoked, Subject = new ComplexSubject { Session = new OpaqueSubject(sessionId), User = new EmailSubject(user), }, Payload = new SessionRevokedPayload { InitiatingEntity = CaepEventPayload.InitiatingEntities.Policy, }, }, cancellationToken); ``` The subject is where a decision hides. SSF's `ComplexSubject` carries coordinated members, and the sample names both a session and a user, because the two mean different things on the receiving side. Naming the session says this one login is over. Naming only the user says every session that person has with you is over. A transmitter that flattens both into a single identifier has thrown the distinction away, and the receiver cannot recover it. ## The receiver ### Trust comes from the key set, not from the connection `AddJwksKeyResolution` points the receiver at the transmitter's published key set, and this is the receiver's trust root. Note what it is not: it is not a check on where the POST came from. An event is believed because it verifies against a key published by the issuer the receiver expects. A delivery arriving from an unexpected address with a valid signature is equally good, and one arriving from the right address with a bad signature is worthless. Which is not a reason to leave the endpoint open. Nothing in this pipeline authenticates the caller: `MapPushDeliveryEndpoint` maps a route with no authorization of its own, and the issuer allowlist admits any token naming the transmitter, which is a public value. So anyone who can route to the endpoint can make the receiver parse and verify, and each token naming an unknown key id costs one outbound fetch against the transmitter. The ratio is one fetch per token and the target is the party the receiver trusts most, which is why the cooldown described under "When the key changes" exists and why the endpoint belongs behind whatever the deployment already has: mutual TLS, a credential the transmitter presents, or a network boundary. What such a caller cannot do is get an event accepted, because the signature still has to verify. ### The validation profile `AddSharedSignalsReceiver` takes the expectations the profile enforces. Two are familiar: the issuers this receiver will listen to, and the audience the tokens must be addressed to. Dropping the audience check is the classic mistake, because it is exactly what stops an event legitimately issued for somebody else from being replayed at you. The third is the one people miss, and nothing defaults it. `StreamIssuer` names the issuer of the stream the events arrive on. [SSF 1.0](https://openid.net/specs/openid-sharedsignals-framework-1_0.html) Section 4.1.6 requires `iss` to match both the Stream Configuration's issuer and the issuer whose Transmitter Configuration the receiver read, and the receiver proved those two equal when it accepted the stream, so one value carries both halves of the rule. Here the sample has one stream from one transmitter and the values coincide; a receiver holding several streams carries one profile per stream. Nothing checks it at startup: left unset, the host comes up clean and the first token to arrive throws, answering 500. It is worth asserting at startup yourself rather than discovering it under load. ```csharp builder.Services.AddSharedSignalsReceiver(new SharedSignalsValidationOptions { ExpectedIssuers = [transmitter], ExpectedAudience = self, StreamIssuer = transmitter, }); ``` The rest of the profile is standard and automatic: the signature, the `jti` that [RFC 8417](https://datatracker.ietf.org/doc/html/rfc8417) makes REQUIRED of every SET, the absence of `exp` that keeps a SET from ever passing as an [ID token](https://www.abblix.com/en/docs/glossary-overview#id-token-identity-token), and a freshness window on `iat`. ### Duplicates are the sink's problem [RFC 8935](https://datatracker.ietf.org/doc/html/rfc8935) lets a transmitter send the same event more than once regardless of the response it got the first time, so duplicates are ordinary traffic rather than a sign that something failed. `AddDistributedReplayCache` records what this receiver accepted, keyed on the issuer and the `jti` together, so a host can see what it consumed. It does not short-circuit a repeat, and the order is deliberate: the reservation is written only after your sink has accepted the event, because an entry written first would stand even when the sink refused, and the transmitter's retry would then be answered 202 with nobody having seen the event. A cache that can reserve but not release has no safe way to undo that. So a duplicate reaches `ConsumeAsync` again, every time. Idempotency in your sink is not a second line here; it is the only one. Order deserves the same caution. A SET carries no sequence number, and delivery order is preserved only within one stream's pass. Decide state from what each event says, together with its event timestamp, rather than from which one landed first. ### The one class you write Everything else in this guide is registration. `ISecurityEventSink` is the single interface the application implements, and its `ConsumeAsync` receives a `ValidatedSecurityEventToken` whose name states what has already happened: signature, issuer, audience, freshness and `jti` were all decided by the profile before your code saw it. This method is where the event stops being a token and becomes a decision in your own domain, and in the sample that decision is to record the revoked session identifier. Returning null accepts the delivery, and the receiver answers 202 only after this method has returned. Returning a `DeliveryError` answers 400 instead, and the code you choose decides the event's fate: the transmitter drops it from its queue unless the code is `access_denied` or `authentication_failed`, the two it reads as conditions an operator can put right. An unrecognised code counts as final too. So a sink that simply cannot act right now, because its database is down or its queue is full, must not answer with a `DeliveryError` at all: fail the request instead, and the transport error leaves the event queued for the next pass. ```csharp public sealed class SessionStore : ISecurityEventSink { public Task ConsumeAsync( ValidatedSecurityEventToken token, CancellationToken cancellationToken = default) { var session = (token.Token.GetSubjectId() as ComplexSubject)?.Session as OpaqueSubject; // ... act on it ... // Accepts the delivery; the receiver answers 202 once this returns. return Task.FromResult(null); } } ``` Two cases the sample does not handle, and a deployment must. An event naming only the user, with no session, means every session that person holds with you, so the sink has to enumerate and close them; the sample acts only on the session member and accepts a user-only event without doing anything. And an event whose subject matches nothing you hold is ordinary rather than exceptional: the identifier vocabulary is agreed between the two organizations before any stream exists, and a mismatch shows up as deliveries that are accepted and change nothing. Whether an unmatched subject stays a silent 202 or becomes something an operator sees is your decision, and worth making deliberately. The route the deliveries arrive on is the receiver's to choose, and `MapPushDeliveryEndpoint` maps it; whatever path you pick is the one the transmitter's stream must name. ## Running the pair The pair is two ASP.NET Core applications started side by side: a Shared Signals transmitter that signs and pushes a CAEP session-revoked event, and a receiver that verifies it and closes the session. They come from the `SharedSignalsSample` project of the Getting Started repository, and each one references its own packages: ```shell # the transmitter dotnet add package Abblix.SharedSignals dotnet add package Abblix.SharedSignals.MinimalAPI dotnet add package Abblix.SecurityEvents.CAEP dotnet add package Abblix.JWT # the receiver dotnet add package Abblix.SharedSignals dotnet add package Abblix.SecurityEvents.MinimalAPI dotnet add package Abblix.SecurityEvents.CAEP ``` A receiver of Back-Channel Logout alone needs neither `Abblix.SharedSignals` nor a stream: `Abblix.SecurityEvents` with its Minimal API adapter is the whole dependency, which is the smaller integration the [Shared Signals Framework article](https://www.abblix.com/en/docs/shared-signals-framework) maps out. The sample listens on `https://localhost:5101` for the transmitter and `https://localhost:5102` for the receiver. The push is a real HTTPS request between two processes, and the receiver's fetch of the key set is another, so the development certificate has to be trusted before either starts: From the root of the cloned repository, first trust the certificate: ```shell dotnet dev-certs https --trust ``` Then start the receiver, and leave it running: ```shell dotnet run --project SharedSignalsSample/ReceiverApp ``` And the transmitter, in a second terminal: ```shell dotnet run --project SharedSignalsSample/TransmitterApp ``` Wait for `Now listening on: https://localhost:5102` and `Now listening on: https://localhost:5101` rather than assuming the ports came up, because a process that failed to start leaves a port quiet in exactly the same way a slow one does. The transmitter also prints `Sweeping push streams every 00:00:30, ...`, which is how often it looks for something to deliver. Now ask the receiver what it knows, and revoke a session: ```shell curl -k https://localhost:5102/revoked-sessions # [] curl -k -X POST "https://localhost:5101/sessions/alice-laptop-session/revoke?user=alice@example.com" # 202 ``` Delivery happens on the next pass, so give it up to thirty seconds before asking again: ```shell curl -k https://localhost:5102/revoked-sessions # ["alice-laptop-session"] ``` Read the first, empty answer as part of the test rather than as a formality. Without it, the last line is equally consistent with a store that always said `alice-laptop-session`, and the run proves nothing about delivery. The `202` from the revoke call is the transmitter accepting the event, not the receiver getting it. The receiver's verdict shows up in the transmitter's log as the status of its own outbound POST, and a `202` there means the token was validated and the sink ran to completion. Accepted is not the same as acted on: a sink that recognizes nothing in the event answers 202 as well. A `400` means the receiver rejected it, and the log line carries the receiver's own error code, which is the one thing worth alerting on. A warning carrying an exception whose message begins `Refusing to deliver` means the transmitter never sent anything at all, with the reason in the rest of that message. Any other status, and a connection failure too, leaves the event queued in order for the next pass rather than dropping it. ## When the key changes This is the failure worth producing on purpose once, in a sample, rather than meeting for the first time in a deployment. Read the `kid` from the transmitter's key set, restart the transmitter, and read it again. It changed, because the sample mints a key per run and mints the id with it. Revoke another session and it arrives: the receiver met a `kid` it did not hold, refetched the key set, and verified against the new key. Now fix the key id to a constant and restart again. Deliveries start failing, and the transmitter logs the receiver's verdict as `invalid_key`. That names the symptom rather than the cause: it is equally what a tampered payload or a wrong algorithm looks like. The cause is that the receiver caches by key id, so a new key wearing the old name is one it is confident it already holds and never refetches. Leave it running and it heals on its own, which is the confusing part. The forced refetch is not the only path back to the issuer: the cached set also has an ordinary lifetime, `JwksKeyResolutionOptions.CacheLifetime`, fifteen minutes by default, and when that expires the receiver refetches for its own reasons and picks up the new key under the pinned name. So the outage lasts until the cache lifetime runs out, and every event refused inside it is already gone. That exercise runs instantly in the sample only because the sample disables a rate limit a deployment needs. `RolloverRefetchCooldown` puts a floor of thirty seconds under the forced refetch, for the reason given under the receiver's trust root: the push endpoint authenticates nobody, so without the floor each token naming an unpublished key id would cost one fetch against the transmitter. Keep that floor, and know what it costs at a rotation. Inside the window a token signed by the new key is judged against the old key set and refused with `invalid_key`, and a refusal about the token itself is acknowledged out of the transmitter's queue rather than retried, so those events are gone. Only a refusal about the transmitter's own standing, `access_denied` or `authentication_failed`, leaves the event queued, because that is the kind an operator can put right without the event changing. The floor is the same order as the default delivery pass, which makes the window easy to land in. None of which you have to accept, because the loss is avoidable rather than inherent. Publish the new public key in the key set before anything is signed with it: the receiver picks it up on an ordinary cache refresh, and the first token naming the new `kid` finds a key it already holds. Rotate by publishing first and switching second, and neither the cooldown nor the cache lifetime ever bites. The lesson generalizes past this sample. A key id is not a label for the slot a key sits in; it is the name of that key, and it changes when the key does. Any rotation scheme that reuses the id produces exactly this outage, on a delay, with a symptom that points at signatures rather than at rotation. ## What to check before you call it working - Point the receiver at a different transmitter address and restart it: deliveries should stop being accepted. The reason is worth being precise about, because it is not the signature. The token's `iss` is no longer an issuer this receiver expects, and the profile checks that before it does any signature work. - Confirm the audience is enforced: point the receiver's expected audience at something the transmitter does not address its tokens to, and deliveries should be refused. - Restart the transmitter and deliver again. In the sample this is instant; in a deployment allow for the rollover cooldown you keep, or rotate by publishing the new key first and skip the wait entirely. - Deliver the same event twice: your sink must reach the same state, because it will see both deliveries. ## Knowing it is still working Silence is ambiguous. No events at all, a stream nobody sweeps, a queue that vanished with a restarted process and a receiver accepting everything while matching nothing all look identical from outside, and none of them raises anything. SSF answers this with the Verification Event: a receiver asks the transmitter to send one and confirms the round trip, throttled by the stream's own minimum interval. The library carries it on both sides, and it is the only signal that exercises the whole path rather than a part of it. Two things the transmitter already logs are worth alerting on beside it. A refusal summary names the receiver's own error code, so a sustained rate of `invalid_key` says a rotation went wrong and a sustained `invalid_request` says the two sides disagree about the envelope. And a `Refusing to deliver` warning means the transmitter is declining an address, which is a configuration answer rather than a network one. ## Where to go next - [Shared Signals Framework](https://www.abblix.com/en/docs/shared-signals-framework): how SSF, CAEP, RISC and Back-Channel Logout relate, and which package covers which layer. - [Getting Started repository](https://github.com/Abblix/Oidc.Server.GettingStarted): the `SharedSignalsSample` project, runnable. --- Source: https://www.abblix.com/en/docs/migrate-from-identityserver.md # Migrating from IdentityServer4 or Duende to Abblix OIDC Server This is an engineer's account of one migration, not a description of migration in general. The subject is [dotnet/eShop](https://github.com/dotnet/eShop), Microsoft's reference .NET commerce application, whose `Identity.API` project ships upstream as a Duende IdentityServer host. The result is [Abblix/eShop](https://github.com/Abblix/eShop): the same application, the same storefront, the same APIs, with Abblix OIDC Server underneath. A word on the subject, for readers who have not met it. eShop is the AdventureWorks web store Microsoft maintains as a showcase of a services-based .NET system: a Blazor storefront, catalog, basket and ordering services talking REST and gRPC, a RabbitMQ event bus, PostgreSQL and Redis, a separate webhooks client, a MAUI mobile app, and a .NET Aspire host that orchestrates the lot. One of those services, `Identity.API`, is the OpenID provider the rest of the system trusts - ASP.NET Core Identity for the users, Duende IdentityServer for the protocol. After the migration the same seat belongs to Abblix OIDC Server. The storefront and the webhooks client sign users in against `Identity.API` through the authorization code flow with [PKCE](https://www.abblix.com/en/docs/pkce-in-openid-connect); inside that service, Abblix OIDC Server answers the protocol endpoints and hands credential checks to ASP.NET Core Identity, whose users - and, in this fork, the signing key - live in PostgreSQL. Token in hand, the storefront calls the basket and ordering APIs and the webhooks client calls its own API, each request carrying a Bearer access token. The resource APIs never ask the provider about any particular request: each validates tokens on its own, against the discovery document and the key set it fetched once and cached, with no shared secret anywhere. That indirection is what makes the provider replaceable - nothing on the consuming side names an implementation. That shape is why it was chosen. eShop is public and runs IdentityServer, so a reader can diff this migration against a system they already recognize. It is also realistic in the places migrations actually break: clients of three different kinds, two of which turn out to be dead, custom claims flowing into a checkout form, gRPC resource servers validating tokens. The MIT license is what lets the finished fork sit in public with every decision inspectable. Each step below says what changed and why it was decided that way; where a real fork existed, it names the alternatives rejected and for what reason. The part that matters most is where the two libraries put the boundary between the library's job and yours, because wherever that boundary sits in a different place, a mechanical translation compiles cleanly and still leaves a decision unmade. Which Duende, for the reader checking along: upstream eShop pinned 7.3.2, and every statement here about how IdentityServer behaves was read from [that version's sources](https://github.com/DuendeSoftware/products/tree/is-7.3.2). A later release may answer differently, and a page about somebody else's product ages the moment it ships. One thing this page is not: an argument for leaving Duende IdentityServer. It has been in production for a decade, and nobody should move off a system that works. What a worked migration adds is the part no feature table reaches: what changes, and what turns out not to. And if you came here with a reason of your own, or simply because you are curious what the alternatives look like from the inside, then this page and the fork it describes are written for you: a migration somebody has already done, in an application you can run today. The code is in the fork; this page is the reasoning. One thing to know before you clone it. The first is that whether the trade is right for you is not a question this page can answer, because it is about eShop. Abblix is the younger product, with no [FAPI](https://www.abblix.com/en/docs/glossary-overview#fapi) certification where Duende holds one, no ready-made server-side session store, and no first-party persistence packages yet. [The feature-by-feature comparison](https://www.abblix.com/en/docs/comparison-duende-openiddict) has those numbers, including the ones that do not flatter us. Read it before this page, not after. ## Measure the blast radius before touching anything The first question is how much of your system knows about the old provider, because that number decides whether the work is a project or an afternoon. In eShop the answer is: the old provider is named in 36 files. Thirty-four sit inside `src/Identity.API`; the other two are the central package pins in `Directory.Packages.props` and a Dependabot group that watches them. No front end, no API, no test names it. Run that search with a control - a count that comes back zero because the search was wrong looks exactly like a count that comes back zero because there is nothing to find. Search for something you know is present and confirm the tool answers. The result shapes everything else. eShop's basket, ordering and webhooks APIs authenticate with the standard JWT bearer handler pointed at an authority URL. The storefront and the webhooks client use the standard OpenID Connect handler, also pointed at an authority. None of them names an implementation: they read the discovery document, take the key set from it, and validate what arrives. One caveat before you conclude the same about your own system. eShop's resource servers set `ValidateAudience = false`, so the `aud` claim never mattered here. If yours validate it - which the bearer handler does by default once `Audience` is set - check the value before cutover. Read the claim out of a token your current server issues, then compare: Duende builds it from the API resources behind the requested scopes, and Abblix has no API-resource concept at all, so with neither an [RFC 8707](https://datatracker.ietf.org/doc/html/rfc8707) `resource` parameter nor an [RFC 8693](https://datatracker.ietf.org/doc/html/rfc8693) `audience` on the request, `aud` falls back to the issuer. Getting a resource-shaped value back means either that the client sends `resource=`, which is a client change, or that the server names a default resource indicator, which is one line of configuration and is read by every resource server in the deployment. Decide which side moves before you promise that nobody has to redeploy. With that caveat stated, the work is nearly confined to one project. Outside `Identity.API`, the migration touched the package pins, the Dependabot group, the ignore file, the readme, and one orchestration hook the AppHost no longer needed - a hand-rolled forwarded-headers subscriber that Aspire has injected by default since it gained `DisableForwardedHeaders` as the opt-out. Inside it, the changes fall into three groups: configuration that is mostly mechanical but hides three decisions that are not, a login screen that is a genuine rewrite, and persistence decisions that become yours. ## Replacing the packages Five packages become one. In the central pin file, this: ```xml ``` becomes this: ```xml ``` Three of the five were storage: the two Entity Framework store packages and the storage abstractions. The fourth, the ASP.NET Identity bridge, holds no store at all: it is the profile service and the resource-owner validator written over ASP.NET Identity, and it goes because the profile service becomes a provider of your own, while ASP.NET Identity itself stays exactly where it was. Duende ships persistence as packages you install, whose schema you migrate and whose tables you then operate. Abblix ships interfaces - with in-memory defaults behind some of them, and behind others, as two later sections insist, nothing at all. The packages disappear because the decision moved into your code, not because the work did. It reappears near the end of this page. One pin moves with them. eShop pins package versions centrally and enables transitive pinning, which promotes every indirect dependency to the pinned version, so any dependency whose floor sits above your pin is raised in the same edit. Here that is Protobuf: raise the central pin to the version the Abblix package asks for. ## Moving the endpoints from middleware onto routes Duende installs a middleware that inspects every request and answers the paths it recognizes. Abblix ships the protocol endpoints as ordinary attribute-routed MVC controllers, so you map them the way you map your own. One line in the pipeline: ```csharp app.UseRouting(); app.UseIdentityServer(); app.UseAuthorization(); ``` becomes three, and each of them is something the old middleware was doing out of sight: ```csharp app.UseRouting(); app.UseCors(); app.UseAuthentication(); app.UseAuthorization(); app.MapControllers(); ``` Because the endpoints are controllers, everything in the pipeline that binds to endpoint metadata applies to them with no plugin model: authorization policies, endpoint-scoped rate limiting and [CORS](https://www.abblix.com/en/docs/glossary-overview#cors) policies, API versioning, your own action filters. A middleware answers before routing reaches an endpoint, so anything endpoint-scoped has to be provided inside the product instead. Two of those lines are ones the middleware used to cover out of sight, so name them deliberately. Authentication becomes your call. Duende's middleware authenticated the request internally. With controllers, authentication is the pipeline's job, so `UseAuthentication` belongs in your startup where you can see it. CORS belongs there too. Several protocol controllers carry CORS metadata, because browser-based clients read the discovery document, the key set and the token endpoint cross-origin, and ASP.NET Core routing serves an endpoint carrying that metadata only when a CORS middleware is present to honour it. `UseCors` is what puts it there. The library registers the policy the controllers name; the middleware call and the origins are yours. Name the origins in the same change, because an empty list means the policy allows any of them. In the fork the list is the two addresses its clients answer on, read from the same registry that declares those clients. eShop has no browser-based client at all, so even that is generous, and it is still narrower than a policy that answers to anyone. ## Deciding which endpoints exist at all The default is the base set: discovery, key set, authorize, token, userinfo, end session and pushed authorization requests. Introspection, revocation, dynamic client registration, check session, backchannel authentication and device authorization stay off until you name them, and naming one without also registering what it needs stops the host at startup rather than serving a half-wired endpoint. The fork runs on the base set rather than restoring the full surface. Nothing in eShop uses introspection, revocation or the device flow, and an endpoint that is enabled is attack surface whether or not anything calls it. The default is changing because an endpoint nobody asked for should not answer, and naming the ones you use costs one line each. Duende gets to the same safety by granting each client what it may use, with every endpoint present. ## Translating clients and scopes This is the largest diff, and most of it is mechanical. The client model maps across field by field, and Duende's three resource concepts - identity resources, API resources, API scopes - collapse into a single scope definition. The registration call shows the shape of the whole step. Before: ```csharp builder.Services.AddIdentityServer(options => { /* events, key management */ }) .AddInMemoryIdentityResources(Config.GetResources()) .AddInMemoryApiScopes(Config.GetApiScopes()) .AddInMemoryApiResources(Config.GetApis()) .AddInMemoryClients(Config.GetClients(builder.Configuration)) .AddAspNetIdentity() .AddDeveloperSigningCredential(); ``` After, with the registry read from configuration and the two seams that have no default at all registered by hand: ```csharp builder.Services.AddOidcServices(options => { options.LoginUri = new Uri("/Account/Login", UriKind.Relative); options.Scopes = oidcConfiguration.Scopes; options.Clients = oidcConfiguration.ToClientInfos(); }); builder.Services.AddSingleton(); builder.Services.AddScoped(); ``` Those two registrations are the story of the second half of this page: the signing key and the claims provider have no defaults to inherit, and each is a section below. The host registers two more things this page reaches later: the CORS origins the protocol endpoints answer to, and the cache that holds authorization codes and pushed requests. Three things do not map mechanically: two client fields and the scope definition itself. ### The client authentication method is registered, and the registered value is enforced Duende registers a shared secret and accepts it from wherever the client put it: [its secret parsers](https://github.com/DuendeSoftware/products/blob/is-7.3.2/identity-server/src/IdentityServer/Configuration/DependencyInjection/BuilderExtensions/Core.cs) try the Basic header and the request body in turn, and the same registration serves both conventions. Abblix registers one authentication method per client and compares what arrives against it. The default is `client_secret_basic` - the variant [RFC 6749](https://datatracker.ietf.org/doc/html/rfc6749) requires every authorization server to support, and the one it prefers over the body form. The standard ASP.NET Core OpenID Connect handler, however, posts the client id and secret in the token request body, which is `client_secret_post`. Registering that value is the whole of the change for such a client. eShop's inherited registry would have needed both values, which is the clearest illustration of why the field exists: the server-rendered clients use the ASP.NET Core handler and need the body variant, while the mobile client used a library that sends an Authorization header and needed the Basic one. Under Duende that difference was invisible because both were accepted. That mobile registration was later dropped (see below), so the shipped registry names `client_secret_post` twice - but the day you add a client whose library differs, this field is where the difference is stated rather than discovered. The difference exists because client registration defines the method as a single value, not a list, and enforcing the registered value buys a client whose authentication method cannot change without a registration change. The cost is one field you must get right, and the way to get it right is to check what the client library actually sends rather than what the old registration tolerated. ### Offline access and the refresh grant are two separate permissions In Duende, one flag both permits the offline-access scope and enables refreshing. Abblix spreads the same permission over three settings, and each refuses at a different moment. `OfflineAccessAllowed` on the client is `false` by default, and with it unset the authorization endpoint answers `invalid_scope` before any list is consulted. The scope in the client's scope list is what makes the request grant a refresh token. The refresh grant in its grant list is what lets the client spend one, checked at the token endpoint on every call. A client that should keep refreshing therefore needs all three, and each omission fails somewhere else: without the flag at the authorization request, without the scope with no token to spend, without the grant holding a token it may not use. Receiving a refresh token and being allowed to exchange one are different powers. A server that merges them cannot express the case where existing refresh tokens should stop working while the client keeps everything else; withdrawing the refresh grant is one field here. Duende reaches the same outcome from the other side: its grant store can enumerate and remove a client's tokens directly, which under Abblix is the inventory described at the end of this page. ### A scope declares the claims it carries, and this is where a real decision was needed Abblix has one scope concept: a name plus the claim types that scope asks for. The library registers the six standard OpenID Connect scopes itself, so a host declares only what the standard does not already name. A scope that is not declared is refused as an invalid scope no matter what a client lists as allowed: the client's list narrows what it may request and never introduces a scope. The second half of that definition changes how you think, because the claim list a scope declares is what the server later asks your user store for. Centralising the mapping costs something: every claim must belong to a scope, so a claim with no natural home needs one found for it. eShop's user records carry a surname and a shipping address split across five fields, none of them a standard claim name. The checkout page prefills its form from the address fields, and the chatbot reads them plus the surname. Under Duende those were produced by the profile service, which decides for itself what to return, so nothing had to declare them anywhere. Under Abblix a claim that no granted scope declares is never requested, so those claims needed a home. Three collections in code go away: `GetApis` and `GetApiScopes`, which named `orders`, `basket` and `webhooks` twice over as an API resource and again as an API scope, and `GetResources`, which listed the built-in `OpenId` and `Profile` identity resources. They become one `Scopes` list in configuration, in which the standard scopes are not restated because the library already declares them: ```json "Scopes": [ { "Scope": "profile", "ClaimTypes": [ "last_name" ] }, { "Scope": "address", "ClaimTypes": [ "address_city", "address_country", "address_state", "address_street", "address_zip_code" ] }, { "Scope": "orders" }, { "Scope": "basket" }, { "Scope": "webhooks" } ] ``` The two named entries are the interesting part. They ended up where OpenID Connect already puts data of that kind: the surname extends the standard `profile` scope, the five address fields extend the standard `address` scope. A host definition under a standard name extends that scope, the host's claims joining the standard ones, which is what makes this placement expressible at all. The three application scopes are then left declaring no claims, which is what an API scope is. The price is one entry in one client's scope list: the storefront now asks for `address` by name, on top of the scope lists both clients state in full for the reason the next section gives. That entry states, in the client's own code, which of the user's data the checkout form needs. The webhooks client asks for `profile` and not for `address`, so it never receives a shipping address it has no use for. The exposure was equally narrow before, for a reason that would not have held: the claims rode on an API scope, granted so that a client may call the ordering service, and the next client granted it for that reason would have started receiving a home address with nothing in the grant to say so. On `address` the grant names what it hands over. The objection a strict reader will raise is that the names traveling under those scopes are not the standard ones. [OpenID Connect Core](https://openid.net/specs/openid-connect-core-1_0.html) defines `family_name` for a surname, and it defines `address` as a single structured claim whose members are the same five fields eShop keeps flat. So a third-party client asking this server for `address` and expecting the standard claim receives nothing, because nothing here produces it. Keeping eShop's names is what kept the storefront and the chatbot untouched, which was the point of the exercise, and it is a debt, not a design: where you are not preserving an existing consumer, use the standard names and let the standard scope mean what it says. Two other homes were considered, and both lose. Hanging the claims on an application scope the client already requests works, and it is what this fork did first, at the price of a scope name that says nothing about the data it carries. Inventing a dedicated scope loses on both counts: every client has to request one more scope, and it names something the standard had already named. ### Translating client by client is how you find the dead configuration The translation is tedious enough that you read every line, and reading every line finds things. eShop's configuration carried three clients registered for a Swagger UI that no longer exists - the project moved to a different API browser, and while the OpenAPI documents still declare an OAuth flow for it, the client ids meant to complete that flow are read by no code. It also carried two scopes for aggregator services the repository no longer contains, which the configuration never declared as API scopes at all: neither library validates a client's allowed list against the declared scopes, because an entry nothing requests is never looked at. The dead Swagger clients also used the implicit flow, which [RFC 9700](https://datatracker.ietf.org/doc/html/rfc9700) now tells clients not to use; the browser-based-applications draft goes further for providers: access tokens are issued only at the token endpoint. Both libraries still support the flow for clients that have not moved. Nothing here needed it. All the dead clients were dropped rather than ported. This is not tidying. A registered client is a credential that can be used, and carrying one forward because it was in the old file is how a demo credential reaches production. The same pass found two services registered in dependency injection that nothing resolved; those went too, after confirming with a search - not by eye - that nothing referenced them. The mobile client went with them, for a different reason. The MAUI application lives in the repository and has its own CI, but it takes no part in the system the orchestrator runs: it is built and deployed separately, to a device. Its registration was a credential serving nothing the demo starts. Restoring it is a few lines when somebody actually runs that app. That left the question of what each surviving client may have. The rule chosen was: what its own code asks for, read carefully. Applied to the two clients, it drops four entries of three kinds that a field-by-field translation would have carried over. Neither client requests offline access, so neither keeps the scope or the refresh grant beside it. The storefront had been allowed a scope it never requests. And the four card claims sitting alongside the address fields are read only by the mobile client whose registration is gone, so they leave with it. Note the direction of the check: the registry is compared against the client code, not against the registry it was translated from. A faithful translation reproduces the old over-granting perfectly. ### What a client asks for is not what its code lists That rule has a prerequisite: the request a client sends is not the list of lines it adds. The ASP.NET Core OpenID Connect handler ships its scope list already holding `openid` and `profile`. A client that calls `Scope.Add` for what it needs extends that list rather than replacing it, so its authorization request carries two scopes that appear nowhere in its own code. Two ways out, and they differ in what they leave behind. Allow the effective list in the registry, which works and leaves the request half-stated in framework defaults. Or clear the list in the client and name every scope it wants, which is what this fork does: the request is then exactly the list in the code, and the registry on the other side can be reviewed against it by reading. Clearing also asks the question that finds real over-granting, since restating a default forces somebody to say why it is there. The webhooks client keeps `profile` under that question, because its user menu displays the name that scope carries. Clearing has two costs, and both are worth knowing before you copy the pattern. It removes `openid` along with `profile`, so a cleared list restates both. And it pins the scope list in compiled code, which is the opposite of what the next section does with the server registry, deliberately: a client's scope list is a claim about what its own code reads, so it belongs beside that code, while a redirect path is an operational setting and does not. ## Where the client registry lives The whole registry, clients and scopes alike, moves out of C# and into `appsettings.json`. The class that held it, `Configuration/Config.cs`, is deleted rather than translated. A registry in code means a rebuild to add a client or move a redirect path, and it means the reviewer of an operational change is reading a compiled language. In configuration, the same change is a settings edit, and the file reads as an inventory of who may ask this server for tokens. A client that used to be written like this: ```csharp new Client { ClientId = "webapp", ClientSecrets = new List { new Secret("secret".Sha256()) }, ClientUri = $"{configuration["WebAppClient"]}", AllowedGrantTypes = GrantTypes.Code, AllowOfflineAccess = true, AlwaysIncludeUserClaimsInIdToken = true, RequirePkce = false, RedirectUris = new List { $"{configuration["WebAppClient"]}/signin-oidc" }, AllowedScopes = new List { "openid", "profile", "offline_access", "orders", "basket", "webshoppingagg", "webhooks" }, AccessTokenLifetime = 60*60*2, } ``` It is now an entry keyed by its own identifier: ```json "webapp": { "BaseAddress": "https://localhost:7298", "RedirectPaths": [ "/signin-oidc" ], "PostLogoutRedirectPaths": [ "/signout-callback-oidc" ], "Client": { "ClientName": "WebApp Client", "ClientSecrets": [ { "Sha256HashHex": "2BB80D537B1DA3E38BD30361AA855686BDE0EACD7162FEF6A25FE97BF527A25B" } ], "TokenEndpointAuthMethod": "client_secret_post", "AllowedGrantTypes": [ "authorization_code" ], "AllowedScopes": [ "openid", "profile", "address", "orders", "basket" ], "ForceUserClaimsInIdentityToken": true, "AccessTokenExpiresIn": "02:00:00", "IdentityTokenExpiresIn": "02:00:00", "AuthorizationCodeExpiresIn": "00:05:00" } } ``` The nesting is the whole design. Everything under `Client` binds straight into the library's own client model, so a property the library gains is configurable the day it ships. Outside it sits the one thing that model has no opinion about: where the client answers, and which paths under that address the server may return a user to. The secret is a hash written as one string, in hexadecimal because that is what a command-line digest tool prints, so the value can be checked against one without converting it first. Base64 binds equally well; hexadecimal was chosen so that the value in the file is the value a digest tool prints. Four differences in there are not formatting. The authentication method is now stated, because it is enforced rather than sniffed. The scope list dropped `offline_access`, a scope for an aggregator service the repository no longer contains, and the webhooks scope this client never requests, and it gained `address` for the reason the previous section gives. PKCE goes unmentioned because the library requires it by default and this client no longer opts out, which the old registry did. And the lifetime is a duration rather than a count of seconds whose unit lives in the field name: the same two hours, said in a way that cannot be misread. Four details of that arrangement came out of building it. Bind the library's own types rather than mirroring them. The scope model and the client model both bind straight from configuration, which is why this fork carries a mirror of neither. What stays in a local type is the shape the library has no opinion about, and that is a base address with paths under it. One member would need help if a client used it: a key set is polymorphic, so it binds through the flat settings type the library ships for it rather than directly. No client here has one. One property of binding into the library's own model is worth knowing, because it is the opposite of what a mirror type does. The binder fills the instance a property already holds rather than constructing a new one, so every value the file leaves out keeps whatever the library shipped. A mirror type has to reproduce every one of those defaults by hand - an omitted `TimeSpan` binds to zero, which is not what the file meant - and binding into the real model removes that obligation rather than discharging it. Keep the address as one scalar and the paths in the file. A client's base address is the one setting that varies by environment; the redirect paths under it do not. Splitting them means a deployment overrides a single value - a plain configuration override, with no positional list indices that retarget when the file is reordered. In the fork the addresses are the fixed development ports the launch profiles assign, which is enough for the demo; a deployment replaces them per client through ordinary configuration. Restate every token lifetime instead of inheriting a default, because the defaults differ sharply. Duende's are on [its client model](https://github.com/DuendeSoftware/products/blob/is-7.3.2/identity-server/src/Storage/Models/Client.cs): the authorization code lives 300 seconds against one minute here, the access token 3600 against ten minutes, the refresh token 2592000 seconds absolute with a 1296000-second sliding window against eight hours and one hour. Refresh token: eight hours absolute with a one-hour sliding window, against thirty days absolute and a fifteen-day sliding window that Duende does not apply unless you switch its refresh expiration to sliding. Every one of them is shorter than the value it replaces, so a registry that restates them is a registry that keeps the behavior it had. Both eShop clients state the three that apply to them, which are the authorization code, the access token and the identity token, as durations, so the unit is part of the value; the old settings file carried bare "minutes" and "days" counts in fields nothing read. The refresh lifetime is stated nowhere because neither client holds the refresh grant, and a registry that has one should restate it too. Refresh-token reuse is the one default that changes behavior in your favour, and the two products disagree on it. Abblix rotates (`AllowReuse = false`); Duende reuses ([`RefreshTokenUsage = TokenUsage.ReUse`](https://github.com/DuendeSoftware/products/blob/is-7.3.2/identity-server/src/Storage/Models/Client.cs) on its client model). A registry arriving from a deployment that relied on a reusable token therefore has to say so explicitly or find its tokens becoming single-use. State it per client either way. ## Producing claims: asked versus told The profile service becomes a user info provider. The signatures differ, but that is not the change worth understanding. The two signatures say most of it. The old service was handed the request and decided for itself what to answer: ```csharp public async Task GetProfileDataAsync(ProfileDataRequestContext context) ``` The context carries the request; eShop's implementation read the `sub` claim out of it, loaded the user, and assigned every claim that user had to `context.IssuedClaims`, without consulting what was asked for. The new one is handed a list and answers it: ```csharp public async Task GetUserInfoAsync(AuthSession authSession, IEnumerable requestedClaims) ``` The fork's implementation loads the user by `authSession.Subject`, returns null when there is none, and otherwise walks `requestedClaims`, mapping each requested name to a field of the user record and skipping the ones it has no value for. The returned object holds exactly the claims that were asked for and that the store could answer. Duende's profile service is advised; Abblix's provider is constrained. Duende computes the requested claim types and hands them to your profile service along with [a filtering helper](https://github.com/DuendeSoftware/products/blob/is-7.3.2/identity-server/src/IdentityServer/Extensions/ProfileDataRequestContextExtensions.cs) that keeps only those - but nothing enforces the filter, and eShop's implementation ignored the request and returned every claim it had. Abblix computes the claim list from the scopes the request was actually granted and asks your provider for exactly that list, so a claim no scope declares is never requested at all. The library does not police what your provider returns beyond that; answering the list you were handed is the discipline the design expects, not a guarantee it enforces. One switch needs naming, because the fork sets it. Whether user claims travel inside the identity token or wait at the userinfo endpoint is a per-client choice in both products. The fork turns `ForceUserClaimsInIdentityToken` on for both clients, for a mechanical reason worth knowing: the ASP.NET Core handler maps every identity-token claim into the principal by default, but maps userinfo fields only through claim actions, and the ones it ships cover `sub`, `name`, `given_name`, `family_name`, `profile` and `email`. Nothing custom, and eShop adds none. So claims delivered in the identity token reach the checkout page, while a surname under a name of eShop's own and five address fields delivered through userinfo would not. The client-side alternative is two claim-action lines per client, which is the framework's own answer to this; it was not taken because leaving the client applications alone was the point of the exercise. One practical note before the harder one: this registration is mandatory. The library ships no default provider, so who answers for a user's claims is a decision the host states rather than one it can inherit, and a host that has not stated it does not start. The harder one is the profile service's second method, the one reporting whether a subject is still active. It has no counterpart, and it is the only thing on this page that a mechanical translation loses without leaving a trace. `IsActiveAsync(IsActiveContext context)` answers a single question by setting `context.IsActive`: eShop's implementation loaded the user, refused when the security stamp in the subject's claims no longer matched the stored one, and otherwise reported the user active unless a lockout was in force and had not yet expired. An unknown user was refused outright. Duende consults it [at userinfo](https://github.com/DuendeSoftware/products/blob/is-7.3.2/identity-server/src/IdentityServer/Validation/Default/UserInfoRequestValidator.cs) and [on refresh](https://github.com/DuendeSoftware/products/blob/is-7.3.2/identity-server/src/IdentityServer/Services/Default/DefaultRefreshTokenService.cs), so disabling a user cuts their tokens off at the next call. Abblix has no equivalent hook. It does reach the host on both paths, through `IUserInfoProvider`, but only to read claims: what it never asks is whether the subject is still allowed in, and that question is left with the host. Two things follow, and both are decisions rather than translation. An access token keeps working until it expires, which is what a self-validating token means, and shortening that window is a lifetime decision. Userinfo is the exception rather than a check: a provider that returns nothing for a user who no longer exists makes the endpoint answer `invalid_token`, and this fork's provider does exactly that, but a user merely disabled still answers. And the server's own session cookie is read the same way, so the question of whether a subject is still allowed in has to be answered on that cookie: `AddIdentity` places the security-stamp validator on Identity's own cookie, and a host that stops using that cookie states the check on the one it does use. The fork states it where the session is read, in a `RejectUsersNoLongerAllowedIn` handler wired to the cookie handler's principal-validation event. It takes the subject from the cookie's principal, loads that user through `UserManager`, and returns with the session untouched when the user exists and is not locked out. In every other case, a missing subject, a user that no longer exists, or a lockout in force, it calls `RejectPrincipal` and signs the cookie scheme out. A lockout reaches an existing session on its next request, and a deleted user with it. A password change deliberately does not: catching it needs the security stamp to travel in the session, and the session's own extension point for custom values is emitted into issued tokens, which is not a place for a stamp. So the session runs on an absolute lifetime rather than a sliding one, and its length is what bounds the window. Closing the remainder properly is the same work as the revocation path below: mark the token ids through a registry every server-side validation consults, described in [token inventory and revocation](https://www.abblix.com/en/docs/token-inventory-and-revocation). ## Rewriting the login screen Duende hands the login page a return URL that encodes the authorization request, and the interaction service is what turns it back into a validated request your page can read; your code is therefore a participant in the protocol decision, and it must understand what denying an authorization means. Abblix keeps the pending request on the server and hands the page an opaque reference to it. The host verifies the credentials it owns, tells the library who signed in, and redirects back to the authorize endpoint carrying the same reference - the page has nothing to parse and renders no verdict at all. The division is that your application owns identity and the library owns the protocol, and the login page sits entirely on your side of it. In practice the rewrite is small: a page with a form, a post action that checks a password, one call to establish the session, and a redirect. The old action had to understand the request it was interrupting. It opened the return URL with `GetAuthorizationContextAsync` before doing anything else; on the cancel button it called `DenyAuthorizationAsync` with an access-denied error and redirected; on the login button it called `PasswordSignInAsync`, and redirected to the return URL only when the sign-in succeeded and that context had come back non-null, which was what made the URL safe to follow. The new one carries a reference it never opens. It checks the password with `CheckPasswordSignInAsync`, redisplaying the form with a model error when that fails. On success it constructs an `AuthSession` from the user id, a freshly generated session id, the current instant and the cookie scheme name, filling in the email, whether it is confirmed, and the authentication method reference for a password. `SignInAsync` on the session service records it. Then the action builds a URL to the authorize endpoint carrying the opaque `request_uri` it was handed, and redirects there. Nothing in the action parses that value or decides anything about the authorization request. External identity providers sit on this side of the line too. The old host carried a controller for upstream providers, deleted here because nothing used it; a host that signs users in through Google, Entra or an upstream [SAML](https://www.abblix.com/en/docs/glossary-overview#saml) provider writes that challenge-and-callback pair on the standard ASP.NET Core external authentication handlers, and the library's contract is unchanged - you report an identity, it re-evaluates the stored request. Three things disappear with the return URL. There is nothing to validate before redirecting to it, because it is an opaque reference the server minted and can only resolve to a request it is already holding. There is no denial path in the page, because refusing is not something the page decides. And `PasswordSignInAsync` becomes `CheckPasswordSignInAsync`: the same lockout handling without issuing Identity's own cookie, which the section below explains. ### The cookie decision this forces Abblix's session adapter reads and writes the standard cookie authentication scheme. eShop registered ASP.NET Identity with the full registration, which brings Identity's own cookie schemes and signs into them. The fork switches to the core Identity registration plus a plain cookie handler. `AddIdentity` gives way to `AddIdentityCore`, with roles, the Entity Framework stores, the sign-in manager and the default token providers each added back by name, so the host takes the pieces it uses and none of the cookie schemes. Separately, `AddAuthentication` followed by `AddCookie` registers the standard cookie scheme, and the only option it sets is `OnValidatePrincipal`, pointed at the `RejectUsersNoLongerAllowedIn` handler above. That second registration is where `AddIdentity` used to hand you three cookie schemes and the security-stamp validation on top of them. Losing the schemes is the point; losing the validation is not, which is why the event is wired back by hand. The session's lifetime moves out of code in the same step. The old host set it in the provider's own options block, as `options.Authentication.CookieLifetime = TimeSpan.FromHours(2)` beside the protocol settings; it now sits in `appsettings.json` under a `Session` section that binds onto the cookie options, and holds two keys: `ExpireTimeSpan`, the same two hours written as a duration, and `SlidingExpiration`, off. How long a session lives is a deployment decision, and a deployment should be able to shorten it without a rebuild. The validation event stays in code deliberately: it is behavior rather than a setting, and a deployment able to switch it off is a deployment able to keep locked-out users signed in without saying so. Why not keep the full registration and point the library at Identity's scheme, which would bring the stamp validation back with it? The adapter does take a scheme name, so the wiring is possible; what does not survive is the claim shape. The library writes the session itself, as a subject, a session id and an authentication time, because those are what it reads back on the next authorization request. Identity's sign-in manager writes a different principal, keyed on a name identifier and carrying the security stamp. Point the validator at a cookie the library wrote and it finds neither the user id it looks for nor a stamp to compare, so it rejects every session it inspects. Point the library at a cookie Identity wrote and there is no session id or authentication time to rebuild from. That is why the two halves are split the way they are, and why the protection had to be re-expressed rather than inherited. It is also why the sign-in path uses the check that applies lockout without issuing a cookie: Identity verifies the password, the library records who signed in, and exactly one component owns the session. In the login action that is one line: the check that applies lockout without issuing a cookie, in place of the one that signs the user in. ## Consent: the step that was empty, and why that is not general eShop registers every client without consent, and Abblix's default consent provider grants automatically, so this step needed no work. That is true for first-party clients and stops being true the moment you have third-party ones. The defaults differ for a storage reason. Duende persists consent decisions in its grant store, so remembered consent works as soon as the storage package is installed and configured. Abblix has no store to remember anything in, so consent is a provider you implement, together with its storage and its screen. Register it before the library's registration call, so that the decorator the library wraps around the registered provider - the part that honours `prompt=consent` - wraps yours. Existing consent decisions do not migrate either. If you rely on remembered consent, plan it as a feature to rebuild and size it before you start. It is the largest thing on this page that eShop did not need. ## Logout eShop's Duende host had a logout controller, a logout prompt, a logged-out page and an identifier threaded through all three. In this migration all of it was deleted, because the storefront signs out with an identity token hint and the end-session endpoint can act on that alone: it validates the request, terminates the session itself, notifies the other clients in the session over the back channel and the front channel, and redirects to the client's post-logout address. What was deleted is the interaction contract, not the confirmation. [RP-Initiated Logout](https://www.abblix.com/en/docs/glossary-overview#rp-initiated-logout) requires the provider to ask the user when no `id_token_hint` accompanies the request, and Abblix enforces it: the end-session endpoint answers `confirmation_required` until the host echoes the user's confirmation back. A client that sends the hint never triggers it, and the ASP.NET Core handler attaches one whenever the identity token was saved, which is what `SaveTokens` buys and what eShop sets. That is why eShop ships no logout page at all. If your clients can reach the endpoint without a hint, the confirmation page is host code, the same way the login page is. ## Signing keys: the library will not make one for you Duende's developer signing credential writes a key file and reuses it, and its key management feature rotates keys in a signing-key store of its own - a key directory on disk by default, a table of its own when you configure EF storage. Abblix does neither: it never generates a signing key and has no store to keep one in. Keys are configuration you supply, or a provider you implement over wherever your keys actually live. The seam has first-party custodians for HashiCorp Vault / OpenBao Transit and Azure Key Vault, in either of two postures: the keys live inside the vault, non-exportable, and every signature is a vault round-trip - or they are minted in-process and sealed to a vault key, so signing stays local and only sealed copies leave the process. Rotation comes with them, on the vault's own policy or on a schedule the server drives. So supplying the key is a decision the migration has to make explicitly, and the host says so at startup: with neither a key in configuration nor a provider registered, it stops while mapping its endpoints, naming both ways to supply one. One call goes away: `AddDeveloperSigningCredential`, which the sample's own comment described as not recommended for production. What replaces it is a class the host owns. The key lives in the identity database, generated on first use, with the insert guarded, because two replicas starting cold would otherwise each mint a key and disagree about which one signs. The guard is a PostgreSQL advisory lock. The provider opens a transaction, takes `pg_advisory_xact_lock` on a constant lock id, and only then re-reads the signing key table, oldest row first. Finding a key there means another instance won the race, and the provider returns that key; finding none means it generates one, saves it, and commits. The whole sequence runs inside an execution strategy obtained from `CreateExecutionStrategy`. Two details in there came out of running it. The advisory lock is transaction-scoped, so it is released by the commit and needs no cleanup path. And the whole thing sits inside an execution strategy because the Aspire Npgsql integration turns on retries, and a retrying strategy requires the transaction to be opened through it. Two other places were considered and rejected. A key file on disk would mirror the developer credential it replaces, but the application runs in containers, where a file written into the image layer is gone on the next start and a mounted volume is one more thing to provision. A key in configuration would put a private key in a settings file, which is exactly the habit a reference application should not teach. Encrypting the stored key with the data protection stack was considered and deliberately not done: the key ring then needs its own persistence and its own protection, which is a second migration this sample does not need to teach. One property of that class does not scale with the rest of it. The library resolves the signing key for every token it signs and for every key-set request, and caches nothing, so this provider reads the database on both paths. For a demo it is invisible. Anything real caches the key inside the provider and invalidates on rotation. The database row is what it is - the posture of a developer signing credential, not a production answer. Production keeps the private key in a key management service or an [HSM](https://www.abblix.com/en/docs/glossary-overview#hsm), which is what the custodian packages above are for. Writing your own provider against the same seam stays an option, and then rotation is yours to run: a new key id, an overlap window covering your longest token lifetime, then retirement. It is worked through in [persisting JWT signing keys in production](https://www.abblix.com/en/docs/signing-key-persistence), alongside the multi-instance startup the guard above addresses. The library stays out of it because where a signing key lives decides who can read it, how it rotates, and what a compromise costs, and those answers differ between a laptop, a container and a regulated environment. A library that owns key storage has to be told to stop before the key can move into an HSM; exposing the seam from the start costs one small class. Nothing else breaks. Resource servers that resolve keys from the discovery document pick up the new key set on their next refresh with no configuration change. Only a service pinning a static key or a hardcoded path needs touching - and if you find one, fixing it during the migration is cheaper than after. ## Operational state belongs in a cache Authorization codes, pushed authorization requests and interrupted login sessions need somewhere to live between two HTTP requests. Abblix uses the standard distributed cache abstraction. The in-memory implementation is single-node only, and this is a production requirement: across two replicas, a code issued by one instance is unknown to the other, and the token exchange fails for whichever request lands on the wrong node. eShop already runs Redis, so pointing this at it is a one-line change when the demo becomes a deployment. One decision travels with that change: entries reach the cache as the store hands them over, so a cache shared with other workloads wants encryption at the storage seam. Why a cache and not tables. Duende keeps authorization codes in its persisted-grant table and pushed requests in a table of their own - schema, migrations, and a cleanup job it ships behind a flag - while an interrupted login is not stored at all: it rides in the return URL. Every value here is short-lived and single-use, which is what a cache with an expiry models; expiry becomes the store's job. The trade is that you must configure a shared and durable cache yourself, because the default distributed cache is not distributed. ## One decision that was not about the migration at all Reading the user store closely enough to write the claims provider surfaced something unrelated: the application never configures the password hasher, so its work factor is whatever the framework default happened to be on the day it was written. So the iteration count moves into `appsettings.json`, as a `PasswordHasher` section with a single `IterationCount` of 220,000, and the reason for the number is written beside it in a comment rather than left for somebody to reconstruct: the OWASP figure for the algorithm actually in use, against a framework default that does not move when the guidance does. Three things decide that number and all three are checkable. The algorithm is PBKDF2 with HMAC-SHA512, which is what Identity's version 3 hashing uses and what the stored hash header says. OWASP publishes a per-algorithm iteration count, and for that pairing it currently reads 220,000; the figure for SHA-256 is different, so the row has to be chosen by the algorithm in use. And the framework's own default is 100,000, which is not wrong so much as fixed: it was chosen once and does not follow the guidance, which is exactly the argument for stating the value instead of inheriting it. Password hashing is the parameter that has to move over a decade, which is the argument for stating it where a deployment can raise it. Then verify it. Decoding an actual stored hash from the running database confirms the format, the per-user random salt, the hash function, and that the configured iteration count is the one that was used. Reading it from the row is a check that can fail. Reading it from the documentation is not. ## What did not change, and how that was confirmed No resource server was modified and no authority URL changed anywhere. The client libraries moved only with the platform: the same pass that took the repository to the current .NET 10 release carried the OpenID Connect and JWT bearer handlers with it, which is servicing rather than migration. What the migration itself changed in the clients is four statements, a pair in each of the two client set-ups: each application now states the scopes it requests in full instead of extending the handler's default list, and the storefront's list includes `address`. Nothing else in a front end or an API was touched. The mobile application was not edited at all; what was dropped is its registration on the server, and restoring those few registry lines is what it needs before it can sign in again. The rest was confirmed by running the fork end to end rather than asserting it. Signing in redirects to the new login page and back, on both clients. The checkout form prefills the shipping address from claims, which exercises the whole chain from the scope declaration through the claims provider to the identity token the storefront consumes. Adding an item to the basket exercises a gRPC service validating a token this server issued - the basket write, note, since the read is anonymous. Placing an order exercises a second service and produces a real order. Signing out through the end-session endpoint returns the site to its anonymous state. The CORS list was checked the way a list of permitted things has to be: from both sides. A request carrying a registered client's origin comes back with that origin echoed, and one carrying a stranger's comes back with no such header at all. Only the pair proves anything, because a policy that has stopped working also refuses the stranger. The endpoint paths eShop actually uses came out identical to the previous host. The key set did not: it sits at `/.well-known/jwks` rather than under the discovery path. Nothing noticed, because every consumer takes `jwks_uri` from the discovery document - which is the real lesson. Verify the paths against your own client set rather than assuming them, and treat any client that hardcodes one as a finding. ## Does the result still match the backend-for-frontend pattern Check this after any provider swap, because the pattern's guarantees live partly in the client and partly in what the provider allows. The [OAuth for browser-based applications draft](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-browser-based-apps) gives the backend for a frontend three responsibilities, and eShop's storefront satisfies all three after the migration. It acts as a confidential client: registered with credentials, using the authorization code flow with PKCE. Tokens are never handed to browser script: the storefront renders server-side, the access token is read from the authentication ticket on the server and attached as a bearer header by a delegating handler. And it is the component that forwards requests to the resource servers, adding the token on the way. One shape the draft explicitly supports, one set of inherited deviations, and one point of compliance that was checked: - The tokens live inside the authentication cookie rather than in a server-side store. The draft supports this shape - a client-side session, which it asks to be encrypted, and this cookie is encrypted and HttpOnly - so it is a supported variant rather than a violation. A server-side ticket store is the stricter form, trading scale for tighter session control. - The session cookie's attributes are a host decision that the swap does not make for you, and the draft names four: `Secure` and `HttpOnly` as MUSTs, `SameSite=Strict`, and a `__Host-` prefix. `HttpOnly` holds by default and the sample leaves the rest to the default cookie policy, so a deployment states all four in one place. - Cross-site request forgery protection holds: the antiforgery middleware is in the pipeline and the form handlers are named, which is what makes the logout post safe. ## What to expect at cutover The first of these happens whether you plan for it or not. The other five are decisions to make before the switch, not after. - Everybody signs in again. Access and refresh tokens minted by the previous server are not honoured, and a live session cookie carries a user across only if the cookie scheme is unchanged - which the cookie decision above changes. Schedule the switch as a user-visible event, the way a key rotation is scheduled. - Decide whether you need a license at all. With none configured the server runs on the free tier: one issuer, and no ceiling on client applications, users or nodes, with every protocol available. eShop's registry fits, and so does most of what a single company runs. A license is what you buy when the company passes the free thresholds or a second independent issuer is genuinely needed. If you do supply one, set it from a secret rather than a settings file, and alert on the license log events: [production hardening checklist](https://www.abblix.com/en/docs/production-hardening-checklist). - Issue one secret per client. Both eShop registrations carry the same hash, inherited from a sample that used one string everywhere; a secret shared by two consumers cannot be rotated for either of them. - Inventory the endpoints you turned off. Anything that calls introspection, revocation, dynamic client registration, check session, backchannel authentication ([CIBA](https://www.abblix.com/en/docs/glossary-overview#ciba)) or device authorization gets a 404 on the day, so grep your resource servers and partners before it rather than after. - Build the consent provider first if you have third-party clients. Until it exists every client is auto-granted, so a client that used to see a consent screen receives tokens without one. - Decide what you alert on. Structured logging exists on both sides, with a numbered event identifier per event, and that is what dashboards are built on; the persisted audit trail Duende ships is on the [roadmap](https://www.abblix.com/en/docs/product-roadmap). Token-endpoint error rates, the license events and key-loading failures are the three worth having on the first day. ## The persistence you now own Three seams ship with in-memory or pass-through defaults that are honest for a demo and are not a production answer; eShop replaced none of them, and its one piece of genuinely durable state was the signing key store above. A production system usually replaces all three: - The client store. A read interface and a write interface, served from configuration here - enough for a fixed set of first-party applications. A system that registers clients at runtime backs them with a database, and the schema, indexing and caching are yours. Abblix's own implementation is short enough to read in one sitting; see [the durable client store guide](https://www.abblix.com/en/docs/durable-client-store). - Consent storage, if you need consent remembered, as described above. - A refresh-token inventory, if you need to [enumerate or revoke active grants](https://www.abblix.com/en/docs/token-inventory-and-revocation) - including the is-active replacement discussed earlier. This is the one of the three that is security code rather than data access, because what it answers decides whether a presented token is still good: rotation with reuse detection revokes the old token and issues the new one in one step, or a stolen token is replayable in the gap. Rotation is on unless a client turns it off, so what to check here is that nothing in your registry turns it off. First-party Entity Framework Core and ASP.NET Identity stores are on the [roadmap](https://www.abblix.com/en/docs/product-roadmap) for Q4 2026. Until they land, this adapter layer is the part of a migration that is genuinely code. ## What this migration says about yours The work divided unevenly, and not where the estimate would have put the line. Translating the registry, the endpoints and the packages was only an afternoon, and none of it needed a decision. Nothing outside that project moved: no resource server was modified, and no authority URL changed anywhere. What took the time was four questions the library declines to answer: where a claim lives once a scope has to declare it, which component owns the session, where the signing key sleeps, and what a lockout is still supposed to reach once the session is no longer Identity's. Each has several defensible answers, and which one is right depends on the system rather than on the protocol. A student or pet project settles all four in an afternoon and is right to. A bank or a telecoms operator answers the same four against auditors, key custody rules and a fleet of instances, arrives somewhere else entirely, and is equally right. A provider that picked for either of them would be a provider the other one argues with. So the useful estimate is how many of those questions your system has already answered, and how loudly it would tell you if one of them were answered wrong. Here neither the build nor the test suite had anything to say about any of the four, and each was settled by running the application and watching what it did. That is the part worth copying, whichever provider you land on. ## Run it yourself The fork is [Abblix/eShop](https://github.com/Abblix/eShop), and its `main` is the migrated application: clone it and run it. The change also stands on its own as [one pull request](https://github.com/Abblix/eShop/pull/1) against the last upstream commit, so the whole diff is one page, and the branch behind it keeps the steps as separate commits in the order this page describes. You need Docker Desktop running and the .NET 10 SDK. Everything else is orchestrated: ```bash git clone https://github.com/Abblix/eShop.git cd eShop dotnet run --project src/eShop.AppHost/eShop.AppHost.csproj ``` The console prints a login link for the Aspire dashboard, which lists every service and its address. Sign in to the storefront as `alice` with `Pass123$`, and the path this page describes runs in front of you: the login page is the host's own, the checkout form fills itself from claims the provider issued, and the basket write goes through a gRPC service that validated the token on its own. ## Next steps - [Getting Started](https://www.abblix.com/en/docs/getting-started-guide) - the full setup, from services to endpoints. - [ASP.NET Identity integration](https://www.abblix.com/en/docs/aspnet-identity-integration) - the user store wiring on its own. - [An Alternative to IdentityServer4 and Duende](https://www.abblix.com/en/docs/duende-identityserver-alternative) - why teams move and what Abblix offers. - [OpenIddict vs Duende IdentityServer vs Abblix OIDC Server](https://www.abblix.com/en/docs/comparison-duende-openiddict) - the feature-by-feature comparison, trade-offs included. --- *IdentityServer and Duende IdentityServer are products of Duende Software; the names are used here only to identify those products. Abblix is not affiliated with, sponsored by or endorsed by Duende Software. All other product names belong to their respective owners.* --- Source: https://www.abblix.com/en/docs/tokenized-routing-dotnet.md # Dynamic Routes ## Introduction Deploying the same ASP.NET Core app to dev, staging, and production usually means different route prefixes per environment, especially when deploying to Docker, Kubernetes, or CI/CD pipelines. But with ASP.NET Core's default static routing model, customizing routes across environments can become error-prone and hard to trace. This article introduces tokenized routing and runtime route resolution as implemented in the Abblix OIDC Server, a certified OpenID Connect library for .NET. These techniques allow you to define route templates using configuration tokens, customize them per environment, and resolve accurate URLs at runtime: all without changing code. You'll learn: - Why traditional routing falls short in modern deployments - How tokenized route templates work and how to configure them - How to resolve runtime URIs programmatically - How it all integrates with OpenID Connect discovery and Swagger If you deploy one app to several environments, this removes hardcoded paths and config drift. That covers multi-tenant setups that need dynamic endpoints and projects whose OpenID Connect metadata or Swagger docs must reflect accurate, runtime-resolved URIs. ## The problem we're solving Each environment may require different route prefixes or endpoint structures due to varying infrastructure, network policies, or gateway configurations. Traditionally, routing in ASP.NET Core is configured statically in code via route attributes or configuration files. This rigid approach introduces several problems: - Duplication and drift: routes are hardcoded across controllers, tests, OpenID discovery metadata, Swagger docs, and external clients, leading to mismatches and maintenance overhead. - Inflexibility: customizing routes for different environments often requires code changes, recompilation, and redeployment, which is error-prone and time-consuming. - Lack of observability: there's no unified way to verify what actual routes the system is using at runtime, making diagnostics and integration testing harder. ## Dynamic routing overview The routing system in the Abblix OIDC Server consists of two tightly integrated components: - Tokenized Route Configuration: allows route templates in controller attributes to include placeholders like `[route:token?fallback]`, resolved from external configuration sources. - Dynamic Route Resolution: provides a runtime mechanism to determine the final, resolved URL of any controller action. Tokenized configuration makes it easy to tailor routing per environment, while dynamic resolution ensures consistent output in OpenID Connect discovery metadata and tools like Swagger. ## Dynamic routing details Routes can now be declared using a custom placeholder syntax: ``` [route:token?fallback] ``` Where the `token` is the configuration key to look up, and `fallback` is used if that key is missing. Tokens can also be nested and resolved recursively. Here is a real-world example from the Abblix OIDC Server's `AuthenticationController`: ```csharp [HttpGet("[route:authorize?[route:base?~/connect]/authorize]")] public async Task AuthorizeAsync(...) { ... } ``` This attribute instructs the framework to resolve the route using configuration values. If no configuration is found for `authorize`, it falls back to `[route:base]/authorize`, which in turn defaults to `~/connect/authorize`. Given the configuration: ```json "Routes": { "base": "~/api", "authorize": "[route:base]/authorize" } ``` The `[route:authorize]` token will resolve to `[route:base]/authorize`, and finally to `~/api/authorize`. This demonstrates how tokens can reference other tokens. It is especially valuable in multi-tenant systems or CI/CD pipelines targeting multiple stages. ## How it works internally The `ConfigurableRouteConvention` is registered as an `IApplicationModelConvention` and executes once during application startup. It applies a custom rule to all [MVC controller](https://www.abblix.com/en/docs/glossary-overview#mvc-controller) actions to transform route attributes containing token placeholders like `[route:token?fallback]` into final resolved paths. ### Under the hood The resolution process begins by inspecting the `ApplicationModel`, which provides metadata for all controllers and actions. For each controller action, the convention checks whether the `AttributeRouteModel.Template` contains any `[route:` syntax. If so, it uses a regular expression to identify all `[route:token?fallback]` patterns, including those nested within other tokens. Next, it recursively resolves each token using values from the provided `IConfigurationSection`. These values can come from any ASP.NET Core configuration source. If a token refers to another token, that reference is resolved before substitution. Once all tokens are resolved, the placeholders are replaced with the final route strings. The updated values are written back into the `AttributeRouteModel`. ASP.NET Core then builds its route table from the final paths. Optionally, the entire resolution process can be logged for observability and troubleshooting. ### Behavior based on configuration The behavior of route token resolution depends on whether `ConfigureRoutes` is called at application startup. If you call `ConfigureRoutes` with a specific configuration section, route tokens will be resolved strictly from that configuration. If a token is missing and no fallback is defined, the application will throw a startup exception, so incomplete configuration surfaces at startup, not after deployment. Fallbacks, if provided in the token syntax, are used to fill in missing values. If you do not call `ConfigureRoutes`, then the application will skip configuration-based resolution entirely. Instead, it will resolve all tokens using only their fallback values, if defined. This is a safe default for development or environments where full routing configuration is not required. ## How Abblix OIDC Server uses it The Abblix OIDC Server applies tokenized routing to all core endpoints using centralized constants (defined in `Path.cs`). These constants incorporate `[route:token?fallback]` templates, which are resolved at startup via the `ConfigurableRouteConvention`. This approach keeps all route logic consistent and easy to override via configuration. In production, routes can be overridden via `appsettings.json`, environment variables, or Kubernetes ConfigMaps. Regardless of how they're configured, they are made discoverable to clients through the OpenID Connect metadata manifest. To ensure runtime consistency, the server uses `IEndpointResolver` to dynamically resolve controller action paths. This is especially important for OIDC discovery endpoints, which must accurately reflect real routes used by the system. ## Route reference summary Most endpoint routes follow this pattern: ``` [route:token?[route:base?~/connect]/...] ``` Where `base = ~/connect` by default. ### Routes by controller #### AuthenticationController | Endpoint | Route Constant | Tokens Used | | ---------------------------- | -------------------------------- | ---------------------- | | Authorization | `Path.Authorize` | `authorize`, `base` | | [Pushed Authorization Request](https://www.abblix.com/en/docs/glossary-overview#par) | `Path.PushAuthorizationRequest` | `par`, `base` | | UserInfo | `Path.UserInfo` | `userinfo`, `base` | | EndSession | `Path.EndSession` | `endsession`, `base` | | CheckSession | `Path.CheckSession` | `checksession`, `base` | | BackChannel Authentication | `Path.BackChannelAuthentication` | `bc_authorize`, `base` | | Device Authorization | `Path.DeviceAuthorization` | `deviceauthorization`, `base` | #### TokenController | Endpoint | Route Constant | Tokens Used | | ------------- | -------------------- | -------------------- | | Token | `Path.Token` | `token`, `base` | | Revocation | `Path.Revocation` | `revoke`, `base` | | Introspection | `Path.Introspection` | `introspect`, `base` | #### ClientManagementController | Endpoint | Route Constant | Tokens Used | | -------- | --------------- | ------------------ | | Register | `Path.Register` | `register`, `base` | #### DiscoveryController | Endpoint | Route Constant | Tokens Used | | ------------- | -------------------- | ----------------------------- | | Configuration | `Path.Configuration` | `configuration`, `well_known` | | [JWKS](https://www.abblix.com/en/docs/glossary-overview#jwks) Keys | `Path.Keys` | `jwks`, `well_known` | ### Token reference map | Token | Default Value (Fallback) | Description | | --------------- | ----------------------------------------- | -------------------------------- | | `base` | `~/connect` | Common prefix for most endpoints | | `authorize` | `[route:base]/authorize` | Authorization endpoint | | `par` | `[route:base]/par` | Pushed Authorization Request | | `userinfo` | `[route:base]/userinfo` | User Info endpoint | | `endsession` | `[route:base]/endsession` | Logout endpoint | | `checksession` | `[route:base]/checksession` | Session iframe endpoint | | `bc_authorize` | `[route:base]/bc-authorize` | [CIBA](https://www.abblix.com/en/docs/glossary-overview#ciba) Backchannel Authentication | | `deviceauthorization` | `[route:base]/deviceauthorization` | Device Authorization endpoint | | `token` | `[route:base]/token` | Token issuance | | `revoke` | `[route:base]/revoke` | [Token revocation](https://www.abblix.com/en/docs/glossary-overview#token-revocation) | | `introspect` | `[route:base]/introspect` | [Token introspection](https://www.abblix.com/en/docs/glossary-overview#token-introspection) | | `register` | `[route:base]/register` | [Dynamic client registration](https://www.abblix.com/en/docs/glossary-overview#dynamic-client-registration) | | `well_known` | `~/.well-known` | Prefix for discovery metadata | | `configuration` | `[route:well_known]/openid-configuration` | OIDC metadata path | | `jwks` | `[route:well_known]/jwks` | JWKS public key set | ## How to use By default, if no explicit call to configure routing is made, fallback values will be used. Use this during development or testing where no route customization is needed. Apply the configuration in production or staging by calling the `ConfigureRoutes` extension: ```csharp services.ConfigureRoutes(Configuration.GetSection("Routes")); ``` If any required token is missing and no fallback is provided, the application will fail to start. The exception message will identify the unresolved token and indicate the source of the misconfiguration. ## Environment-specific configuration ### Local development ```json "Routes": { "base": "~/dev", "authorize": "[route:base]/authorize", "token": "[route:base]/token", "userinfo": "[route:base]/userinfo", "endsession": "[route:base]/endsession", "revoke": "[route:base]/revoke", "introspect": "[route:base]/introspect", "register": "[route:base]/register", "configuration": "[route:well_known]/openid-configuration", "jwks": "[route:well_known]/jwks", "well_known": "~/.well-known" } ``` ### Docker Compose ```yaml services: oidc-server: image: ... environment: Routes__base: "~/docker" Routes__authorize: "[route:base]/authorize" Routes__token: "[route:base]/token" Routes__userinfo: "[route:base]/userinfo" Routes__endsession: "[route:base]/endsession" Routes__revoke: "[route:base]/revoke" Routes__introspect: "[route:base]/introspect" Routes__register: "[route:base]/register" Routes__configuration: "[route:well_known]/openid-configuration" Routes__jwks: "[route:well_known]/jwks" Routes__well_known: "~/.well-known" ``` ### Kubernetes ```yaml apiVersion: v1 kind: ConfigMap metadata: name: abblix-oidc-config namespace: default data: Routes__base: ~/kube Routes__authorize: "[route:base]/authorize" Routes__token: "[route:base]/token" Routes__userinfo: "[route:base]/userinfo" Routes__endsession: "[route:base]/endsession" Routes__revoke: "[route:base]/revoke" Routes__introspect: "[route:base]/introspect" Routes__register: "[route:base]/register" Routes__configuration: "[route:well_known]/openid-configuration" Routes__jwks: "[route:well_known]/jwks" Routes__well_known: "~/.well-known" ``` ```yaml containers: - name: oidc-server image: abblix/oidc-server:latest envFrom: - configMapRef: name: abblix-oidc-config ``` ## Runtime URI resolution You can also use `IEndpointResolver` to resolve final URIs for your controller actions: ```csharp var uri = endpointResolver.Resolve("Authentication", "AuthorizeAsync"); ``` ### Resolution mechanics The provided `IEndpointResolver` implementation relies on ASP.NET Core's routing infrastructure to identify the actual runtime URLs of controller actions. It starts by querying the `EndpointDataSource`, which contains all routes available in the application after MVC conventions and middleware have been applied. From this data source, it filters endpoints based on `ControllerActionDescriptor`, matching the controller name and method name using a case-insensitive comparison. Once the appropriate action is found, it extracts the final route pattern from `RoutePattern.RawText`. That raw template is then converted into a fully qualified URI by `IUriResolver`, which resolves it against the application's base address and the current request context. The result is a complete URL that reflects the currently active route configuration. This includes routes defined statically, those resolved from tokenized configuration, and those transformed by MVC conventions. ### Integration with DiscoveryController The `IEndpointResolver` is already used within the `DiscoveryController` to dynamically populate the OpenID Connect metadata manifest. This includes resolved URIs for every endpoint the metadata manifest lists. As a result, the [discovery document](https://www.abblix.com/en/docs/discovery-and-well-known-endpoints) remains synchronized with the resolved route configuration, which improves client interoperability and reduces the risk of mismatches. OpenID Connect clients and Swagger tooling always see URIs that match the real routes. ## Why integration matters On one side, route templates are resolved at startup based on environment-specific settings. On the other, the resolved routes are programmatically exposed at runtime. This eliminates the gap between how endpoints are configured and how they're communicated to clients. It improves consistency, as OpenID Connect clients, Swagger UI, and other tooling always receive accurate and up-to-date URIs. Developers benefit from cleaner code without hardcoded paths, and operations teams gain confidence that deployments reflect the right routing rules. ## Best practices To get the most from tokenized routing, define all routes in configuration for consistency and clarity. During development, fallback-only mode provides flexibility, while strict mode should be used in production to catch misconfigurations early. Instead of hardcoding URLs, always resolve endpoint URIs via `IEndpointResolver`. When troubleshooting, review startup logs to trace how route tokens are resolved and which fallbacks (if any) are applied. ## Summary `ConfigurableRouteConvention` resolves token placeholders at startup (before ASP.NET Core builds its route table) so every environment gets its correct paths without a code change. `IEndpointResolver` reads those resolved routes back at runtime, giving the OIDC discovery document and Swagger accurate URIs regardless of how you deployed. The practical result: route config lives in `appsettings.json`, environment variables, or a Kubernetes ConfigMap; the application adapts on startup; and external clients always get the right endpoints from the discovery document. No hardcoded paths, no config drift between environments. --- Source: https://www.abblix.com/en/docs/signing-key-persistence.md # Persisting JWT Signing Keys in Production ## Overview Abblix OIDC Server signs JWT tokens using keys supplied through the `IAuthServiceKeysProvider` contract, empty by default. In any multi-instance deployment or across process restarts, this default is unsafe: unless the host provisions persistent, shared signing keys, instances will issue tokens that other instances or future restarts cannot validate. The result is intermittent `invalid_token` errors and mass logouts under rolling deploys. This guide covers the `IAuthServiceKeysProvider` contract, the three production failure modes caused by ephemeral or per-instance keys, three storage recipes (static secret, Redis-backed, database-backed), encrypting the stored key at rest, the key rotation discipline, and a verification test suitable for CI. ## Scope: signing keys, not Data Protection Before anything else, a disambiguation worth a minute of your time. ASP.NET Core Data Protection is the framework service that protects cookies, anti-forgery tokens, and `TempData`. Its key storage is a separate concern, configured via `services.AddDataProtection().PersistKeysTo...()`. If you've read that .NET teams routinely lose production Data Protection keys on restart and wonder whether that applies to Abblix, the answer is: it does not, because the library does not route signing through Data Protection. Abblix OIDC Server signing keys are the JSON Web Keys ([JWKs](https://www.abblix.com/en/docs/glossary-overview#jwk)) used to sign ID tokens, access tokens, and refresh tokens. They live behind a dedicated library contract, `IAuthServiceKeysProvider`. Both problems have the same shape (a key store that must survive restarts and be shared across pods) and both failure modes look identical from the outside (random authentication errors, phantom logouts). But the remedies are unrelated. Configuring Data Protection persistence does not persist your signing keys. You have to do both. The rest of this article is about the signing-key side; Data Protection returns only later, as a tool for encrypting that key at rest, never for its own cookie and anti-forgery duties. ## The library contract Abblix OIDC Server exposes signing-key access through a small interface. `IAuthServiceKeysProvider` has two methods, `GetSigningKeys` and `GetEncryptionKeys`, each returning an `IAsyncEnumerable` and each taking one flag, `includePrivateKeys`, which defaults to false: the public half is what the JWKS endpoint publishes, the private half is what the signer asks for. ```csharp public interface IAuthServiceKeysProvider { IAsyncEnumerable GetEncryptionKeys(bool includePrivateKeys = false); IAsyncEnumerable GetSigningKeys(bool includePrivateKeys = false); } ``` `IAsyncEnumerable` is deliberate. Retrieval may hit a cache, a [Redis](https://www.abblix.com/en/docs/glossary-overview#redis) hash, a database table, or an external [KMS](https://www.abblix.com/en/docs/glossary-overview#kms). The library does not assume synchronous in-memory access. The default implementation is `OidcOptionsKeysProvider`, which reads from `IOptions` - two collections of `JsonWebKey`, `SigningKeys` and `EncryptionKeys`. The default value of both properties is an empty collection. That is not a sensible production default, and it is not meant to be. The library ships an escape hatch (the options) and an extension point (the interface), and expects the host to choose which one to use before going live. The XML documentation on `OidcOptionsKeysProvider` says this out loud: > It is recommended to implement a dynamic resolution mechanism in production environments to enable seamless certificate replacement without the need for service reloading. ## Production failure modes Three concrete scenarios motivate the recipes in the rest of this guide. Each produces authentication errors that look random until you know the cause. ### Multi-pod key divergence A Kubernetes Deployment runs three pods of your auth-service. Each pod's startup code calls something like `JsonWebKeyFactory.CreateRsa()` to populate `OidcOptions.SigningKeys`. Each pod independently generates a different key pair. The three pods now have three different `jwks_uri` responses, three different sets of `kid` values, and three different private keys signing tokens that are all presented to the same load balancer. The user impact is intermittent 401 errors that correlate with nothing the user can control. Sticky sessions partially mask the problem; a rolling deploy exposes it. Your tracing shows nothing in application code. The only clue is that failures correlate with the `kid` claim on the token not matching the verifying pod's published [JWKS](https://www.abblix.com/en/docs/glossary-overview#jwks). Diagnosis is slow because the usual suspects (token expiry, clock skew, incorrect audience) all check out. ### Restart invalidates every token A single-pod deployment has keys generated at process start. Every refresh token in circulation is signed by the current process's in-memory private key. A rolling restart, a liveness-probe kill, or a Kubernetes eviction replaces the process. New keys, new `kid` values, and every refresh token that was valid a minute ago is now unrecognized. Users experience a mass logout. Mobile apps start retrying refresh, hit the auth endpoint harder than steady state, and some teams accidentally DoS themselves during a routine deploy. ### Keys in Git The third failure mode is avoided by engineers who know not to commit `.pem` files, but it keeps appearing in leaked-secrets audits anyway. A developer pastes a [JWK](https://www.abblix.com/en/docs/glossary-overview#jwk) into `appsettings.Development.json`, copies that file into `appsettings.Production.json` to "unblock staging", and a month later somebody greps the repo history and finds a live production private key in a commit. The code works. The deploy works. The security review three quarters later finds the key. ## Recipe A: static keys from a shared secret This is the simplest production-grade setup, appropriate when you have a small number of pods, a stable key set, and no strict rotation SLA. Keys live in a Kubernetes Secret (or Vault, or AWS Secrets Manager) and are mounted into every pod as an environment variable or file. All pods read the same keys at startup and never change them until a planned rotation. Generate a [JWK](https://www.abblix.com/en/docs/glossary-overview#jwk) once, store it in your secret manager, and load it through configuration: inside the `AddOidcServices` options delegate, read the environment variable holding the JWK - `ABBLIX_SIGNING_JWK` below - deserialize it into a `JsonWebKey`, and assign it to `options.SigningKeys`. Read both steps as mandatory - a missing variable and unparsable JSON each throw at startup, naming the variable, rather than leaving the collection empty and the failure for the first token request. ```csharp services.AddOidcServices(options => { var jwkJson = Environment.GetEnvironmentVariable("ABBLIX_SIGNING_JWK") ?? throw new InvalidOperationException("ABBLIX_SIGNING_JWK is required."); var jwk = JsonSerializer.Deserialize(jwkJson) ?? throw new InvalidOperationException("ABBLIX_SIGNING_JWK is not valid JSON."); options.SigningKeys = new[] { jwk }; }); ``` The corresponding secret (Kubernetes example): ```bash kubectl create secret generic abblix-signing-key \ --from-literal=ABBLIX_SIGNING_JWK="$(cat signing-key.jwk.json)" \ --namespace=production ``` And the Deployment references it: ```yaml env: - name: ABBLIX_SIGNING_JWK valueFrom: secretKeyRef: name: abblix-signing-key key: ABBLIX_SIGNING_JWK ``` What this buys you: - Every pod sees the same keys at startup. No multi-pod divergence. - A pod restart reads the same secret and produces the same `jwks_uri`. Existing tokens remain valid. - The key never appears in git, in a built image, or in a runtime memory dump anyone can trivially grab. What this does not buy you: - Automatic rotation. A new key requires a manual secret update and a restart. - Graceful overlap during rotation. Unless you deliberately publish both the old and the new key for a window, clients will see [JWKS](https://www.abblix.com/en/docs/glossary-overview#jwks) churn and existing tokens may stop validating. For teams with low-volume auth traffic and rotations measured in months, Recipe A is often the right answer. For high-volume services with compliance-driven rotation policies, read on. :::note[Why not just put the JWK in appsettings.Production.json?] Two reasons. First, application settings files typically end up in your build artifact, Docker image, or deployment manifest, all of which are easier to accidentally leak than a secret manager entry. Second, `appsettings.*.json` is not designed for secrets and most organizations' scanning tooling does not treat it as such. Keep private keys in a dedicated secret store, always. ::: ## Recipe B: Redis-backed provider When rotation is frequent, or when you want the ability to swap keys without a deploy, a Redis-backed provider gives you a shared, out-of-process key store that every pod reads from on demand. The library deliberately does not depend on any particular Redis client, so the host owns the dependency. That keeps Abblix OIDC Server free of transitive weight for teams who use a different backend, and it keeps version conflicts from forcing your hand. The shape of such a provider, given a host that has `StackExchange.Redis` available and an `IConnectionMultiplexer` registered: a class implementing `IAuthServiceKeysProvider` whose two methods differ only in which hash they read, both delegating to one private reader. That reader fetches the whole hash, deserializes each field value into a `JsonWebKey`, logs and skips a malformed entry instead of failing the whole read, and yields each key through `Sanitize(includePrivateKeys)` - the call that strips the private half unless the caller asked for it, so the same store serves the JWKS endpoint and the signer. Host registration is `AddSingleton` after `AddOidcServices()` so it overrides the library default, with `SigningKeys` in the options left empty. What to put in Redis: - A hash per key-usage (one for signing, one for encryption). - Each field is a `kid`, each value is the full [JWK](https://www.abblix.com/en/docs/glossary-overview#jwk) serialized as JSON. - A separate small wrapper job (or an admin UI) adds new keys and retires old ones on schedule. Performance note: a production-quality Redis provider caches the result of that read in-process for a short TTL (five to thirty seconds is typical). Reading Redis for every token-sign operation is unnecessary overhead, because keys rotate on human timescales, not per-request. Implement the cache with `IMemoryCache` or equivalent, and invalidate on a simple Redis pub/sub signal if you need sub-minute propagation. The library carries no Redis client dependency, so a Redis provider is host-owned code that pulls in `StackExchange.Redis` itself. The runnable sample in the repository is the database-backed recipe below, not this one; the Redis shape mirrors it, swapping the table query for a hash read. ## Recipe C: database-backed provider The library does not prescribe an ORM, and neither does this recipe. If you already have EF Core, use EF Core. If you prefer Dapper, use Dapper. If you're writing raw ADO.NET against a legacy stored-procedure layer, that works too. What matters is the table shape and the query. Suggested table: ```sql CREATE TABLE abblix_signing_keys ( kid TEXT PRIMARY KEY, key_usage TEXT NOT NULL, -- 'sig' or 'enc' algorithm TEXT NOT NULL, -- e.g. 'RS256', 'ES384' jwk_json TEXT NOT NULL, -- full JWK, including private material not_before TIMESTAMPTZ, -- NULL means effective immediately not_after TIMESTAMPTZ, -- NULL means indefinite is_active BOOLEAN NOT NULL DEFAULT TRUE, created_at TIMESTAMPTZ NOT NULL DEFAULT NOW() ); CREATE INDEX abblix_signing_keys_active ON abblix_signing_keys (key_usage, not_after) WHERE is_active = TRUE; ``` The effective query for `GetSigningKeys`: ```sql SELECT jwk_json FROM abblix_signing_keys WHERE key_usage = 'sig' AND is_active = TRUE AND (not_before IS NULL OR not_before <= NOW()) AND (not_after IS NULL OR not_after > NOW()) ORDER BY created_at DESC; ``` Wrap that in whichever data-access technology you already use. Cache the result in-process with the same short TTL you'd use for the Redis recipe. Implement `IAuthServiceKeysProvider` on top of the query-plus-cache, register it in [DI](https://www.abblix.com/en/docs/glossary-overview#di), done. Private keys at rest deserve their own conversation, and the honest answer is that an application database is not their real home. In a high-assurance system signing keys live in an [HSM](https://www.abblix.com/en/docs/glossary-overview#hsm) or a managed [KMS](https://www.abblix.com/en/docs/glossary-overview#kms) (AWS KMS, Azure Key Vault, GCP KMS, HashiCorp Vault), where the private half ideally never leaves the boundary in plaintext. This library imposes a ceiling here worth stating plainly: `IAuthServiceKeysProvider` hands a `JsonWebKey` with private material to an in-process signer, so vault-resident signing (the key never leaving the HSM) is not reachable through that seam. What the keys provider can do is fetch the private material from a KMS per use, which brings the plaintext private half into process memory to sign. The database-backed recipe here is a documented, deliberate tradeoff for teams that accept DB key custody. If you take it, encrypt the key at rest at a minimum, either at the database layer (pgcrypto, Always Encrypted, TDE with additional protections) or at the application layer with ASP.NET Data Protection (see [Encrypting the stored key at rest](#encrypting-the-stored-key-at-rest)). Whichever layer you pick, the encryption relocates key custody to that layer's own master key rather than removing it, as the next section traces for Data Protection. Prefer keeping only key IDs in the database while fetching private material from a KMS per use. Left unencrypted and unrotated, a database holding raw RSA private keys is worse than a Kubernetes Secret. A runnable version of this recipe, backed by EF Core and SQLite, lives in the `AspNetIdentitySample` project of the [Getting Started repository](https://github.com/Abblix/Oidc.Server.GettingStarted). It generates and persists a signing key on first run, encrypts it at rest with ASP.NET Data Protection (see the next section), and reloads the same key on every restart, so tokens issued before a restart keep validating. The residual custody concerns are marked with `#warning` directives in the sample, so a developer copying it toward production trips over them at build time. ## Encrypting the stored key at rest Storing a private key as plaintext in any database is the weakest form of this recipe. One step up, without reaching for a [KMS](https://www.abblix.com/en/docs/glossary-overview#kms), is to encrypt the [JWK](https://www.abblix.com/en/docs/glossary-overview#jwk) before it is written and decrypt it on read. ASP.NET Core Data Protection is the built-in tool for that: create a protector with a fixed purpose string, `Protect` the serialized JWK on the way in, `Unprotect` it on the way out. The protector comes from `IDataProtectionProvider.CreateProtector`, and the purpose string you pass it is part of the key derivation: change it and everything already stored stops decrypting, so pick one and version it deliberately. The `AspNetIdentitySample` sample does this, so a raw dump of the SQLite file yields ciphertext, not a signing key. Be precise, though, about what this buys and what it does not. There is an irony worth naming. The [scope note](#scope-signing-keys-not-data-protection) at the top of this article warned that Data Protection keys and signing keys are two separate stores with the same failure modes. Encrypting your signing key with Data Protection does not merge them, it stacks them: your signing key is now exactly as durable and as shared as the Data Protection key ring that encrypts it. The custody problem moves one layer down, onto a key ring that must be persisted and shared exactly as this article demands of the signing key, and protected on top of that: a smaller, better-understood surface to defend, but not one you can ignore. - Persisted. With no explicit configuration the key ring lands in a per-user profile folder on a developer machine, which is exactly why a local restart still decrypts the signing key. Inside a container with no user profile that fallback is not available, and Data Protection degrades to ephemeral in-memory keys lost on the next restart. Persist and back up the ring, or a lost ring leaves every stored signing key unrecoverable. Call `PersistKeysToFileSystem(...)` a durable location (or a shared store) and `SetApplicationName(...)` so every instance derives the same keys, rather than relying on the developer-machine default. - Shared. Two instances with two different key rings cannot read each other's encrypted signing keys, so an unshared ring has the same multi-instance problem this article opened with, one layer down. Persist the ring to a store every instance reads, using the backend-specific extension: `PersistKeysToFileSystem` for a shared volume (in-box), `PersistKeysToStackExchangeRedis`, `PersistKeysToAzureBlobStorage`, or `PersistKeysToDbContext`, each in its own package. There is no generic `PersistKeysTo`. - Protected. A persisted ring is itself plaintext at rest unless you protect it with `ProtectKeysWithCertificate(...)` or a cloud KMS (`ProtectKeysWithAzureKeyVault(...)`). Without that, the Data Protection keys sit next to the database you were protecting, and the encryption defends only against a leaked database file, not against read access to the host filesystem. The certificate option only defers custody again (the cert's own private key must be loadable to open the ring); a cloud KMS is what actually terminates the chain. Concrete recommendations, by deployment shape: - Single instance, development or low assurance. Data Protection with `PersistKeysTo` a durable path is enough. Know that without `ProtectKeysWith`, you are defended against a leaked database backup but not against an attacker who can read the host filesystem. - Multiple instances. The key ring must be both shared (a store every instance reads: a mounted volume, a blob container, Redis, a database table) and protected (a certificate or KMS). Configure both: miss the shared store and validation fails across pods, miss the protector and the encryption adds nothing over the database's own protection. - High assurance or compliance-bound. Do not keep private key material in your database at all, encrypted or not. Put the key in an [HSM](https://www.abblix.com/en/docs/glossary-overview#hsm) or a managed KMS and store only key IDs in the database. Mind the library ceiling from Recipe C: `IAuthServiceKeysProvider` can fetch and unwrap the private key from the vault per use (it then signs in process), but a key that never leaves the HSM would require replacing the token-signing pipeline, not just the keys provider. This is the real home for signing keys; Data Protection encryption is a pragmatic middle ground, not a substitute. ## Key rotation discipline Whichever storage you pick, rotation needs the same four moves. - Generate a new key ahead of time. Give it a unique `kid`, a `not_before` set to about ten minutes from now, and insert it as `is_active = TRUE`. Your [JWKS](https://www.abblix.com/en/docs/glossary-overview#jwks) endpoint will start publishing the new key immediately, but the signing pipeline will keep using the previous one until the `not_before` window opens. - Start signing with the new key. At the configured `not_before`, your signing code should prefer the newest active key. Relying parties who fetched JWKS in the last ten minutes already have the new `kid` in their cache. Freshly issued tokens validate. - Retain the old key for the token lifetime plus a buffer. Set the old key's `not_after` to now plus your longest refresh-token lifetime plus a safety margin of at least an hour. During this overlap window, both keys are published in JWKS, old tokens validate against the old key, and new tokens validate against the new key. Nobody is locked out. - Retire the old key. Once no extant token could still be signed by it, set `is_active = FALSE` and drop it from JWKS. Keep the row around for an audit trail, but stop publishing the public half. A common beginner mistake is to rotate the key and immediately remove the old one, which invalidates every outstanding refresh token. Another is to skip `not_before` and start signing with a key the JWKS endpoint hasn't published yet, which causes a brief window of 401s for every client that cached JWKS too recently. The overlap window is not a nicety, it is the whole point. :::note[How long should the overlap window be?] At minimum, the longest refresh-token lifetime you issue. If your refresh tokens live for thirty days, the old key must remain verifiable for thirty days after you stop signing with it. For most deployments, forty-five days is a reasonable default. For short-lived tokens in higher-risk environments, shorter overlap windows reduce the blast radius if a key is compromised. ::: ## A multi-pod consistency test worth writing An integration test you can run in CI, using ephemeral keys but a shared store: - Start two auth-service instances pointed at the same Redis or database. - Issue a token from instance A. - Present that token to instance B's [token introspection](https://www.abblix.com/en/docs/glossary-overview#token-introspection) endpoint. - Assert the introspection result is `active: true`. Repeat with a forced key rotation between issue and validate. Assert the old-signed token still validates during the overlap window. Assert it fails after the window elapses. This test catches almost every real configuration mistake in this area before it reaches production. It runs in CI alongside normal integration tests. ## Registering your provider To override the library's default `IAuthServiceKeysProvider`, register your implementation after `AddOidcServices()`: ```csharp services.AddOidcServices(options => { /* ... */ }); services.AddSingleton(); ``` Order matters. Microsoft's default DI container returns the most recently registered implementation when resolving a single service, so your `AddSingleton` must come after `AddOidcServices()` to win. Registering in the opposite order silently leaves the library default in place. ## Summary Signing keys need three properties to work in production: they must be shared across all instances, they must survive restarts, and they must not live in source control. Abblix OIDC Server provides the `IAuthServiceKeysProvider` extension point exactly so you can meet all three without fighting the library. Pick the simplest recipe that meets your rotation needs. Static keys from a secret store handle small deployments with planned rotations. A Redis-backed provider gives you dynamic rotation without a deploy. A database-backed provider fits naturally in teams that already keep durable state in Postgres or SQL Server. Whatever you pick, back the configuration with the multi-pod consistency test. It is the practical difference between a setup you can trust under rolling-deploy conditions and one whose failures only surface under production load. --- Source: https://www.abblix.com/en/docs/production-hardening-checklist.md # Production Hardening Checklist A fresh Abblix OIDC Server compiles, boots, and passes a happy-path login. That is not the same as being ready to face third-party clients in production. This page is the list of what to check and what to turn on before you get there. The items split into two kinds, and it helps to keep them apart: - On (or fail-closed) by default: verify a deployment has not undone it. Transport enforcement is on, and signing keys are fail-closed: the server refuses to issue tokens until you supply them. What breaks these is the deployment *around* them: a reverse proxy that hides the real scheme, or a certificate loaded without a pinned algorithm. - Off by default: you have to turn it on. [Refresh-token rotation](https://www.abblix.com/en/docs/glossary-overview#refresh-token-rotation), cache-entry encryption, and consent enforcement ship in their most permissive form. Each is a deliberate default that suits a trusted first-party evaluation and that a third-party-facing deployment is expected to tighten. Every one has a one-line fix in its section below. Licensing sits in neither list and is here for a different reason. With no license supplied the server runs on the free tier, which is a supported production posture rather than an evaluation mode, so the item below is about knowing which posture you are in and alerting on it, not about tightening a loose default. A note on wiring: the examples use the MVC host entry point `AddOidcServices`, which internally calls the protocol-core `AddOidcCore`; where a [DI](https://www.abblix.com/en/docs/glossary-overview#di) seam has to beat or wrap the library's own `TryAdd` registration, "before/after `AddOidcServices`" is what you write. ## Refresh tokens: keep rotation on, and make it stateful Refresh tokens rotate out of the box: `AllowReuse` defaults to `false`, so every redemption mints a fresh token and marks the presented one used, and a replay of a superseded token is rejected. What to check here is whether anything in your configuration switches it off. Never set `AllowReuse = true` for a public or SPA client: a leaked reusable token is replayable until natural expiry. The policy is per client (`ClientInfo.RefreshToken`), not a server-wide switch: each [confidential client](https://www.abblix.com/en/docs/glossary-overview#confidential-client) that issues refresh tokens carries its own. It holds three values worth stating rather than inheriting. `AllowReuse` decides rotation: left at `false`, the presented token becomes single-use. `AbsoluteExpiresIn` is the hard ceiling on the token and every rotation descended from it, 8 hours by default. `SlidingExpiresIn` is the rolling window, 1 hour by default; set it to null to make the absolute ceiling a hard, non-extending cap. Set all three explicitly per client to shrink the replay window. ```js { "Clients": { "my-web-app": { "ClientId": "my-web-app", "RefreshToken": { "AllowReuse": false, "AbsoluteExpiresIn": "08:00:00", "SlidingExpiresIn": "01:00:00" } } } } ``` :::warning[IMPORTANT] Reuse detection is stateful. In a multi-instance deployment the used/revoked status lives in the token registry. A replay that lands on a *different* node only fails if that registry is a shared, persistent store. Back it with [Redis](https://www.abblix.com/en/docs/glossary-overview#redis) or a database, not a per-pod in-memory cache, or a stolen token can slip through on another instance (see [Choosing a Backend for Operational State](https://www.abblix.com/en/docs/choosing-a-cache-backend)). ::: What rotation buys. A rotated-out token is marked used rather than revoked, and presenting it again revokes the whole grant family: every token descended from the same authorization, including the live one the thief did not take. That is the rotation-with-lineage model of [RFC 9700, section 4.14.2](https://datatracker.ietf.org/doc/html/rfc9700#section-4.14.2), and it is what turns a replay from a rejected request into an ended session. Keep the distinction in mind when you query the registry: rotation writes `Used`, and only the replay writes `Revoked`. [Dynamic Client Registration](https://www.abblix.com/en/docs/glossary-overview#dynamic-client-registration) inherits the same defaults. A registration that says nothing about rotation or PKCE gets the library's answer to both, which is the strict one, so a third-party client cannot register itself into a weaker posture by omission. What a registration policy still owes you is the values a client *can* state: a request that explicitly asks for reusable refresh tokens is a request to refuse. ## Client policy: PKCE, secrets, and token lifetimes Three per-client settings decide how exposed each client is, and their safe forms are worth pinning explicitly. - Require [PKCE](https://www.abblix.com/en/docs/pkce-in-openid-connect), and audit for it. A client requires PKCE by default (`PkceRequired = true`) and rejects the `plain` challenge method (`PlainPkceAllowed = false`), and a dynamically registered client that stays silent on the subject inherits exactly that. The audit is therefore for clients that opted out: verify none sets `PkceRequired = false` or `PlainPkceAllowed = true`. - Store client secrets hashed, not in plaintext. `ClientSecret` carries `Sha256Hash`, `Sha512Hash`, and a raw `Value`; `client_secret_basic`/`client_secret_post` authenticate against the hash. Store the `Sha512Hash` and keep the raw `Value` only for the clients that use `client_secret_jwt` (HMAC verification needs it). Never commit a raw secret to `appsettings`. - Cap token lifetimes. The access token is the primary bearer exposure window: stolen, it is usable and unrevoked until it expires. The per-client defaults are a 10-minute access token, a 5-minute [ID token](https://www.abblix.com/en/docs/glossary-overview#id-token-identity-token), and a 1-minute authorization code; shorten `AccessTokenExpiresIn` to your risk tolerance, and consider [sender-constraining](https://www.abblix.com/en/docs/glossary-overview#sender-constrained-token) public/SPA clients with DPoP or [mTLS](https://www.abblix.com/en/docs/glossary-overview#mutual-tls-client-authentication) so a stolen access token is not replayable. ## Transport: HTTPS, forwarded headers, secure cookies The library is secure by default on transport: every protocol endpoint is gated on HTTPS (`[RequireHttps]` on the MVC controllers, the group HTTPS filter in the Minimal API adapter), discovery and JWKS included, so a cleartext request is redirected or refused with no opt-in from you. The way to break that is to run behind a TLS-terminating reverse proxy or ingress and forget that, to the app, every forwarded request now looks like plain HTTP. - Run `ForwardedHeaders` behind a proxy, listing every hop as trusted. `[RequireHttps]` keys off `Request.IsHttps`, which is `false` behind a terminating proxy until the host honors `X-Forwarded-Proto`. `ForwardLimit` defaults to one hop, so with a chain (edge CDN, then ingress, then pod) you must raise it to the number of trusted hops *and* list every hop's range in `KnownNetworks` / `KnownProxies`, otherwise the scheme is dropped and the library redirect-loops or 403s every request, the exact failure this prevents. - Include `XForwardedFor` if anything downstream needs the client IP. Forwarding only the scheme leaves `RemoteIpAddress` as the proxy's, silently breaking host-side rate limiting, audit logging, and IP allowlists. The call that does this is `UseForwardedHeaders`, host-side ASP.NET Core rather than an Oidc.Server option, placed before authentication. Its options object names the headers to honour through the `ForwardedHeaders` flags: `XForwardedProto`, `XForwardedHost` and `XForwardedFor` are the three this checklist is about, and there is a fourth, `XForwardedPrefix`, which matters when the proxy mounts the app under a path rather than at a root. `All` is the union of the four. It also sets `ForwardLimit` to the number of trusted proxies in front of the app, which defaults to one, and lists every trusted hop in `KnownProxies` or in `KnownIPNetworks`, whose entries are `System.Net.IPNetwork`. Those defaults are the insecure part: `KnownProxies` starts out holding the loopback address alone, so a deployment behind a real proxy honours nothing until it says which hops it trusts. ```csharp app.UseForwardedHeaders(new ForwardedHeadersOptions { ForwardedHeaders = ForwardedHeaders.XForwardedProto | ForwardedHeaders.XForwardedHost | ForwardedHeaders.XForwardedFor, ForwardLimit = 2, // = number of trusted proxies in front of the app KnownIPNetworks = { new System.Net.IPNetwork(IPAddress.Parse("10.0.0.0"), 8) }, }); ``` - Mark the host's own authentication cookie `Secure`, and keep it `HttpOnly`. The login cookie is the host's, not the library's: set `CookieSecurePolicy.Always`, and leave `HttpOnly` on (ASP.NET Core's default) so [XSS](https://www.abblix.com/en/docs/glossary-overview#xss) cannot read it. :::warning[IMPORTANT] Do not force `HttpOnly` globally with a blanket `CookiePolicy`. The library deliberately sets its OIDC [Session Management](https://www.abblix.com/en/docs/glossary-overview#session-management) `session_state` cookie non-`HttpOnly` because the `check_session_iframe` must read it from JavaScript, and that cookie is a non-secret session-management value, not your authentication cookie. A global `HttpOnly = Always` would override the library and break Session Management; the fix is to leave the auth cookie `HttpOnly` (its default) and not impose a global policy, not to make anything else script-readable. ::: :::note[NOTE] The discovery and [JWKS](https://www.abblix.com/en/docs/glossary-overview#jwks) endpoints are public, unauthenticated GET metadata: the provider configuration a client reads to find your endpoints, and the public keys it uses to verify your tokens. The library `[RequireHttps]`-gates them exactly like every other endpoint: a cleartext GET is redirected to the https URL rather than served. This is not about secrecy (the metadata is public) but about integrity: a client that fetches your JWKS over cleartext can have its view of your signing keys tampered with in flight, and an attacker who substitutes keys there can forge tokens any client trusting that JWKS would accept as genuinely yours. If you additionally want an ungated route (a load-balancer liveness probe, say), map it yourself outside the OIDC endpoints; the library gates all of its own without exception. The `ForwardedHeaders` requirement above covers these routes too: behind a TLS-terminating proxy, `Request.IsHttps` must reflect `X-Forwarded-Proto` or even the metadata endpoints redirect-loop. (`RequireHttpsMetadata` is a setting on Microsoft's OpenID Connect *client* handler, not an Abblix server option; leave it at its secure default `true` if the same host also consumes OIDC.) ::: ## Signing keys: fail-closed, then harden the choices Signing keys are fail-closed: `OidcOptions.SigningKeys` is empty until you supply it, and the first token issuance throws if it is still empty; the server never auto-generates or auto-rotates a key. Persisting and rotating those keys across restarts and replicas is its own topic, covered in [Persisting JWT Signing Keys in Production](https://www.abblix.com/en/docs/signing-key-persistence); this checklist adds the hardening on top of a working key store. - Pin each key's algorithm. A certificate loaded via `cert.ToJsonWebKey()` carries no `alg`, so the token header alone drives selection and the key is usable with any compatible algorithm. Set `JsonWebKey.Algorithm` so the validator rejects the key for anything else, closing within-family algorithm confusion. - Prefer PS256 or ES256 over RS256. Both have a tighter security reduction than the RSASSA-PKCS1 family. - Use asymmetric keys for a public OP. RSA of 2048 bits or more, or an elliptic-curve key. A public OP issues asymmetric-signed tokens third parties verify against your [JWKS](https://www.abblix.com/en/docs/glossary-overview#jwks), and the JWKS never publishes usable symmetric key material. An HMAC (`HS*`)-only signing configuration therefore cannot serve one, and token issuance fails. - Provision a separate encryption key. Never reuse a signing key to encrypt. The library reads signing and encryption keys from two distinct collections; leaving `EncryptionKeys` empty simply issues signed-only tokens. `JsonWebKeyFactory.CreateRsa` is where all four of those meet: it takes the usage the key is for, `Signature` or `Encryption`, the algorithm, and the key size, so a signing key created with `PS256` named carries that algorithm and cannot be repurposed for another. Signing keys go into `OidcOptions.SigningKeys` and encryption keys into `EncryptionKeys`, two collections that never share a member. ```csharp options.SigningKeys = new[] { JsonWebKeyFactory.CreateRsa(PublicKeyUsages.Signature, SigningAlgorithms.PS256, keySize: 3072), }; options.EncryptionKeys = new[] { JsonWebKeyFactory.CreateRsa(PublicKeyUsages.Encryption, keySize: 3072), }; ``` Rotate by publishing overlapping keys: the JWKS carries every key in `SigningKeys`, so prepend the fresh key (it signs, because selection takes the first key matching the token's algorithm), keep the previous one for at least one maximum token lifetime plus a buffer so tokens it signed still validate, then drop it. That works for same-algorithm rotation; changing the signing algorithm (RS256 to PS256) is a separate step, not achieved by prepending, since the old key keeps signing until the issued algorithm itself changes. There is no built-in scheduler: cadence is a runbook item you drive, by mutating the collection or through a replaceable `IAuthServiceKeysProvider`. ## Cache entries: encrypt at rest Everything the server keeps between requests (authorization grants, [PAR](https://www.abblix.com/en/docs/glossary-overview#par), [CIBA](https://www.abblix.com/en/docs/glossary-overview#ciba) and device records, token status marks, replay-prevention markers) lives as expiring entries in whatever `IDistributedCache` the host registers, serialized with protobuf (choosing that backend is its own guide: [Choosing a Backend for Operational State](https://www.abblix.com/en/docs/choosing-a-cache-backend)). It is written as plaintext: the library ships no cache-encryption surface of its own. As a result, at-rest confidentiality is delegated to the backing store. A private Redis with TLS on encrypted disk satisfies most controls; where the cache tier is not trusted, encrypt at one of three host-owned seams. - Decorate the serializer (cleanest). Wrap `IBinarySerializer` so bytes are encrypted before they reach the cache and decrypted on read. Register the decorator *after* `AddOidcServices` so the built-in composite serializer is the inner instance. The decorator is a small class taking the inner `IBinarySerializer` and an `IDataProtectionProvider`, holding one protector obtained from `CreateProtector` under a purpose string of its own. Its `Serialize` passes the inner result through `Protect`, and its `Deserialize` calls `Unprotect` before handing the bytes to the inner serializer. Nothing else is overridden, and the single-use lock tokens of the atomic get-and-remove protocol bypass the serializer, so encrypting here leaves that path intact. :::warning[IMPORTANT] This decorator depends on the app's ASP.NET Data Protection key ring, and the default ring is per-process and ephemeral. In the multi-instance deployment this page assumes, an entry written by one instance cannot be decrypted by another: the authorization-code, PAR, and device flows break under load balancing, and every entry is unreadable after a restart. So if you take this route you must persist and share the key ring across instances (`PersistKeysToStackExchangeRedis`, blob storage, or a mounted volume) and protect it at rest, the same overlap discipline as signing keys. The Data Protection key ring is separate from the OIDC cache it protects; a plain `AddDataProtection()` for cookies and antiforgery does not encrypt cache entries. That is what this decorator adds, and it makes the ring's persistence a hard prerequisite for your token flows. ::: - Replace `IEntityStorage` with your own encrypting implementation, pre-registered before `AddOidcServices` so it wins the library's `TryAdd`. If you do, wrap or delegate to the built-in `DistributedCacheStorage`: do not reimplement the get-and-remove yourself, or you lose the atomic lock-token protocol that guarantees exactly one caller consumes a pushed authorization request, a CIBA request, or a device code across instances, reintroducing replay races. (Authorization-code single-use is enforced separately, by a reuse-detecting decorator at the token endpoint.) - Encrypt at the transport layer, wrapping the host's `IDistributedCache` or pointing it at a store with at-rest encryption: fully host-side, decoupled from Abblix. ## Consent: enforce it for third-party clients Consent is not enforced by default. The library binds `IUserConsentsProvider` to a `NullConsentService` that auto-grants every requested scope, so the authorize flow never prompts, the shape intended for a trusted first-party deployment. Never expose a third-party or [public client](https://www.abblix.com/en/docs/glossary-overview#public-client) while `NullConsentService` is active: for anything touching consent-to-processing, an auto-grant with no user prompt and no consent record is a compliance problem. Replace the provider before that happens; there is no global "require consent" flag, so enforcement *is* the provider you supply. - Replace the provider, and register it *before* `AddOidcServices`. Your provider returns the not-yet-approved scopes in `Pending`; any non-empty `Pending` makes the authorize flow return a consent-required outcome. Order matters: register before `AddOidcServices` and the library's `TryAdd` yields to you *and* the built-in `PromptConsentDecorator` wraps you; register *after* with a plain `AddScoped` and your provider wins but the decorator is bypassed, so `prompt=consent` stops forcing re-consent, with nothing to signal it. In `Program.cs` that is one `AddScoped` for your `IUserConsentsProvider` standing above the `AddOidcServices` call, whose options set `ConsentUri` to the page a pending outcome is sent to. - Set `OidcOptions.ConsentUri`. Once a provider produces pending consents, the default MVC formatter redirects the consent-required outcome there and throws if it is unset. - Put per-client policy in host code. With no per-client flag, branch inside your provider on `request.ClientInfo`: auto-grant a trusted first-party client, force `Pending` for third-party ones. - Verify it enforces. Because a misordered registration fails silently, confirm after wiring by driving one authorize call with `prompt=consent` and checking it re-prompts. ## CORS: pin the origins The UserInfo, EndSession, CheckSession, and Discovery endpoints can be called cross-origin, and the library exposes their [CORS](https://www.abblix.com/en/docs/glossary-overview#cors) policy through `CorsSettings` (`AllowedOrigins`, `AllowCredentials`). A third-party OP with SPA or public clients must pin `AllowedOrigins` to the exact origins that need it, and never combine wildcard origins with `AllowCredentials = true`, the classic misconfiguration that lets any site make credentialed calls. ## License: supply the JWT from a secret Abblix OIDC Server is licensed, and the license is a signed JWT blob issued by Abblix, not a key string you can invent. With none supplied, the server runs on the free tier, which allows one issuer and puts no ceiling on client applications, users or nodes. A deployment that needs a second independent issuer fails once that second issuer is seen, and it fails on both: the issuer count is process-wide and never decreases, so every later request throws whichever issuer it names. The failure is easy to miss in development, which is exactly why the license belongs on a production checklist. - Supply the license through `OidcOptions.LicenseJwt` (or the `AddLicense(jwt)` extension), and never hardcode it. The library binds no license appsettings section of its own (the host owns that mapping), so read it from a secret and mount it as an environment variable. In code that is a single assignment to `options.LicenseJwt` from a configuration key of your own naming, whose value arrives from the secret and is never committed. - Alert on the license log events, because the loudest failure mode is silent in development. An issuer-limit or issuer-whitelist violation throws at runtime, and that exception takes down discovery, token, userinfo and registration flows alike. An expired license degrades back to the free tier once its grace period ends, and the free tier allows one issuer, so a deployment serving two then fails on both until the process restarts under a valid license. The grace period exists only where the issued key carries one. Alert on the license `EventId`s (issuer-limit, whitelist, expiring-soon, grace-period), and alert on the license expiry date held outside the server: nothing is logged at the instant a license passes the end of its grace period, so the daily grace-period record simply stops. The inline options, the `ILicenseJwtProvider` seam for vault-backed retrieval and zero-downtime rotation, and the free-tier limit are covered in [Configuration and Setup](https://www.abblix.com/en/docs/configuration-and-setup); treat this as the reminder to move the value into a secret and to alert on it. ## Host-side essentials Two more belong on the go-live list even though they are the host's job, not the library's: - Rate-limit the token, introspection, and [client-authentication](https://www.abblix.com/en/docs/glossary-overview#client-authentication) endpoints at the edge or with ASP.NET Core rate limiting, to blunt credential-stuffing and brute-force. - Keep secrets out of logs. The server logs request detail; ensure your logging pipeline does not persist `code`, `client_secret`, or `Authorization` headers. ## The checklist | Item | Default | Harden by | Lives in | |---|---|---|---| | Refresh-token rotation | Rotating (`AllowReuse=false`), replay revokes the grant family | Refuse `AllowReuse=true` in review and in your DCR policy; tighten lifetimes; back the token registry with a shared store | Per-client options | | Client policy | [PKCE](https://www.abblix.com/en/docs/pkce-in-openid-connect) required, `plain` refused; secrets can carry a plaintext `Value` | Audit for clients that opted out of PKCE; store `Sha512Hash` not plaintext; cap `AccessTokenExpiresIn`; DPoP/mTLS for public clients | Per-client options | | Transport HTTPS | Enforced on all endpoints, [JWKS](https://www.abblix.com/en/docs/glossary-overview#jwks) and discovery included | `ForwardedHeaders` with `ForwardLimit` + known proxies behind an ingress; `Secure`, `HttpOnly` auth cookie | Host pipeline | | Signing keys | Fail-closed (you must provide) | Pin `alg`; PS256/ES256; asymmetric only; separate encryption key; overlap rotation | `OidcOptions` | | Cache entries | Plaintext in the backing store | Encrypt at `IBinarySerializer`, `IEntityStorage`, or `IDistributedCache`, with a shared, persisted DataProtection ring | DI | | Consent | Not enforced (auto-grant) | Replace `IUserConsentsProvider` before `AddOidcServices`; set `ConsentUri`; verify with `prompt=consent` | DI + options | | CORS | Policy driven by host config | Pin `AllowedOrigins`; never wildcard with `AllowCredentials` | `CorsSettings` | | License | Free tier: 1 issuer, no client or user limit | Supply `LicenseJwt` from a secret; alert on license events | Options + secret | | Host-side | - | Rate-limit token/introspection endpoints; keep secrets out of logs | Host / edge | None of these is exotic, and none of them is on by accident. The permissive defaults are the ones a first-party evaluation wants; the checklist is the deliberate list of what a third-party-facing production deployment tightens on top. --- Source: https://www.abblix.com/en/docs/http-resilience.md # Retries Where You Want Them: HTTP Resilience for Abblix OIDC Server At Abblix, we develop Oidc.Server, our certified OpenID Connect and OAuth 2.0 library for .NET. Most of what it does happens inside your process: minting tokens, validating requests, checking signatures. But not all of it. Your provider fetches a client's key set to verify a signed request object. It POSTs a [logout token](https://www.abblix.com/en/docs/glossary-overview#logout-token) to every session a user is signing out of. It notifies a [CIBA](https://www.abblix.com/en/docs/glossary-overview#ciba) client that its authentication request has completed. If your keys live in Vault or Azure Key Vault, every signature is a network call too. Each of those calls crosses a network you do not control, to a server whose availability is somebody else's problem. A key set fetch that fails takes a valid request down with it. A notification that fails leaves a client waiting out its timeout. So sooner or later you want retries, and a circuit breaker to stop hammering a receiver that is already down. None of that is ours to invent. .NET has it: `Microsoft.Extensions.Http.Resilience`, built on Polly. What we owe you is a seam it can attach to, on every client we send requests through, without asking you to subclass anything or reach in with reflection. ## TL;DR Every outbound call this library makes goes through `IHttpClientFactory`. To make all of them resilient, you write one line and name nothing: ```csharp services.ConfigureHttpClientDefaults(http => http.AddStandardResilienceHandler()); ``` To treat one of them differently, you name it instead: every client publishes its name as a constant, so nothing is copied out of our source or guessed from a type name. Host-wide and per-client are alternatives, not layers. That is the one thing to get right before you start, and the next sections say why. Either way you keep everything else you already have. Adding a resilience pipeline is additive: on the three clients that call a URI an OAuth client supplied, the address validation stays exactly where it was, underneath your retries, and every retried attempt is validated afresh. Retries and a circuit breaker cost you nothing in security, which is why this is the path to take. ## The one-line version One package carries everything below: ```bash dotnet add package Microsoft.Extensions.Http.Resilience ``` The numbers quoted below are the defaults of version 9.10. They are stable across patch releases and have moved across majors, so check them against the version you resolve. If your answer to "which of these calls should be resilient?" is "all of them", you are done in a line. `ConfigureHttpClientDefaults` is part of `Microsoft.Extensions.Http`, and it applies to clients registered before or after the call: ```csharp builder.Services.ConfigureHttpClientDefaults(http => http.AddStandardResilienceHandler()); builder.Services.AddOidcServices(options => { /* ... */ }); ``` Order does not matter here. Put the defaults call first or last; every client this library registers picks it up either way. That is worth knowing because our registrations are one `AddOidcServices` call deep, and you should not have to reason about what happens inside it. The standard handler is a pipeline of five strategies: a total request timeout, a retry, a circuit breaker and an attempt timeout, with rate limiting in front. Retries cover the outcomes worth repeating: connection failures, 5xx, 408 and 429, and a per-attempt timeout, which is why that timeout sits inside the retry. A 400 is not retried, correctly, since repeating the same request will earn the same answer. One thing overrides you. A response carrying `Retry-After` replaces the delay you configured, because the standard retry honours the header by default, so a receiver asking for five minutes spends your whole budget in one wait. Set `Retry.ShouldRetryAfterHeader = false` if you would rather keep your own schedule. One consequence of the convenience is worth knowing before you rely on it. The defaults register a single pipeline under one shared name, so every client in your host shares one circuit breaker instance: ours, and your own application's clients too. A relying party that stops answering can therefore open the breaker that stands in front of your key vault. If that coupling is unacceptable, you have two ways out. Raise `MinimumThroughput` and `FailureRatio` so the breaker engages only on a genuinely global outage, or configure clients individually, which gives each its own pipeline and its own breaker. ## Turning the knobs The defaults that ship with that handler are these: thirty seconds for the whole operation, ten for a single attempt, three retries starting at a two-second delay with exponential backoff and jitter, and a breaker that opens when a tenth of the calls fail over a thirty-second window, then stays open for five seconds. Every one of them is a property you can set, and the shape is the same whichever client you are configuring: ```csharp services.ConfigureHttpClientDefaults(http => http.AddStandardResilienceHandler(options => { // Timeouts: the ceiling on everything, and on one attempt. options.TotalRequestTimeout.Timeout = TimeSpan.FromSeconds(20); options.AttemptTimeout.Timeout = TimeSpan.FromSeconds(5); // Retry. options.Retry.MaxRetryAttempts = 4; options.Retry.Delay = TimeSpan.FromMilliseconds(500); options.Retry.BackoffType = DelayBackoffType.Exponential; options.Retry.UseJitter = true; // Circuit breaker: open when half the calls fail, and stay open long enough to matter. options.CircuitBreaker.FailureRatio = 0.5; options.CircuitBreaker.MinimumThroughput = 10; options.CircuitBreaker.SamplingDuration = TimeSpan.FromSeconds(30); options.CircuitBreaker.BreakDuration = TimeSpan.FromSeconds(15); })); ``` Two relationships between these are checked for you. The attempt timeout must be shorter than the total, and the breaker's sampling duration must be at least twice the attempt timeout, or resolving the client throws an `OptionsValidationException` naming both values. A third is not checked: whether the total leaves room for the retries you asked for. Take four retries with a half-second base delay and exponential backoff: the waiting alone comes to roughly eight seconds before the last attempt even begins, and if that plus the attempts themselves exceeds the total, you get a cancellation where you expected a retry. Do that arithmetic against the values you actually set. The breaker's `MinimumThroughput` is the one that surprises people. It defaults to a hundred calls within the sampling window, a sensible floor for a busy service and one a provider fetching a key set a few times a minute will never reach, which means the breaker never opens. If you want it to engage on a low-traffic client, lower it. `Retry.BackoffType` takes a `DelayBackoffType`, which comes from `Polly`, so setting it needs `using Polly;` alongside the resilience one. If you would rather assemble the pipeline yourself than adjust a standard one, you can. `AddResilienceHandler` takes the strategies you name and nothing else: ```csharp using Microsoft.Extensions.Http.Resilience; using Polly.Retry; using Polly.Timeout; services.AddHttpClient(VaultTransport.HttpClientName) .AddResilienceHandler("vault", pipeline => pipeline .AddRetry(new HttpRetryStrategyOptions { MaxRetryAttempts = 5 }) .AddTimeout(TimeSpan.FromSeconds(10))); ``` The strategy methods live in their own Polly namespaces, which is easy to miss: without those two `using` lines the compiler reports that `ResiliencePipelineBuilder` has no `AddRetry`. ## Naming one client The one-liner is a floor, not a ceiling. Different calls deserve different treatment, and once you want that, you name the client you are configuring. Say a client's key set fetch should fail fast, because a user is waiting on the authorization request it blocks, while your Vault calls deserve patience because that server occasionally stalls. Name each and give it what it needs: ```csharp // A user is waiting on this one. Fail fast. services .AddHttpClient(SecureFetchTransport.HttpClientName) .AddStandardResilienceHandler(options => { options.TotalRequestTimeout.Timeout = TimeSpan.FromSeconds(4); options.AttemptTimeout.Timeout = TimeSpan.FromSeconds(2); options.Retry.MaxRetryAttempts = 1; options.CircuitBreaker.SamplingDuration = TimeSpan.FromSeconds(10); }); // Nothing is waiting on this one. Be patient, and give the total room to hold the backoff. services .AddHttpClient(VaultTransport.HttpClientName) .AddStandardResilienceHandler(options => { options.Retry.MaxRetryAttempts = 5; options.Retry.Delay = TimeSpan.FromMilliseconds(500); // 0.5 + 1 + 2 + 4 + 8 = 15.5s of waiting options.TotalRequestTimeout.Timeout = TimeSpan.FromSeconds(90); }); ``` The second block is the arithmetic from the previous section done in earnest. Leave the delay at its two-second default, and five retries spend 62 seconds waiting before the last attempt begins. A 30-second total cancels that long before it finishes, so you would get four attempts and a timeout where you asked for patience. Configuration is keyed by client, so what you set on one never reaches another. ### Do not do both Adding a pipeline host-wide and then adding a second one to a single client does not override the first. It stacks. The client ends up wrapped in two pipelines and the attempts multiply: a host-wide handler allowing three attempts plus a per-client handler allowing two gives that client six attempts at the origin. Reaching back to reconfigure the pipeline the defaults installed does not work either. The defaults register it under one shared options name, with no client name in it, so there is nothing per-client to address. Pick one style and keep to it. Either one host-wide call that everything shares, or a call per client: ```csharp services.AddHttpClient(BackChannelLogoutTransport.HttpClientName).AddStandardResilienceHandler(); services.AddHttpClient(BackChannelNotificationTransport.HttpClientName).AddStandardResilienceHandler(); services .AddHttpClient(SecureFetchTransport.HttpClientName) .AddStandardResilienceHandler(options => options.Retry.MaxRetryAttempts = 1); ``` One exception fits inside the host-wide style, because it adds no second pipeline: a client's own timeout. `HttpClient.Timeout` caps the whole operation, retries included, so capping it makes one client give up early while the rest keep the shared policy: ```csharp services.ConfigureHttpClientDefaults(http => http.AddStandardResilienceHandler()); // A user is waiting on this one, so it gives up while the others are still retrying. services.AddHttpClient(SecureFetchTransport.HttpClientName, client => client.Timeout = TimeSpan.FromSeconds(3)); ``` What you get is a cancellation, not a graceful failure, and the pipeline's own timeouts still apply underneath. Reach for it when the requirement is genuinely "not a second longer than this", and configure clients individually when the requirement is about retry behavior. ## What to name Every client carries its name as `HttpClientName` on a small transport type in its own package. One shape, every client, nothing to guess and no string to copy out of our source: | What it calls | Package | Name it with | |---|---|---| | A client's [JWKS](https://www.abblix.com/en/docs/glossary-overview#jwks), `request_uri`, [software statement](https://www.abblix.com/en/docs/glossary-overview#software-statement) | `Abblix.Oidc.Server` | `SecureFetchTransport.HttpClientName` | | [Back-channel logout](https://www.abblix.com/en/docs/glossary-overview#back-channel-logout) tokens | `Abblix.Oidc.Server` | `BackChannelLogoutTransport.HttpClientName` | | [CIBA](https://www.abblix.com/en/docs/glossary-overview#ciba) ping and push notifications | `Abblix.Oidc.Server` | `BackChannelNotificationTransport.HttpClientName` | | Vault / OpenBao, custodian and key ring | `Abblix.Jwt.Vault` | `VaultTransport.HttpClientName` | | Azure Key Vault | `Abblix.Jwt.Azure` | `AzureKeyVaultTransport.HttpClientName` | | The key ring's blob container | `Abblix.Jwt.Azure` | `AzureKeyRingTransport.HttpClientName` | | An issuer's key set, for event verification | `Abblix.SecurityEvents` | `JwksTransport.HttpClientName` | | Shared Signals push delivery | `Abblix.SharedSignals` | `PushDeliveryTransport.HttpClientName` | Some of these are typed clients underneath and some are named ones, which changes how the factory keys them internally. The constant hides that difference, so you configure all eight the same way. You will not find a `new HttpClient()` anywhere in these packages, and that is deliberate. A client constructed inside a library is a client you cannot configure: nothing of yours runs on it, and no policy of yours applies. Every one of these comes from your factory instead. ## A retry is a second delivery Most of these clients POST. When an attempt times out you do not learn whether the receiver ignored the request or processed it and lost the response on the way back, so a retry is a second delivery of the same message, and every receiver in your ecosystem has to tolerate one. For a logout token that is cheap, because its effect is idempotent. Note though that [Back-Channel Logout](https://www.abblix.com/en/docs/glossary-overview#back-channel-logout) leaves `jti` replay detection optional for the relying party, so a receiver that does implement it will reject your retry as a replay: a delivery that timed out after arriving cannot be rescued by retrying it. For [CIBA](https://www.abblix.com/en/docs/glossary-overview#ciba) push it is not cheap at all, because the retry re-delivers tokens, and a receiver that mints a session per delivery mints two. Retry hard where the receiver deduplicates and redelivery is harmless. Keep the attempts low where it is not. ## When the breaker is open An open breaker does not slow calls down, it stops them: the pipeline throws `BrokenCircuitException` without touching the network. What that means depends on the client. For a notification or a logout token it means a delivery that never left your process. For a key set fetch it means the authorization request that needed the key fails, and it fails as a protocol error about the client's metadata, because from the fetcher's point of view the fetch did not succeed. For a custodian client it means token issuance stops while the breaker is open. The tell in an incident is asymmetry: your logs show failures and the receiver's logs show no requests at all. That is the breaker, not the receiver. ## What a retry does not reach Two things sit outside the pipeline you attach, and both are worth knowing before you rely on it. In the Azure package, the credential authenticates over a transport of its own. What you attach to `AzureKeyVaultTransport.HttpClientName` and `AzureKeyRingTransport.HttpClientName` covers the vault and blob calls, not the token requests the credential makes to acquire its access token. If you need those resilient too, that is a property of the Azure SDK's own client options, not of ours. And a pipeline is bounded by `HttpClient.Timeout`, which is a ceiling over the whole operation including every retry. The [CIBA](https://www.abblix.com/en/docs/glossary-overview#ciba) notification client sets that timeout from `OidcOptions`, so if you configure retries there, leave the client's timeout enough room to accommodate them. A retry strategy that would take twenty seconds under a five-second client timeout does not retry three times: it is cancelled once. ## Where our own retry policy sits, and why it mostly does not exist You may notice that our senders make one attempt and report what happened. That is deliberate, and it is what makes them safe to wrap. [CIBA](https://www.abblix.com/en/docs/glossary-overview#ciba) notifications are best-effort by design. A failed ping costs the client its own timeout, not a lost protocol state. Building a retry into the delivery service would mean holding attempt counters and timers inside a type you cannot configure, in exchange for a policy that would be wrong for somebody. One honest attempt, and your pipeline decides the rest. Shared Signals push delivery is the same reasoning at stream level. The sender drains a stream's queue in order, stops at the first transient failure so ordering survives into the next pass, and drops a security event token the receiver judged terminally invalid. Retry lives in the schedule that calls it and in the pipeline underneath it, which is why the sender itself holds no state. ## Where the address validation sits Three of these clients address a URI that came from an OAuth client, not from your configuration: its registered [CIBA](https://www.abblix.com/en/docs/glossary-overview#ciba) notification endpoint, its back-channel logout URI, and the `request_uri`, [JWKS](https://www.abblix.com/en/docs/glossary-overview#jwks) and software statement addresses a fetch is pointed at. A client that registers a link-local metadata address and gets your provider to call it has turned a callback into a [server-side request forgery](https://www.abblix.com/en/docs/glossary-overview#ssrf). So those three validate the address on every request, re-resolving the name each time instead of trusting the resolution that passed a moment ago. That validation is the client's primary handler, the innermost one in the chain, and everything this article asks you to add chains outside it. `AddStandardResilienceHandler`, `AddResilienceHandler`, a logging handler, a host-wide default: each of them adds a link above the validation, so the guarantee survives the configuration and every retried attempt is validated afresh, not once per request. That is the whole reason to prefer these calls: you get retries and a circuit breaker without trading anything away. One call is different in kind. `ConfigurePrimaryHttpMessageHandler` does not add a link, it replaces the bottom of the chain, and on these three clients the bottom is the validation. That call is also the standard way to set a client certificate or your own connection pooling, so it is worth saying plainly: here it changes a security control, not a transport setting, and it deserves the review any such change would get. If what you need is a proxy or a certificate on one of these three, raise it with us before reaching for that call. You will not have to notice it on your own. When one of those three clients ends up with a primary handler that is not the validation, the library says so at `Warning`, naming the client and what replaced it. A deployment that made the swap deliberately silences that one message by its own log category, and every other log this library writes keeps working: ```json { "Logging": { "LogLevel": { "Abblix.Oidc.Server.Features.SecureHttpFetch.SsrfGuardWatch": "None" } } } ``` ## Start here Add the one-liner from the top of this article. It costs a line and covers every call this library makes, which is the right floor for a deployment that has none today. Then spend five minutes on the two places where that floor is wrong for you. The secure-fetch client sits on the authorization path with a user waiting on it, and thirty seconds is generous there. The shared circuit breaker couples clients that have nothing to do with each other, which some deployments will not accept. Fixing either means switching styles, not layering: drop the defaults call and configure clients one by one, since a per-client pipeline added on top of the host-wide one stacks instead of replacing it. The exception is a client's own `HttpClient.Timeout`, which caps one client without adding a second pipeline. The table above names the transports this guide is about; the library publishes others for the Shared Signals paths, and they follow the same shape, and those names are the only API of ours this article asks you to touch. --- Source: https://www.abblix.com/en/docs/choosing-a-cache-backend.md # Choosing a Backend for Operational State Everything Abblix OIDC Server keeps between requests (authorization grants, [pushed authorization requests](https://www.abblix.com/en/docs/glossary-overview#par), [CIBA](https://www.abblix.com/en/docs/glossary-overview#ciba) and device-flow records, token status marks, replay-prevention markers) lives as expiring entries in whatever `IDistributedCache` implementation the host registers. The library deliberately registers none of its own. There is no default and no fallback, and the first protocol request fails fast if the host forgot to supply one, caught immediately rather than in production. `AddDistributedMemoryCache()` gets a sample running; this guide is about choosing what runs in production, because the choice carries one functional requirement and one security requirement that are easy to miss. ## What actually lives in the cache Each entry kind arrives with its own TTL, driven by the matching option or token lifetime, which is why this store never needs a cleanup job; it expires everything itself: - Authorization grants: the state behind an issued authorization code, kept for the code's lifetime (per-client, 1 minute by default). - Pushed authorization requests ([PAR](https://www.abblix.com/en/docs/glossary-overview#par)): consumed atomically at the authorize endpoint. - Token status marks: the `Revoked`/`Used` verdicts written by the [revocation endpoint](https://www.abblix.com/en/docs/glossary-overview#revocation-endpoint), [refresh-token rotation](https://www.abblix.com/en/docs/glossary-overview#refresh-token-rotation), and authorization-code reuse detection; each mark lives exactly as long as the token it condemns. - [CIBA](https://www.abblix.com/en/docs/glossary-overview#ciba) and device-flow requests: polled state, plus the device flow's user-code map and its brute-force rate-limit counters. - Replay-prevention markers: used `jti` marks for DPoP proofs, JWT-bearer assertions, and one-time [client-authentication](https://www.abblix.com/en/docs/glossary-overview#client-authentication) assertions, and the rolling HMAC secrets behind DPoP nonces. Entries are serialized with protobuf (a JSON fallback covers host-supplied types the protobuf whitelist does not know). Encrypting them at rest is its own topic with its own pitfalls; the [Production Hardening Checklist](https://www.abblix.com/en/docs/production-hardening-checklist) owns it. ## Requirement one: shared, or multi-instance breaks The protocol itself hops between requests, and under a load balancer those requests land on different instances. With a per-instance cache (a plain memory cache on each pod), every one of these flows breaks: - Authorization code exchange: the code is minted on the node that served `/authorize` and redeemed on whichever node serves `/token`; if the grant is not in a shared store, redemption returns `invalid_grant`, intermittently, depending on the load balancer. The shared experiment below surfaces it deterministically. - [PAR](https://www.abblix.com/en/docs/glossary-overview#par): the `request_uri` is pushed to one node and consumed on another. - [CIBA](https://www.abblix.com/en/docs/glossary-overview#ciba) and device flow: the client polls the token endpoint repeatedly, and each poll may hit a different instance; the user approves on yet another. - DPoP nonces: the rolling HMAC secret must be readable by every instance, or nonces issued by one node fail validation on the next and force clients into retry loops. - Rate limiting: per-instance counters multiply the rate-limit budget by the pod count, and collapse back to one budget once the counter lives in the shared cache. So the first requirement is simply *shared*. This is also why the in-memory cache is a development tool, not a deployment option, even before durability enters the picture. ## Requirement two: persistent, or a wipe un-revokes tokens The less obvious requirement is durability, and it comes from the token status and replay-prevention marks. Revocation in Abblix's stateless model works by exception, the standard stateless-JWT tradeoff: tokens carry their own validity, and the cache holds only the marks that condemn them, checked on every validation of a token that carries a `jti`. Lose the cache, and the marks are gone: - a revoked refresh or access token validates again, until its own natural expiry; - a rotated-out refresh token is accepted again; - used `jti` replay marks vanish, reopening the replay window for DPoP proofs, JWT-bearer assertions, and one-time client-authentication assertions within their validity period. A wipe also drops in-flight [authorization codes](https://www.abblix.com/en/docs/glossary-overview#authorization-codes), [PAR](https://www.abblix.com/en/docs/glossary-overview#par), and device flows, but those are short-lived and their loss is a brief availability blip clients retry through. The status marks are what make this a durability requirement rather than a self-healing one: they must outlive the tokens they condemn. Nothing in the deployment fails visibly, which is what makes it a security requirement rather than an operational one; the persistence check in the last section makes that invisible failure visible on demand. Treat the cache as a security store and run it with persistence enabled, on encrypted disk, never as an ephemeral instance that is free to restart empty. For a store holding token status marks, prefer AOF with `appendfsync everysec`. That still loses up to about a second of writes on a hard crash, so a token revoked in that final second can come back: acceptable for most, and far better than RDB snapshots alone, which leave a minutes-to-hours window in which a crash silently loses everything marked since the last snapshot. `appendfsync always` closes the second-wide gap by fsyncing every write, but that lands on the token path and caps write throughput at the disk's fsync rate, so reach for it only if a sub-second window is unacceptable. AOF rewrites and snapshots also fork the process; the dataset here is small and short-lived, so the copy-on-write rarely spikes latency, but watch `latencystats` if you tune persistence aggressively. The [Production Hardening Checklist](https://www.abblix.com/en/docs/production-hardening-checklist) makes the same point from the defense side; this is the storage decision that implements it. ## Latency sits on the token path The backend's round-trip time lands directly in request latency: - Every validation of a `jti`-bearing token does one cache read for the status mark: introspection, userinfo, every flow that validates a token server-side. - Every DPoP-protected request adds a get-and-set pair for the replay mark, plus a nonce-secret read where DPoP nonces are enabled. - Consuming a [PAR](https://www.abblix.com/en/docs/glossary-overview#par) request, or redeeming a [CIBA](https://www.abblix.com/en/docs/glossary-overview#ciba) or device-code request, runs the get-and-remove protocol: half a dozen sequential cache round-trips, the price of resolving a redemption race to a single consumer on top of the plain `IDistributedCache` contract. A poll that finds the request still pending is a single read; the expensive protocol runs once, at redemption. On a 1 ms backend that is invisible; on a 20 ms cross-zone hop it is over a hundred milliseconds added to whichever endpoint runs the consume: the authorize endpoint for PAR, the token endpoint for CIBA and device-code. Keep the cache topologically close to the server instances, and prefer backends where a warm, pooled round trip is measured in fractions of a millisecond (the first call after a reconnect also pays TLS setup, and [Redis](https://www.abblix.com/en/docs/glossary-overview#redis) Cluster can add a redirect hop, so pool connections and keep them warm). ## The candidates - Redis is the canonical choice and what Abblix's own [identity provider](https://www.abblix.com/en/docs/glossary-overview#identity-provider) runs: shared, sub-millisecond, durable with the right persistence mode, and available on every cloud. If you take one recommendation from this page, it is a private, persistent, TLS-protected Redis close to the pods. Two settings are not optional for a security store. Set `maxmemory-policy noeviction` and size `maxmemory` with headroom: every entry here has a TTL, so any `volatile-*` or `allkeys-*` policy evicts token status and replay marks first under memory pressure, silently un-revoking tokens with no restart involved; Azure Cache for Redis and AWS ElastiCache both default to `volatile-lru`, so check and override it (`noeviction` fails writes closed, a visible, alertable error, instead of dropping security state silently). And know that persistence protects a crash-and-restart, not a failover: Redis replication is asynchronous, so a promoted replica can be missing the last writes, including a just-written revocation mark, whatever the primary's `appendfsync`. A single durable instance has no failover window; an HA pair trades some of the guarantee for uptime unless you force replica acknowledgement (`WAIT`/`WAITAOF`) at a latency cost. - SQL Server distributed cache (or an equivalent relational-backed `IDistributedCache`) inverts the trade: durable by nature and already inside many enterprises' operational comfort zone, at the cost of higher per-read latency (workable for modest traffic, measurable at scale). - In-memory (`AddDistributedMemoryCache`): development and single-instance evaluation only; it fails both requirements above by construction. - Anything else implementing `IDistributedCache` works functionally; the library never sees past the interface. But the exactly-once guarantees above assume linearizable single-key operations, so judge a candidate by that too, alongside the two requirements and the latency profile, not by its name. One honesty note for the strictest deployments: `IDistributedCache` offers no atomic compare-and-set. Both exactly-once mechanisms here, the get-and-remove protocol behind [PAR](https://www.abblix.com/en/docs/glossary-overview#par), [CIBA](https://www.abblix.com/en/docs/glossary-overview#ciba), and device-code redemption and the get-then-set `jti` replay mark, are emulated on top of the interface and are only as strong as the backend's per-key linearizability. The get-and-remove uses a lock-token last-write-wins check; the replay mark is a plain get-then-set, a probabilistic defense under extreme concurrent replay, as the source itself documents. Redis (single-threaded per shard) and relational-backed caches (row locks) provide that linearizability, so on those the guarantees hold in practice; a backend that serves stale reads from replicas can let two consumers each believe they won, double-redeeming a code. A host that needs a hard guarantee can replace the affected seam with a backend-native atomic (Redis `SET NX EX`, `INSERT ... ON CONFLICT DO NOTHING`); one more interface, same pattern as every other seam in this cookbook. ## Verify the deployment, not the config Two experiments prove the two requirements. Run them in staging with production-identical persistence, never against live traffic: in staging this proves nothing is lost, but against live traffic with persistence off (the very thing the second experiment tests), the restart drops all in-flight operational state and un-revokes every previously revoked token system-wide, not just your test one: - Shared: run two instances behind the balancer, complete an [authorization-code flow](https://www.abblix.com/en/docs/glossary-overview#authorization-code-flow) with sticky sessions disabled, and repeat until both nodes have served each leg; no `invalid_grant` may appear. - Persistent: revoke a refresh token through the revocation endpoint, restart the cache backend, and present the revoked token again; it must still be rejected. If it validates, persistence is not actually on. ## Where this sits in the bigger picture This page covers operational state, the short-lived entries the server itself expires. Clients are a different store with different durability rules ([A Durable Client Store](https://www.abblix.com/en/docs/durable-client-store)), and a queryable inventory of issued tokens is a build-out on separate seams ([Token Inventory and Incident Revocation](https://www.abblix.com/en/docs/token-inventory-and-revocation)). --- Source: https://www.abblix.com/en/docs/durable-client-store.md # A Durable Client Store in About a Hundred Lines Out of the box, Abblix OIDC Server keeps clients in memory, in an internal store seeded from `OidcOptions.Clients` at startup. For statically configured clients that is all you ever need: the configuration file is the durable store, and a restart reloads it. The moment [Dynamic Client Registration](https://www.abblix.com/en/docs/glossary-overview#dynamic-client-registration) enters the picture, it stops being enough, twice over. The in-memory dictionary is per-process: in any multi-instance deployment (two pods behind a Kubernetes load balancer), a client registered through one instance simply does not exist on its neighbors, so the registration succeeds and the very next token request fails with `invalid_client` whenever the balancer picks another pod. And a restart forgets everything silently, along with every token-endpoint credential the registered client was issued. The fix is the library's standard answer to persistence: put your own store behind the seams. Client configuration is durable data. Registrations must survive restarts and failovers by construction, so its home is a persistent database. Which one is your call: the seams take any relational or document store. The worked example below uses PostgreSQL. ## Two seams, one store The client registry splits into a read seam and a write seam. The read seam is `IClientInfoProvider`, one method: `TryFindClientAsync` takes a client id and returns the `ClientInfo` or nothing. The write seam is `IClientInfoManager`, three methods: `AddClientAsync` and `UpdateClientAsync` take a whole `ClientInfo`, `RemoveClientAsync` takes an id. The server reads through `IClientInfoProvider` on every protocol request that names a client: authorization validation, every [client-authentication](https://www.abblix.com/en/docs/glossary-overview#client-authentication) method, userinfo, end-session, DCR reads. The write seam is exercised by exactly one feature: [Dynamic Client Registration](https://www.abblix.com/en/docs/glossary-overview#dynamic-client-registration) persists new clients through `AddClientAsync` and drives the [RFC 7592](https://datatracker.ietf.org/doc/html/rfc7592) lifecycle through the other two methods. If you never enable DCR, a read-only provider is a complete implementation. The split is [CQRS](https://martinfowler.com/bliki/CQRS.html) in the small: queries and commands travel separate interfaces, and nothing requires one implementation to serve both. A host can point `IClientInfoProvider` at a read-optimized model (a replica, a cache, a denormalized view) while `IClientInfoManager` commands go to the system of record. The recipe below composes both sides into one class only because that is the simplest arrangement; the short-TTL cache the hot-path section adds in front of the provider is exactly a separate read model growing out of this split. `ClientInfo`, the record both seams exchange, is keyed by `ClientId` and carries the client's whole protocol policy: secrets and authentication method, redirect and logout URIs, grant and scope allow-lists, token lifetimes, per-client signing and encryption algorithm choices, and the DCR metadata. Treat it as one document rather than a table of its sixty-plus members: that shapes the storage decision below. ## How the default is wired, and how to replace it The library's seams follow the `TryAdd` convention, and the client store is one of them: register your implementation of either interface before `AddOidcServices` and the library's own default stands down. Internally it registers one singleton implementing both interfaces and routes each interface to it only if nothing already answers for that interface, so the host wins by arriving first. This guide takes a different arrangement. Decorating the read side and replacing the write side *after* `AddOidcServices` keeps the clients declared in configuration working alongside the durable store, which is what a migration usually wants. Register your store class as a singleton after `AddOidcServices`, then do the two sides separately. On reads, `Decorate` wraps `IClientInfoProvider` in a decorator of your own that holds the library's default alongside your store. On writes, `RemoveAll` detaches the in-memory manager and `AddAlias` points that interface at your store, so Dynamic Client Registration writes where the reads will find it. ```csharp // Program.cs, after AddOidcServices(...) builder.Services.AddSingleton(); // reads: config-file clients keep working, the durable store answers for the rest builder.Services.Decorate(); // writes: detach the in-memory manager, point DCR at the durable store builder.Services.RemoveAll(); builder.Services.AddAlias(); ``` `Decorate` and `AddAlias` come with the library's [DI](https://www.abblix.com/en/docs/glossary-overview#di) toolkit (`Abblix.DependencyInjection`); `RemoveAll` lives in `Microsoft.Extensions.DependencyInjection.Extensions`, a `using` the implicit set does not cover. The decorator itself is one expression: ask the inner provider first, fall back to the store when it answers nothing. Config-defined clients therefore win on read, so a DCR registration can never override an existing first-party client - which is a fact about resolution order, not a license for host authorization to trust id naming patterns. ## The recipe, worked on PostgreSQL A persistent store is the natural home for client configuration, and a relational one adds what a key-value store cannot: a *queryable* client inventory (list all clients, filter by name, audit registrations) inside the same durability and backup regime as your system-of-record data. Nothing below is PostgreSQL-specific beyond the SQL dialect; the same shape carries to any relational or document database your platform already trusts. Resist the urge to model `ClientInfo`'s sixty-plus members as columns: the server only ever looks a client up by id, and a column-per-property schema buys nothing but a migration every time the library adds a policy knob. One `jsonb` payload column carries the document; promote to real columns only what *you* query: ```sql CREATE TABLE oidc_clients ( client_id text PRIMARY KEY, payload jsonb NOT NULL, updated_at timestamptz NOT NULL DEFAULT now() ); ``` ```csharp public sealed class PostgresClientStore(NpgsqlDataSource dataSource) : IClientInfoProvider, IClientInfoManager { public async Task TryFindClientAsync(string clientId) { await using var connection = await dataSource.OpenConnectionAsync(); var json = await connection.ExecuteScalarAsync( "SELECT payload FROM oidc_clients WHERE client_id = @clientId", new { clientId }); return json is null ? null : JsonSerializer.Deserialize(json); } public Task AddClientAsync(ClientInfo clientInfo) => UpsertAsync(clientInfo); public Task UpdateClientAsync(ClientInfo clientInfo) => UpsertAsync(clientInfo); private async Task UpsertAsync(ClientInfo clientInfo) { await using var connection = await dataSource.OpenConnectionAsync(); await connection.ExecuteAsync( """ INSERT INTO oidc_clients (client_id, payload, updated_at) VALUES (@ClientId, @Payload::jsonb, now()) ON CONFLICT (client_id) DO UPDATE SET payload = @Payload::jsonb, updated_at = now() """, new { clientInfo.ClientId, Payload = JsonSerializer.Serialize(clientInfo) }); } public async Task RemoveClientAsync(string clientId) { await using var connection = await dataSource.OpenConnectionAsync(); await connection.ExecuteAsync( "DELETE FROM oidc_clients WHERE client_id = @clientId", new { clientId }); } } ``` The example uses Dapper for brevity; EF Core with a single mapped entity works identically, and a runnable EF Core / SQLite version of exactly this pattern, layering decorator and all, lives in the `AspNetIdentitySample` project of the [Getting Started repository](https://github.com/Abblix/Oidc.Server.GettingStarted). The data source comes from `builder.Services.AddNpgsqlDataSource(...)` in the `Npgsql.DependencyInjection` package. DCR expiry needs one explicit touch here. There is no store-side TTL, so persist an `expires_at` column and filter it in the `SELECT`, or run a periodic cleanup. The choice between the two is exactly the schema control the bring-your-own-store model hands you. Populate the lifetime from `ClientInfo.ExpiresAfter` or your own registration default: the library's DCR endpoint never sets `ExpiresAfter`; its value is host policy. :::warning[This store holds client credentials: protect it accordingly] `ClientInfo.ClientSecrets` carries secret hashes and, for `client_secret_jwt` clients, the raw secret value (HMAC verification needs it), so this store puts credential material at rest in your database and its backups. The cache-entry encryption recipe in the [Production Hardening Checklist](https://www.abblix.com/en/docs/production-hardening-checklist) does not cover this store: it protects the operational-state path, while here the host owns serialization end to end. Protect the store itself: encrypted disk and TLS, a dedicated least-privilege role with no reporting or analytics grants, and the same retention and access discipline on backups you apply to a password database. ::: ## The hot-path caveat `TryFindClientAsync` sits on the hot path: the library ships no caching layer above it, so every authorization request, every token-endpoint client authentication, every userinfo call resolves the client through your adapter. Put a short-TTL in-memory cache in front, and keep the TTL short deliberately: it is the window during which an [RFC 7592](https://datatracker.ietf.org/doc/html/rfc7592) update or removal is not yet visible to validation. Seconds, not minutes. Decide the miss side explicitly too: caching nulls keyed by attacker-supplied client ids lets anyone bloat the cache by spraying identifiers, while not caching them sends every unknown-client probe to the database. Bound the cache size and keep negative entries shorter-lived than positive ones. And either way, note the coupling: your store's availability is now the token endpoint's availability, so an unreachable store means client resolution fails closed, and every flow with it. ## Verify it holds Before calling the store done, run the one scenario the default fails: - register a client through the DCR endpoint and complete a token request with it; - restart the server; - repeat the token request: it must still succeed, and the [RFC 7592](https://datatracker.ietf.org/doc/html/rfc7592) read must still return the registration; - confirm a config-file client authenticates as before: that proves the layering decorator works; - run two instances behind a balancer without sticky sessions and repeat the DCR-then-token sequence: a store can be durable without being shared, and this run catches that. ## Where this sits in the bigger picture This store covers clients. Operational state (codes, grants, device and [CIBA](https://www.abblix.com/en/docs/glossary-overview#ciba) requests) lives behind a different seam with different durability rules, covered in [Choosing a Backend for Operational State](https://www.abblix.com/en/docs/choosing-a-cache-backend); the go-live defaults that interact with DCR-registered clients ([PKCE](https://www.abblix.com/en/docs/pkce-in-openid-connect), refresh-token policy) are in the [Production Hardening Checklist](https://www.abblix.com/en/docs/production-hardening-checklist). --- Source: https://www.abblix.com/en/docs/token-inventory-and-revocation.md # Token Inventory and Incident Revocation Abblix OIDC Server issues self-contained JWTs and deliberately keeps no list of them. Individual revocation works out of the box: the [RFC 7009](https://datatracker.ietf.org/doc/html/rfc7009) endpoint marks a token's `jti` revoked, and every server-side validation checks that mark. The *inventory* question, though, has no built-in answer: which tokens does this user hold right now? Which clients received tokens today? Revoke everything issued to this subject. The day you need those answers is usually an incident, which is the wrong day to start building. This guide builds the missing piece on the seams designed for it: recording decorators over the token-issuance services, one queryable table, and a bulk-revocation routine that writes through the exact registry the server already consults. ## How revocation actually works: the path to plug into Two library pieces carry the whole mechanism, and the recipe must match both: - `ITokenRegistry` stores a status per `jti`: `GetStatusAsync(jwtId)` and `SetStatusAsync(jwtId, status, expiresAt)`, with `Revoked` and `Used` as the meaningful statuses. The entry lives in operational storage exactly as long as the token itself, then expires away; revocation bookkeeping cleans itself up. - A status-checking decorator on the JWT validator consults that registry on every server-side validation of a token that carries a `jti`. That single choke point is what makes a mark effective everywhere at once: a revoked refresh token fails redemption with `invalid_grant`, a revoked access token turns `active: false` at introspection and `invalid_token` at userinfo, and the same rejection covers token-exchange subject tokens as well. So bulk revocation needs no new enforcement: one `SetStatusAsync(jti, Revoked, expiresAt)` per token rides the same rails as the [revocation endpoint](https://www.abblix.com/en/docs/glossary-overview#revocation-endpoint). What is missing is only the list of `jti`s to feed it. That is the inventory. ## Record at issuance Every access and refresh token the server mints passes through one of two seams: `IAccessTokenService.CreateAccessTokenAsync` and `IRefreshTokenService.CreateRefreshTokenAsync`. Both receive the full context (`AuthSession` for the subject, `AuthorizationContext` for client and scopes, plus `ClientInfo`) and return the encoded token. One detail shapes the decorator: the `jti` is generated *inside* the library service, so nothing can be recorded before the inner call. Your implementation of the interface delegates to the inner service first and reads the record off the result - `JwtId` and `ExpiresAt` from the returned token's payload, the subject and the client and scopes from the arguments it was handed. Refresh-token issuance can legitimately return nothing, when the expiration policies have already elapsed, and that case records nothing. The second method of each interface, `AuthorizeByRefreshTokenAsync` and `AuthenticateByAccessTokenAsync`, is redemption rather than issuance: the inventory has nothing to write there, so it passes straight through. Recording at the issuance seam rather than deeper down is deliberate: this is the only place where the subject, client, and scopes are all in hand next to the fresh `jti`; the registry level sees nothing but ids and statuses. Both services are registered with `TryAdd`, and `Decorate` (from the library's `Abblix.DependencyInjection` toolkit) wraps whatever is currently registered, so the two `Decorate` calls, along with the registration of your own inventory store, belong in `Program.cs` *after* `AddOidcServices`. ```csharp // Program.cs, after AddOidcServices(...) builder.Services.AddSingleton(); builder.Services.Decorate(); builder.Services.Decorate(); ``` The decorator forces a decision: what happens when the inventory write fails. As written, the exception propagates and issuance fails: the inventory and reality stay consistent, at the price of coupling the token endpoint's availability to the inventory store; worse, a failure during [refresh-token rotation](https://www.abblix.com/en/docs/glossary-overview#refresh-token-rotation) lands after the old token is already marked, so the client loses its refresh chain. Do not soften that with a silent catch or a fire-and-forget write: a token issued but never recorded is invisible to the sweep, the one failure this build-out exists to prevent. If availability must win, route the failed record into a durable dead-letter store (an outbox table the sweep unions over) so nothing issued escapes the inventory, and alert on every fallback write. ## The inventory table The store behind `ITokenInventory` is yours; a single table answers every inventory question this guide opened with: ```sql CREATE TABLE issued_tokens ( jwt_id text PRIMARY KEY, kind text NOT NULL, -- 'access' | 'refresh' subject text NOT NULL, client_id text NOT NULL, scopes text[] NOT NULL, issued_at timestamptz NOT NULL DEFAULT now(), -- NOT NULL: both recorded seams always mint an expiry, and a nullable column -- would leave rows the nightly prune never removes expires_at timestamptz NOT NULL, revoked_at timestamptz ); CREATE INDEX ON issued_tokens (subject, expires_at); CREATE INDEX ON issued_tokens (client_id, expires_at); CREATE INDEX ON issued_tokens (expires_at); -- the nightly prune scans by expiry alone ``` Rows are prunable the moment `expires_at` passes: an expired token needs no inventory, and the registry's own status entries expire with the token anyway. A nightly `DELETE WHERE expires_at < now()` keeps the table at the size of your live token population. One honest sizing note: with short access-token lifetimes this table takes a write per issued token, which on a busy server is the highest-frequency write in this whole cookbook. If access-token rows earn nothing for you (many deployments only ever revoke and audit refresh tokens, accepting the few minutes of access-token tail), record the refresh decorator alone and halve the write volume. The seams make that a one-line choice. Treat the table itself as sensitive. It is a subject-to-token map (user identifiers, the clients they use, their scopes), and `revoked_at` makes it an incident-history ledger on top. Restrict it to a least-privilege role and keep it out of reporting and analytics grants. Bring `subject` under the same retention and erasure policy as your other user data: the expiry prune removes expired rows, not your incident history; set an explicit retention window for that. ## Incident revocation With the inventory in place, bulk revocation is a query plus two writes per token. List the subject's still-active rows, and for each one call `ITokenRegistry.SetStatusAsync` with the token's `jti`, the status `Revoked` and the token's own expiry - the same write the RFC 7009 endpoint makes, and the same mark every server-side validation consults. Passing the token's expiry keeps the mark alive exactly as long as the token it condemns; if you ever inventory a token kind whose expiry you did not record, fail long and pass your maximum token lifetime, because a mark that dies before its token silently un-revokes it. The second write stamps `revoked_at` on the inventory row, which is what makes the sweep auditable afterwards. Revoking everything issued to a client is the same loop over a different query. At incident scale, parallelize it (`Parallel.ForEachAsync` with a bounded degree) rather than awaiting one token at a time; both writes are idempotent, so the sweep is safe to re-run after any interruption. And see these for what they are, mass-revocation primitives: one call logs a subject out of everything, or a whole client's user base. Expose them only behind your strongest operator authentication and authorization, never bind the subject or client id to an unauthenticated request parameter, and audit-log every invocation with the operator's identity. ## What the sweep reaches, and what it cannot Immediately after the sweep, on the server itself: - every revoked refresh token fails redemption with `invalid_grant`, cutting the renewal chain; - every revoked access token answers `active: false` at introspection and `invalid_token` at userinfo; - the same marks reject revoked tokens presented as token-exchange subject tokens. What no server-side mark can reach is a resource server validating JWT signatures locally: it never asks the server, so it honors a revoked access token until the token's own expiry. That exposure is bounded by the access-token lifetime, which is exactly why the [Production Hardening Checklist](https://www.abblix.com/en/docs/production-hardening-checklist) caps it at minutes; resource APIs that must see revocation immediately should validate via introspection instead. And the sweep is a point-in-time cut, not containment: it does nothing to stop *new* issuance. A compromised account with a live [SSO](https://www.abblix.com/en/docs/glossary-overview#sso) session (or a compromised client with valid credentials) obtains fresh tokens seconds later. Terminate the user's sessions or suspend the client's credentials first, then sweep; or sweep again after containment. Rotation and cache persistence both interact with the sweep. [Refresh-token rotation](https://www.abblix.com/en/docs/glossary-overview#refresh-token-rotation), which is on unless a client turns it off, already marks a rotated-out token `Used` and revokes the whole grant family when one is replayed, so the inventory complements rotation rather than replacing it. Keep the two marks apart in any registry tooling you build: the sweep writes `Revoked`, rotation writes `Used`, and a query keyed on `Revoked` alone sees only half of what the registry knows. And because the registry rides on operational storage, the persistence requirement from [Choosing a Backend for Operational State](https://www.abblix.com/en/docs/choosing-a-cache-backend) applies doubly here: a wiped cache forgets revocation marks, and no inventory row will re-write them by itself. ## Verify the loop end to end - complete an [authorization-code flow](https://www.abblix.com/en/docs/glossary-overview#authorization-code-flow) with `offline_access` for a test user: the inventory must show one refresh and one access row; - run the subject sweep for that user; - present the refresh token at the token endpoint: `invalid_grant`; - introspect the access token: `active: false`; call userinfo with it: rejected; - confirm the inventory rows carry `revoked_at`. That sequence is also the E2E test worth keeping: it proves the decorators, the store, and the registry writes compose, not just that each piece works alone. ## Where this sits in the bigger picture The inventory rides on the rest of the cookbook: the revocation marks it writes live in operational storage, where persistence is load-bearing ([Choosing a Backend for Operational State](https://www.abblix.com/en/docs/choosing-a-cache-backend)), and the clients these tokens belong to have their own store with its own duties ([A Durable Client Store](https://www.abblix.com/en/docs/durable-client-store)). --- Source: https://www.abblix.com/en/docs/understanding-the-architecture.md # Understanding the Architecture This article walks through the internal architecture of Abblix OIDC Server: the components that make up its protocol core and the boundaries they expose, then shows how the server integrates with ASP.NET Core. Understanding the structure helps when you want to customize behavior, test the protocol logic in isolation, or plug the server into an existing .NET application. ## Basic Concepts Designed on the principles of [Hexagonal Architecture](https://en.wikipedia.org/wiki/Hexagonal_architecture_(software)), Abblix OIDC Server prioritizes separation of concerns by isolating its core logic through interfaces. Known alternatively as the Ports and Adapters architecture, this approach separates the application's core functionality from external interactions. ### Core The Core is the center of the hexagon: the business logic specific to authentication and authorization. In the context of Abblix OIDC Server, the Core holds the essential business logic and rules specific to authentication and authorization processes. This includes handling of OpenID Connect protocols, token generation, validation, user session management and the execution of authentication flows. The Core is agnostic to the external entities it communicates with, such as databases, web services or user interfaces. ### Ports Ports are the interfaces through which the Core interacts with the outside world. They are the capabilities the application offers, abstracted in a way that external actors or systems can use them without knowing the Core's internals. In Abblix OIDC Server, Ports might include: - API Endpoints: interfaces for receiving authentication requests, token requests, and other OpenID Connect-specific operations. - Data Access: abstractions for how data (e.g., tokens, user sessions, client configurations) is stored and retrieved, which could be through databases or external services. Ports act as contractual boundaries that define what capabilities are available from the Core. External changes then never reach the core business logic. ### Adapters Adapters are the implementations that connect the Ports to the actual external services or systems. They translate the external requests into operations that the Core can understand and execute, and conversely, adapt the Core's responses back to forms suitable for the external world. In the Abblix OIDC Server, Adapters might include: - Web Controllers: these adapt HTTP requests into calls to the application's Core services, handling web-specific protocols and data formats. - Database Connectors: they translate the Core's data access interfaces into actual queries to a relational database, NoSQL store, or other persistence mechanisms. - Client Libraries: software components that enable other applications to interact with the Abblix OIDC Server, adapting the server's capabilities into convenient methods for external use. By employing a [Hexagonal Architecture](https://www.abblix.com/en/docs/glossary-overview#hexagonal-architecture), Abblix OIDC Server ensures that its core functionality remains stable, secure, and isolated from external changes, whether those changes come from new UIs or new storage. ## Inside the Core The hexagon gives the shape of the whole server. ### Understanding Endpoints In OAuth 2.0 and OpenID Connect, endpoints typically refer to the URLs clients call to request tokens, retrieve user information, or initiate logout. In Abblix OIDC Server's core, endpoints are more than URLs. They are abstract logical units that group specific capabilities. ### Endpoint Catalog The easiest way to see the catalog is to follow a client application through it. A client's first contact with the server is Discovery, which publishes the [OpenID Provider Metadata](https://www.abblix.com/en/docs/glossary-overview#openid-provider-metadata) as the `.well-known/openid-configuration` document. A deployment that allows it can also let clients register and manage themselves at runtime through Dynamic Client Management ([RFC 7591](https://datatracker.ietf.org/doc/html/rfc7591) and [RFC 7592](https://datatracker.ietf.org/doc/html/rfc7592)). Then comes the main road of the protocol. Authorization is the front door for the authorization code, implicit, and hybrid flows; its validation pipeline chains composable validators that each check a single aspect of the request. A client that wants to keep the request parameters off the browser URL sends them ahead over a back channel to Pushed Authorization ([RFC 9126](https://datatracker.ietf.org/doc/html/rfc9126)) and receives a `request_uri` to present at the authorization endpoint. Input-constrained devices start at Device Authorization ([RFC 8628](https://datatracker.ietf.org/doc/html/rfc8628)) instead, and clients that authenticate users without any browser interaction open a [CIBA](https://www.abblix.com/en/docs/glossary-overview#ciba) flow at Backchannel Authentication. Whatever the entry point, everything converges on the Token endpoint, which exchanges grants for tokens: authorization code, client credentials, refresh token, resource owner password, device code, CIBA, and JWT bearer. Once tokens are issued, the serving endpoints take over. UserInfo returns claims about the authenticated user based on the granted scopes. Introspection lets resource servers verify whether an access token is active and inspect its metadata. Revocation lets clients invalidate access or refresh tokens they no longer need. And the session ends where it began, in the browser: Check Session serves the iframe for silent session monitoring, and End Session handles [RP-Initiated Logout](https://www.abblix.com/en/docs/glossary-overview#rp-initiated-logout), coordinating front-channel and back-channel notifications. Every one of these endpoints is built the same way inside, so learning how one works (say, the Token endpoint) gives you a reliable mental model for all the others. Let's take one apart. ### The Role of Handlers Each endpoint has a Handler that coordinates its operations. To achieve this, a typical Handler is composed of two key elements: a Validator and a Processor. #### Validators Validators are the first line of defense, tasked with examining incoming requests for authenticity and compliance with established protocols. To manage the complexity inherent in these requests, some of our more involved Validators are structured as a pipeline of simpler validation steps sharing a common validation context. This design adheres to the Composite pattern, where each step in the pipeline is responsible for validating a single aspect of the request. Decomposing complex validation into focused checks gives us fine-grained control over which aspects of a request succeed or fail: useful both for security reasoning and for writing tests that exercise a single validation rule at a time. #### Processors Processors take over after a request has been validated. They carry out the necessary actions based on the request, such as generating tokens or managing sessions. Unlike Validators, which ensure requests meet certain criteria, Processors actively perform actions or modify the system's state. #### Features Processors are built from Features: specialized application-level services, each focused on one isolated capability. Processors typically engage several Features, which in turn can use other Features. By following the Single Responsibility Principle ([SRP](https://www.abblix.com/en/docs/glossary-overview#srp)), each Feature is responsible for one specific task. You can think of them as the tiles in our mosaic, where each tile has its own color and its shape is very simple. But when you step back, all those tiles blend together to make a brilliant picture. When the server needs new capabilities, we add new Features and reuse existing ones instead of modifying monolithic classes. This keeps the Core extensible as OAuth 2.0 and OIDC evolve: new RFCs, new flows, new compliance requirements. To give you a sense of scale, here is the ground the current Feature set covers. A large share of it deals with the two parties of every exchange. On the client side, [Client Authentication](https://www.abblix.com/en/docs/glossary-overview#client-authentication) verifies applications through shared secrets sent in a header or request body, signed JWT assertions using either a shared secret or a private key, or [mutual TLS](https://www.abblix.com/en/docs/glossary-overview#mutual-tls-client-authentication) with a client certificate, while Client Information manages registrations, secrets, keys, and mTLS options behind a pluggable provider/manager abstraction. On the user side, User Information resolves claims based on granted scopes, with pairwise subject identifiers for privacy. Consent Management handles consent decisions through an `IUserConsentsProvider` abstraction, and a decorator injects consent prompts into the authorization flow. [Session Management](https://www.abblix.com/en/docs/glossary-overview#session-management) tracks authentication sessions, supports the OIDC Session Management spec including the `check_session_iframe`, and coordinates front-channel and [back-channel logout](https://www.abblix.com/en/docs/glossary-overview#back-channel-logout) notifications. Another cluster shapes the artifacts the server issues. Token Lifecycle creates, formats, and validates access, identity, refresh, and logout tokens, with separate formatters for auth-service JWTs and client-facing JWTs. Scope and Resource Management resolves scopes to claim sets and manages [resource indicators](https://www.abblix.com/en/docs/glossary-overview#resource-indicators-for-oauth-2-0) per [RFC 8707](https://datatracker.ietf.org/doc/html/rfc8707). Hashing computes the specification-mandated `at_hash`, `c_hash`, and `s_hash` values for token binding. Some flows bring Features of their own. Device Authorization implements the [RFC 8628](https://datatracker.ietf.org/doc/html/rfc8628) grant, including user-code generation, rate limiting, and device-code storage. Backchannel Authentication supports [CIBA](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html) with its ping, poll, and push notification modes. JWT Bearer handles the matching [grant type](https://www.abblix.com/en/docs/glossary-overview#grant-type) with issuer validation and a replay cache backed by distributed storage. Request Objects fetches and validates JWT-Secured Authorization Requests ([JAR](https://datatracker.ietf.org/doc/html/rfc9101)). Underneath all of that sits the plumbing no protocol implementation survives without. Storage persists [authorization codes](https://www.abblix.com/en/docs/glossary-overview#authorization-codes), authorization requests, and token metadata through `IEntityStorage` abstractions, with a distributed-cache implementation and Protobuf serialization. Secure HTTP Fetching makes outbound calls with [SSRF](https://www.abblix.com/en/docs/glossary-overview#ssrf) protection and response caching wherever the server retrieves request objects or JWKS documents. URI Validation guards redirect URIs with composable strategies, closing the door on open redirects. Random Generation covers the cryptographically secure generation of authorization codes, client IDs and secrets, session and token IDs, and request URIs. Issuer Resolution determines the issuer identifier from preconfigured values or from the request itself. Each of these Features exposes its own narrow interface, so replacing or extending any single capability (say, swapping the URI validation strategy or adding a custom token formatter) touches only that interface, not the surrounding flow. ### Composition Patterns The building blocks described above are deliberately assembled with classic patterns from the [Gang of Four](https://en.wikipedia.org/wiki/Design_Patterns) catalog rather than with a bespoke plugin model. Composite, Decorator, and Adapter carry most of the weight, and standard .NET [dependency injection](https://www.abblix.com/en/docs/glossary-overview#di) is what snaps them together. The [Composite](https://en.wikipedia.org/wiki/Composite_pattern) pattern lets the server combine multiple implementations of the same interface into a single logical unit. Client authentication is a good example: a composite tries dedicated per-method authenticators in turn (one for each method the spec defines) behind a single interface. The same pattern applies to authorization grant handlers, logout notifiers, URI validators, and the authorization validation pipeline itself. Adding a new authentication method means registering one more implementation. The composite picks it up automatically. The whole `CompositeClientAuthenticator` is a dozen lines: a constructor array of authenticators and a loop that asks each one until it gets a result. The wiring is one line too: `services.Compose()`, a helper from `Abblix.DependencyInjection` that collects every registered `IClientAuthenticator`, replaces those registrations with the composite, and hands them to its constructor. The [Decorator](https://en.wikipedia.org/wiki/Decorator_pattern) pattern layers cross-cutting concerns onto existing behavior without modifying the original class. Token status validation, consent prompt injection, HTTP response caching, and session-management enrichment of authorization responses are all implemented as decorators. Each one wraps an inner service, adds its concern, and delegates the rest. This keeps individual classes focused while letting the DI container assemble the full behavior chain. A concrete one is `AuthorizationCodeReusePreventingDecorator` at the token endpoint. It implements the same `ITokenRequestProcessor` interface it wraps; when it sees an authorization code that has already been used, it revokes every token issued from that code and rejects the request with `invalid_grant`, and in every other case it simply passes the request to the inner processor. One registration line (`services.Decorate()`) wraps whatever `ITokenRequestProcessor` is currently in the container, whether the default one or one you have already replaced. The [Adapter](https://en.wikipedia.org/wiki/Adapter_pattern) pattern works at the boundary rather than inside the Core. The entire `Abblix.Oidc.Server.Mvc` package is one large adapter (in the Gang-of-Four sense as much as in the hexagonal one) and its internal pieces repeat the pattern at a smaller scale: model binders adapt HTTP wire formats into typed request models, response formatters adapt typed responses back into HTTP. The section on ASP.NET Core integration below walks through those pieces in detail. None of this is wired by hand; the container assembles the chains. And where the protocol itself names the variants of a behavior, the server goes one step further and uses keyed services, making the protocol identifier the DI key. JWT signers and encryptors are registered under their [JOSE](https://www.abblix.com/en/docs/glossary-overview#jose) algorithm names, CIBA token-delivery handlers under their delivery modes, token-exchange subject-token resolvers under [RFC 8693](https://datatracker.ietf.org/doc/html/rfc8693) token-type URNs, [Rich Authorization Request](https://www.abblix.com/en/docs/glossary-overview#rich-authorization-requests) validators under their `authorization_details` types. A keyed registration is the container-native form of the Strategy pattern: the key selects the strategy, and the dispatch that would otherwise be a `switch` inside a factory lives in the container. Token encryption is the richest illustration, because a single JWE operation composes two keyed strategies. A JWE header names two algorithms: `alg` for key management and `enc` for content encryption. The encryptor resolves both from the container (the key encryptor under the key-management name (`RSA-OAEP-256`, `A256GCMKW`, `dir`), the content encryptor under the content-encryption name (`A256GCM`, `A128CBC-HS256`)) and combines them into one encryption pass. Signing works the same way with a single key: the signer for `RS256`, `ES384`, or any other algorithm is looked up by the name from the token header. The algorithm lists the server advertises in its [discovery document](https://www.abblix.com/en/docs/discovery-and-well-known-endpoints) are accumulated from those same registrations, so what is registered and what is promised cannot drift apart. CIBA shows the same shape outside cryptography: each delivery mode the spec defines registers its own completion handler under the mode string, and when an authentication completes, the router asks the container for the handler keyed by the delivery mode the client declared at registration. Supporting one more algorithm or delivery mode means one more registration. Working with DI at this depth is practical because of `Abblix.DependencyInjection`: a small standalone package that extends `Microsoft.Extensions.DependencyInjection` with tools the standard container does not provide out of the box. It deserves attention in its own right. Beyond `Compose` and `Decorate`, it offers service aliasing (the same implementation exposed under a second interface without creating a second instance) and per-registration dependency overrides: `Dependency.Override` supplies one constructor argument as a type, an instance, or a factory while the container resolves everything else. That override mechanism is exactly how each JWE encryptor above receives its algorithm name. The package depends only on Microsoft abstractions, so any .NET application can use it independently of the OIDC server. A [companion article on advanced DI in .NET](https://www.abblix.com/en/docs/advanced-dependency-injection) walks through these tools in depth: service aliasing, `Dependency.Override`, in-place decoration, and the live cursor that reopens a composed pipeline after the fact. The payoff of all this composition shows up when you need to change something. New functionality is added by composing Features rather than editing monolithic classes; existing behavior is customized by implementing narrow interfaces rather than subclassing large default implementations. The surface area you touch is sized to the change itself. ## Design Decisions Three internal design decisions shape how code is written throughout the library and are worth understanding before you start extending it. ### Standard .NET Mechanisms First Wherever .NET or ASP.NET Core already ships a mechanism, the library uses it instead of inventing a parallel one. Configuration flows through the options pattern (`IOptions`). Logging goes through `ILogger` with source-generated `LoggerMessage` methods. Protocol state that must survive between requests (authorization codes, device codes, replay caches) sits behind `IDistributedCache` by default. Outbound HTTP uses `IHttpClientFactory`, time is injected as `TimeProvider`, cryptography is native `System.Security.Cryptography`, JSON is `System.Text.Json`. The extension mechanism throughout is `IServiceCollection` itself, keyed services included. This is the inward-facing half of the same principle the ASP.NET Core integration follows on the hosting side: no parallel vocabulary. There is nothing library-specific to learn before you can operate or extend the server. Redirecting logs works the way it does in any other ASP.NET Core app; so does replacing a store or faking time in a test. And when the platform's mechanisms improve, the library inherits the improvement for free. ### Result Pattern for Error Handling Every operation that can fail returns a [`Result`](https://github.com/Abblix/Oidc.Server/blob/master/Abblix.Utils/Result.cs): success with a typed value, or failure with a structured error. Success and failure are different shapes in the type signature, not two faces of the same object distinguished by a boolean flag. The compiler enforces that callers handle both cases. You cannot accidentally read success data from a failed result. Validation failures become typed values you can bind, map, and match on, rather than exceptions floating up a call stack or string-coded error fields you need to remember to check. The pattern runs through the whole pipeline, not just its edges: validators return typed failures, processors return typed outcomes, and the failure branch travels untouched all the way to the response formatter, which turns it into the correct protocol error response. Nothing is thrown for control flow, and nothing gets silently swallowed on the way out. In a protocol library, where OAuth 2.0 error responses are a first-class part of the specification, this matters: the type system does the correctness work instead of each caller doing it manually. Migrating the entire codebase onto this pattern was a project of its own; the numbers and the lessons are in [the Result-pattern migration](https://www.abblix.com/en/docs/result-pattern-migration). ### JSON-Native JWT Layer The JWT library, [Abblix.Jwt](https://github.com/Abblix/Oidc.Server/tree/master/Abblix.Jwt), is built on `System.Text.Json.Nodes`. A claim value is a `JsonNode` and can carry any JSON type: string, number, boolean, array, or object. There is no intermediate serialization through strings. This sounds like a baseline expectation, but many JWT implementations in the .NET ecosystem are built around a string-valued claim model inherited from the `ClaimsPrincipal` abstraction. That model works until you hit standard claims that carry structured data: `aud` as an array of audiences, `amr` as an array of authentication methods ([RFC 8176](https://datatracker.ietf.org/doc/html/rfc8176)), `address` as a JSON object ([OIDC Core](https://openid.net/specs/openid-connect-core-1_0.html#AddressClaim)), or `cnf` carrying a proof-of-possession key ([RFC 7800](https://datatracker.ietf.org/doc/html/rfc7800)). Squeezing these through a string bottleneck introduces subtle bugs: whitespace differences, key ordering, numeric type ambiguity, single-element arrays serialized differently by different serializers. In Abblix.Jwt, a JSON object put into a token payload comes out as a JSON object on the other side. End to end, types are preserved without round-tripping through strings. ## Solution Structure The server is not a single monolithic assembly. It ships as a set of focused NuGet packages, each with a clear responsibility: - Abblix.Oidc.Server: the protocol Core: endpoints, features, domain model, and all the abstractions described above. Has no dependency on ASP.NET Core MVC. - Abblix.Oidc.Server.Mvc: the ASP.NET Core adapter: controllers, model binders, response formatters, and routing conventions that bridge the Core to the MVC pipeline. - Abblix.Jwt: a standalone JWT library handling token creation, signing, encryption, and validation. Used by the Core but also usable independently. - Abblix.Utils: general-purpose utilities: cryptographic helpers, URI builders, caching extensions, and the `Result` type used for error handling throughout the solution. - Abblix.DependencyInjection: advanced DI tooling built on top of the standard `IServiceCollection`: composite and decorator registration (`Compose`, `Decorate`), service aliases, dependency overrides, and keyed-service utilities that keep the `ServiceCollectionExtensions` in the other packages concise. Usable on its own, outside the OIDC stack. This separation matters in practice. If you need JWT operations without the full OIDC stack, reference `Abblix.Jwt` alone. If you want to host the server on a transport other than MVC, reference `Abblix.Oidc.Server` and write your own adapter. The Core will work the same way. ## Integration with ASP.NET Core Abblix OIDC Server plugs into ASP.NET Core through a dedicated MVC adapter. The protocol Core has no dependency on `HttpContext`, controllers, model binding, or action results. Those concerns are handled by the adapter. This has one deliberate consequence: inside your ASP.NET Core application, you continue to use the ecosystem's native mechanisms (routing, model binding, validation attributes, filters, [CORS](https://www.abblix.com/en/docs/glossary-overview#cors) configuration, standard action results) rather than learning a parallel vocabulary invented inside the OIDC library. We deliberately scoped the library to OpenID Connect and OAuth 2.0. Everything the framework already provides (HTTP plumbing, DI, logging, configuration) we defer to the framework. Everything specific to the OIDC and OAuth 2.0 specifications (issuance rules, flow state machines, conformance behavior) lives inside Abblix's Core and is the part we want to do well. The MVC adapter itself is organized around a few focused responsibilities: - Controllers translate HTTP requests into Core handler calls and Core responses back into action results. Each controller maps to a group of related endpoints (authentication, tokens, discovery, client management) rather than to individual protocol operations, so the number of controllers stays small. - Model Binders handle the OAuth/OIDC-specific quirks of HTTP input: parsing `Authorization` headers for client credentials, converting space-separated scope strings into collections, deserializing seconds-since-epoch values into `TimeSpan`, and forwarding client certificates from TLS termination proxies. - Response Formatters convert the Core's typed response objects into the appropriate HTTP representations: JSON bodies, redirect responses with fragment or query parameters, HTML pages for [front-channel logout](https://www.abblix.com/en/docs/glossary-overview#front-channel-logout). Each endpoint has its own formatter behind a narrow interface, so the Core never constructs HTTP responses directly. - Conventions and Filters wire up configurable routing (so endpoint paths can be changed per deployment) and conditional endpoint activation (so unused endpoints can be disabled entirely via configuration). ### Formatters in Depth Formatters exist for a single reason: the Core is isolated from constructing HTTP responses. This is intentional. Its job ends when it produces a typed response object for an endpoint: the semantic outcome, free of wire-level details. What happens next depends on HTTP concerns the Core has no business knowing: response modes, status codes, header conventions, media types, cookies, signed-JWT serialization. That translation is the formatter's job. Keeping the split has two concrete payoffs. The Core stays testable without any web infrastructure, because its response objects are abstract and framework-agnostic: never an MVC `ActionResult`, a Minimal API `IResult`, or any other transport-specific shape. And the same Core can serve different hosting models: a different adapter brings its own formatters without touching the protocol logic. Each OIDC endpoint has its own formatter, registered in DI and replaceable independently. The variety of HTTP outputs they produce is worth showing, because it is what justifies the concern having its own layer: - Response-mode handling: the same authorization response can be delivered as query parameters, a URL fragment, or an auto-submitting `form_post` HTML page. The Core produces the response once; the formatter picks the delivery channel. - Typed error to HTTP status code: the failure branch of a `Result` carries a protocol-level error code. The formatter translates it into the correct HTTP status, adding protocol-required headers such as a `WWW-Authenticate` challenge on `401` matching the client's authentication scheme. - Content negotiation driven by client configuration: the same response may travel as plain JSON or as a signed JWT, depending on what the client registered. The Core emits the claims once; the formatter decides the wire shape. - Cross-cutting response enrichment: HTTP-layer concerns that the Core cannot know about, such as session cookies and routing-resolved endpoint URLs, are attached at the formatter boundary, keeping the Core free of hosting-specific details. The same typed response from the Core could be routed through a Minimal API handler, serialized as a gRPC message, or captured by a test double. The conversion strategy is a detail of the hosting layer, not of the protocol. ## Conclusion Two properties of the architecture matter in practice. The Core can be exercised in unit tests without HTTP, storage, or any web framework infrastructure. And new adapters (different storage backends, different transport surfaces) can be added without modifying the protocol logic. The MVC adapter is one of two shipping today, and the second makes the point concrete: the Minimal API adapter brings the same protocol logic to services built that way without a single change to the Core. Inside the Core, the recursive pattern of Handlers splitting into Validators and Processors, which in turn compose Features, keeps the same separation going: each customization implements an interface matched to the concept being changed, not to the class that happened to contain it. And because the assembly language for all of it is standard .NET dependency injection, customizing the server feels like writing ordinary ASP.NET Core code, which is exactly the intent. --- Source: https://www.abblix.com/en/docs/advanced-dependency-injection.md # Advanced DI in .NET: Dependency Overrides, Decorators, Composites and Editable Pipelines At Abblix, we develop Oidc.Server, our certified OpenID Connect and OAuth 2.0 library for .NET. Integrate it and a single line, `AddOidcCore()`, registers a few hundred services. One of them is a pipeline: a chain of validators that every token request runs through, folded into a single service you resolve. Now suppose your deployment has a rule the library's authors never anticipated. A validation step of your own has to run at an exact point in the chain, right after one the library already put there. You did not write the pipeline, you cannot edit the library, and the chain is already assembled behind one interface. The package behind that escape hatch is `Abblix.DependencyInjection`, the [DI](https://www.abblix.com/en/docs/glossary-overview#di) toolkit Oidc.Server is built on. It takes no dependency beyond the Microsoft DI and logging abstractions. Everything it does rests on one observation you can confirm in a debugger: until you call `BuildServiceProvider()`, your DI configuration is not wiring or framework state. It is an `IList` you can read, rewrite, and hand back. ## TL;DR Before `BuildServiceProvider()`, that configuration is still an editable list, and `Abblix.DependencyInjection` edits it. This article climbs from the simplest use of that to the most powerful. Aliases route one service through another's registration so both share an instance. `Dependency.Override` pins a single constructor dependency without marker interfaces or keyed-everything. `Decorate` wraps a service in place without a hand-written factory. `Compose` folds a family of implementations into one pipeline behind a single interface. And `Decompose` hands you a live cursor over that pipeline, so you can drop a built-in step or insert your own, in a vendor-composed pipeline, after the fact, any time before the container is built. Each rung uses only what the one below it established. It is all registration-time work, and it asks nothing of your classes beyond an interface. What's here - [The collection as data: aliases and queries](#the-collection-as-data-aliases-and-queries) - [Pinning one dependency out of many](#pinning-one-dependency-out-of-many) - [Wrapping a service you don't own](#wrapping-a-service-you-dont-own) - [When many services answer as one](#when-many-services-answer-as-one) - [Why the library hands you one service](#why-the-library-hands-you-one-service) - [Taking the pipeline apart](#taking-the-pipeline-apart) - [Modifying the pipeline](#modifying-the-pipeline) - [Several pipelines behind one interface](#several-pipelines-behind-one-interface) - [Where this ends](#where-this-ends) ## The collection as data: aliases and queries The smallest tools work directly on that list, and the alias is the one you meet first. It fixes a problem the built-in container handles badly: a class that implements two interfaces, registered the obvious way, becomes two objects. ```csharp public class InMemoryCache : IReadableCache, IWritableCache { /* ... */ } services.AddSingleton(); services.AddSingleton(); // a SECOND InMemoryCache ``` Each registration activates its own instance, so `IReadableCache` and `IWritableCache` resolve to different objects, and whatever one of them caches is invisible to the other. The clean fix registers the class once as itself, then aliases each interface to it, so both resolve to the one instance and share its lifetime: ```csharp services.AddSingleton(); services.AddAlias(); services.AddAlias(); // one instance behind both interfaces ``` That is how `ClientInfoStorage` in Oidc.Server registers once and serves two contracts, `IClientInfoProvider` and `IClientInfoManager`, from a single instance. `TryAddEnumerableAlias` does the same into an enumerable set with deduplication (the shape a grant handler uses for its two contracts), and `AddKeyedAlias` covers the keyed case. Next to them sits a drawer of one-liners that query or rewrite the collection directly: `Find`, `FindAll`, and `FindRequired` locate registrations, `ChangeLifetime` rewrites one in place, `Clone` copies a descriptor under a new service type, and `RemoveAll` prunes. None of them is clever, and that is the point. ## Pinning one dependency out of many Sooner or later one registration needs a different dependency than the global one. The textbook workarounds are all heavy: invent a marker interface, switch everything to keyed services, or give up on the container and `new` the graph by hand. `Dependency.Override` keeps the container in charge and pins only the parameters you name: ```csharp services.AddSingleton(Dependency.Override(signingSecret)); ``` The container builds `WebhookPublisher` and resolves every constructor parameter as usual, except the one matching the pinned value, here a secret you hold at registration time that no container could resolve on its own. Overrides come in three flavors, each in generic and `Type`-based form: ```csharp Dependency.Override(fixedClock) // pin an instance Dependency.Override() // pin a type to resolve for that parameter Dependency.Override(sp => sp.GetRequiredService()) // pin a factory, run per construction ``` They work wherever the package builds objects: the `AddSingleton`/`AddScoped`/`AddTransient` overloads that take `params Dependency[]`, the imperative `CreateService` that builds an instance now and honors the same overrides, and the extra dependencies of a `Decorate` call. Under the hood it is `ActivatorUtilities`. The constructor is matched on each construction, pinned parameters skip resolution, the rest flow from the provider building the instance, so a scoped consumer still gets scoped dependencies. Oidc.Server uses this where one consumer must see a differently wired dependency. The [Pushed Authorization Requests](https://www.abblix.com/en/docs/glossary-overview#par) handler needs a request-object fetcher, but not the global one the authorization endpoint uses. Its registration pins `Dependency.Override()`, giving the PAR handler just the request-object fetcher where every other consumer resolves the full multi-fetcher chain. The override lives on the one registration that is the exception. Two habits keep overrides honest. Pin the exception and resolve the rule: if every registration overrides the same parameter, that parameter wants a real registration. And a pinned instance lives as long as the service holding it, so pinning something disposable into a singleton makes you its lifetime manager. ## Wrapping a service you don't own Aliases and overrides each leave the registration count alone. The next tool changes what sits behind one registration. Sometimes you need to add one concern to one service (cache its results, log calls, or guard what it hands back) without touching the class or knowing who registered it. That is the [Decorator pattern](https://en.wikipedia.org/wiki/Decorator_pattern), one of the [Gang of Four](https://en.wikipedia.org/wiki/Design_Patterns) structural patterns. A decorator implements the same interface as the object it wraps, holds a reference to it, and forwards calls while adding behavior before, after, or instead of delegating. Wrapper and wrapped are interchangeable to every caller, which is why decorators stack. If you have decorated services in .NET before, you have probably used [Scrutor](https://github.com/khellang/Scrutor), whose `Decorate()` has been the community's answer for years. Scrutor and this package share the same foundation: both build the decorator through `ActivatorUtilities` and swap the `ServiceDescriptor` in place, with no code generation and no dynamic proxies. They differ in scope. Scrutor's center of gravity is assembly scanning and decoration; it does not compose families or take them back apart, which is the whole reason this package exists. There was also a plainer motive for building rather than borrowing: Oidc.Server is a certified security library, and a third-party runtime dependency for machinery this central is surface we would rather not carry. Writing our own kept the footprint at the Microsoft abstractions and put decoration, composition, and editing in one place. If decoration is all you need, Scrutor does it well. The heavier alternatives cost more than they save here. Adopting a full container like Autofac means taking on a second container and its registration model; your existing registrations keep working through Autofac's `Microsoft.Extensions.DependencyInjection` adapter, but Autofac now backs the whole graph. Editing through the DI collection keeps that reach with one change layered on the shipped package. The call is one line: ```csharp services.Decorate(); ``` The decorator is an ordinary class that implements the interface and takes the wrapped instance as a constructor parameter. Everything else in its constructor still comes from the container: ```csharp public class TokenStatusValidatorDecorator( ITokenRegistry tokenRegistry, IJsonWebTokenValidator innerValidator) : IJsonWebTokenValidator { // validate via innerValidator, then reject tokens the registry marks revoked } ``` `Decorate` finds the current registration and replaces its descriptor in place with one that builds the original and hands it to the decorator. In place has two consequences. The original lifetime is preserved, so decorating a scoped service gives a scoped decorated service. And the descriptor keeps its position in the collection, so decorating a member of an enumerable set neither reorders it nor detaches it from the set: a property that matters once those members are folded into a composite, as the next sections do. Decoration stacks. Each call wraps whatever is registered right now, including a previous decorator, so the last one registered is the outermost at runtime: ```csharp services.AddScoped(); services.Decorate(); services.Decorate(); services.Decorate(); // resolves to Logging( Caching( Validating( ReportBuilder ) ) ) ``` Order is a design choice you make in the registration sequence, and it changes behavior. A cache outside the validator serves cached results without re-validating; swap the two lines and every hit re-validates. Logging outermost sees every call including cache hits; move it innermost and it sees only the misses. Oidc.Server stacks two decorators on one service, added by two features that know nothing about each other. `IAuthorizationRequestProcessor` runs an authorization request after validation. The single-use-PAR decorator wraps it during endpoint wiring: once a request has minted a code or token, it consumes the pushed `request_uri` so it cannot be replayed ([RFC 9126 section 7.3](https://datatracker.ietf.org/doc/html/rfc9126#section-7.3)). Session management wraps it later, in the feature-registration pass, attaching `session_state` on a successful sign-in for OIDC [Session Management](https://www.abblix.com/en/docs/glossary-overview#session-management). Because `AddOidcCore` wires endpoints before features, the PAR decorator goes on first and ends up the inner layer, with session-state as the outer one. Neither feature coordinates with the other beyond the shared interface, and the code comment on the PAR side says as much: it mirrors the session-management decorator and stacks with it. That independence is what registration-order stacking is for. `DecorateKeyed(serviceKey)` does the same for a keyed registration, with one deliberate fallback. If nothing is registered under the key but a plain registration exists, it builds a keyed decorated copy over the plain original and leaves the plain one untouched. Oidc.Server uses that to hand one consumer a caching `ISecureHttpFetcher` under a key while everyone else keeps the plain one. If there is nothing to decorate at all, the call throws and names the service, because a decorator waiting forever for a registration that never arrives is a bug better caught at startup. ## When many services answer as one Where a decorator wraps one service, a composite folds many into one. That is the [Composite pattern](https://en.wikipedia.org/wiki/Composite_pattern), the sibling of the decorator among the [Gang of Four](https://en.wikipedia.org/wiki/Design_Patterns) structural patterns. The composite implements the same interface as its children, holds them, and answers each call by delegating across them. Written by hand it is tiny: ```csharp public class ValidatorComposite(IValidator[] validators) : IValidator { public bool Validate(Request request) => validators.All(validator => validator.Validate(request)); } ``` The consumer never asks for an `IEnumerable`; it keeps asking for the single service it always wanted and receives the whole chain disguised as one. `AddOidcCore()` composes exactly this. Before composing them, it registers the token-context validators as an ordinary family: ```csharp services.TryAddEnumerable([ ServiceDescriptor.Singleton(), ServiceDescriptor.Singleton(), ServiceDescriptor.Singleton(), ServiceDescriptor.Singleton(), ServiceDescriptor.Singleton(), ServiceDescriptor.Singleton(), ]); ``` The order carries meaning: `ClientValidator` populates the client information that `ScopeValidator` and the DPoP check later read, so it has to run before them. `TryAddEnumerable` deduplicates on the (service type, implementation type) pair, so a feature module applied twice does not double a step. ## Why the library hands you one service The fair question first: why collapse a family of validators behind one service, instead of letting a consumer inject `IEnumerable` and loop over it? That is the standard .NET pipeline pattern, it costs zero library code, and for many chains it is the right call. A composite earns its place when you want three things the raw enumerable does not give you. The iteration policy (run all of them, stop at the first failure, aggregate errors) lives in one named class instead of being copied into every consumer. The members are hidden from plain resolution, so nobody accidentally injects a half-assembled chain. And the whole pipeline becomes a single service you can decorate or replace as a unit. Oidc.Server wants all three, so it composes. A plainer pattern than keyed registrations gets you most of the way: give the members their own `IValidatorStep` interface and write a composite that consumes them as `IEnumerable` internally, so consumers still inject the single composite, never the enumerable. That delivers the first and third benefits in full, and the second only weakly: the members remain injectable under `IValidatorStep`, where keying hides them from resolution entirely. What it cannot give you is the thing the rest of this article rests on: a pipeline you can still edit after it is composed. (Keeping the members and the composite under one interface is what makes that editing possible; it is why the package keys members by composite type rather than splitting the interface.) If you never need to reopen the pipeline, the two-interface composite is simpler, and you should reach for it first. In Oidc.Server the composite class is `TokenContextValidatorComposite`, and one call connects it to the family: ```csharp services.Compose(); ``` The class is the easy half. The hard half is the wiring: getting the members into that constructor, hiding them from every other consumer, and keeping them editable afterward. `Compose` transforms the collection to do all three. It re-registers them as *keyed* descriptors whose service key is the composite type itself, adds the composite, and points a plain `ITokenContextValidator` alias at it: - Before: plain `ITokenContextValidator` descriptors, one per validator. - After: the same set, re-registered under the key `typeof(TokenContextValidatorComposite)`; one descriptor for the composite whose factory pulls those keyed members; and one plain `ITokenContextValidator` alias routing to the composite. Keying the members by the composite type pays off three ways. Keyed registrations are invisible to plain resolution, so resolving `ITokenContextValidator` yields only the composite and every existing consumer keeps working. The members remain real descriptors in the collection, findable by anything that knows the key. And because the key *is* the composite type, the descriptors are their own registry, with no bookkeeping kept on the side. At resolve time the composite's factory asks for `GetKeyedServices(key)` and passes the members, in registration order, into the composite's `T[]` constructor. Descriptor order in the collection thus becomes execution order in the pipeline. That execution order is load-bearing, so it is the one platform assumption the package actively guards: the tests resolve a composed pipeline and fail if its members ever come back out of order. The platform documents ordering only for plain `IEnumerable` resolution, so that guard is what makes relying on it safe. This also closes a silent trap. Without the keyed move the members would all be plain `ITokenContextValidator` registrations, and Microsoft's container resolves a singular service as last-wins. `GetRequiredService()` would then hand back only the last-registered step and quietly skip the rest, with no error to warn you that you are validating with one check instead of the whole family. Keying the members takes them out of plain resolution entirely, so a singular resolve can only find the composite. Plural resolution follows suit: `GetServices()` returns exactly one element, the composite, so consumers that injected the enumerable keep compiling and simply see the whole chain as a single item. The lifetime rule is asymmetric. The composite adopts the *shortest* lifetime among its members, and each member keeps its own. The shortest is the only safe choice for the composite: it must never outlive a member, since a singleton composite holding a scoped step would capture it. A member *longer*-lived than the composite is fine, though. A singleton member of a scoped pipeline is created once and shared across every scoped composite instance, never re-created per request. So a mixed-lifetime family composes cleanly: several built-in pipelines deliberately mix one scoped validator among singletons, and the singletons stay singletons. Because the members are genuine descriptors now, the container inspects them like any other registration: with `ValidateOnBuild` enabled, a member whose own constructor dependencies can't be satisfied fails build-time validation with a precise error instead of surfacing only at first resolve. A holder that kept the members to itself would forfeit that, since the container can only validate what it can see. ## Taking the pipeline apart The pipeline is sealed behind one interface. To change a step after the fact, you have to reach its members again. That is what `Decompose` is for. The alternative it replaces is arranging the family's registrations by hand before the composing call, which works only while you are still writing that call. `Decompose` returns an `IComposition`: a live `IList` cursor over the family's keyed members. It does not detach them; every edit rewrites the keyed registrations in place, and the composite, rebuilt from its keyed members by a factory that reads them via `GetKeyedServices`, simply sees the new set. `AddFirst` and `AddLast` place a step unconditionally, while `AddBefore`, `AddAfter`, `Remove`, and `Replace` match their anchor by implementation type and throw when it is absent, so a mis-anchored edit fails at startup rather than doing nothing. Because these methods live on `IComposition` itself, the family interface is already bound: you name only the anchor at the call site (`AddAfter`), never `AddAfter`. `ResolveImplementationType`, which the anchor matching leans on, has one limit. A descriptor registered by implementation type, by instance, through a typed `AddX`, or through the package's own helpers reports its type cleanly, including the typed-factory shapes the alias helpers produce (the type is recovered from the delegate's generic arguments, or from the compiler-generated wrapper when those are erased). The exception is a hand-written factory lambda: `services.AddScoped(sp => new MyValidator())` compiles to a delegate whose only visible type is the return type, so `ResolveImplementationType` reports the interface and a match by concrete type finds nothing. Match those by service type or by position instead. ## Modifying the pipeline Your first instinct is probably to append your own validator the way you would extend any ordinary family, after `AddOidcCore()`: ```csharp services.AddOidcCore(/* ... */); services.TryAddEnumerable( ServiceDescriptor.Singleton()); ``` It compiles, and it does nothing useful. By the time control returns from `AddOidcCore()`, those validators are no longer resolved as an enumerable. They have been folded into a single composite behind `ITokenContextValidator`. A singular registration is last-wins, so your late addition either sits unused or shadows the whole composite, depending on how you registered it. The cursor from the previous section is the supported way to reach the composed pipeline. An insertion names an anchor and the step to place after it: ```csharp // in your composition root, AFTER AddOidcCore() services .Decompose() .AddAfter(ServiceDescriptor.Singleton()); ``` Two things about that snippet are easy to miss. It has to run after `AddOidcCore()`, because `Decompose` throws if the family was never composed, and composition happens inside `AddOidcCore`. That is the mirror image of the other extension path: registering your own validator *before* the library call still works, and editing the composed family works *after* it. The second is the anchor type. Several validator names are reused across endpoint families (the library defines four `ResourceValidator`s, and more than one `ScopeValidator`), so qualify the namespace you mean; a wrong one matches no member, and the edit fails at startup rather than leaving the pipeline unchanged. Removing a step reads the same way: ```csharp services.Decompose().Remove(); ``` As `AddOidcCore` composes it, the pipeline is the one that passed certification. Any edit, whether you insert, reorder, or drop a step, means you are running a pipeline the certification did not cover, and re-establishing conformance is on you. Reordering can break a spec requirement as surely as deleting, because the built-in order encodes correctness. So change as little as the fix needs. Appending or replacing in place is the same shape: ```csharp services.Decompose() .AddLast(ServiceDescriptor.Singleton()); services.Decompose() .Replace(ServiceDescriptor.Singleton()); ``` `Compose` refuses a few misuses outright. Composing an already-composed family throws, because the second composite would try to resolve the first as its own member. And the cursor throws if you add a member shorter-lived than the composite, the one lifetime combination it cannot hold without capturing it, while accepting an equal- or longer-lived member freely. ## Several pipelines behind one interface The keyed API mirrors the plain one for hosts that run several pipelines of one interface. A host may run one per channel, say, each under its own key: ```csharp services.AddKeyedSingleton("email"); services.AddKeyedSingleton("email"); services.ComposeKeyed("email"); services.DecomposeKeyed("email") .AddFirst(ServiceDescriptor.Singleton()); ``` The one new piece is the member key. A keyed family cannot key its members by composite type alone, because two pipelines of one interface might share the composite class and their members must never mix. So members live under a `ComposedFamilyKey`, a small record pairing the original service key with the composite type. Equality is by value, isolation follows from it, and from any member you can still recover both which pipeline it belongs to and what composes it. `ComposedFamilyKey` is a detail the package manages; you never construct one. ## Where this ends The boundaries are deliberate. All of this is registration-time machinery: the edits end at `BuildServiceProvider()`, and nothing here mutates a running container. The shortest-lifetime rule from earlier still holds: the composite never outlives a member. The costs are real and worth naming. Decoration and overrides build through `ActivatorUtilities`-style factories and reflection, which the container cannot statically analyze the way it analyzes a typed registration; the package is not annotated for trimming or NativeAOT, so validate it before a trimmed deployment. That reflection is a constructor match on each construction: negligible for singletons, small against the crypto and I/O of a real token request, but worth measuring if a decorated service sits in a hot loop. A failure through a composite reports a longer, factory-built stack than a typed registration would, and those factory layers are opaque in a debugger even though the descriptor list stays readable at build time. And the indirection only pays off when you need post-hoc editing; without that, the two-interface composite from earlier is simpler. Inside Oidc.Server this package is behind every `AddX()` you call, and it is your escape hatch the moment a built-in behavior is close but not quite. It asks nothing of your classes beyond an interface, and nothing of a composite beyond a constructor that takes its members as a `T[]`. The next time the library hands you a pipeline you cannot edit, open it. Call `Decompose` on it and look at what comes back: your registrations, in order, ready to rewrite before the container is built. Start with the one pipeline that almost fits. --- Source: https://www.abblix.com/en/docs/extension-points-map.md # Extension Points Map: Which Interface Owns Which Behavior You have wired `AddOidcCore` and the server runs. Now the real questions start: clients must live in your database, signing keys in your vault, consent in your UI, and one token-endpoint check has to follow your policy. Every one of those questions has the same shape (*which of the public interfaces owns this behavior, and how do I make my implementation stick?*), and this page maps the answers, seam by seam. The [architecture guide](https://www.abblix.com/en/docs/understanding-the-architecture) explains why the server is built this way; the [Advanced DI guide](https://www.abblix.com/en/docs/advanced-dependency-injection) covers the underlying [DI](https://www.abblix.com/en/docs/glossary-overview#di) toolkit in depth. This page stays at the level of *to change X, replace Y*. ## Four rules cover every seam Singular seams honor host pre-registration: your registration wins if it comes first. Register your implementation *before* `AddOidcCore` (or the feature's `Add*` call) and it takes the slot; the library's default never enters the container. The pattern is always the same: ```csharp builder.Services.AddSingleton(); builder.Services.AddOidcCore(options => { /* ... */ }); ``` Match the default's lifetime: nearly every seam resolves as a singleton, so a database-backed implementation takes `IServiceScopeFactory` and opens a scope per call rather than injecting a scoped `DbContext` directly. Pipeline families fold into composites: add members before composition, or edit the pipeline afterwards. Multi-member families (request-pipeline validators, client authenticators, logout notifiers, request fetchers, grant handlers) are collapsed into one composite at composition time: during `AddOidcCore` for the always-on families, or inside the opt-in call itself (`AddDynamicClientRegistration`, `AddBackChannelAuthentication`, `AddDeviceAuthorization`) for the families those bring in. A member registered *after* that point does not extend the pipeline. It replaces it: singular resolution returns only your implementation, every built-in step silently stops running, and nothing detects that at startup or runtime. So either register the member before the composing call, or take the pipeline apart with the [`Decompose()` cursor](https://www.abblix.com/en/docs/advanced-dependency-injection#taking-the-pipeline-apart): `AddFirst`, `AddAfter`, `Remove`, `Replace` edit one step in one line. Grant handlers are the one family that instead fails loud with a clear exception when registered too late; for them, register-before is the only path. And not every `*Validator` is a family member: keyed validators such as `IAuthorizationDetailValidator` follow the keyed rule below. Keyed seams dispatch on a wire discriminator: register under the key the protocol sends. Where the incoming message carries a discriminator (`alg`, `subject_token_type`, `authorization_details.type`, a JWS `crit` name), implementations are registered as keyed services under that exact string, and unknown keys are rejected at the protocol level. Keyed registrations follow the same first-wins rule as singular ones: register your implementation under a built-in key before the library's `Add*` call and it replaces the shipped default for that key. Decorator seams wrap after registration: the default must already exist to be wrapped. Where the table says *decorate*, call `services.Decorate()` after `AddOidcCore`: it wraps whatever is currently registered. Registering your own implementation *before* instead replaces the seam and silently drops the built-in decorators already stacked on it (the authorize-request processor, for example, ships wrapped in [PAR](https://www.abblix.com/en/docs/glossary-overview#par) and session-management decorators). The [Advanced DI guide](https://www.abblix.com/en/docs/advanced-dependency-injection) covers `Decorate` in detail. ## The seams you must supply Most seams have working defaults. Two do not: - `IUserInfoProvider`: the bridge to your user store. The library ships no default: connecting your user store (ASP.NET Identity, a custom table, an external directory) is the one integration every host writes. The [Getting Started guide](https://www.abblix.com/en/docs/getting-started-guide) walks through it. - `IUserDeviceAuthenticationHandler`: only if you enable [CIBA](https://www.abblix.com/en/docs/glossary-overview#ciba). The shipped stub throws by design: how your users approve a backchannel login on their device (push notification, authenticator app) is inherently yours to decide. And one near-mandatory seam: `IAuthSessionService` has a real default only when your host runs cookie authentication: the shipped adapter binds to the host's cookie authentication scheme. Hosts with a different session model implement this seam directly. ## Clients and registration | You need | Seam | Ships with | Notes | |---|---|---|---| | Clients in your database or config service | `IClientInfoProvider` | In-memory store over `OidcOptions.Clients` | About a hundred lines for a durable store; budget for caching. The provider sits on every request's hot path | | Persist clients registered through DCR | `IClientInfoManager` | Same in-memory store | Pairs with the provider above | | Custom client JWKS resolution or caching | `IClientKeysProvider` | Resolves keys from the client's registered JWKS or JWKS URI | | | Your own dynamic-registration policy (allowed hosts, quotas, naming) | `IClientRegistrationContextValidator` | Built-in validation steps | Composed family | | Gate open registration with initial access tokens | `IInitialAccessTokenService` | Built-in issuance and validation | | | client_id / client_secret format for DCR | `IClientIdGenerator`, `IClientSecretGenerator` | Secure random defaults | | ## Users, claims and consent | You need | Seam | Ships with | Notes | |---|---|---|---| | Your user store behind the server | `IUserInfoProvider` | Nothing. You supply it | Mandatory for every deployment | | Full control over claims assembly | `IUserClaimsProvider` | Orchestrates scopes, requested claims, subject conversion | | | Custom scope-to-claims mapping | `IScopeClaimsProvider` | Standard OIDC scope mapping | | | Dynamic or database-backed scope registry | `IScopeManager` | In-memory over `OidcOptions.Scopes` | | | API resource registry ([RFC 8707](https://datatracker.ietf.org/doc/html/rfc8707)) | `IResourceManager` | In-memory over `OidcOptions.Resources` | | | Persistent consent and a consent UI | `IUserConsentsProvider` | Auto-granting default | Replace to honor OIDC consent semantics; pending consents surface as a `ConsentRequired` outcome your host UI handles; `prompt=consent` handled by a decorator | | Pairwise subject identifiers under your salt policy | `ISubjectTypeConverter` + `AddPairwiseSubjectIdentifiers(...)` | HMAC-SHA256 per OIDC Core section 8.1 | | | Custom session tracking (server-side sessions, [SSO](https://www.abblix.com/en/docs/glossary-overview#sso) policy) | `IAuthSessionService` | Adapter over the host's cookie authentication | See [The seams you must supply](#the-seams-you-must-supply) | ## Tokens and grants | You need | Seam | Ships with | Notes | |---|---|---|---| | Extra access-token claims, custom token shaping | `IAccessTokenService` | Signed JWT per [RFC 9068](https://datatracker.ietf.org/doc/html/rfc9068) | | | [ID-token](https://www.abblix.com/en/docs/glossary-overview#id-token-identity-token) claim shaping | `IIdentityTokenService` | OIDC Core claims, nonce, hash-binding claims | | | Refresh-token rotation and persistence policy | `IRefreshTokenService` | Rotation, absolute and sliding expiration | | | A custom [grant type](https://www.abblix.com/en/docs/glossary-overview#grant-type) | `IAuthorizationGrantHandler` via `AddAuthorizationGrant()` | Code, refresh, client credentials, JWT bearer, token exchange; password / device / [CIBA](https://www.abblix.com/en/docs/glossary-overview#ciba) opt-in | Composed family; registers dispatch and discovery in one call; must precede `AddOidcCore`, fails loud otherwise | | Custom token-endpoint validation step | `ITokenContextValidator` | Built-in steps in load-bearing order | Composed family; worked example in the [Advanced DI guide](https://www.abblix.com/en/docs/advanced-dependency-injection#taking-the-pipeline-apart) | | Token and code lifetimes per client | Not a seam: `ClientInfo` properties | Per-client expirations with sensible defaults | Configuration, not code; for dynamic policy, shape tokens in `IAccessTokenService` | | Audit events / SIEM hooks | Not a seam: no event bus ships | Structured log events with stable event ids | Decorate the service that owns the action, or consume the structured logs | | Token exchange for new token types | `ISubjectTokenResolver` | JWT and refresh-token resolvers | Keyed by `subject_token_type` | | Trusted issuer registry for the JWT bearer grant | `IJwtBearerIssuerProvider` | Config-driven registry with JWKS resolution | | | Revocation-state storage | `ITokenRegistry` | Distributed-cache-backed status registry | | | Replay-protection backend for assertions and proofs | `IJwtReplayCache` | Distributed-cache implementation | Use a shared cache ([Redis](https://www.abblix.com/en/docs/glossary-overview#redis)) across instances | ## Keys and cryptography | You need | Seam | Ships with | Notes | |---|---|---|---| | Key rotation, vault- or database-held signing keys | `IAuthServiceKeysProvider` | Keys from `OidcOptions` certificates | [Signing-key persistence guide](https://www.abblix.com/en/docs/signing-key-persistence); the provider returns key material to the signing pipeline. Non-exportable [HSM](https://www.abblix.com/en/docs/glossary-overview#hsm) keys need the keyed signer seam below instead | | Support a JWS `crit` header extension | `ICriticalHeaderHandler` via `AddCriticalHeaderHandler(name)` | Unknown `crit` rejected per [RFC 7515](https://datatracker.ietf.org/doc/html/rfc7515) | Keyed by header name | | Swap or add a signing or key-management algorithm (HSM-backed RS256, an algorithm the library does not ship) | `IDataSigner`, `IKeyEncryptor` | RSA, ECDSA, HMAC signing; RSA, AES-GCM key wrap, direct key agreement | Keyed by JWS / JWE `alg`; each implementation self-declares its `Algorithm`, so registered algorithms appear in discovery automatically | | Custom hashing for stored secrets | `IHashService` | SHA-based hashing | | ## Sessions and logout | You need | Seam | Ships with | Notes | |---|---|---|---| | Custom `session_state` computation or session store | `ISessionManagementService` | OIDC [Session Management](https://www.abblix.com/en/docs/glossary-overview#session-management) implementation | | | Logout propagation beyond front/back-channel (message bus, custom protocols) | `ILogoutNotifier` | Front-channel and back-channel notifiers | Composed family | | Custom delivery or retry of [back-channel logout](https://www.abblix.com/en/docs/glossary-overview#back-channel-logout) tokens | `ILogoutTokenSender` | HTTP delivery through SSRF-validated client | | | Your own end-session request policy | `IEndSessionContextValidator` | Built-in validation steps | Composed family | ## Storage and operational state | You need | Seam | Ships with | Notes | |---|---|---|---| | Operational state in your cache or database (codes, [PAR](https://www.abblix.com/en/docs/glossary-overview#par), device and [CIBA](https://www.abblix.com/en/docs/glossary-overview#ciba) requests) | `IEntityStorage` | `IDistributedCache`-backed storage | Must keep get-and-remove atomic. Single-use credentials depend on it | | Key prefixes and namespacing in a shared cache | `IEntityStorageKeyFactory` | Standardized key layout | | | Storage wire format (compatibility, migration) | `IBinarySerializer` | Protobuf with JSON fallback | | | Custom authorization-code persistence | `IAuthorizationCodeService` | One-time codes over entity storage | | | PAR request storage | `IAuthorizationRequestStorage` | Entity-storage-backed | | | PKCE / nonce reuse-detection backend | `IAuthorizationValueReuseDetector` | Off until an interval is configured in `OidcOptions` | [RFC 9700](https://datatracker.ietf.org/doc/html/rfc9700) hardening | ## Authorization pipeline and flows | You need | Seam | Ships with | Notes | |---|---|---|---| | A custom [client-authentication](https://www.abblix.com/en/docs/glossary-overview#client-authentication) method | `IClientAuthenticator` | `none`, `client_secret_post`/`client_secret_basic`, `client_secret_jwt`/`private_key_jwt`, [mTLS](https://www.abblix.com/en/docs/glossary-overview#mutual-tls-client-authentication) variants | Composed family; each authenticator self-selects by credential shape | | Custom authorize-request policy step | `IAuthorizationContextValidator` | Built-in steps in load-bearing order | Composed family | | A new request-object transport | `IAuthorizationRequestFetcher` | [PAR](https://www.abblix.com/en/docs/glossary-overview#par), `request_uri`, inline request object | Composed family | | A custom response type, or enabling implicit / none | `IAuthorizationResponseBuilder` via `AddAuthorizationResponseProcessor()` | Code by default; `EnableImplicitFlow()`, `EnableNoneFlow()` opt-ins | A response type absent from DI does not exist: default-off semantics | | Cross-cutting behavior at authorize time | `IAuthorizationRequestProcessor` (decorate) | Core processor, already decorated for PAR and session management | Decorator seam: see the fourth rule above | | RAR: your `authorization_details` types | `IAuthorizationDetailValidator` via `AddAuthorizationDetailValidator(type)` | None: with no validators, RAR requests are rejected | Keyed by `type`; advertised in discovery automatically | | DPoP proof-validation policy | `IProofValidator` | [RFC 9449](https://datatracker.ietf.org/doc/html/rfc9449) validation | | | [SSRF](https://www.abblix.com/en/docs/glossary-overview#ssrf) policy for outbound fetches (request_uri, JWKS, notifications) | `ISecureHttpFetcher`, `ISecureUriValidator` | SSRF-validating client, DNS-free URI checks | | | [CIBA](https://www.abblix.com/en/docs/glossary-overview#ciba) user approval on the device | `IUserDeviceAuthenticationHandler` | Stub that throws. You supply it | Mandatory for CIBA | | CIBA acceptance policy | `IBackChannelAuthenticationContextValidator` | Built-in validation steps | Composed family | | Device-flow user-code format and verification UX | `IUserCodeGenerator`, `IUserCodeVerificationService` | Configurable alphabet; verification service your `/device` page calls | | ## Discovery, metadata and transport | You need | Seam | Ships with | Notes | |---|---|---|---| | Per-tenant or multi-host issuer | `IIssuerProvider` | Configured issuer, or derived from the request when unset | Issuer string only: derive the tenant from ambient request context; client, key and scope providers are not tenant-aware and need the same tenant resolution | | Dynamic or per-tenant [ACR](https://www.abblix.com/en/docs/glossary-overview#acr) advertisement (MFA levels) | `IAcrMetadataProvider` | Reads `OidcOptions.Discovery.AcrValuesSupported` | A static set needs no seam: configure the option | | Control advertised scopes and claims | `IScopesAndClaimsProvider` | Aggregated from registered scopes | | | The core's view of the incoming request (proxies, rewriting) | `IRequestInfoProvider` | Per-adapter HTTP implementation | Pairs with issuer strategy | | Custom HTTP shaping of any endpoint response | `I*ResponseFormatter`, one per endpoint (e.g. `ITokenResponseFormatter`) | Defaults per endpoint in both adapters | Decorate or replace per endpoint: see the fourth rule above | | Endpoint paths | `OidcRouteOptions` (Minimal API) / tokenized route templates from configuration (MVC) | `/connect/*`, `/.well-known/*` fallbacks | [Dynamic routes guide](https://www.abblix.com/en/docs/tokenized-routing-dotnet) | ## When the map is not enough The seams above are the curated set, not the full inventory. The library's public surface is larger, and it is one file away: every default registration lives in the `ServiceCollectionExtensions` of its feature area in [the source](https://github.com/Abblix/Oidc.Server). If you still find no seam for the behavior you need, [open an issue](https://github.com/Abblix/Oidc.Server/issues): the extension point you need may already exist under a name this page omits, or it will become a candidate for the next release. --- Source: https://www.abblix.com/en/docs/cognitive-cost-of-extensibility.md # The Cognitive Cost of Extensibility Your security team hands you a one-sentence policy: a [public client](https://www.abblix.com/en/docs/glossary-overview#public-client) (one that authenticates with no secret) must never be granted the `payments:write` scope. The sentence fits in a commit message. Enforcing it means adding one validation step to the authorization endpoint of your OpenID Connect server. Any of the three OpenID Connect server frameworks for .NET compared here (Duende IdentityServer, OpenIddict, Abblix OIDC Server) can enforce it. If the question is *can it be done*, the comparison is over before it starts: all three are extensible enough for almost anything a deployment demands. The question that separates them is a different one. How much of the product's internal model must you learn before your one-sentence rule runs? Call that the cognitive cost of extension. You pay it in two currencies. The first is domain knowledge, OAuth 2.0 and OpenID Connect themselves, and that bill is identical everywhere; no server can waive it. The second is product knowledge (the extension model each server asks you to think in). That part varies, and it varies far more than feature tables suggest. Full disclosure: we build one of the three. So instead of scoring difficulty (a number we would be inventing), this article implements the same rule in all three products against their real, shipped APIs, flagging the one place a cleaner form arrives in a future release, and lets you count the concepts yourself. ## TL;DR One security rule, three implementations. The rule reads the resolved client, which is the fact that separates the products. In Duende IdentityServer it is a custom validator in the fixed slot at the end of validation, where the loaded client is already waiting on the request. One interface, one builder call, nothing to resolve. In OpenIddict it is a scoped handler that fetches the client through the application manager and classifies it: the most ceremony of the three, and the price of a pipeline where every step is addressed the same way. In Abblix OIDC Server it is one more member of the endpoint's rule family, resolving the client through the same provider the built-in validator uses; the rule stays in protocol terms (the requested scope, client id, client type), and the wrinkle you learn is that its default slot runs before the client is resolved, so you either resolve the client yourself or seat the rule after the built-in client validator in one line. What differs is not the size of the code. It is the model you hold in your head to write it. ## The rule, and why it exists Reject an authorization request that asks for `payments:write` when the client is public. The rule is in no specification, so no product ships it as a switch, but its motivation is old and well documented. A public client (a single-page app, a mobile app, a CLI tool) cannot keep a secret: its bytes run on a device the user controls, so it authenticates with nothing stronger than its `client_id`. The [OAuth 2.0 Security Best Current Practice](https://www.abblix.com/en/docs/glossary-overview#security-bcp) ([RFC 9700](https://datatracker.ietf.org/doc/html/rfc9700)) and the [Financial-grade API](https://www.abblix.com/en/docs/glossary-overview#fapi) profiles draw the obvious line from there: a high-value capability, moving money or changing account state, must sit behind a client the authorization server can actually authenticate. It is the same segregation-of-duties instinct that keeps a payment-initiation role apart from an account-information role in open banking: a token that can move money, held by a client that cannot protect a secret, is a stolen token waiting to happen. The server already checks that a scope is registered for a client. What it does not do out of the box is enforce this cross-cutting policy: public clients never get the money-moving scope, whatever their registration says. That gap is where your one line of policy becomes one class of code. And because the policy is about the client, not just the request, every product must first answer the same question. Where do I get the resolved client, and what does that cost me? ## Duende IdentityServer: the client is already on the request Duende's extension language is domain services: named interfaces, each owning one area of behavior, customized by implementing the one whose name matches your problem. For custom checks on the authorize request, that name is `ICustomAuthorizeRequestValidator`, and its defining property is *where* it runs: last, after Duende's own validation has resolved and loaded the client. ```csharp public class ConfidentialClientPaymentsRule : ICustomAuthorizeRequestValidator { public Task ValidateAsync(CustomAuthorizeRequestValidationContext context, CancellationToken ct) { var request = context.Result.ValidatedRequest; if (request.RequestedScopes.Contains("payments:write") && !request.Client.RequireClientSecret) { context.Result = new AuthorizeRequestValidationResult( request, OidcConstants.AuthorizeErrors.AccessDenied, "payments:write requires a confidential client."); } return Task.CompletedTask; } } ``` Registration is one call on the builder: ```csharp builder.Services .AddIdentityServer(options => { /* ... */ }) .AddCustomAuthorizeRequestValidator(); ``` What you had to know: the interface, the builder method, and that `request.Client` is already the fully loaded client, because the fixed slot runs after client resolution. A public client is the one that requires no secret (`RequireClientSecret == false`). There is no ordering to arrange and no client to fetch: the single, fixed-position slot hands you everything the built-in validation has assembled, and this is the lightest of the three here. The change is exactly the shape Duende's model is best at: a check that runs once, at a known point, over a fully resolved request. The trade of that fixed slot is its mirror image. You take the request as validation left it, at the one point the model offers, and cannot place your check between two built-in steps. ## OpenIddict: fetch the client through the application manager OpenIddict's extension language is the pipeline: every request walks an ordered chain of handler descriptors (about 270 across the server), and your rule becomes one of them. A rule reading only the request would be barely more than a lambda (`AddEventHandler(builder => builder.UseInlineHandler(context => { /* ... */ }))`, no class at all). Reading the client is what turns it into a scoped handler. An inline handler takes no constructor dependency, so resolving the application manager requires a class. ```csharp public sealed class ConfidentialClientPaymentsHandler : IOpenIddictServerHandler { private readonly IOpenIddictApplicationManager _applications; public ConfidentialClientPaymentsHandler(IOpenIddictApplicationManager applications) => _applications = applications; public async ValueTask HandleAsync(ValidateAuthorizationRequestContext context) { if (!context.Request.HasScope("payments:write")) return; var application = await _applications.FindByClientIdAsync(context.ClientId); if (application is not null && await _applications.HasClientTypeAsync(application, ClientTypes.Public)) { context.Reject( error: Errors.AccessDenied, description: "payments:write requires a confidential client."); } } } ``` Registration adds the handler to the pipeline: ```csharp options.AddEventHandler(builder => builder.UseScopedHandler()); ``` What you had to know is a longer list. Which event context carries authorization validation: `ValidateAuthorizationRequestContext`. The handler contract and how rejection works. The descriptor builder and the lifetime choice it forces (here a scoped handler, because the rule injects a service). And the application-manager API to fetch the client (`FindByClientIdAsync`) and classify it (`HasClientTypeAsync`). No `SetOrder` is needed (an unordered custom handler runs after the built-in validation by default), so ordering enters only when a rule must sit between two specific built-in steps. What the extra ceremony buys is uniformity. This rule is a descriptor like every other, so the same knowledge that placed it can remove, reorder, or replace any built-in step, and the same handler model runs on OWIN and .NET Framework. ## Abblix OIDC Server: resolve the client, stay in protocol terms Abblix's extension language is the protocol rule itself. The authorization endpoint's built-in validation is a family of single-rule validators (client, redirect URI, flow type, nonce, scopes, PKCE), each about the size of the requirement it enforces, folded into one composite behind `IAuthorizationContextValidator` when `AddOidcCore` runs. Your rule joins that family: ```csharp public sealed class ConfidentialClientPaymentsRule(IClientInfoProvider clients) : IAuthorizationContextValidator { public async Task ValidateAsync(AuthorizationValidationContext context) { if (!context.Request.Scope.Contains("payments:write") || context.Request.ClientId is not { } clientId) return null; var client = await clients.TryFindClientAsync(clientId); return client is { ClientType: ClientType.Public } ? context.Error(ErrorCodes.AccessDenied, "payments:write requires a confidential client.") : null; } } ``` Registration is standard [dependency injection](https://www.abblix.com/en/docs/glossary-overview#di), before the composing call: ```csharp services.AddSingleton(); services.AddOidcCore(options => { /* ... */ }); ``` The one thing to know, the code above already answers. A member registered before `AddOidcCore` joins at the front of the family, ahead of the built-in `ClientValidator`, the step that resolves the client and populates `context.ClientInfo`. So at that position `context.ClientInfo` is not yet set, and the rule resolves the client itself, through the very same `IClientInfoProvider` the built-in validator uses. That keeps the rule's logic in protocol terms (the requested scope, `client_id`, the client type), with `IClientInfoProvider` the one library seam it touches. Its cost is one ordering fact (the default slot precedes client resolution) and one extra client lookup, negligible against the in-memory default provider, though a storage-backed provider pays a second resolution unless it caches. If you would rather seat the rule after `ClientValidator` and read `context.ClientInfo` directly, the `Decompose()` cursor does it in one line: ```csharp services.Decompose() .AddAfter( ServiceDescriptor.Singleton()); ``` Which of the two to reach for is a question about the rule, not about the library. A rule that needs nothing but the client stays self-contained when it resolves the client itself; one that also reads what earlier steps put on the context belongs after them, and the cursor is how it gets there. What you had to know: which family owns the behavior; that members fold into a composite at `AddOidcCore`, so a member registers before that call (one registered *after* it does not extend the family: singular resolution then returns only your rule, and the built-in composite silently stops running); and that the default front position precedes client resolution, so a client-dependent rule resolves the client itself. The library exposes its whole protocol core as public interfaces, a surface comparable to Duende's, and finding the seam among them is real work; the [extension points map](https://www.abblix.com/en/docs/extension-points-map) exists to shorten it, and the generated API reference lists them in full. What that buys is a rule that stays a rule. The class above is the policy, in the same shape as the built-in validators beside it and registered with the DI verbs any ASP.NET Core service uses; the one model to learn is where the rule composes (learned once, then reused for every rule you add), because the composition lives in the container, in a [small DI toolkit](https://www.abblix.com/en/docs/advanced-dependency-injection) the rest of the library is built with. ## Counting the concepts The tally turns on the same fact the walks did: where each rule runs relative to the moment the client is resolved. | Product | The rule becomes | What you learn before it runs | |---|---|---| | Duende IdentityServer | A custom validator in the fixed final slot | The validator interface and one builder call; the resolved client is already on the request, so nothing about ordering or fetching it | | OpenIddict | A scoped handler that fetches the client through the application manager | The event and context model, the descriptor builder and its scoped-handler lifetime, and the application-manager API to fetch and classify the client | | Abblix OIDC Server | One more member of the endpoint's rule family | Which family owns the behavior; that members compose at `AddOidcCore`; and that the default slot precedes client resolution, so the rule either resolves the client itself or sits after `ClientValidator` via the cursor | Three qualifiers keep this table honest. First, a rule reading only the requested scopes is trivial in all three (a bare inline handler in OpenIddict, a few lines through `ValidatedRequest` in Duende, two lines over `context.Request.Scope` in Abblix), so the comparison that reveals anything is the rule that needs the resolved client. Second, the line counts merely echo the concept counts (Duende the fewest, then Abblix, then OpenIddict) and track the model each makes you hold, not raw difficulty: Duende's fixed final slot is built for exactly this and is genuinely the lightest here because the client arrives already resolved. Third, a threshold depends on who is crossing it: a team already fluent in OpenIddict's pipeline, or in Microsoft DI internals, pays less than the concept count suggests. ## What a unit of extension is Underneath the three walks lies the real divide: what each product treats as the unit a developer reasons in. Duende's unit is the domain service: a named interface owning one area of behavior, coarse enough that a handful of them cover most customization territory, documented well enough that the right name is usually easy to find. OpenIddict's unit is the pipeline step: uniform, position-addressable, small, and deliberately domain-agnostic; the same descriptor machinery carries protocol validation and transport processing alike. Abblix's unit is the domain rule: smaller than a service, but still speaking protocol vocabulary rather than machinery vocabulary. In Abblix these units nest rather than compete. The hierarchy runs from coarse to fine: each endpoint has a handler that orchestrates it, one handler interface per endpoint area; each handler coordinates services (a validator, a processor, the token and client services they draw on); and the services decompose into features and rules, the feature areas plus the single-rule members of the composed families. An extension enters at whichever level matches its size. Replacing an endpoint's whole behavior means implementing its handler. Owning one behavior (token shaping, client storage, session tracking) means replacing one service. Adding one rule means adding one rule. The other two products layer as well (Duende runs from options through named services to its custom-validator hooks, and OpenIddict's descriptors group into well-defined stages), so all three products layer; the distinction is which unit each hands you at the moment your requirement steps off the covered path: a service to implement, a pipeline address to compute, or a rule to write. ## An architecture shaped like the specification There is a reason the rule-sized unit fits an OpenID Connect server so naturally: the specification itself is written in rule-sized statements. OpenID Connect Core requires that the redirect URI exactly match one of the values the client pre-registered, and that a nonce, when present, round-trips into the [ID token](https://www.abblix.com/en/docs/glossary-overview#id-token-identity-token); [RFC 7636](https://datatracker.ietf.org/doc/html/rfc7636) requires that PKCE parameters obey the method the client declared. Line those requirements up against the authorization endpoint's validator family (`RedirectUriValidator`, `NonceValidator`, `PkceValidator`) and the code reads like the specification's table of contents. Roughly one requirement, one class. When the unit of code matches the unit of the spec, spec evolution tends to arrive as addition rather than rewrite: a new draft's new requirement becomes a new family member, not a deeper branch inside an existing method. It also keeps rules honest about their dependencies: an ordering between two rules (flow type must be known before response modes can be judged) is visible in the family's declared order, not buried in a method's control flow. The price of that correspondence is the surface already noted: many rule-sized units mean many seams to learn your way around, which is the tax the extension points map exists to offset. ## Two roads to the same summit Pull back far enough and only two strategies for extensibility remain. One universalizes the execution mechanism: build a pipeline general enough to host anything, and every conceivable change becomes an insertion, removal, or reordering of steps. That is OpenIddict's road, and it is the same road ASP.NET Core middleware walks. Its strength is reach: the mechanism accommodates concerns the original authors never anticipated, at any depth of the stack. Its cost profile is front-loaded. Learn the mechanism once, then every extension looks alike. The other granularizes the domain model: make the units of behavior so small and so domain-shaped that most changes become additions to a model that already speaks your language. Duende took this road at service granularity; Abblix drives it further down, to the granularity of individual protocol rules, with DI as the composition mechanism. The cost profile here is pay-per-lookup. Each change starts by finding the owning seam, and each change stays small once found. Neither road dominates. A universal mechanism will always reach places a domain model has not mapped; a domain model will always keep more of your reasoning in the protocol you were hired to implement. Which bill is cheaper depends on how many extensions you will write, how unusual they are, and who on the team pays the learning cost. ## Choosing by the bill you will pay Do not choose an OIDC server by asking whether it can be extended. All three can, further than most deployments will ever push. Choose by tracing one concrete policy from your own backlog, the way this article traced one: write down what you would need to learn before the rule runs, in each product, given the team you actually have. The exercise takes an hour and tells you more than any feature matrix. The broader trade-offs (protocol coverage, storage philosophy, licensing, operational tooling) live in [the full comparison](https://www.abblix.com/en/docs/comparison-duende-openiddict). The architecture that makes rule-sized extension possible is described in [Understanding the Architecture](https://www.abblix.com/en/docs/understanding-the-architecture), the seams themselves are cataloged in the [extension points map](https://www.abblix.com/en/docs/extension-points-map), and the DI toolkit behind `Compose` and `Decompose` is covered in [advanced dependency injection in .NET](https://www.abblix.com/en/docs/advanced-dependency-injection). The specification will keep growing either way. The only real question is what each new sentence of it will cost you. *API shapes in this article were verified against the shipped sources of Duende IdentityServer 8.0.2, OpenIddict 7.5.0, and the current Abblix OIDC Server release.* --- Source: https://www.abblix.com/en/docs/result-pattern-migration.md # Stop Writing Boilerplate Conversions: The Result Pattern in C# Every error type looked identical. Same two properties: error and description. Different type name. I stared at the handler converting `ValidationError` to `ProcessingError`, copying those same two fields into a new type. Eight lines of boilerplate, for what? Simply because C# couldn't express "same error, different context." Every handler looked almost the same: validate the request, then explicitly pattern-match the result. If validation failed, destructure the error and reconstruct an identical error with a different type name from another hierarchy of types. If validation succeeded, process the request. Don't forget the default case throwing `UnexpectedTypeException`, a runtime bomb that could detonate if anyone added a new result type and forgot to update every handler. There had to be a better way. The refactoring changed how I think about error handling in OAuth 2.0 and OpenID Connect, where one mishandled case can compromise security or break an auth flow. I'll share what stuck: the patterns I kept using afterwards, and the mistakes that taught them. ## TL;DR I migrated our OAuth 2.0/OIDC library from per-endpoint inheritance-based unions to a single generic Result type. The problem? About twenty duplicate error types, handlers bloated with boilerplate type conversions, and runtime type checks waiting for the day someone added a result type and missed a handler. Here's what was at stake: Every new endpoint meant copy-pasting error handling code across four layers. Every handler risked `UnexpectedTypeException` if I forgot to update pattern matching. Code reviews became "spot the missing default case" exercises. Even I, as the author, had to re-trace the error hierarchy every time I touched a new endpoint. The mechanical work was dragging velocity down. The Result pattern changed the economics. About twenty duplicate error types vanished, and every handler in the validate-then-process pipeline collapsed from 10-15 lines to just 2. The runtime type checks along that pipeline became compile-time guarantees. The work shipped as the core of our v2.0 release, a change that swept more than 300 files; the test suite stayed green throughout, and v2 went on to pass the same OpenID Foundation conformance profiles v1 had passed. The trade-offs were real. Your team faces a learning curve with functional concepts. Type signatures grow longer in some places. The migration itself takes time and effort. Would I do it again? Without hesitation. If you're working with rich error semantics - OAuth 2.0, payment systems, complex validation flows - this pattern transforms how you handle errors. ## Where I Started To understand the impact of my migration, you need to see how Abblix OIDC Server is designed under the hood. Each OAuth 2.0/OIDC endpoint follows a consistent pipeline: Validators examine incoming requests for OAuth 2.0/OIDC compliance. Invalid credentials, missing parameters, expired tokens: validators catch these and return either a validated request or validation errors. Processors execute the business logic - generating tokens, retrieving user info, managing sessions, revoking credentials. They consume validated requests and return either success results or processing errors. Handlers orchestrate the flow: they coordinate validators and processors and manage the request-response lifecycle for each endpoint. Formatters convert results into HTTP responses. Success usually becomes 200 OK with a JSON payload. Errors become 400 Bad Request (client errors), 401 Unauthorized, or 403 Forbidden (auth failures), with standardized error details. ```mermaid flowchart TD Req([HTTP Request]) Req --> V subgraph Handler["Handler (orchestrates)"] V["Validator
returns: ValidRequest | ValidationError"] P["Processor
returns: Success | Error"] Fmt["Formatter
Converts to HTTP Response"] V -->|"ValidRequest"| P P -->|"Success"| Fmt V -->|"ValidationError → Error"| Fmt P -->|"Error"| Fmt end Fmt --> Res([HTTP Response: 200 OK or 4xx]) ``` Clean. Testable. Hexagonal. What no diagram shows: the mechanical work of passing errors through each stage. Validators returned `ValidationError`. Processors needed `ProcessingError`. Same two fields, copied manually at every boundary, not because the architecture was wrong, but because C# forced separate types in each hierarchy. ## The Problem I Was Solving Every component needed to communicate success or failure between stages, and my discriminated union implementation created massive duplication at every level. OAuth 2.0 and OpenID Connect servers are full of complex error scenarios across multiple endpoints. My original implementation used inheritance-based discriminated unions - each endpoint had a base response type with success and error subtypes. But here's what made it painful in my case: every endpoint had two separate type hierarchies. One for validation (ValidRequest/ValidationError) and another for processing (SuccessResponse/ErrorResponse). This meant: - About twenty duplicate error types, all containing identical properties - Forced type conversions: handlers manually converted `ValidationError` to `ProcessingError`, pure boilerplate - 10-15 line handlers: just to pass errors through validation, processing, and formatting - Runtime exceptions: pattern matching required default cases that threw `UnexpectedTypeException` The root cause? The C# we were building on had no native discriminated unions. Unlike F#, TypeScript, or Rust, it had no sum types built into the language, so the codebase simulated discriminated unions with inheritance, a verbose workaround. (That gap is closing in C# 15, which a later section takes up.) ### The Inheritance-Based Approach ```csharp // Base type for discriminated union public abstract record UserInfoResponse; // Success case public record UserInfoFoundResponse(JsonObject User, ClientInfo ClientInfo, string Issuer) : UserInfoResponse; // Error case - identical structure across all endpoints! public record UserInfoErrorResponse(string Error, string ErrorDescription) : UserInfoResponse; // Handler signature - doesn't reveal this can fail Task HandleAsync(UserInfoRequest request); ``` This pattern repeated across every endpoint. You might wonder: why not one base type for all endpoints? Because OAuth 2.0 endpoints return fundamentally different success types: UserInfo returns claims, Token returns access and refresh tokens, Revocation returns nothing, Introspection returns token metadata. Separate base types weren't a design mistake; they reflected the domain. The same goes for the split between validation and processing stages, which are genuinely different concerns. In inheritance-based unions, the base type defines the union's scope: you can't mix types from different hierarchies. The next idea is usually to share one base type across all pipeline stages. It would work only if the type system distinguished between stages, but C# doesn't. ```csharp public abstract record PipelineResult; public record ValidRequest(...) : PipelineResult; public record OidcError(string Error, string ErrorDescription) : PipelineResult; public record SuccessResponse(...) : PipelineResult; Task ValidateAsync(...); // Should be: ValidRequest | OidcError Task ProcessAsync(ValidRequest); // Should be: SuccessResponse | OidcError ``` Both methods return the same `PipelineResult`, so the compiler can't catch a processor that accidentally returns a `ValidRequest`. Sharing base types produces unions that are too loose, including combinations that should be impossible. The same problem appears if you try to share a base type across different endpoints: `UserInfoSuccess` and `TokenSuccess` under a common parent means the UserInfo handler is now type-compatible with the Token handler's return, and vice versa. I needed precise unions: - Validation union: `ValidRequest | ValidationError` - Processing union: `SuccessResponse | ProcessingError` Two different unions with different valid combinations. C# has no way to express "semantically identical types, different unions." The single-inheritance constraint forces separate error types per stage, even though they carry identical properties (`Error`, `ErrorDescription`). The handler sat in the middle, copying those properties from `ValidationError` to `ProcessingError`. I spent significant time trying to make shared base types work before I accepted this constraint. ### The Handler Complexity A typical handler: ```csharp public async Task HandleAsync( UserInfoRequest userInfoRequest, ClientRequest clientRequest) { var validationResult = await _validator.ValidateAsync(userInfoRequest, clientRequest); return validationResult switch { ValidUserInfoRequest validRequest => await _processor.ProcessAsync(validRequest), UserInfoRequestError { Error: var error, ErrorDescription: var description } => new UserInfoErrorResponse(error, description), _ => throw new UnexpectedTypeException(nameof(validationResult), validationResult.GetType()), }; } ``` More than 10 lines of code to express a simple flow: validate, then either process or return an error. The middle case is pure boilerplate - destructuring `Error` and `ErrorDescription` from `UserInfoRequestError` just to construct an identical `UserInfoErrorResponse`. And that `default` case with `UnexpectedTypeException`? It fails only at runtime. If you add a new validation result type and forget to update the handler, the compiler won't catch it. You'll only discover the bug when that code path executes in production. This pattern repeated across many handlers. The Token endpoint had `TokenError` to `TokenErrorResponse`. The [Revocation endpoint](https://www.abblix.com/en/docs/glossary-overview#revocation-endpoint) had `RevocationError` to `RevocationErrorResponse`. You get the idea. Every handler performed the same mechanical job. The formatters had the same problem - explicit pattern matching with default exception cases everywhere. ## Why Not Result From Day One A fair question I get from peer reviewers: why did I ship v1 on inheritance-based discriminated unions, when I knew about the Result pattern back when Oidc.Server started in late 2022 and functional error handling was already well-established? Two honest reasons. First, I didn't feel the pain yet. The codebase was small. A few endpoints, a handful of error types. Pattern matching with default-case-throws felt like the standard C# idiom, and most .NET projects I'd worked on used exactly that. I knew Result existed. I didn't have a concrete moment that made me think "this would have prevented today's bug." Without that pressure, the inheritance-based approach was the path of least resistance. Second, I deliberately limited novelty. Starting an OIDC server from scratch was already a large unknown: six conformance profiles, dozens of edge cases per spec, all of it security-critical. Adding "and the error model is something I've never shipped to production" multiplies risk on the wrong axis. I wanted v1 to land in a reasonable timeframe, and familiar idioms were part of that velocity, not a deficit. The migration came when both reasons inverted. The codebase had grown to more than a dozen endpoints, and the cost of inheritance-based DU was no longer hypothetical: every new endpoint cost me an hour of mechanical boilerplate. By that point, I'd absorbed enough of the codebase to take on a deeper refactor. Conditions changed; the answer changed. If I were starting Oidc.Server today, knowing what I know now? I'd probably reach for the Result pattern from the first endpoint. But that's the privilege of hindsight, not a critique of the original choice. v1 shipped on time and passed OpenID Foundation certification. The migration to v2 happened when it was the right move, not earlier and not later. ## Understanding Result Pattern A quick primer before the code. Result is a functional-programming approach to error handling. Instead of throwing exceptions or returning null, a method returns an explicit type: success with a value, or failure with an error. Nothing else. No nulls and no exceptions. The type system forces you to handle both paths. The critical part: you can't casually access the success value without handling the failure case. The success value is sealed inside the Result type, and the idiomatic path out is through operations like `Match` and `Bind` that force you to deal with both outcomes (escape hatches like `TryGetSuccess` exist for tests and boundaries). You rarely have to wonder "did I forget to check for errors?" Think of it as a railway with two tracks: ```mermaid flowchart TD Input([Input]) Input --> Validate Validate -->|"Success ✓"| Process Process -->|"Success ✓"| Format Format --> Ok([200 OK]) Validate -->|"Failure ✗"| Err([400 Error]) Process -->|"Failure ✗"| Err ``` - Success track: If the current operation succeeded, execute the next operation. - Failure track: If the current operation failed, skip all subsequent operations and propagate the error. ## Abblix Implementation You might ask why roll your own at all. The .NET ecosystem has solid Result libraries: ErrorOr, FluentResults, LanguageExt, OneOf. The honest answer is that we already had this type, proven in production in Abblix Account, before the migration began. Swapping working code we owned for a third-party dependency would have added external surface to a security library for no functional gain. If you are starting fresh without one, any of those libraries will do; nothing in this article is specific to ours. Its shape: ```csharp public abstract record Result { public static implicit operator Result(TSuccess value) => new SuccessResult(value); public static implicit operator Result(TFailure failure) => new FailureResult(failure); public abstract T Match(Func onSuccess, Func onFailure); public abstract Result Bind(Func> func); public abstract Task> BindAsync(Func>> func); private sealed record SuccessResult(TSuccess Value) : Result; private sealed record FailureResult(TFailure Failure) : Result; } ``` Implicit conversions. Processors just `return new OidcError(...)` on failure or `return new TokenIssued(...)` on success. The type system wraps them. No `Result.Success()` or `Result.Failure()` ceremony. Composition with Bind. `Bind` chains operations that return Results. If validation succeeds, processing continues. If it fails, `BindAsync` propagates the error automatically: ```csharp var validationResult = await _validator.ValidateAsync(request); return await validationResult // Result .BindAsync(_processor.ProcessAsync); // runs only on success ``` Pattern matching with Match. The compiler enforces exhaustiveness. You must handle both cases. No default branches, no runtime exceptions: ```csharp return response.Match( onSuccess: success => FormatSuccess(success), onFailure: error => FormatError(error)); ``` Additional operations. `MapSuccess`/`MapFailure` transform values without changing the Result shape; `Ensure` adds a predicate that converts success to failure; `TryGetSuccess`/`TryGetFailure` extract safely; `Deconstruct` plugs into C# deconstruction. Together these let you chain validations, transformations, and async operations while errors propagate automatically through the pipeline. ## The Migration Steps The first step was clear: I needed to establish the foundation. I couldn't touch handlers until I had a solid error type to rely on. I defined a single `OidcError` record to replace all those duplicate error types: ```csharp // One error type to rule them all public record OidcError(string Error, string ErrorDescription); ``` Simple, right? I kept specialized types only where they actually add value: ```csharp public record AuthorizationRequestValidationError(string Error, string ErrorDescription, Uri? RedirectUri, string ResponseMode) : OidcError(Error, ErrorDescription); ``` Why keep this? Because authorization errors need additional properties that generic `OidcError` doesn't have. This is legitimate specialization - the error carries context-specific information needed for OAuth 2.0 redirect flows. This is where the security stakes get concrete. An authorization error has to travel back to the client through the registered `redirect_uri`, encoded in the `response_mode` the request asked for. The exception is when the `redirect_uri` itself is what failed validation: redirecting then would be an open redirect, handing an attacker a way to bounce victims off our domain. The error type carries exactly the context that decides "redirect with the error" versus "stop and show it here." When that decision rode on a default case in a switch, a missed branch would not have been a 500 but a potential security hole. In v1 that guarantee rested on tests and review, and it held; exhaustive matching moves it from runtime discipline to a compile-time guarantee, which in an OAuth server is not a nicety. Here's the final error hierarchy: ``` OidcError (base: Error, ErrorDescription) ├── BackChannelAuthenticationUnauthorized → HTTP 401 ├── BackChannelAuthenticationForbidden → HTTP 403 └── AuthorizationRequestValidationError → HTTP 400 ├── Error, ErrorDescription (inherited) ├── RedirectUri (additional) └── ResponseMode (additional) ``` I deleted about twenty duplicate error types in this phase. That alone was worth the effort. Once the foundation was solid, I started migrating endpoints to it. And I discovered that every endpoint followed the exact same transformation pattern. ### Update Interface Signatures ```csharp // Before - what does this return? Task HandleAsync(UserInfoRequest request); // After - explicitly a success-or-failure operation Task> HandleAsync(UserInfoRequest request); ``` The new signature is self-documenting. Anyone reading it knows there are exactly two cases and what they are: either `UserInfoFoundResponse` on success or `OidcError` on failure. ### Simplify the Handlers The payoff: ```csharp // Before - explicit pattern matching with runtime exception var validationResult = await _validator.ValidateAsync(userInfoRequest, clientRequest); return validationResult switch { ValidUserInfoRequest validRequest => await _processor.ProcessAsync(validRequest), UserInfoRequestError { Error: var error, ErrorDescription: var description } => new UserInfoErrorResponse(error, description), _ => throw new UnexpectedTypeException(nameof(validationResult), validationResult.GetType()), }; // After - just 2 lines that do the same thing var validationResult = await _validator.ValidateAsync(userInfoRequest, clientRequest); return await validationResult.BindAsync(_processor.ProcessAsync); ``` That `BindAsync` call? It's railway-oriented programming in action. If validation fails, the error propagates automatically. On success, the processor runs next. No manual error mapping needed. ### Update Processors Processors became simpler too. Their signature changes to return `Result`, and the bodies stay as they were: thanks to the implicit conversions, a processor still returns the plain success response it built, and a failing one returns an `OidcError`. No wrapping, the type system handles it. ### Clean Up Formatters Formatters got the Match treatment: ```csharp // Before - explicit switch with runtime exception risk return response switch { UserInfoFoundResponse found => FormatSuccess(found), UserInfoErrorResponse error => FormatError(error), _ => throw new UnexpectedTypeException(nameof(response), response.GetType()) }; // After - exhaustive, compile-time checked return response.Match( onSuccess: FormatSuccess, onFailure: FormatError); ``` Both cases are handled or the code doesn't compile. No runtime surprises. ### Delete the Base Type The final satisfaction: deleting `UserInfoResponse` entirely. No more discriminated union base types needed. I repeated this pattern across all the endpoints. By the third one, I could do it in my sleep, and that sameness is what made each migration diff small, atomic, and easy to review. ### Let the Compiler Guide You After updating interfaces, I just built the project and fixed errors systematically. Each error was a clear signpost showing exactly what needed fixing. I worked from the bottom up: interfaces, then implementations, then tests, one endpoint at a time, keeping the suite green after each step. ## The Challenges Nothing's perfect. The migration had real costs. ### The Learning Curve Terms like `monad` and `railway-oriented programming` sound intimidating. Once you get past terminology, Result is simpler than what I had before. The real challenge isn't new complexity, it's unlearning OOP patterns I had convinced myself were normal because I had used them for years. Inheritance hierarchies with base types and switch expressions with default cases throwing exceptions are not simple. They feel simple only because they are familiar. The mental shifts were more significant than the code changes. Exceptions stopped being control flow and became the mechanism for truly unexpected failures. Validation failures? Expected: use Result. Database down? Unexpected: throw. When a signature returns `Result`, null is unrepresentable (nullable annotations enforce it), so the defensive null checks had nothing left to defend and disappeared. The biggest shift was replacing inheritance hierarchies with composition through `BindAsync`. Reading Scott Wlaschin's essays on railway-oriented programming was the breakthrough moment; after that I started seeing dual-track patterns everywhere in my codebase. ### Longer Type Signatures This is a real trade-off: ```csharp // Before Task // After Task> ``` The type signature got longer. In deeply nested generics, it can get verbose: ```csharp Task>, OidcError>> ``` My solution? Type aliases: ```csharp using ValidationResult = Result; Task ValidateAsync(...); ``` Much more readable. ### Multiple Error Types Result holds one error type. What if an operation can fail with database errors or validation errors? A common solution is a shared discriminated union base (`public abstract record OperationError`) with derived types. Another is nested `Result>`, which gets unreadable fast. I chose a third path: Result for expected failures (validation, auth) that map to 4xx status codes, exceptions for unexpected failures (database down, network timeout) that map to 5xx. Expected outcomes flow as values; system failures flow as exceptions. ### Minor Trade-offs No stack traces for Result errors. Result doesn't capture a call stack. That's fine: expected failures like "missing parameter" don't need one; the error code and description tell you what happened. Stack traces are valuable for unexpected failures, which remain exceptions. C# doesn't enforce handling. Unlike Rust's `#[must_use]`, C# lets you ignore a returned `Result` with no compiler error: the limitation applies to any return value in C#, not specifically Result, and C# has no built-in must-use enforcement, so code review carries this one. The idiomatic operations, `Match` and `Bind`, do force you to acknowledge both paths; the `TryGet*` and `Deconstruct` escape hatches are for tests and boundaries, where the discipline stays on you. Allocation cost. `Result` is a class-based record, so every pipeline stage allocates a small wrapper object, where struct-based libraries like ErrorOr and OneOf avoid the allocation. That is a deliberate choice - records keep the type simple, avoid large-struct copies, and sidestep default-struct pitfalls - and in an OAuth server the cost disappears into the noise: every request is dominated by I/O and cryptography, and the short-lived wrappers die in gen0. If you are adopting Result on a hot in-memory path, measure first; the struct-based libraries exist for exactly that case. ## What I Gained I approached the migration incrementally: one endpoint at a time, compiler-guided, with atomic commits I could revert. It touched almost every layer, and a large share of the code in those files simply disappeared, not because I cut corners but because it was boilerplate the Result pattern made obsolete. Three things changed for good. The twenty-odd near-identical error types collapsed into one `OidcError` with a few specialized variants. Every pipeline handler shrank to two lines. And along the Result-shaped pipeline, the `default` cases that used to throw at runtime became compile-time exhaustiveness: forget a case there now and it does not compile. (The authorize endpoint's multi-shape responses keep a discriminated union with its guarded matching: the residue the C# 15 section returns to.) Type safety moved from runtime hope to a guarantee the compiler checks. ### Automatic Error Propagation Railway-oriented programming made the pipeline simple: ``` Success Track: Validate → Process → Format → Return 200 ↓ ↓ ↓ Failure Track: Error ────→ Error ──→ Error → Return 4xx ``` On success, the processor runs; on failure, the error propagates automatically without running the processor. No manual error checking. No if or switch statements. Errors flow automatically. The first time I saw a validation error skip straight past processing to the error response without a single `if` statement, I knew the migration was going to pay off. ### Unified Error Type Across Pipeline The same `OidcError` now flows through every stage: ``` Validator → Result ↓ Processor → Result // Same OidcError! ↓ Formatter → ActionResult ``` No more forced type conversions between `ValidationError` and `ProcessingError`. The same `OidcError` flows from validation through processing to formatting. That's what a unified error type buys you. In languages with native discriminated unions, this unification is built in. In the C# versions we target, the Result pattern provides it. ### Simpler Testing Before, I had to do type checks in tests: ```csharp var response = await handler.HandleAsync(request); Assert.IsInstanceOfType(response); var error = (UserInfoErrorResponse)response; Assert.AreEqual("invalid_token", error.Error); ``` After, `TryGetFailure` extracts the failure directly, no casts and no type checks: ```csharp var result = await handler.HandleAsync(request); Assert.IsTrue(result.TryGetFailure(out var error)); Assert.AreEqual("invalid_token", error.Error); ``` ## Patterns That Emerged I now reach for these templates on every new endpoint. ### The Universal Handler Template Every pipeline handler (validate, then process) now looks like this: ```csharp public async Task> HandleAsync(TRequest request) { var validationResult = await _validator.ValidateAsync(request); return await validationResult.BindAsync(_processor.ProcessAsync); } ``` Two lines. Every time. The one deliberate outlier is the authorize endpoint, whose multi-shape response is exactly the case "Multiple Success Types" below is about. When all handlers look the same, you can focus on what makes each endpoint unique (the validation and processing logic), rather than the wiring that carries errors between stages. ### The Formatter Match Pattern All formatters follow this structure: ```csharp public Task FormatResponseAsync( TRequest request, Result response) { return Task.FromResult(response.Match( onSuccess: success => FormatSuccess(request, success), onFailure: error => FormatError(error))); } ``` Extract formatting logic into separate methods and keep the `Match` call clean. The success side formats the payload; the failure side picks the status from the error's subtype, per the hierarchy above, and writes the error code and description into the body. ### Implicit Conversion Pattern Skip the explicit `Result.Success()` and `Result.Failure()` wrappers. The implicit operators on `Result` let processors just return the domain value or the error directly, and the type system wraps them. The signature announces what the method does; the body doesn't need to repeat it. ### Error Type Inheritance Only for Behavior Only derive from `OidcError` when the subtype carries real differentiation: a distinct HTTP status code (`BackChannelAuthenticationUnauthorized` -> 401, `BackChannelAuthenticationForbidden` -> 403) or additional properties the caller needs (`AuthorizationRequestValidationError` adds `RedirectUri` and `ResponseMode`). Don't create hierarchies for organizational purposes. ## When NOT to Use Result Pattern Result isn't a silver bullet. ### Operation Always Succeeds If it can't fail, don't use Result. A method that adds two numbers returns a number; wrapping it in a Result costs the caller a `Match` and tells them nothing. ### Failure Is Truly Exceptional A repository read that fails only when the database is down does not need a `DatabaseError` in its signature. Let it return the data and let the driver's exception propagate. Database failures are unexpected. Use exceptions for unexpected failures and let them propagate up the call stack. ### Multiple Success Types If you need to return different success types, use discriminated unions (inheritance): ```csharp // Good: Discriminated union is appropriate here public abstract record AuthorizationResponse; public record AuthorizationSuccess(...) : AuthorizationResponse; public record AuthorizationRedirect(...) : AuthorizationResponse; public record AuthorizationError(...) : AuthorizationResponse; ``` Result is for binary success or failure. Multiple success types still need discriminated unions. ### Integrating with Exception-Based APIs Don't wrap everything in Result just for consistency. A method whose whole body is a try-catch around a database call, turning the driver's exception into an error value, has added boilerplate and lost the stack trace, and the caller now handles a failure it cannot do anything about anyway. Let those exceptions propagate. Introduce Result only where an expected, domain-level failure needs to travel as a value, not as a blanket wrapper around every exception-based API. ## What C# 15's Union Types Change If you follow the language, you can probably see the obvious objection coming: C# is getting native unions. Type unions ship in C# 15 with .NET 11, previewed in April 2026 and headed for general availability that November. The `union` keyword finally gives C# what F#, Rust, and TypeScript have had for years. So does that make this whole migration a workaround for a gap that is about to close? Not really, and the reason clarifies what Result actually is. Native unions and Result are not different problems so much as two levels of the same one. A union expresses "this value is exactly one of a closed set of types," and the compiler checks that you handle every case. That is exactly the right tool for the places this article tells you not to use Result. An authorization response that is success, redirect, or error is three genuinely different shapes, and a native union will express that more cleanly than the inheritance-based discriminated union I simulate today. Result adds something the `union` keyword does not provide on its own. It is the binary success-or-failure shape plus the railway composition layered on top: `Bind` chains the next step only on success, `Match` forces both branches, errors short-circuit the pipeline automatically. Could you write those same `Bind` and `Match` methods over a C# 15 union? Of course, and you would have to: the keyword hands you the shape and exhaustive matching, but the composition is library code either way. That composition, `BindAsync(_processor.ProcessAsync)` collapsing a handler to two lines, is the payoff of this migration, and it lives in the library layer, not in the shape underneath it. So the two are complementary. When C# 15 lands I expect to reach for native unions exactly where I reach for inheritance-based discriminated unions today: the multiple-success-shape cases above. Result stays the success-or-error spine of every endpoint, whatever shape sits under it. The migration was never a bet against the language catching up. It was a bet on railway-oriented composition, which the language is not adding. Could a future major that requires .NET 11 rebuild Result on a native union and delete the hand-rolled `SuccessResult` and `FailureResult` records? Out of the box a union is not a full replacement: it gives you the shape and exhaustive matching, not the `Bind` and `Match` composition that does the real work. Write those over the union and the two level out; what the native side then adds is that the hand-rolled wrapper records disappear and the one switch inside `Match` becomes compiler-verified. The usual objection, that an untagged `TSuccess | TFailure` cannot tell the two apart when success and failure are the same type, does not bite us: a success payload and an `OidcError` are never the same type, so a native union discriminates our cases directly. If your domain can put the same type on both tracks, the objection does bite (today's implicit conversions collide the same way), so keep the error type distinct. There is a practical gap too. C# 15 unions are a language and runtime feature, so a library can only put them in its public API by targeting .NET 11 and dropping the frameworks it still supports. We multi-target .NET 8, 9, and 10 today, and .NET 10 is itself an LTS supported into 2028. Result is just a type. It works on all of them now, with no framework or language version to wait for. That shapes the road ahead. .NET 8 and .NET 9 both retire in November 2026, the same month .NET 11 and C# 15 reach general availability. The likely path is to settle the 2.x line on .NET 10, supported through that LTS into 2028, and build a 3.0 on .NET 11 once those ship in stable form, not on the previews. That 3.0 is most likely where we adopt C# 15 unions as the substrate, with the `Bind` and `Match` composition kept on top: the success-or-error spine unchanged, the plumbing underneath it modernized. ## Recommendations ### Document Result vs. Exception Guidelines The dual approach needs clear boundaries. Document when each mechanism applies or the team will rediscover the distinction in every code review. Result works best for domain-level failures - the kind where you want to return a specific error code to the client. Validation failures become 400 Bad Request, authentication failures become 401 Unauthorized, authorization failures become 403 Forbidden. These are expected business outcomes, not exceptional circumstances. Exceptions remain appropriate for infrastructure failures - situations where the system itself is compromised. Database unavailable, network timeout, missing configuration, programming bugs - these map to 500-level status codes because they indicate something went wrong with the system, not the request. ### Create Helper Extensions Beyond the core Result type, I created extension methods for common patterns: #### Ensure - Inline Validation Convert a plain value into a Result with validation, the plain-value counterpart of the member `Ensure` on Result itself: an extension on any value that takes a predicate and the failure to use when it does not hold, plus an `EnsureAsync` doing the same for a value still inside a `Task`. Usage: ```csharp var result = clientId.Ensure( id => !string.IsNullOrEmpty(id), new OidcError("invalid_client", "Client ID is required")); ``` #### FailIfNull - Null Safety Converts a nullable into a Result, with a corresponding `FailIfNullAsync` for `Task`: ```csharp var result = await _repository.FindUserAsync(userId) .FailIfNullAsync(new OidcError("user_not_found", "User does not exist")); ``` #### BindAsync for Task<Result> Chains operations when you already have a `Task`, so you don't `await` in the middle of a pipeline: ```csharp return await _validator.ValidateAsync(request) .BindAsync(_processor.ProcessAsync) .BindAsync(_enricher.EnrichAsync); ``` ### Avoid Nested Results Don't nest Results unless absolutely necessary. Instead of `Result, AuthenticationError>`, flatten with a common error base: ```csharp public abstract record OperationError; public record ValidationError(...) : OperationError; public record AuthenticationError(...) : OperationError; Result ``` (Both are expected, domain-level failures. Infrastructure errors stay exceptions, per the guideline above.) ## Further Reading - [Railway Oriented Programming](https://fsharpforfunandprofit.com/rop/) by Scott Wlaschin: the definitive guide that introduced the railway metaphor. - [Functional Error Handling in C#](https://enterprisecraftsmanship.com/posts/functional-c-handling-failures-input-errors/) by Vladimir Khorikov: functional error handling patterns adapted to C#. - [Result in Rust](https://doc.rust-lang.org/std/result/): first-class Result in a language that enforces handling. ## Summary Method signatures became self-documenting contracts. The compiler caught, during the migration itself, the kind of mistakes that would otherwise have surfaced only in testing. For a domain where a mishandled error can leak the wrong response down the wrong channel, that shift from runtime hope to compile-time guarantee is the real return. That's the better way I was looking for. ## Try It Yourself If you're working with OAuth 2.0, OpenID Connect, or any domain with rich error semantics, try this approach. Start small: pick one feature with complex error handling, follow the migration steps above, measure the impact. You don't have to build the Result type yourself, either. The same `Result` this migration runs on is published as [Abblix.Utils](https://www.nuget.org/packages/Abblix.Utils/) on NuGet, the type that proved itself across the Abblix OIDC Server codebase. Pull it in (or reach for ErrorOr or FluentResults; the patterns transfer) and `Bind`, `Match`, `Ensure`, and the rest are already written, so you start on the patterns, not the plumbing. - [Abblix OIDC Server on GitHub](https://github.com/Abblix/Oidc.Server): Result pattern in action across 200+ files - [Abblix.Utils on NuGet](https://www.nuget.org/packages/Abblix.Utils/): the open-source Result implementation The worst thing you can do is continue writing boilerplate error conversions. Try it on one feature. Make an informed decision. --- Source: https://www.abblix.com/en/docs/source-generated-binding-models.md # A Source Generator Replaced Over a Thousand Lines of Hand-Written Code Abblix OIDC Server is our certified OpenID Connect and OAuth 2.0 library for .NET. Its architecture rests on a deliberate split: the core assembly implements the protocol - validators, grant handlers, token services - and knows OAuth 2.0 and OpenID Connect but nothing about ASP.NET Core. A separate MVC assembly adapts that core to the web framework: controllers, model binders, response formatters. The split is worth protecting: it keeps the protocol logic testable without a web host, and it leaves the door open for transports other than ASP.NET Core. But it has a price, and the price is paid in models: everything the protocol receives has to be described twice, once on each side of the boundary. Here is what the MVC side of one such pair looked like until recently. There were many like it, one per endpoint, and every line of every one was written and maintained by hand: ```csharp // The hand-written MVC model: every property duplicated from the core, // re-annotated for form binding, then copied back field by field. [BindProperty(SupportsGet = true, Name = Parameters.Scope)] [ModelBinder(typeof(SpaceSeparatedValuesBinder))] public string[] Scope { get; init; } = []; // ...twenty more properties... public Core.AuthorizationRequest Map() => new() { Scope = Scope, Claims = Claims, // ...twenty more assignments... }; ``` Here is the same model today, in its entirety: ```csharp [GeneratedFrom(typeof(Core.AuthorizationRequest), SupportsGet = true)] public partial record AuthorizationRequest; ``` The other half of that record still exists - the properties, the wire names, the binders, the validation, the projection onto the core type - but no human writes it anymore. A Roslyn incremental source generator emits it on every build, derived from the core model that was always the real source of truth. This article walks the diff between those two snippets, one hunk at a time: what moved into the core, what was deleted outright, what refused to move - and why the most important change is the one no diff can show. ## TL;DR Abblix OIDC Server keeps its protocol logic in a transport-agnostic core assembly. The ASP.NET Core MVC layer used to mirror every core request model with a hand-written binding model: same properties, different attributes, plus a mapping method copying every field. Keeping the two hierarchies consistent was a standing tax: every new wire parameter had to be added twice and mapped once, a missed copy produced no compile error, and the only countermeasures were review attention and tests written specifically to verify the mapping. We built an incremental source generator that produces the binding models from the core ones. The core declares the semantics of each parameter with small marker attributes - this value travels as a space-separated string, this one is an embedded JSON document, this one arrives in a named HTTP header. Each model binder declares which marker it realizes. The generator connects the two and emits the model: bound properties, binders, executable validation attributes, inherited XML documentation, and an implicit conversion back to the core type. Anything it cannot resolve fails the build. The payoff is the thing duplication never gave us: the two model hierarchies stay consistent automatically, as a property of the build rather than of anyone's discipline. The binding model layer shrank by an order of magnitude - from well over a thousand lines to barely more than a hundred - and the mapping tests went with it: there is no hand-written mapping left to verify. The full suite - thousands of unit and end-to-end tests - runs green. The costs were real: generated code is harder to discover, metadata symbols hide property initializers, and one model category turned out not to need generation at all - it needed deletion. ## What the Two Copies Carried The core version of each model carried `System.Text.Json` attributes describing the wire shape - this is how a request object's payload deserializes, and how requests round-trip through storage. The MVC version - the first snippet at the top of this article - carried ASP.NET Core binding attributes describing how the same parameters arrive from a form or query string, and a hand-written `Map()` method copied every property from the MVC model to the core one. Could one set of classes have carried both? Not without giving up the split. ASP.NET Core's model binding is driven by attributes on the bound type's properties - `[BindProperty]` with the wire name, `[ModelBinder]` with the binder type, the validation attributes the MVC pipeline executes - and every one of them is a type from the ASP.NET Core assemblies. Put them on the core models, and the core now references the web framework: it no longer compiles without it, no longer runs under any other transport, and the boundary we set out to protect is gone. Inheritance does not rescue this either: binding attributes must sit on the property being bound, and a derived model cannot attach attributes to properties it inherits - it would have to redeclare every one of them, which is the same duplication wearing a different syntax. MVC's attribute-free alternative, custom binding conventions, only relocates the problem: a convention that knows every parameter's wire name and binder is the same mirror, written as registration code instead of a class. So the second set of classes was the honest price of the architecture - which made it no less tedious to maintain. Many request models. Well over a thousand lines of this, plus the tests whose only purpose was to confirm the copying was faithful. None of it wrong, all of it upkeep. At some point you ask the obvious question: why is a human doing this? The MVC model contains no decision a machine could not derive from the core one. Its properties are the core's properties, its wire names are the core's wire names, and its mapping method is the identity function written out by hand, twenty assignments at a time. ## The Consistency Tax Adding a wire parameter to an endpoint meant touching the core model, the MVC model, and the mapping method. Miss either of the last two and nothing complains at compile time: each copy of the model is internally consistent on its own, and the type system has no idea the two are supposed to agree. It was never hard, just boring - the same three edits, endpoint after endpoint. So agreement had to be manufactured by process, and we paid for it the way every team with a mirrored layer pays. Reviews checked model changes property against property. Tests existed whose entire assertion was that the mapping assigned every field - tests that verify no behavior, only that a human performed a mechanical task correctly. And every contributor carried the standing obligation to remember the second and third edit. The daily cost was small, but it was permanent, it grew with every endpoint, and the guarantee it bought was only ever as strong as the most recent person's attention. To be fair, the layer was not pure duplication. The MVC attributes on its properties carried real behavior: which binder parses each parameter, which validation runs before the pipeline ever sees the value. But that knowledge was a fraction of the lines. Everything else - the properties, the wire names, the mapping - was a second copy of the truth, plus the standing obligation to keep both copies in agreement. ## The Property: Mechanism Out, Semantics In The first hunk is the property itself. Before, the binding knowledge lived in the MVC layer and named the technology outright: ```csharp // MVC layer, hand-written: names the binding technology directly. [BindProperty(SupportsGet = true, Name = Parameters.Scope)] [ModelBinder(typeof(SpaceSeparatedValuesBinder))] public string[] Scope { get; init; } = []; ``` This was the central design question of the migration: if the MVC model is generated from the core model, where does the binding knowledge live? The core cannot reference `SpaceSeparatedValuesBinder` - that would drag ASP.NET Core into the assembly we keep transport-free. The answer was to make the core declare *what* each parameter is, never *how* to bind it. A handful of empty marker attributes name the wire format: ```csharp // Core layer, after: declares the wire format, never the mechanism. [JsonPropertyName(Parameters.Scope)] [JsonConverter(typeof(SpaceSeparatedValuesConverter))] [SpaceSeparatedString] public string[] Scope { get; init; } = []; [JsonPropertyName(Parameters.MaxAge)] [JsonConverter(typeof(TimeSpanSecondsConverter))] [TotalSeconds] public TimeSpan? MaxAge { get; init; } ``` `SpaceSeparatedString` says: on the wire, this is one string with space-separated tokens. `TotalSeconds` says: an integer number of seconds. Neither mentions a binder, a converter, or any other mechanism. They are statements about the protocol, and they would read the same way if the transport were gRPC. A second family of markers describes transport sources for values that are not payload parameters at all: a named HTTP request header, the parsed `Authorization` header, the client certificate from the TLS connection. Those let the generator handle the [client authentication](https://www.abblix.com/en/docs/glossary-overview#client-authentication) material - DPoP proofs, [mTLS](https://www.abblix.com/en/docs/glossary-overview#mutual-tls-client-authentication) certificates - that the core marks as excluded from JSON serialization. ## The Binder: It Declares Itself The MVC side closes the loop. Each model binder states which marker it realizes: ```csharp [Binds(typeof(SpaceSeparatedStringAttribute))] public class SpaceSeparatedValuesBinder : ModelBinderBase { // ... } ``` The generator carries no mapping table. It scans the compiling assembly for these declarations and builds the marker-to-binder map on the fly. Adding a new wire format means adding a marker in the core and a binder with a `Binds` declaration in the MVC layer - the generator itself never changes. This mirrors a convention the codebase already follows elsewhere: when an extension point dispatches on a wire discriminator, the implementations self-declare their key in [DI](https://www.abblix.com/en/docs/glossary-overview#di) registrations. The instance owns its name; no central registry to keep in sync. ## The Mapping: Every Assignment Becomes One Operator The before side of this hunk is the `Map()` method from the top of the article - the identity function written out by hand, one assignment per property. The after side is emitted by the generator as the other half of the three-line stub: every bound property with its wire name lifted from the core's `JsonPropertyName`, the binder resolved through the marker, validation attributes translated to their executable MVC counterparts, XML documentation inherited from the core property, and the projection onto the core type - a `Map()` method plus an implicit conversion operator that delegates to it: ```csharp /// [global::Microsoft.AspNetCore.Mvc.BindProperty(SupportsGet = true, Name = "scope")] [global::Microsoft.AspNetCore.Mvc.ModelBinder(typeof(global::Abblix.Oidc.Server.Mvc.Binders.SpaceSeparatedValuesBinder))] public string[] Scope { get; init; } = []; ``` The pairing turned out to be more than a stylistic preference. The explicit method is discoverable - it shows up in completion lists and reads naturally in tests - while the implicit operator means a controller simply assigns the bound model to a core-typed local and the conversion happens at the assignment. There is no method call to forget, and only one projection body to maintain: the operator is a one-line delegate to the method. ## The Hunk That Fails the Build A hand-maintained mirror can only fail silently; the generated one was designed to fail loudly. The generator reports build errors for every situation that would otherwise be a silent drop: a wire-format marker no binder declares, a bound property without a wire name, an unrecognized marker on a property excluded from the payload. The last one doubles as a rename guard - if someone renames a marker attribute in the core, the generator stops recognizing it and the build breaks instead of a parameter quietly vanishing from an endpoint. ## What the Diff Will Not Show Some of the most consequential changes never appear in a property-by-property diff. ### The Model That Was Deleted, Not Generated The generator reads the core models through compilation symbols - effectively through the compiled assembly's metadata. Metadata does not carry property initializers. `public string[] Scope { get; init; } = [];` looks, through symbols, identical to a property with no default at all. For form-bound request models this barely matters; the generator special-cases non-nullable arrays. But the client registration model is different: it is a JSON document with meaningful defaults baked into initializers - the default response type, the default authentication method, the default subject type. A generated mirror would silently lose all of them, and the implicit operator would then overwrite the core's defaults with nulls. We went back and forth on this until the right answer turned out to be the simplest one: for a JSON-bound endpoint, the mirror should not exist. The core model already carries complete `System.Text.Json` metadata - it *is* the wire contract. The registration action now takes the core `ClientRegistrationRequest` itself as its `FromBody` parameter, takes the `Authorization` header as a separate `FromHeader` parameter, and copies that header onto the request record before handling it - the one thing the body cannot carry, added in one expression. That single decision deleted a hand-written model of several hundred lines and the entire question of how to preserve its defaults. ### The Model That Refused to Move One model refused to fit, and the refusal was informative. The client management endpoints of [RFC 7592](https://datatracker.ietf.org/doc/html/rfc7592) identify the client through the URL path - `/register/{clientId}` - with a registration access token in the `Authorization` header. The little model binding those two values is not a transport mirror of any core type; it is a narrow projection specific to those routes, and the client identifier's source is a routing concept the core deliberately does not know about. Inventing a route marker in the core would have smuggled URL topology into the assembly we keep transport-free. It stays hand-written, with a remark explaining why. Three categories emerged, each justified by the nature of its transport: form-bound models are generated, JSON-bound models do not exist as mirrors at all, and route-bound projections are written by hand. ### The Code Nobody Wrote Two smaller traps came from the same root: symbols read from metadata are not symbols read from source. A record's compiler-synthesized `EqualityContract` property is flagged as implicitly declared when you analyze source, but not when you analyze a referenced assembly - the generator initially tried to bind it as a wire parameter. And an attribute constructor with an optional parameter that the source never spelled out arrives from metadata with the default value folded into an explicit constructor argument; render that back into generated code and you produce a call that does not match the mirror attribute's constructor. The generator now trims trailing arguments equal to their parameter's declared default, restoring the attribute as it was written. ### The Annotation Stricter Than the Protocol Translating validation attributes produced the most instructive failure: dozens of end-to-end tests rejected [pushed authorization requests](https://www.abblix.com/en/docs/glossary-overview#par) the moment the generated authorization request model went in. The failing check was the https-scheme requirement on `request_uri`. The annotation was stricter than the protocol. With Pushed Authorization Requests in the picture, `request_uri` legitimately carries either an https URL or the `urn:ietf:params:oauth:request_uri:` value PAR hands to the client - and the only thing both have in common is being absolute URIs. We relaxed the core annotation to plain absolute-URI and let the request-object fetchers enforce scheme rules per source, where the distinction actually lives. The episode sharpened a rule for declarative validation: annotate only what holds for every flow that touches the parameter. Anything flow-specific belongs to runtime logic, because an attribute cannot know which flow it is in. ## Closing the Diff The binding model layer collapsed by an order of magnitude: many hand-written models became a handful of three-line stubs, one deleted file, and one deliberately hand-written projection. The mapping methods disappeared, and the tests that existed only to verify them disappeared with them. The generator itself is a few hundred lines, written once, covering every current and future model. The numbers matter less than the new invariant: the two model hierarchies now stay consistent automatically, with no effort spent on keeping them so. A wire parameter added to a core model appears in the MVC layer on the next build, documented, validated, and mapped - there is no second place to forget. The review attention, the mapping tests, the discipline of the second and third edit: all of that is gone, because the build now guarantees consistency instead of a process we run on people. And the markers earned their keep beyond generation. The core models now document their own wire semantics in a machine-checkable form. A reader sees `[SpaceSeparatedString]` and `[TotalSeconds]` and knows the wire shape without opening the converter. ## Principles That Travel Declare semantics, not mechanisms. The core says space-separated string; only the MVC layer knows what binder that implies. The moment a shared declaration names a technology, the layering is gone. Markers that survive a hypothetical transport swap are the ones worth having. Let implementations self-declare. The generator owns no table mapping markers to binders. Each binder claims its marker; the generator discovers the claims. Extending the system never means editing the generator. Static value lists only for spec-fixed sets. If a set of allowed values is defined by host configuration or DI registrations - grant types, response types, signing algorithms - a compile-time allow-list duplicates a runtime check and will eventually contradict it. Reserve declarative lists for sets the specification itself froze. Make the generator fail the build for anything it half-understands. Every silent skip in a code generator is a future debugging session. In a mirrored model layer the natural failure mode is the silent drop; the generator's job was to convert that entire class into compile errors, and the diagnostics took a quarter of its code. ## The Obligation That Never Expires We set out to stop paying for the same model twice: once in writing it, and forever after in keeping it aligned with its twin through reviews and tests. That is the part I keep coming back to. Duplication does not just cost the lines it occupies - it manufactures an obligation, and the obligation never expires until the duplication does. If your codebase mirrors models across a layer boundary by hand, add up what keeping the mirrors honest costs you per year: the mapping code, the tests that verify nothing but copying, the reviewer minutes spent comparing property lists. Then ask what any of that buys you that a build step could not guarantee outright. --- Source: https://www.abblix.com/en/docs/api/abblix-utils.md #### [Abblix\.Utils](https://www.abblix.com/en/docs/api/abblix-utils 'index') ## Abblix\.Utils Assembly | Namespaces | | | :--- | :--- | | [Abblix\.Utils](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils 'Abblix\.Utils') | | | [Abblix\.Utils\.Collections](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Collections 'Abblix\.Utils\.Collections') | | | [Abblix\.Utils\.Json](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Json 'Abblix\.Utils\.Json') | | | [Abblix\.Utils\.Validation](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Validation 'Abblix\.Utils\.Validation') | | | [System\.Buffers\.Text](https://www.abblix.com/en/docs/api/abblix-utils/System.Buffers.Text 'System\.Buffers\.Text') | | | [System\.Threading](https://www.abblix.com/en/docs/api/abblix-utils/System.Threading 'System\.Threading') | | --- Source: https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.md #### [Abblix\.Utils](https://www.abblix.com/en/docs/api/abblix-utils 'index') ## Abblix\.Utils Namespace | Classes | | | :--- | :--- | | [AddressValidatingHttpMessageHandler](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.AddressValidatingHttpMessageHandler 'Abblix\.Utils\.AddressValidatingHttpMessageHandler') | The message\-handler half of protecting a server\-initiated request whose address came from outside: it refuses redirects and re\-checks the address immediately before every send, leaving only the policy \- which addresses are refused \- to the derived handler\. | | [ArrayExtensions](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.ArrayExtensions 'Abblix\.Utils\.ArrayExtensions') | Allocation\-explicit array helpers: each operation returns a freshly allocated array sized to the result\. Prefer these over LINQ when the caller needs a concrete `T[]` without an extra `ToArray()` step, or when copying byte buffers via [System\.Buffer\.BlockCopy\(System\.Array,System\.Int32,System\.Array,System\.Int32,System\.Int32\)](https://learn.microsoft.com/en-us/dotnet/api/system.buffer.blockcopy#system-buffer-blockcopy(system-array-system-int32-system-array-system-int32-system-int32) 'System\.Buffer\.BlockCopy\(System\.Array,System\.Int32,System\.Array,System\.Int32,System\.Int32\)') matters\. | | [Base32](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Base32 'Abblix\.Utils\.Base32') | Provides methods for encoding and decoding data using Base32 and Base32hex formats as defined in RFC 4648\. Supports optional padding and ignores padding characters during decoding\. | | [CertificateId](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.CertificateId 'Abblix\.Utils\.CertificateId') | Represents the identifiers for a certificate, including paths to certificate and key files, and an optional password\. | | [CryptoRandom](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.CryptoRandom 'Abblix\.Utils\.CryptoRandom') | Provides cryptographic random number generation\. | | [DistributedCacheExtensions](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.DistributedCacheExtensions 'Abblix\.Utils\.DistributedCacheExtensions') | Extension methods for [Microsoft\.Extensions\.Caching\.Distributed\.IDistributedCache](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.caching.distributed.idistributedcache 'Microsoft\.Extensions\.Caching\.Distributed\.IDistributedCache') providing atomic operations\. | | [EnumerableExtensions](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.EnumerableExtensions 'Abblix\.Utils\.EnumerableExtensions') | Provides extension methods for IEnumerable\ for common operations\. | | [EnumFlagExtensions](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.EnumFlagExtensions 'Abblix\.Utils\.EnumFlagExtensions') | Extension methods for `[Flags]` enum values that complement the BCL surface\. Named with the `Flag` qualifier so it does not collide with the very common `EnumExtensions` class name used by other libraries \(e\.g\. `Fido2NetLib.EnumExtensions`\), which would surface as `CS0104` in any consumer that imports both namespaces\. | | [HexConverter](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.HexConverter 'Abblix\.Utils\.HexConverter') | Provides a static method for converting a byte array to its hexadecimal string representation\. | | [HttpServerUtility](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.HttpServerUtility 'Abblix\.Utils\.HttpServerUtility') | Provides utility methods for encoding and decoding URL tokens\. | | [ObjectExtensions](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.ObjectExtensions 'Abblix\.Utils\.ObjectExtensions') | Provides extension methods for objects to ensure non\-null values\. | | [ParametersBuilder](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.ParametersBuilder 'Abblix\.Utils\.ParametersBuilder') | Provides a builder for constructing and manipulating query strings or URI fragment parts\. | | [PrivateNetworks](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.PrivateNetworks 'Abblix\.Utils\.PrivateNetworks') | Tells an address inside the deployment's own network from one on the public internet\. | | [Result<TSuccess,TFailure>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\') | Represents a result of an operation that can either succeed with a value of type [TSuccess](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.TSuccess 'Abblix\.Utils\.Result\\.TSuccess') or fail with a value of type [TFailure](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.TFailure 'Abblix\.Utils\.Result\\.TFailure')\. | | [ResultExtensions](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.ResultExtensions 'Abblix\.Utils\.ResultExtensions') | Provides extension methods for working with [Result<TSuccess,TFailure>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\') types\. | | [StringExtensions](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.StringExtensions 'Abblix\.Utils\.StringExtensions') | The class provides extension methods for enhancing the functionality and ease of use of strings\. | | [UriBuilder](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.UriBuilder 'Abblix\.Utils\.UriBuilder') | A wrapper around System\.UriBuilder, providing enhanced functionality for URI manipulation, specifically for handling query strings and fragments\. | | [UriExtensions](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.UriExtensions 'Abblix\.Utils\.UriExtensions') | Helpers for adding parameters to a URI's query or fragment and for extracting standard parts \(origin, trailing slash\)\. Empty or null parameter values are dropped rather than serialized as bare keys, matching the OAuth 2\.0 / OpenID Connect convention for absent parameters\. | | [WwwAuthenticate](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.WwwAuthenticate 'Abblix\.Utils\.WwwAuthenticate') | Builds `WWW-Authenticate` challenge values: the HTTP grammar, not any one protocol's vocabulary of errors\. | | Structs | | | :--- | :--- | | [Sanitized](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Sanitized 'Abblix\.Utils\.Sanitized') | A type that sanitizes a given string by removing control characters and escaping special characters to prevent log injection attacks\. | | Interfaces | | | :--- | :--- | | [ICertificateProvider](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.ICertificateProvider 'Abblix\.Utils\.ICertificateProvider') | Resolves an [System\.Security\.Cryptography\.X509Certificates\.X509Certificate2](https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.x509certificates.x509certificate2 'System\.Security\.Cryptography\.X509Certificates\.X509Certificate2') from a logical [CertificateId](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.CertificateId 'Abblix\.Utils\.CertificateId'), abstracting away the physical source \(file system, certificate store, secret manager, etc\.\)\. Implementations are expected to be thread\-safe and to surface format or access errors as [System\.InvalidOperationException](https://learn.microsoft.com/en-us/dotnet/api/system.invalidoperationexception 'System\.InvalidOperationException')\. | --- Source: https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.AddressValidatingHttpMessageHandler.md #### [Abblix\.Utils](https://www.abblix.com/en/docs/api/abblix-utils 'index') ### [Abblix\.Utils](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils 'Abblix\.Utils') ## AddressValidatingHttpMessageHandler Class The message\-handler half of protecting a server\-initiated request whose address came from outside: it refuses redirects and re\-checks the address immediately before every send, leaving only the policy \- which addresses are refused \- to the derived handler\. ```csharp public abstract class AddressValidatingHttpMessageHandler : System.Net.Http.DelegatingHandler ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [System\.Net\.Http\.HttpMessageHandler](https://learn.microsoft.com/en-us/dotnet/api/system.net.http.httpmessagehandler 'System\.Net\.Http\.HttpMessageHandler') → [System\.Net\.Http\.DelegatingHandler](https://learn.microsoft.com/en-us/dotnet/api/system.net.http.delegatinghandler 'System\.Net\.Http\.DelegatingHandler') → AddressValidatingHttpMessageHandler ### Remarks Two properties make this the right place for the check rather than a pre\-flight in front of the client\. Redirects are not followed. A receiver that answers a delivery with a 3xx to an internal address would otherwise have the request re-sent there, past any address the caller vetted, so this is the difference between a check and a bypass. With the follow disabled the 3xx comes back as an ordinary non-success response and the caller decides what to do with it. The address is judged here, one call before the connection, rather than only when the request was scheduled. A name that resolved to a public address a moment ago can resolve to an internal one now, so the resolution a derived handler performs in [Abblix\.Utils\.AddressValidatingHttpMessageHandler\.GuardAsync\(System\.Uri,System\.Threading\.CancellationToken\)](https://learn.microsoft.com/en-us/dotnet/api/abblix.utils.addressvalidatinghttpmessagehandler.guardasync#abblix-utils-addressvalidatinghttpmessagehandler-guardasync(system-uri-system-threading-cancellationtoken) 'Abblix\.Utils\.AddressValidatingHttpMessageHandler\.GuardAsync\(System\.Uri,System\.Threading\.CancellationToken\)') is the one whose answer the socket actually uses. --- Source: https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.ArrayExtensions.md #### [Abblix\.Utils](https://www.abblix.com/en/docs/api/abblix-utils 'index') ### [Abblix\.Utils](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils 'Abblix\.Utils') ## ArrayExtensions Class Allocation\-explicit array helpers: each operation returns a freshly allocated array sized to the result\. Prefer these over LINQ when the caller needs a concrete `T[]` without an extra `ToArray()` step, or when copying byte buffers via [System\.Buffer\.BlockCopy\(System\.Array,System\.Int32,System\.Array,System\.Int32,System\.Int32\)](https://learn.microsoft.com/en-us/dotnet/api/system.buffer.blockcopy#system-buffer-blockcopy(system-array-system-int32-system-array-system-int32-system-int32) 'System\.Buffer\.BlockCopy\(System\.Array,System\.Int32,System\.Array,System\.Int32,System\.Int32\)') matters\. ```csharp public static class ArrayExtensions ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ArrayExtensions ### Methods ## ArrayExtensions\.Append\\(this T\[\], T\) Method {#Abblix.Utils.ArrayExtensions.Append_T_(thisT[],T)} Appends a value to the end of an array\. ```csharp public static T[] Append(this T[] array, T value); ``` #### Type parameters ###### `T` {#Abblix.Utils.ArrayExtensions.Append_T_(thisT[],T).T} The type of the elements in the array\. #### Parameters ###### `array` [T](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.ArrayExtensions#Abblix.Utils.ArrayExtensions.Append_T_(thisT[],T).T 'Abblix\.Utils\.ArrayExtensions\.Append\\(this T\[\], T\)\.T')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Utils.ArrayExtensions.Append_T_(thisT[],T).array} The array to append to\. ###### `value` [T](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.ArrayExtensions#Abblix.Utils.ArrayExtensions.Append_T_(thisT[],T).T 'Abblix\.Utils\.ArrayExtensions\.Append\\(this T\[\], T\)\.T') {#Abblix.Utils.ArrayExtensions.Append_T_(thisT[],T).value} The value to append\. #### Returns [T](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.ArrayExtensions#Abblix.Utils.ArrayExtensions.Append_T_(thisT[],T).T 'Abblix\.Utils\.ArrayExtensions\.Append\\(this T\[\], T\)\.T')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') A new array with the value appended\. ### Remarks This method creates a new array with a size larger by one than the original array, copies all elements from the original array, and adds the specified value at the end\. ## ArrayExtensions\.Concat\(byte\[\]\[\]\) Method {#Abblix.Utils.ArrayExtensions.Concat(byte[][])} Concatenates multiple byte arrays into a single array\. ```csharp public static byte[] Concat(params byte[][] arrays); ``` #### Parameters ###### `arrays` [System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Utils.ArrayExtensions.Concat(byte[][]).arrays} The arrays to concatenate\. #### Returns [System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') A new array containing all input arrays concatenated in order\. ### Remarks Uses Buffer\.BlockCopy for efficient byte\-level copying\. Returns empty array if no arrays are provided\. ## ArrayExtensions\.Concat\(this byte\[\], byte\[\]\) Method {#Abblix.Utils.ArrayExtensions.Concat(thisbyte[],byte[])} Concatenates two byte arrays into a single array\. ```csharp public static byte[] Concat(this byte[] first, byte[] second); ``` #### Parameters ###### `first` [System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Utils.ArrayExtensions.Concat(thisbyte[],byte[]).first} The first array\. ###### `second` [System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Utils.ArrayExtensions.Concat(thisbyte[],byte[]).second} The second array\. #### Returns [System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') A new array containing all elements from both arrays in order\. ### Remarks Uses Buffer\.BlockCopy for efficient byte\-level copying\. ## ArrayExtensions\.Prepend\\(this T\[\], T\) Method {#Abblix.Utils.ArrayExtensions.Prepend_T_(thisT[],T)} Prepends a value to the beginning of an array\. ```csharp public static T[] Prepend(this T[] array, T value); ``` #### Type parameters ###### `T` {#Abblix.Utils.ArrayExtensions.Prepend_T_(thisT[],T).T} The type of the elements in the array\. #### Parameters ###### `array` [T](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.ArrayExtensions#Abblix.Utils.ArrayExtensions.Prepend_T_(thisT[],T).T 'Abblix\.Utils\.ArrayExtensions\.Prepend\\(this T\[\], T\)\.T')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Utils.ArrayExtensions.Prepend_T_(thisT[],T).array} The array to prepend to\. ###### `value` [T](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.ArrayExtensions#Abblix.Utils.ArrayExtensions.Prepend_T_(thisT[],T).T 'Abblix\.Utils\.ArrayExtensions\.Prepend\\(this T\[\], T\)\.T') {#Abblix.Utils.ArrayExtensions.Prepend_T_(thisT[],T).value} The value to prepend\. #### Returns [T](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.ArrayExtensions#Abblix.Utils.ArrayExtensions.Prepend_T_(thisT[],T).T 'Abblix\.Utils\.ArrayExtensions\.Prepend\\(this T\[\], T\)\.T')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') A new array with the value prepended\. ### Remarks This method creates a new array with a size larger by one than the original array, copies all elements from the original array starting from the second position, and adds the specified value at the beginning\. --- Source: https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Base32.md #### [Abblix\.Utils](https://www.abblix.com/en/docs/api/abblix-utils 'index') ### [Abblix\.Utils](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils 'Abblix\.Utils') ## Base32 Class Provides methods for encoding and decoding data using Base32 and Base32hex formats as defined in RFC 4648\. Supports optional padding and ignores padding characters during decoding\. ```csharp public static class Base32 ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → Base32 ### Methods ## Base32\.Decode\(ReadOnlySpan\\) Method {#Abblix.Utils.Base32.Decode(System.ReadOnlySpan_char_)} Decodes a Base32\-encoded string into a byte array\. Ignores any '=' padding characters at the end of the input\. ```csharp public static byte[] Decode(System.ReadOnlySpan input); ``` #### Parameters ###### `input` [System\.ReadOnlySpan<](https://learn.microsoft.com/en-us/dotnet/api/system.readonlyspan-1 'System\.ReadOnlySpan\`1')[System\.Char](https://learn.microsoft.com/en-us/dotnet/api/system.char 'System\.Char')[>](https://learn.microsoft.com/en-us/dotnet/api/system.readonlyspan-1 'System\.ReadOnlySpan\`1') {#Abblix.Utils.Base32.Decode(System.ReadOnlySpan_char_).input} The Base32 string to decode \(may include padding '='\)\. #### Returns [System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') A byte array containing the original binary data\. #### Exceptions [System\.ArgumentException](https://learn.microsoft.com/en-us/dotnet/api/system.argumentexception 'System\.ArgumentException') Thrown if the input contains invalid Base32 characters\. ## Base32\.DecodeHex\(ReadOnlySpan\\) Method {#Abblix.Utils.Base32.DecodeHex(System.ReadOnlySpan_char_)} Decodes a Base32hex\-encoded string into a byte array\. Ignores any '=' padding characters at the end of the input\. ```csharp public static byte[] DecodeHex(System.ReadOnlySpan input); ``` #### Parameters ###### `input` [System\.ReadOnlySpan<](https://learn.microsoft.com/en-us/dotnet/api/system.readonlyspan-1 'System\.ReadOnlySpan\`1')[System\.Char](https://learn.microsoft.com/en-us/dotnet/api/system.char 'System\.Char')[>](https://learn.microsoft.com/en-us/dotnet/api/system.readonlyspan-1 'System\.ReadOnlySpan\`1') {#Abblix.Utils.Base32.DecodeHex(System.ReadOnlySpan_char_).input} The Base32hex string to decode \(may include padding '='\)\. #### Returns [System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') A byte array containing the original binary data\. #### Exceptions [System\.ArgumentException](https://learn.microsoft.com/en-us/dotnet/api/system.argumentexception 'System\.ArgumentException') Thrown if the input contains invalid Base32hex characters\. ## Base32\.Encode\(ReadOnlySpan\, bool\) Method {#Abblix.Utils.Base32.Encode(System.ReadOnlySpan_byte_,bool)} Encodes the specified binary data into a Base32 string using the standard RFC 4648 alphabet \(A\-Z, 2\-7\)\. ```csharp public static string Encode(System.ReadOnlySpan input, bool padding=true); ``` #### Parameters ###### `input` [System\.ReadOnlySpan<](https://learn.microsoft.com/en-us/dotnet/api/system.readonlyspan-1 'System\.ReadOnlySpan\`1')[System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[>](https://learn.microsoft.com/en-us/dotnet/api/system.readonlyspan-1 'System\.ReadOnlySpan\`1') {#Abblix.Utils.Base32.Encode(System.ReadOnlySpan_byte_,bool).input} The binary data to encode\. ###### `padding` [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') {#Abblix.Utils.Base32.Encode(System.ReadOnlySpan_byte_,bool).padding} `true` to include '=' characters to pad the output string to a multiple of 8 characters; `false` to omit padding\. #### Returns [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') A Base32\-encoded string representation of the input data\. If [padding](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Base32#Abblix.Utils.Base32.Encode(System.ReadOnlySpan_byte_,bool).padding 'Abblix\.Utils\.Base32\.Encode\(System\.ReadOnlySpan\, bool\)\.padding') is `true`, the result length is always a multiple of 8 by adding '=' characters as needed\. ## Base32\.EncodeHex\(ReadOnlySpan\, bool\) Method {#Abblix.Utils.Base32.EncodeHex(System.ReadOnlySpan_byte_,bool)} Encodes the specified binary data into a Base32hex string using the extended hexadecimal alphabet \(0\-9, A\-V\)\. ```csharp public static string EncodeHex(System.ReadOnlySpan input, bool padding=true); ``` #### Parameters ###### `input` [System\.ReadOnlySpan<](https://learn.microsoft.com/en-us/dotnet/api/system.readonlyspan-1 'System\.ReadOnlySpan\`1')[System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[>](https://learn.microsoft.com/en-us/dotnet/api/system.readonlyspan-1 'System\.ReadOnlySpan\`1') {#Abblix.Utils.Base32.EncodeHex(System.ReadOnlySpan_byte_,bool).input} The binary data to encode\. ###### `padding` [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') {#Abblix.Utils.Base32.EncodeHex(System.ReadOnlySpan_byte_,bool).padding} `true` to include '=' characters to pad the output string to a multiple of 8 characters; `false` to omit padding\. #### Returns [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') A Base32hex\-encoded string representation of the input data\. If [padding](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Base32#Abblix.Utils.Base32.EncodeHex(System.ReadOnlySpan_byte_,bool).padding 'Abblix\.Utils\.Base32\.EncodeHex\(System\.ReadOnlySpan\, bool\)\.padding') is `true`, the result length is always a multiple of 8 by adding '=' characters as needed\. --- Source: https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.CertificateId.md #### [Abblix\.Utils](https://www.abblix.com/en/docs/api/abblix-utils 'index') ### [Abblix\.Utils](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils 'Abblix\.Utils') ## CertificateId Class Represents the identifiers for a certificate, including paths to certificate and key files, and an optional password\. ```csharp public record CertificateId : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → CertificateId Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[CertificateId](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.CertificateId 'Abblix\.Utils\.CertificateId')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Constructors ## CertificateId\(string, string, string\) Constructor {#Abblix.Utils.CertificateId.CertificateId(string,string,string)} Represents the identifiers for a certificate, including paths to certificate and key files, and an optional password\. ```csharp public CertificateId(string CertPemFilePath, string? KeyPemFilePath=null, string? Password=null); ``` #### Parameters ###### `CertPemFilePath` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Utils.CertificateId.CertificateId(string,string,string).CertPemFilePath} Path to the certificate file in PEM format\. ###### `KeyPemFilePath` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Utils.CertificateId.CertificateId(string,string,string).KeyPemFilePath} Optional path to the key file in PEM format\. If not provided, assume the certificate file contains the key\. ###### `Password` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Utils.CertificateId.CertificateId(string,string,string).Password} Optional password for the key file\. Required if the key file is encrypted\. ### Properties ## CertificateId\.CertPemFilePath Property {#Abblix.Utils.CertificateId.CertPemFilePath} Path to the certificate file in PEM format\. ```csharp public string CertPemFilePath { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## CertificateId\.KeyPemFilePath Property {#Abblix.Utils.CertificateId.KeyPemFilePath} Optional path to the key file in PEM format\. If not provided, assume the certificate file contains the key\. ```csharp public string? KeyPemFilePath { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## CertificateId\.Password Property {#Abblix.Utils.CertificateId.Password} Optional password for the key file\. Required if the key file is encrypted\. ```csharp public string? Password { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') --- Source: https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.CryptoRandom.md #### [Abblix\.Utils](https://www.abblix.com/en/docs/api/abblix-utils 'index') ### [Abblix\.Utils](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils 'Abblix\.Utils') ## CryptoRandom Class Provides cryptographic random number generation\. ```csharp public static class CryptoRandom ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → CryptoRandom ### Methods ## CryptoRandom\.GetRandomBytes\(int\) Method {#Abblix.Utils.CryptoRandom.GetRandomBytes(int)} Generates a specified number of random bytes\. ```csharp public static byte[] GetRandomBytes(int count); ``` #### Parameters ###### `count` [System\.Int32](https://learn.microsoft.com/en-us/dotnet/api/system.int32 'System\.Int32') {#Abblix.Utils.CryptoRandom.GetRandomBytes(int).count} The number of random bytes to generate\. #### Returns [System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') An array of bytes filled with cryptographically strong random values\. --- Source: https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.DistributedCacheExtensions.md #### [Abblix\.Utils](https://www.abblix.com/en/docs/api/abblix-utils 'index') ### [Abblix\.Utils](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils 'Abblix\.Utils') ## DistributedCacheExtensions Class Extension methods for [Microsoft\.Extensions\.Caching\.Distributed\.IDistributedCache](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.caching.distributed.idistributedcache 'Microsoft\.Extensions\.Caching\.Distributed\.IDistributedCache') providing atomic operations\. ```csharp public static class DistributedCacheExtensions ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → DistributedCacheExtensions ### Methods ## DistributedCacheExtensions\.TryAddAsync\(this IDistributedCache, string, TimeSpan, CancellationToken\) Method {#Abblix.Utils.DistributedCacheExtensions.TryAddAsync(thisMicrosoft.Extensions.Caching.Distributed.IDistributedCache,string,System.TimeSpan,System.Threading.CancellationToken)} Marks a key as present unless it already is, telling a first call from a repeat: the add\-if\-absent primitive replay caches and other "seen before?" checks are built on\. ```csharp public static System.Threading.Tasks.Task TryAddAsync(this Microsoft.Extensions.Caching.Distributed.IDistributedCache cache, string key, System.TimeSpan timeToLive, System.Threading.CancellationToken cancellationToken=default(System.Threading.CancellationToken)); ``` #### Parameters ###### `cache` [Microsoft\.Extensions\.Caching\.Distributed\.IDistributedCache](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.caching.distributed.idistributedcache 'Microsoft\.Extensions\.Caching\.Distributed\.IDistributedCache') {#Abblix.Utils.DistributedCacheExtensions.TryAddAsync(thisMicrosoft.Extensions.Caching.Distributed.IDistributedCache,string,System.TimeSpan,System.Threading.CancellationToken).cache} The distributed cache instance\. ###### `key` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Utils.DistributedCacheExtensions.TryAddAsync(thisMicrosoft.Extensions.Caching.Distributed.IDistributedCache,string,System.TimeSpan,System.Threading.CancellationToken).key} The key whose first sighting is being recorded\. ###### `timeToLive` [System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan') {#Abblix.Utils.DistributedCacheExtensions.TryAddAsync(thisMicrosoft.Extensions.Caching.Distributed.IDistributedCache,string,System.TimeSpan,System.Threading.CancellationToken).timeToLive} How long the sighting is remembered\. ###### `cancellationToken` [System\.Threading\.CancellationToken](https://learn.microsoft.com/en-us/dotnet/api/system.threading.cancellationtoken 'System\.Threading\.CancellationToken') {#Abblix.Utils.DistributedCacheExtensions.TryAddAsync(thisMicrosoft.Extensions.Caching.Distributed.IDistributedCache,string,System.TimeSpan,System.Threading.CancellationToken).cancellationToken} Optional cancellation token to cancel the operation\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task containing true when the key was absent and is now marked; false when it was already present\. ### Remarks Not atomic:[Microsoft\.Extensions\.Caching\.Distributed\.IDistributedCache](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.caching.distributed.idistributedcache 'Microsoft\.Extensions\.Caching\.Distributed\.IDistributedCache') exposes only Get + Set, no compare-and-set primitive, so two concurrent callers of the same key can both observe a miss before either writes and both hear "new". The race window is bounded by the cache round-trip, which makes the duplicate-detection guarantee probabilistic rather than strict. Callers whose domain needs strict exactly-once use a backend-aware primitive instead - for replay prevention that is a `ReplayCacheBase` over the store's own conditional write (Redis `SET ... NX PX`, SQL `INSERT ... ON CONFLICT DO NOTHING`). The entry stores an opaque marker; only the key's presence carries meaning. The requested time-to-live is floored to a small positive minimum so a value the cache would reject or discard immediately still records the sighting. ## DistributedCacheExtensions\.TryGetAndRemoveAsync\(this IDistributedCache, string, Nullable\, CancellationToken\) Method {#Abblix.Utils.DistributedCacheExtensions.TryGetAndRemoveAsync(thisMicrosoft.Extensions.Caching.Distributed.IDistributedCache,string,System.Nullable_System.TimeSpan_,System.Threading.CancellationToken)} Reads a value and removes it, both under one hold of the per\-key gate, for a cache with no native primitive of its own\. This is NOT the equivalent of Redis GETDEL\. The gate holds out other REDEMPTIONS of the key and nothing else, so a plain write landing between the read and the removal is destroyed by this caller while it is handed the earlier bytes \- and that is only one of the ways the two differ\. AT MOST one caller is handed the value when nothing writes the key, and none may be\. Read the remarks before relying on it\. ```csharp public static System.Threading.Tasks.Task TryGetAndRemoveAsync(this Microsoft.Extensions.Caching.Distributed.IDistributedCache cache, string key, System.Nullable lockTimeout=null, System.Threading.CancellationToken cancellationToken=default(System.Threading.CancellationToken)); ``` #### Parameters ###### `cache` [Microsoft\.Extensions\.Caching\.Distributed\.IDistributedCache](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.caching.distributed.idistributedcache 'Microsoft\.Extensions\.Caching\.Distributed\.IDistributedCache') {#Abblix.Utils.DistributedCacheExtensions.TryGetAndRemoveAsync(thisMicrosoft.Extensions.Caching.Distributed.IDistributedCache,string,System.Nullable_System.TimeSpan_,System.Threading.CancellationToken).cache} The distributed cache instance\. ###### `key` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Utils.DistributedCacheExtensions.TryGetAndRemoveAsync(thisMicrosoft.Extensions.Caching.Distributed.IDistributedCache,string,System.Nullable_System.TimeSpan_,System.Threading.CancellationToken).key} The key of the value to retrieve and remove\. ###### `lockTimeout` [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') {#Abblix.Utils.DistributedCacheExtensions.TryGetAndRemoveAsync(thisMicrosoft.Extensions.Caching.Distributed.IDistributedCache,string,System.Nullable_System.TimeSpan_,System.Threading.CancellationToken).lockTimeout} Duration after which the lock expires, 5 seconds if null\. ###### `cancellationToken` [System\.Threading\.CancellationToken](https://learn.microsoft.com/en-us/dotnet/api/system.threading.cancellationtoken 'System\.Threading\.CancellationToken') {#Abblix.Utils.DistributedCacheExtensions.TryGetAndRemoveAsync(thisMicrosoft.Extensions.Caching.Distributed.IDistributedCache,string,System.Nullable_System.TimeSpan_,System.Threading.CancellationToken).cancellationToken} Optional cancellation token to cancel the operation\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task that completes when the operation finishes, containing the value read under this caller's own hold of the gate, when its claim was still in the store afterwards\. Null otherwise, which does NOT mean somebody else took it: see [TryRemoveAsync\(this IDistributedCache, string, Nullable<TimeSpan>, CancellationToken\)](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.DistributedCacheExtensions#Abblix.Utils.DistributedCacheExtensions.TryRemoveAsync(thisMicrosoft.Extensions.Caching.Distributed.IDistributedCache,string,System.Nullable_System.TimeSpan_,System.Threading.CancellationToken) 'Abblix\.Utils\.DistributedCacheExtensions\.TryRemoveAsync\(this Microsoft\.Extensions\.Caching\.Distributed\.IDistributedCache, string, System\.Nullable\, System\.Threading\.CancellationToken\)'), whose remarks carry the condition; this method adds nothing to it beyond returning the value\. What the placement of the read does and does not settle is in the remarks\. ### Remarks Atomicity Protocol: 1. Step 1: 2. Step 2: 3. Step 3: How it provides atomicity: the removal reports itself under the same condition [TryRemoveAsync\(this IDistributedCache, string, Nullable<TimeSpan>, CancellationToken\)](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.DistributedCacheExtensions#Abblix.Utils.DistributedCacheExtensions.TryRemoveAsync(thisMicrosoft.Extensions.Caching.Distributed.IDistributedCache,string,System.Nullable_System.TimeSpan_,System.Threading.CancellationToken) 'Abblix\.Utils\.DistributedCacheExtensions\.TryRemoveAsync\(this Microsoft\.Extensions\.Caching\.Distributed\.IDistributedCache, string, System\.Nullable\, System\.Threading\.CancellationToken\)') states, and the read is inside the same hold of the gate rather than in front of it. What the read's placement buys, and what it does not. The bytes handed back are the bytes at the key when this caller got IN - not the ones there before it waited, and that wait is as long as another caller's whole redemption. What is still open is narrower and real: a writer that takes no gate can land between the read and the removal, so this caller destroys that write and is handed the earlier bytes. Nothing in this class closes THAT, and the SERIALIZATION survives no second process at all - the lock protocol still admits at most one winner across nodes, but nothing there holds the read and the removal together. A store whose own primitive returns the removed value closes both, and issue 435 tracks it. Lock timeout: the claim auto-expires after the specified timeout (5 seconds by default), so a process that crashes mid-protocol does not leave the key claimed forever. It also means a caller slower than the timeout loses its own claim: see [TryRemoveAsync\(this IDistributedCache, string, Nullable<TimeSpan>, CancellationToken\)](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.DistributedCacheExtensions#Abblix.Utils.DistributedCacheExtensions.TryRemoveAsync(thisMicrosoft.Extensions.Caching.Distributed.IDistributedCache,string,System.Nullable_System.TimeSpan_,System.Threading.CancellationToken) 'Abblix\.Utils\.DistributedCacheExtensions\.TryRemoveAsync\(this Microsoft\.Extensions\.Caching\.Distributed\.IDistributedCache, string, System\.Nullable\, System\.Threading\.CancellationToken\)'). Performance: up to six cache operations - one read, and up to five in the removal protocol - so it has higher latency than a store's own atomic primitive, and works with any IDistributedCache in exchange. All of them inside the gate, so a contended key serializes for the whole of that rather than for the removal alone. ## DistributedCacheExtensions\.TryRemoveAsync\(this IDistributedCache, string, Nullable\, CancellationToken\) Method {#Abblix.Utils.DistributedCacheExtensions.TryRemoveAsync(thisMicrosoft.Extensions.Caching.Distributed.IDistributedCache,string,System.Nullable_System.TimeSpan_,System.Threading.CancellationToken)} Atomically attempts to remove a value from the distributed cache\. Uses a lock\-based protocol to ensure atomic removal semantics, preventing race conditions where multiple threads attempt to remove the same key concurrently\. ```csharp public static System.Threading.Tasks.Task TryRemoveAsync(this Microsoft.Extensions.Caching.Distributed.IDistributedCache cache, string key, System.Nullable lockTimeout=null, System.Threading.CancellationToken cancellationToken=default(System.Threading.CancellationToken)); ``` #### Parameters ###### `cache` [Microsoft\.Extensions\.Caching\.Distributed\.IDistributedCache](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.caching.distributed.idistributedcache 'Microsoft\.Extensions\.Caching\.Distributed\.IDistributedCache') {#Abblix.Utils.DistributedCacheExtensions.TryRemoveAsync(thisMicrosoft.Extensions.Caching.Distributed.IDistributedCache,string,System.Nullable_System.TimeSpan_,System.Threading.CancellationToken).cache} The distributed cache instance\. ###### `key` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Utils.DistributedCacheExtensions.TryRemoveAsync(thisMicrosoft.Extensions.Caching.Distributed.IDistributedCache,string,System.Nullable_System.TimeSpan_,System.Threading.CancellationToken).key} The key of the value to remove\. ###### `lockTimeout` [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') {#Abblix.Utils.DistributedCacheExtensions.TryRemoveAsync(thisMicrosoft.Extensions.Caching.Distributed.IDistributedCache,string,System.Nullable_System.TimeSpan_,System.Threading.CancellationToken).lockTimeout} Duration after which the lock expires, 5 seconds if null\. ###### `cancellationToken` [System\.Threading\.CancellationToken](https://learn.microsoft.com/en-us/dotnet/api/system.threading.cancellationtoken 'System\.Threading\.CancellationToken') {#Abblix.Utils.DistributedCacheExtensions.TryRemoveAsync(thisMicrosoft.Extensions.Caching.Distributed.IDistributedCache,string,System.Nullable_System.TimeSpan_,System.Threading.CancellationToken).cancellationToken} Optional cancellation token to cancel the operation\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task that completes when the operation finishes, containing true when the value was removed by this caller AND its own lock token was still in the store afterwards\. False otherwise \- which covers the key not being there, another caller having taken it, and the case where the value is gone and nobody can be told they took it\. That last one does not need a second node: see the remarks\. A store fault after the removal raises rather than returning, and loses the value the same way\. ### Remarks Atomicity Protocol: 1. Step 1: 2. Step 2: 3. Step 3: 4. Step 4: 5. Step 5: How it provides atomicity: a caller reports the removal as its own only when its own claim is still in the store at the end of the protocol. What that condition does and does not buy is spelled out below. Use Case: This method is useful when you need to atomically remove a value without retrieving it (unlike [TryGetAndRemoveAsync\(this IDistributedCache, string, Nullable<TimeSpan>, CancellationToken\)](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.DistributedCacheExtensions#Abblix.Utils.DistributedCacheExtensions.TryGetAndRemoveAsync(thisMicrosoft.Extensions.Caching.Distributed.IDistributedCache,string,System.Nullable_System.TimeSpan_,System.Threading.CancellationToken) 'Abblix\.Utils\.DistributedCacheExtensions\.TryGetAndRemoveAsync\(this Microsoft\.Extensions\.Caching\.Distributed\.IDistributedCache, string, System\.Nullable\, System\.Threading\.CancellationToken\)')). For example, in the Device Authorization Grant flow when a user denies authorization, you only need confirmation that the request was removed, not the request data itself. What the protocol decides: a caller is told it took the value only when the protocol runs to the end AND finds its own lock token still in the store. That is the whole contract, and it is deliberately not followed by a count of what can go wrong. Such a list is not closable - the token can be overwritten, it can expire while a cache call stalls, and the store calls after the removal can fail, and there is no argument that those are all. What the tests carry instead, each dying when its fact stops holding: `TryRemoveAsync_TheLockExpiresMidProtocol_OneCallerAloneLosesTheValue` for a removal with nobody told, on one node with no competitor, and `TryRemoveAsync_TheStoreFaultsAfterTheRemoval_TheValueIsGoneAndNobodyIsTold` for the same outcome reached by a fault, where the caller gets an exception rather than an answer at all. What the check does NOT give you. It does not make this a take-once: the gate serializes callers within one process, so a competitor cannot overwrite another's token HERE, and nothing about that survives a second node - see below. Across processes even the overwrite reopens. Two nodes redeeming the same key at the same moment can end with the value removed and neither told it took it, because the lock protocol is assembled from `Get`, `Set` and `Remove` as three separate operations and there is a window between any two of them. A take-once needs one indivisible read-modify-write, and this interface exposes none: no compare-and-swap, no set-if-absent, no delete-returning-value. A deployment on several nodes that cannot afford that supplies its own storage and reaches for the primitive its store already has. No new API is needed for that: `IDeviceAuthorizationStorage`, `IBackChannelRequestStorage` and `IEntityStorage` are public and registered with `TryAddSingleton`, so a host's own registration wins. Which primitive to reach for depends on the store, which is why it cannot be chosen here: - Redis 6.2 and later: `GETDEL key`, one command, which returns the value to exactly one caller and deletes it. Earlier versions get the same effect from a two-line `EVAL` script, since Redis runs a script indivisibly. Both are for a storage of your own: they read a STRING, and the `IDistributedCache` implementation for Redis keeps each entry as a hash whose value sits in a field, so pointed at these keys they answer `WRONGTYPE`. - PostgreSQL: `DELETE FROM ... WHERE key = $1 RETURNING value`. The row lock picks the winner, and at the default isolation level the loser returns no rows; under REPEATABLE READ or SERIALIZABLE it fails to serialize instead, which is the same answer through an exception. - SQL Server: `DELETE ... OUTPUT deleted.value`, the same shape. - Oracle: `DELETE ... RETURNING value INTO :out`. Oracle documents the RETURNING INTO clause as belonging to DELETE among others, and for a DELETE it yields the pre-deletion value. Lock timeout: Locks auto-expire after the specified timeout (default 5 seconds) to prevent orphaned locks if a process crashes between writing the lock token and cleaning it up. --- Source: https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.EnumerableExtensions.md #### [Abblix\.Utils](https://www.abblix.com/en/docs/api/abblix-utils 'index') ### [Abblix\.Utils](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils 'Abblix\.Utils') ## EnumerableExtensions Class Provides extension methods for IEnumerable\ for common operations\. ```csharp public static class EnumerableExtensions ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → EnumerableExtensions ### Methods ## EnumerableExtensions\.EnqueueAll\\(this Queue\, IEnumerable\\) Method {#Abblix.Utils.EnumerableExtensions.EnqueueAll_T_(thisSystem.Collections.Generic.Queue_T_,System.Collections.Generic.IEnumerable_T_)} Enqueues all elements from a specified collection into the given queue\. ```csharp public static void EnqueueAll(this System.Collections.Generic.Queue queue, System.Collections.Generic.IEnumerable? input); ``` #### Type parameters ###### `T` {#Abblix.Utils.EnumerableExtensions.EnqueueAll_T_(thisSystem.Collections.Generic.Queue_T_,System.Collections.Generic.IEnumerable_T_).T} The type of elements contained in the queue and the enumerable collection\. #### Parameters ###### `queue` [System\.Collections\.Generic\.Queue<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.queue-1 'System\.Collections\.Generic\.Queue\`1')[T](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.EnumerableExtensions#Abblix.Utils.EnumerableExtensions.EnqueueAll_T_(thisSystem.Collections.Generic.Queue_T_,System.Collections.Generic.IEnumerable_T_).T 'Abblix\.Utils\.EnumerableExtensions\.EnqueueAll\\(this System\.Collections\.Generic\.Queue\, System\.Collections\.Generic\.IEnumerable\\)\.T')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.queue-1 'System\.Collections\.Generic\.Queue\`1') {#Abblix.Utils.EnumerableExtensions.EnqueueAll_T_(thisSystem.Collections.Generic.Queue_T_,System.Collections.Generic.IEnumerable_T_).queue} The queue into which elements will be enqueued\. ###### `input` [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[T](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.EnumerableExtensions#Abblix.Utils.EnumerableExtensions.EnqueueAll_T_(thisSystem.Collections.Generic.Queue_T_,System.Collections.Generic.IEnumerable_T_).T 'Abblix\.Utils\.EnumerableExtensions\.EnqueueAll\\(this System\.Collections\.Generic\.Queue\, System\.Collections\.Generic\.IEnumerable\\)\.T')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') {#Abblix.Utils.EnumerableExtensions.EnqueueAll_T_(thisSystem.Collections.Generic.Queue_T_,System.Collections.Generic.IEnumerable_T_).input} The collection of elements to enqueue\. If the collection is null, no action is taken\. ## EnumerableExtensions\.FirstOrDefaultAsync\\(this IEnumerable\, Func\\>\) Method {#Abblix.Utils.EnumerableExtensions.FirstOrDefaultAsync_TSource,TResult_(thisSystem.Collections.Generic.IEnumerable_TSource_,System.Func_TSource,System.Threading.Tasks.Task_TResult__)} Projects each element of [source](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.EnumerableExtensions#Abblix.Utils.EnumerableExtensions.FirstOrDefaultAsync_TSource,TResult_(thisSystem.Collections.Generic.IEnumerable_TSource_,System.Func_TSource,System.Threading.Tasks.Task_TResult__).source 'Abblix\.Utils\.EnumerableExtensions\.FirstOrDefaultAsync\\(this System\.Collections\.Generic\.IEnumerable\, System\.Func\\>\)\.source') through an async [selector](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.EnumerableExtensions#Abblix.Utils.EnumerableExtensions.FirstOrDefaultAsync_TSource,TResult_(thisSystem.Collections.Generic.IEnumerable_TSource_,System.Func_TSource,System.Threading.Tasks.Task_TResult__).selector 'Abblix\.Utils\.EnumerableExtensions\.FirstOrDefaultAsync\\(this System\.Collections\.Generic\.IEnumerable\, System\.Func\\>\)\.selector') and returns the first non\-null projection, or `null` when every projection is null\. Short\-circuits at the first non\-null result \-\- subsequent elements are not awaited\. ```csharp public static System.Threading.Tasks.Task FirstOrDefaultAsync(this System.Collections.Generic.IEnumerable source, System.Func> selector) where TResult : class; ``` #### Type parameters ###### `TSource` {#Abblix.Utils.EnumerableExtensions.FirstOrDefaultAsync_TSource,TResult_(thisSystem.Collections.Generic.IEnumerable_TSource_,System.Func_TSource,System.Threading.Tasks.Task_TResult__).TSource} The element type of the sequence\. ###### `TResult` {#Abblix.Utils.EnumerableExtensions.FirstOrDefaultAsync_TSource,TResult_(thisSystem.Collections.Generic.IEnumerable_TSource_,System.Func_TSource,System.Threading.Tasks.Task_TResult__).TResult} The projection result type; constrained to reference so "no result" can be expressed as `null`\. #### Parameters ###### `source` [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[TSource](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.EnumerableExtensions#Abblix.Utils.EnumerableExtensions.FirstOrDefaultAsync_TSource,TResult_(thisSystem.Collections.Generic.IEnumerable_TSource_,System.Func_TSource,System.Threading.Tasks.Task_TResult__).TSource 'Abblix\.Utils\.EnumerableExtensions\.FirstOrDefaultAsync\\(this System\.Collections\.Generic\.IEnumerable\, System\.Func\\>\)\.TSource')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') {#Abblix.Utils.EnumerableExtensions.FirstOrDefaultAsync_TSource,TResult_(thisSystem.Collections.Generic.IEnumerable_TSource_,System.Func_TSource,System.Threading.Tasks.Task_TResult__).source} The sequence of items to iterate\. ###### `selector` [System\.Func<](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2')[TSource](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.EnumerableExtensions#Abblix.Utils.EnumerableExtensions.FirstOrDefaultAsync_TSource,TResult_(thisSystem.Collections.Generic.IEnumerable_TSource_,System.Func_TSource,System.Threading.Tasks.Task_TResult__).TSource 'Abblix\.Utils\.EnumerableExtensions\.FirstOrDefaultAsync\\(this System\.Collections\.Generic\.IEnumerable\, System\.Func\\>\)\.TSource')[,](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2')[System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[TResult](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.EnumerableExtensions#Abblix.Utils.EnumerableExtensions.FirstOrDefaultAsync_TSource,TResult_(thisSystem.Collections.Generic.IEnumerable_TSource_,System.Func_TSource,System.Threading.Tasks.Task_TResult__).TResult 'Abblix\.Utils\.EnumerableExtensions\.FirstOrDefaultAsync\\(this System\.Collections\.Generic\.IEnumerable\, System\.Func\\>\)\.TResult')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[>](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2') {#Abblix.Utils.EnumerableExtensions.FirstOrDefaultAsync_TSource,TResult_(thisSystem.Collections.Generic.IEnumerable_TSource_,System.Func_TSource,System.Threading.Tasks.Task_TResult__).selector} Async projection invoked per element until one returns non\-null\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[TResult](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.EnumerableExtensions#Abblix.Utils.EnumerableExtensions.FirstOrDefaultAsync_TSource,TResult_(thisSystem.Collections.Generic.IEnumerable_TSource_,System.Func_TSource,System.Threading.Tasks.Task_TResult__).TResult 'Abblix\.Utils\.EnumerableExtensions\.FirstOrDefaultAsync\\(this System\.Collections\.Generic\.IEnumerable\, System\.Func\\>\)\.TResult')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') The first non\-null projection, or `null` when none produced a value\. ### Remarks Designed for short\-circuiting pipelines where each step returns either a payload \(e\.g\. an error object\) or `null` meaning "passed; keep going"\. ## EnumerableExtensions\.FlattenTree\\(this IEnumerable\, Func\\>\) Method {#Abblix.Utils.EnumerableExtensions.FlattenTree_T_(thisSystem.Collections.Generic.IEnumerable_T_,System.Func_T,System.Collections.Generic.IEnumerable_T__)} Flattens a tree structure into a flat sequence using breadth\-first traversal\. ```csharp public static System.Collections.Generic.IEnumerable FlattenTree(this System.Collections.Generic.IEnumerable? input, System.Func> childrenSelector); ``` #### Type parameters ###### `T` {#Abblix.Utils.EnumerableExtensions.FlattenTree_T_(thisSystem.Collections.Generic.IEnumerable_T_,System.Func_T,System.Collections.Generic.IEnumerable_T__).T} The type of elements in the tree\. #### Parameters ###### `input` [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[T](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.EnumerableExtensions#Abblix.Utils.EnumerableExtensions.FlattenTree_T_(thisSystem.Collections.Generic.IEnumerable_T_,System.Func_T,System.Collections.Generic.IEnumerable_T__).T 'Abblix\.Utils\.EnumerableExtensions\.FlattenTree\\(this System\.Collections\.Generic\.IEnumerable\, System\.Func\\>\)\.T')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') {#Abblix.Utils.EnumerableExtensions.FlattenTree_T_(thisSystem.Collections.Generic.IEnumerable_T_,System.Func_T,System.Collections.Generic.IEnumerable_T__).input} The sequence of root elements\. ###### `childrenSelector` [System\.Func<](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2')[T](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.EnumerableExtensions#Abblix.Utils.EnumerableExtensions.FlattenTree_T_(thisSystem.Collections.Generic.IEnumerable_T_,System.Func_T,System.Collections.Generic.IEnumerable_T__).T 'Abblix\.Utils\.EnumerableExtensions\.FlattenTree\\(this System\.Collections\.Generic\.IEnumerable\, System\.Func\\>\)\.T')[,](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2')[System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[T](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.EnumerableExtensions#Abblix.Utils.EnumerableExtensions.FlattenTree_T_(thisSystem.Collections.Generic.IEnumerable_T_,System.Func_T,System.Collections.Generic.IEnumerable_T__).T 'Abblix\.Utils\.EnumerableExtensions\.FlattenTree\\(this System\.Collections\.Generic\.IEnumerable\, System\.Func\\>\)\.T')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[>](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2') {#Abblix.Utils.EnumerableExtensions.FlattenTree_T_(thisSystem.Collections.Generic.IEnumerable_T_,System.Func_T,System.Collections.Generic.IEnumerable_T__).childrenSelector} A function to retrieve the children of an element\. #### Returns [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[T](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.EnumerableExtensions#Abblix.Utils.EnumerableExtensions.FlattenTree_T_(thisSystem.Collections.Generic.IEnumerable_T_,System.Func_T,System.Collections.Generic.IEnumerable_T__).T 'Abblix\.Utils\.EnumerableExtensions\.FlattenTree\\(this System\.Collections\.Generic\.IEnumerable\, System\.Func\\>\)\.T')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') A flattened sequence of all elements in the tree\. ## EnumerableExtensions\.FlattenTree\\(this T, Func\\>\) Method {#Abblix.Utils.EnumerableExtensions.FlattenTree_T_(thisT,System.Func_T,System.Collections.Generic.IEnumerable_T__)} Flattens a tree structure starting from a single root element into a flat sequence using breadth\-first traversal\. ```csharp public static System.Collections.Generic.IEnumerable FlattenTree(this T root, System.Func> childrenSelector); ``` #### Type parameters ###### `T` {#Abblix.Utils.EnumerableExtensions.FlattenTree_T_(thisT,System.Func_T,System.Collections.Generic.IEnumerable_T__).T} The type of elements in the tree\. #### Parameters ###### `root` [T](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.EnumerableExtensions#Abblix.Utils.EnumerableExtensions.FlattenTree_T_(thisT,System.Func_T,System.Collections.Generic.IEnumerable_T__).T 'Abblix\.Utils\.EnumerableExtensions\.FlattenTree\\(this T, System\.Func\\>\)\.T') {#Abblix.Utils.EnumerableExtensions.FlattenTree_T_(thisT,System.Func_T,System.Collections.Generic.IEnumerable_T__).root} The root element of the tree\. ###### `childrenSelector` [System\.Func<](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2')[T](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.EnumerableExtensions#Abblix.Utils.EnumerableExtensions.FlattenTree_T_(thisT,System.Func_T,System.Collections.Generic.IEnumerable_T__).T 'Abblix\.Utils\.EnumerableExtensions\.FlattenTree\\(this T, System\.Func\\>\)\.T')[,](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2')[System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[T](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.EnumerableExtensions#Abblix.Utils.EnumerableExtensions.FlattenTree_T_(thisT,System.Func_T,System.Collections.Generic.IEnumerable_T__).T 'Abblix\.Utils\.EnumerableExtensions\.FlattenTree\\(this T, System\.Func\\>\)\.T')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[>](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2') {#Abblix.Utils.EnumerableExtensions.FlattenTree_T_(thisT,System.Func_T,System.Collections.Generic.IEnumerable_T__).childrenSelector} A function to retrieve the children of an element\. #### Returns [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[T](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.EnumerableExtensions#Abblix.Utils.EnumerableExtensions.FlattenTree_T_(thisT,System.Func_T,System.Collections.Generic.IEnumerable_T__).T 'Abblix\.Utils\.EnumerableExtensions\.FlattenTree\\(this T, System\.Func\\>\)\.T')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') A flattened sequence of all elements in the tree\. ## EnumerableExtensions\.Materialize\\(this IEnumerable\\) Method {#Abblix.Utils.EnumerableExtensions.Materialize_T_(thisSystem.Collections.Generic.IEnumerable_T_)} Forces a sequence to be evaluated once and returns the result as a non\-lazy [System\.Collections\.Generic\.IReadOnlyCollection<>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ireadonlycollection-1 'System\.Collections\.Generic\.IReadOnlyCollection\`1') that callers can iterate any number of times\. Use at any site that needs to enumerate the same [System\.Collections\.Generic\.IEnumerable<>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') more than once \(cost estimate \+ actual call, log \+ record, etc\.\) \- a lazy LINQ pipeline or an iterator method passed by an upstream caller would otherwise re\-execute its source per enumeration\. ```csharp public static System.Collections.Generic.IReadOnlyCollection Materialize(this System.Collections.Generic.IEnumerable source); ``` #### Type parameters ###### `T` {#Abblix.Utils.EnumerableExtensions.Materialize_T_(thisSystem.Collections.Generic.IEnumerable_T_).T} The type of elements in the sequence\. #### Parameters ###### `source` [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[T](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.EnumerableExtensions#Abblix.Utils.EnumerableExtensions.Materialize_T_(thisSystem.Collections.Generic.IEnumerable_T_).T 'Abblix\.Utils\.EnumerableExtensions\.Materialize\\(this System\.Collections\.Generic\.IEnumerable\\)\.T')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') {#Abblix.Utils.EnumerableExtensions.Materialize_T_(thisSystem.Collections.Generic.IEnumerable_T_).source} The sequence to materialize\. #### Returns [System\.Collections\.Generic\.IReadOnlyCollection<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ireadonlycollection-1 'System\.Collections\.Generic\.IReadOnlyCollection\`1')[T](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.EnumerableExtensions#Abblix.Utils.EnumerableExtensions.Materialize_T_(thisSystem.Collections.Generic.IEnumerable_T_).T 'Abblix\.Utils\.EnumerableExtensions\.Materialize\\(this System\.Collections\.Generic\.IEnumerable\\)\.T')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ireadonlycollection-1 'System\.Collections\.Generic\.IReadOnlyCollection\`1') A non\-lazy collection holding all elements of [source](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.EnumerableExtensions#Abblix.Utils.EnumerableExtensions.Materialize_T_(thisSystem.Collections.Generic.IEnumerable_T_).source 'Abblix\.Utils\.EnumerableExtensions\.Materialize\\(this System\.Collections\.Generic\.IEnumerable\\)\.source')\. ### Remarks Skips the allocation when [source](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.EnumerableExtensions#Abblix.Utils.EnumerableExtensions.Materialize_T_(thisSystem.Collections.Generic.IEnumerable_T_).source 'Abblix\.Utils\.EnumerableExtensions\.Materialize\\(this System\.Collections\.Generic\.IEnumerable\\)\.source') is already a concrete collection \(`T[]`, `List`, `HashSet`, etc\.\) \- only lazy / iterator\-method sources pay for a one\-shot copy\. ## EnumerableExtensions\.OrEmpty\\(this IEnumerable\\) Method {#Abblix.Utils.EnumerableExtensions.OrEmpty_T_(thisSystem.Collections.Generic.IEnumerable_T_)} Returns the original sequence, or an empty sequence if the original is null\. ```csharp public static System.Collections.Generic.IEnumerable OrEmpty(this System.Collections.Generic.IEnumerable? value); ``` #### Type parameters ###### `T` {#Abblix.Utils.EnumerableExtensions.OrEmpty_T_(thisSystem.Collections.Generic.IEnumerable_T_).T} The type of elements in the sequence\. #### Parameters ###### `value` [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[T](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.EnumerableExtensions#Abblix.Utils.EnumerableExtensions.OrEmpty_T_(thisSystem.Collections.Generic.IEnumerable_T_).T 'Abblix\.Utils\.EnumerableExtensions\.OrEmpty\\(this System\.Collections\.Generic\.IEnumerable\\)\.T')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') {#Abblix.Utils.EnumerableExtensions.OrEmpty_T_(thisSystem.Collections.Generic.IEnumerable_T_).value} The sequence to return or an empty sequence if this is null\. #### Returns [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[T](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.EnumerableExtensions#Abblix.Utils.EnumerableExtensions.OrEmpty_T_(thisSystem.Collections.Generic.IEnumerable_T_).T 'Abblix\.Utils\.EnumerableExtensions\.OrEmpty\\(this System\.Collections\.Generic\.IEnumerable\\)\.T')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') The original sequence or an empty sequence\. ## EnumerableExtensions\.TravelUp\\(this T, Func\\) Method {#Abblix.Utils.EnumerableExtensions.TravelUp_T_(thisT,System.Func_T,T_)} Traverses a hierarchy upwards, starting from a specific item and moving to its parent, grandparent, etc\., as determined by a parent selector function\. ```csharp public static System.Collections.Generic.IEnumerable TravelUp(this T item, System.Func parentSelector) where T : class; ``` #### Type parameters ###### `T` {#Abblix.Utils.EnumerableExtensions.TravelUp_T_(thisT,System.Func_T,T_).T} The type of elements in the hierarchy\. #### Parameters ###### `item` [T](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.EnumerableExtensions#Abblix.Utils.EnumerableExtensions.TravelUp_T_(thisT,System.Func_T,T_).T 'Abblix\.Utils\.EnumerableExtensions\.TravelUp\\(this T, System\.Func\\)\.T') {#Abblix.Utils.EnumerableExtensions.TravelUp_T_(thisT,System.Func_T,T_).item} The starting item in the hierarchy\. ###### `parentSelector` [System\.Func<](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2')[T](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.EnumerableExtensions#Abblix.Utils.EnumerableExtensions.TravelUp_T_(thisT,System.Func_T,T_).T 'Abblix\.Utils\.EnumerableExtensions\.TravelUp\\(this T, System\.Func\\)\.T')[,](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2')[T](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.EnumerableExtensions#Abblix.Utils.EnumerableExtensions.TravelUp_T_(thisT,System.Func_T,T_).T 'Abblix\.Utils\.EnumerableExtensions\.TravelUp\\(this T, System\.Func\\)\.T')[>](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2') {#Abblix.Utils.EnumerableExtensions.TravelUp_T_(thisT,System.Func_T,T_).parentSelector} A function that returns the parent of a given item\. #### Returns [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[T](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.EnumerableExtensions#Abblix.Utils.EnumerableExtensions.TravelUp_T_(thisT,System.Func_T,T_).T 'Abblix\.Utils\.EnumerableExtensions\.TravelUp\\(this T, System\.Func\\)\.T')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') An IEnumerable\ representing the path from the item upwards in the hierarchy\. --- Source: https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.EnumFlagExtensions.md #### [Abblix\.Utils](https://www.abblix.com/en/docs/api/abblix-utils 'index') ### [Abblix\.Utils](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils 'Abblix\.Utils') ## EnumFlagExtensions Class Extension methods for `[Flags]` enum values that complement the BCL surface\. Named with the `Flag` qualifier so it does not collide with the very common `EnumExtensions` class name used by other libraries \(e\.g\. `Fido2NetLib.EnumExtensions`\), which would surface as `CS0104` in any consumer that imports both namespaces\. ```csharp public static class EnumFlagExtensions ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → EnumFlagExtensions ### Methods ## EnumFlagExtensions\.HasAnyFlag\\(this T, T\) Method {#Abblix.Utils.EnumFlagExtensions.HasAnyFlag_T_(thisT,T)} Returns `true` when at least one flag in [mask](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.EnumFlagExtensions#Abblix.Utils.EnumFlagExtensions.HasAnyFlag_T_(thisT,T).mask 'Abblix\.Utils\.EnumFlagExtensions\.HasAnyFlag\\(this T, T\)\.mask') is set in [value](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.EnumFlagExtensions#Abblix.Utils.EnumFlagExtensions.HasAnyFlag_T_(thisT,T).value 'Abblix\.Utils\.EnumFlagExtensions\.HasAnyFlag\\(this T, T\)\.value')\. The OR\-counterpart to [System\.Enum\.HasFlag\(System\.Enum\)](https://learn.microsoft.com/en-us/dotnet/api/system.enum.hasflag#system-enum-hasflag(system-enum) 'System\.Enum\.HasFlag\(System\.Enum\)'): `HasFlag(mask)` requires every bit of [mask](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.EnumFlagExtensions#Abblix.Utils.EnumFlagExtensions.HasAnyFlag_T_(thisT,T).mask 'Abblix\.Utils\.EnumFlagExtensions\.HasAnyFlag\\(this T, T\)\.mask') to be set, while this method is satisfied by any single bit\. Callers should build the mask inline by OR\-ing the individual flags they want to test for, rather than reusing a named composite enum member whose semantics may match [System\.Enum\.HasFlag\(System\.Enum\)](https://learn.microsoft.com/en-us/dotnet/api/system.enum.hasflag#system-enum-hasflag(system-enum) 'System\.Enum\.HasFlag\(System\.Enum\)') \(all\-of\) instead of any\-of\. ```csharp public static bool HasAnyFlag(this T value, T mask) where T : struct, System.Enum; ``` #### Type parameters ###### `T` {#Abblix.Utils.EnumFlagExtensions.HasAnyFlag_T_(thisT,T).T} A `[Flags]` enum type\. #### Parameters ###### `value` [T](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.EnumFlagExtensions#Abblix.Utils.EnumFlagExtensions.HasAnyFlag_T_(thisT,T).T 'Abblix\.Utils\.EnumFlagExtensions\.HasAnyFlag\\(this T, T\)\.T') {#Abblix.Utils.EnumFlagExtensions.HasAnyFlag_T_(thisT,T).value} The flag value to inspect\. ###### `mask` [T](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.EnumFlagExtensions#Abblix.Utils.EnumFlagExtensions.HasAnyFlag_T_(thisT,T).T 'Abblix\.Utils\.EnumFlagExtensions\.HasAnyFlag\\(this T, T\)\.T') {#Abblix.Utils.EnumFlagExtensions.HasAnyFlag_T_(thisT,T).mask} An OR of the flags to test for\. #### Returns [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') `true` when any flag in [mask](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.EnumFlagExtensions#Abblix.Utils.EnumFlagExtensions.HasAnyFlag_T_(thisT,T).mask 'Abblix\.Utils\.EnumFlagExtensions\.HasAnyFlag\\(this T, T\)\.mask') is set in [value](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.EnumFlagExtensions#Abblix.Utils.EnumFlagExtensions.HasAnyFlag_T_(thisT,T).value 'Abblix\.Utils\.EnumFlagExtensions\.HasAnyFlag\\(this T, T\)\.value'); otherwise `false`\. --- Source: https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.HexConverter.md #### [Abblix\.Utils](https://www.abblix.com/en/docs/api/abblix-utils 'index') ### [Abblix\.Utils](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils 'Abblix\.Utils') ## HexConverter Class Provides a static method for converting a byte array to its hexadecimal string representation\. ```csharp public static class HexConverter ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → HexConverter ### Methods ## HexConverter\.ToHexString\(this byte\[\]\) Method {#Abblix.Utils.HexConverter.ToHexString(thisbyte[])} Converts a byte array to a hexadecimal string representation\. ```csharp public static string ToHexString(this byte[] bytes); ``` #### Parameters ###### `bytes` [System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Utils.HexConverter.ToHexString(thisbyte[]).bytes} The byte array to convert\. #### Returns [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') A string representing the hexadecimal representation of the byte array\. --- Source: https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.HttpServerUtility.md #### [Abblix\.Utils](https://www.abblix.com/en/docs/api/abblix-utils 'index') ### [Abblix\.Utils](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils 'Abblix\.Utils') ## HttpServerUtility Class Provides utility methods for encoding and decoding URL tokens\. ```csharp public static class HttpServerUtility ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → HttpServerUtility ### Methods ## HttpServerUtility\.UrlTokenDecode\(string\) Method {#Abblix.Utils.HttpServerUtility.UrlTokenDecode(string)} Decodes a URL token into a byte array\. ```csharp public static byte[] UrlTokenDecode(string input); ``` #### Parameters ###### `input` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Utils.HttpServerUtility.UrlTokenDecode(string).input} The URL token to decode\. #### Returns [System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') A byte array representing the decoded data\. ### Remarks This method converts URL\-safe characters \('\-' and '\_'\) back to their original Base64 equivalents \('\+' and '/'\) and then decodes the Base64 string\. ## HttpServerUtility\.UrlTokenEncode\(byte\[\], Nullable\\) Method {#Abblix.Utils.HttpServerUtility.UrlTokenEncode(byte[],System.Nullable_int_)} Encodes a byte array into a URL token\. ```csharp public static string UrlTokenEncode(byte[]? input, System.Nullable length=null); ``` #### Parameters ###### `input` [System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Utils.HttpServerUtility.UrlTokenEncode(byte[],System.Nullable_int_).input} The byte array to encode\. ###### `length` [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.Int32](https://learn.microsoft.com/en-us/dotnet/api/system.int32 'System\.Int32')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') {#Abblix.Utils.HttpServerUtility.UrlTokenEncode(byte[],System.Nullable_int_).length} The number of bytes to encode\. If null, encodes the entire array\. #### Returns [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') A URL\-safe token representing the encoded data\. #### Exceptions [System\.ArgumentOutOfRangeException](https://learn.microsoft.com/en-us/dotnet/api/system.argumentoutofrangeexception 'System\.ArgumentOutOfRangeException') Thrown when the specified length is greater than the actual length of the input array\. ### Remarks This method first converts the byte array to a Base64 string, then replaces Base64\-specific characters \('\+' and '/'\) with URL\-safe characters \('\-' and '\_'\), and trims any trailing '=' characters\. --- Source: https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.ICertificateProvider.md #### [Abblix\.Utils](https://www.abblix.com/en/docs/api/abblix-utils 'index') ### [Abblix\.Utils](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils 'Abblix\.Utils') ## ICertificateProvider Interface Resolves an [System\.Security\.Cryptography\.X509Certificates\.X509Certificate2](https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.x509certificates.x509certificate2 'System\.Security\.Cryptography\.X509Certificates\.X509Certificate2') from a logical [CertificateId](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.CertificateId 'Abblix\.Utils\.CertificateId'), abstracting away the physical source \(file system, certificate store, secret manager, etc\.\)\. Implementations are expected to be thread\-safe and to surface format or access errors as [System\.InvalidOperationException](https://learn.microsoft.com/en-us/dotnet/api/system.invalidoperationexception 'System\.InvalidOperationException')\. ```csharp public interface ICertificateProvider ``` ### Methods ## ICertificateProvider\.GetCertificate\(CertificateId\) Method {#Abblix.Utils.ICertificateProvider.GetCertificate(Abblix.Utils.CertificateId)} Retrieves an X\.509 certificate based on the specified certificate identifier\. ```csharp System.Security.Cryptography.X509Certificates.X509Certificate2 GetCertificate(Abblix.Utils.CertificateId certificateId); ``` #### Parameters ###### `certificateId` [CertificateId](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.CertificateId 'Abblix\.Utils\.CertificateId') {#Abblix.Utils.ICertificateProvider.GetCertificate(Abblix.Utils.CertificateId).certificateId} The identifier of the certificate to retrieve\. #### Returns [System\.Security\.Cryptography\.X509Certificates\.X509Certificate2](https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.x509certificates.x509certificate2 'System\.Security\.Cryptography\.X509Certificates\.X509Certificate2') An [System\.Security\.Cryptography\.X509Certificates\.X509Certificate2](https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.x509certificates.x509certificate2 'System\.Security\.Cryptography\.X509Certificates\.X509Certificate2') instance representing the requested certificate\. #### Exceptions [System\.Collections\.Generic\.KeyNotFoundException](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.keynotfoundexception 'System\.Collections\.Generic\.KeyNotFoundException') Thrown if a certificate with the specified identifier is not found\. [System\.InvalidOperationException](https://learn.microsoft.com/en-us/dotnet/api/system.invalidoperationexception 'System\.InvalidOperationException') Thrown if there is an issue in retrieving the certificate, such as issues with certificate format or storage\. --- Source: https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.ObjectExtensions.md #### [Abblix\.Utils](https://www.abblix.com/en/docs/api/abblix-utils 'index') ### [Abblix\.Utils](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils 'Abblix\.Utils') ## ObjectExtensions Class Provides extension methods for objects to ensure non\-null values\. ```csharp public static class ObjectExtensions ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ObjectExtensions ### Methods ## ObjectExtensions\.NotNull\\(this Nullable\, string\) Method {#Abblix.Utils.ObjectExtensions.NotNull_T_(thisSystem.Nullable_T_,string)} Ensures that the specified nullable value type is not null\. Throws an InvalidOperationException if it is null\. ```csharp public static T NotNull(this System.Nullable value, string valueName) where T : struct; ``` #### Type parameters ###### `T` {#Abblix.Utils.ObjectExtensions.NotNull_T_(thisSystem.Nullable_T_,string).T} The type of the nullable value type\. #### Parameters ###### `value` [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[T](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.ObjectExtensions#Abblix.Utils.ObjectExtensions.NotNull_T_(thisSystem.Nullable_T_,string).T 'Abblix\.Utils\.ObjectExtensions\.NotNull\\(this System\.Nullable\, string\)\.T')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') {#Abblix.Utils.ObjectExtensions.NotNull_T_(thisSystem.Nullable_T_,string).value} The nullable value type to check for null\. ###### `valueName` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Utils.ObjectExtensions.NotNull_T_(thisSystem.Nullable_T_,string).valueName} The name of the nullable value type, which will be used in the exception message if the value is null\. #### Returns [T](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.ObjectExtensions#Abblix.Utils.ObjectExtensions.NotNull_T_(thisSystem.Nullable_T_,string).T 'Abblix\.Utils\.ObjectExtensions\.NotNull\\(this System\.Nullable\, string\)\.T') The original non\-null value of type T\. #### Exceptions [System\.InvalidOperationException](https://learn.microsoft.com/en-us/dotnet/api/system.invalidoperationexception 'System\.InvalidOperationException') Thrown when the input value is null\. ## ObjectExtensions\.NotNull\\(this T, string\) Method {#Abblix.Utils.ObjectExtensions.NotNull_T_(thisT,string)} Ensures that the specified nullable reference type is not null\. Throws an InvalidOperationException if it is null\. ```csharp public static T NotNull(this T? value, string valueName) where T : class; ``` #### Type parameters ###### `T` {#Abblix.Utils.ObjectExtensions.NotNull_T_(thisT,string).T} The type of the nullable reference type\. #### Parameters ###### `value` [T](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.ObjectExtensions#Abblix.Utils.ObjectExtensions.NotNull_T_(thisT,string).T 'Abblix\.Utils\.ObjectExtensions\.NotNull\\(this T, string\)\.T') {#Abblix.Utils.ObjectExtensions.NotNull_T_(thisT,string).value} The nullable reference type to check for null\. ###### `valueName` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Utils.ObjectExtensions.NotNull_T_(thisT,string).valueName} The name of the nullable reference type, which will be used in the exception message if the value is null\. #### Returns [T](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.ObjectExtensions#Abblix.Utils.ObjectExtensions.NotNull_T_(thisT,string).T 'Abblix\.Utils\.ObjectExtensions\.NotNull\\(this T, string\)\.T') The original non\-null value of type T\. #### Exceptions [System\.InvalidOperationException](https://learn.microsoft.com/en-us/dotnet/api/system.invalidoperationexception 'System\.InvalidOperationException') Thrown when the input value is null\. ## ObjectExtensions\.ToAsync\\(this T\) Method {#Abblix.Utils.ObjectExtensions.ToAsync_T_(thisT)} Wraps a single value as an [System\.Collections\.Generic\.IAsyncEnumerable<>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.iasyncenumerable-1 'System\.Collections\.Generic\.IAsyncEnumerable\`1') that yields exactly one element\. Useful for adapting non\-streaming sources to APIs that consume an async sequence \- for example handing a single signing key to a verifier that expects a candidate\-key stream\. ```csharp public static System.Collections.Generic.IAsyncEnumerable ToAsync(this T value); ``` #### Type parameters ###### `T` {#Abblix.Utils.ObjectExtensions.ToAsync_T_(thisT).T} The type of the value to wrap\. #### Parameters ###### `value` [T](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.ObjectExtensions#Abblix.Utils.ObjectExtensions.ToAsync_T_(thisT).T 'Abblix\.Utils\.ObjectExtensions\.ToAsync\\(this T\)\.T') {#Abblix.Utils.ObjectExtensions.ToAsync_T_(thisT).value} The value to yield\. #### Returns [System\.Collections\.Generic\.IAsyncEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.iasyncenumerable-1 'System\.Collections\.Generic\.IAsyncEnumerable\`1')[T](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.ObjectExtensions#Abblix.Utils.ObjectExtensions.ToAsync_T_(thisT).T 'Abblix\.Utils\.ObjectExtensions\.ToAsync\\(this T\)\.T')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.iasyncenumerable-1 'System\.Collections\.Generic\.IAsyncEnumerable\`1') An [System\.Collections\.Generic\.IAsyncEnumerable<>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.iasyncenumerable-1 'System\.Collections\.Generic\.IAsyncEnumerable\`1') producing [value](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.ObjectExtensions#Abblix.Utils.ObjectExtensions.ToAsync_T_(thisT).value 'Abblix\.Utils\.ObjectExtensions\.ToAsync\\(this T\)\.value') once and then completing\. --- Source: https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.ParametersBuilder.md #### [Abblix\.Utils](https://www.abblix.com/en/docs/api/abblix-utils 'index') ### [Abblix\.Utils](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils 'Abblix\.Utils') ## ParametersBuilder Class Provides a builder for constructing and manipulating query strings or URI fragment parts\. ```csharp public class ParametersBuilder ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ParametersBuilder ### Constructors ## ParametersBuilder\(string\) Constructor {#Abblix.Utils.ParametersBuilder.ParametersBuilder(string)} Initializes a new instance of the [ParametersBuilder](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.ParametersBuilder 'Abblix\.Utils\.ParametersBuilder') class\. ```csharp public ParametersBuilder(string valuesString=""); ``` #### Parameters ###### `valuesString` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Utils.ParametersBuilder.ParametersBuilder(string).valuesString} A string representing the initial query string or URI fragment\. ### Properties ## ParametersBuilder\.this\[string\] Property {#Abblix.Utils.ParametersBuilder.this[string]} The value associated with the specified parameter name\. ```csharp public string? this[string name] { get; set; } ``` #### Parameters ###### `name` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Utils.ParametersBuilder.this[string].name} The name of the parameter to get or set\. #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Methods ## ParametersBuilder\.Add\(string, string\) Method {#Abblix.Utils.ParametersBuilder.Add(string,string)} Appends a value under a name, keeping any value already stored under it\. ```csharp public void Add(string name, string? value); ``` #### Parameters ###### `name` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Utils.ParametersBuilder.Add(string,string).name} The name of the parameter to append to\. ###### `value` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Utils.ParametersBuilder.Add(string,string).value} The value to append\. ### Remarks The indexer replaces, which is what almost every parameter wants\. This is for the few that a specification allows to repeat \(`resource` of RFC 8707, for one\), where each occurrence carries its own meaning and replacing would silently drop all but the last\. ## ParametersBuilder\.Clear\(\) Method {#Abblix.Utils.ParametersBuilder.Clear()} Clears all the parameters from the builder\. ```csharp public void Clear(); ``` ## ParametersBuilder\.ToString\(\) Method {#Abblix.Utils.ParametersBuilder.ToString()} Returns a string that represents the current query string or URI fragment\. ```csharp public override string ToString(); ``` #### Returns [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') A string that represents the current state of the builder\. --- Source: https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.PrivateNetworks.md #### [Abblix\.Utils](https://www.abblix.com/en/docs/api/abblix-utils 'index') ### [Abblix\.Utils](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils 'Abblix\.Utils') ## PrivateNetworks Class Tells an address inside the deployment's own network from one on the public internet\. ```csharp public static class PrivateNetworks ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → PrivateNetworks ### Remarks Whenever a server is made to call an address that arrived from outside, this is the question that decides whether the call is a feature or a server\-side request forgery\. More than one package asks it, which is why the answer lives here rather than beside any one of them: a range added to the list below has to take effect everywhere at once, and a second copy of these rules would drift silently, since neither copy fails when they disagree\. "Private" is this type's term and it is wider than the RFC 1918 ranges the phrase usually names: it covers everything a server-initiated request has no business reaching, so loopback, link-local (where a cloud's metadata service lives), carrier-grade NAT, multicast and the unspecified address count too, as do hostnames that resolve inside a network rather than on the internet. What surrounds the question stays with each caller: which schemes are allowed, whether the check applies at all, and which destinations an operator has deliberately permitted are policy, and policy differs by feature. ### Methods ## PrivateNetworks\.IsPrivateHostname\(string\) Method {#Abblix.Utils.PrivateNetworks.IsPrivateHostname(string)} Reports whether a hostname belongs to a network rather than to the internet\. ```csharp public static bool IsPrivateHostname(string hostname); ``` #### Parameters ###### `hostname` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Utils.PrivateNetworks.IsPrivateHostname(string).hostname} The host component of the address about to be reached\. #### Returns [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') True when the name should not be reached from a server\-initiated request\. ## PrivateNetworks\.IsPrivateOrReservedAddress\(IPAddress\) Method {#Abblix.Utils.PrivateNetworks.IsPrivateOrReservedAddress(System.Net.IPAddress)} Reports whether an IP address is private, loopback, link\-local or otherwise reserved\. ```csharp public static bool IsPrivateOrReservedAddress(System.Net.IPAddress address); ``` #### Parameters ###### `address` [System\.Net\.IPAddress](https://learn.microsoft.com/en-us/dotnet/api/system.net.ipaddress 'System\.Net\.IPAddress') {#Abblix.Utils.PrivateNetworks.IsPrivateOrReservedAddress(System.Net.IPAddress).address} The address a name resolved to, or the literal in the URI\. #### Returns [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') True when the address belongs to the deployment's own network rather than the internet\. --- Source: https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_.md #### [Abblix\.Utils](https://www.abblix.com/en/docs/api/abblix-utils 'index') ### [Abblix\.Utils](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils 'Abblix\.Utils') ## Result\ Class Represents a result of an operation that can either succeed with a value of type [TSuccess](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.TSuccess 'Abblix\.Utils\.Result\\.TSuccess') or fail with a value of type [TFailure](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.TFailure 'Abblix\.Utils\.Result\\.TFailure')\. ```csharp public abstract record Result : System.IEquatable> ``` #### Type parameters ###### `TSuccess` {#Abblix.Utils.Result_TSuccess,TFailure_.TSuccess} The type of the success result\. ###### `TFailure` {#Abblix.Utils.Result_TSuccess,TFailure_.TFailure} The type of the failure result\. Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → Result\ Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[TSuccess](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.TSuccess 'Abblix\.Utils\.Result\\.TSuccess')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[TFailure](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.TFailure 'Abblix\.Utils\.Result\\.TFailure')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Methods ## Result\\.Bind\(Action\\) Method {#Abblix.Utils.Result_TSuccess,TFailure_.Bind(System.Action_TSuccess_)} Executes the specified action if the result is successful, and returns the original result\. ```csharp public abstract Abblix.Utils.Result Bind(System.Action action); ``` #### Parameters ###### `action` [System\.Action<](https://learn.microsoft.com/en-us/dotnet/api/system.action-1 'System\.Action\`1')[TSuccess](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.TSuccess 'Abblix\.Utils\.Result\\.TSuccess')[>](https://learn.microsoft.com/en-us/dotnet/api/system.action-1 'System\.Action\`1') {#Abblix.Utils.Result_TSuccess,TFailure_.Bind(System.Action_TSuccess_).action} The action to execute if the result is successful\. #### Returns [Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[TSuccess](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.TSuccess 'Abblix\.Utils\.Result\\.TSuccess')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[TFailure](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.TFailure 'Abblix\.Utils\.Result\\.TFailure')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\') The original result after executing the action if successful; otherwise, the failure result\. ## Result\\.Bind\\(Func\\>\) Method {#Abblix.Utils.Result_TSuccess,TFailure_.Bind_TNext_(System.Func_TSuccess,Abblix.Utils.Result_TNext,TFailure__)} Binds the result to a function that returns a new result, allowing chaining of operations\. ```csharp public abstract Abblix.Utils.Result Bind(System.Func> func); ``` #### Type parameters ###### `TNext` {#Abblix.Utils.Result_TSuccess,TFailure_.Bind_TNext_(System.Func_TSuccess,Abblix.Utils.Result_TNext,TFailure__).TNext} The type of the success value in the returned result\. #### Parameters ###### `func` [System\.Func<](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2')[TSuccess](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.TSuccess 'Abblix\.Utils\.Result\\.TSuccess')[,](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[TNext](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.Bind_TNext_(System.Func_TSuccess,Abblix.Utils.Result_TNext,TFailure__).TNext 'Abblix\.Utils\.Result\\.Bind\\(System\.Func\\>\)\.TNext')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[TFailure](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.TFailure 'Abblix\.Utils\.Result\\.TFailure')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[>](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2') {#Abblix.Utils.Result_TSuccess,TFailure_.Bind_TNext_(System.Func_TSuccess,Abblix.Utils.Result_TNext,TFailure__).func} The function to apply to the success value\. #### Returns [Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[TNext](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.Bind_TNext_(System.Func_TSuccess,Abblix.Utils.Result_TNext,TFailure__).TNext 'Abblix\.Utils\.Result\\.Bind\\(System\.Func\\>\)\.TNext')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[TFailure](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.TFailure 'Abblix\.Utils\.Result\\.TFailure')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\') The result of applying the function if successful; otherwise, the original failure\. ## Result\\.BindAsync\(Func\\) Method {#Abblix.Utils.Result_TSuccess,TFailure_.BindAsync(System.Func_TSuccess,System.Threading.Tasks.Task_)} Asynchronously executes the specified action if the result is successful, and returns the original result\. ```csharp public abstract System.Threading.Tasks.Task> BindAsync(System.Func action); ``` #### Parameters ###### `action` [System\.Func<](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2')[TSuccess](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.TSuccess 'Abblix\.Utils\.Result\\.TSuccess')[,](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2')[System\.Threading\.Tasks\.Task](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task 'System\.Threading\.Tasks\.Task')[>](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2') {#Abblix.Utils.Result_TSuccess,TFailure_.BindAsync(System.Func_TSuccess,System.Threading.Tasks.Task_).action} The asynchronous action to execute if the result is successful\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[TSuccess](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.TSuccess 'Abblix\.Utils\.Result\\.TSuccess')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[TFailure](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.TFailure 'Abblix\.Utils\.Result\\.TFailure')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task representing the operation, with the original result\. ## Result\\.BindAsync\\(Func\\>\>\) Method {#Abblix.Utils.Result_TSuccess,TFailure_.BindAsync_TNext_(System.Func_TSuccess,System.Threading.Tasks.Task_Abblix.Utils.Result_TNext,TFailure___)} Asynchronously binds the result to a function that returns a new result, allowing chaining of operations\. ```csharp public abstract System.Threading.Tasks.Task> BindAsync(System.Func>> func); ``` #### Type parameters ###### `TNext` {#Abblix.Utils.Result_TSuccess,TFailure_.BindAsync_TNext_(System.Func_TSuccess,System.Threading.Tasks.Task_Abblix.Utils.Result_TNext,TFailure___).TNext} The type of the success value in the returned result\. #### Parameters ###### `func` [System\.Func<](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2')[TSuccess](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.TSuccess 'Abblix\.Utils\.Result\\.TSuccess')[,](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2')[System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[TNext](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.BindAsync_TNext_(System.Func_TSuccess,System.Threading.Tasks.Task_Abblix.Utils.Result_TNext,TFailure___).TNext 'Abblix\.Utils\.Result\\.BindAsync\\(System\.Func\\>\>\)\.TNext')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[TFailure](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.TFailure 'Abblix\.Utils\.Result\\.TFailure')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[>](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2') {#Abblix.Utils.Result_TSuccess,TFailure_.BindAsync_TNext_(System.Func_TSuccess,System.Threading.Tasks.Task_Abblix.Utils.Result_TNext,TFailure___).func} The asynchronous function to apply to the success value\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[TNext](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.BindAsync_TNext_(System.Func_TSuccess,System.Threading.Tasks.Task_Abblix.Utils.Result_TNext,TFailure___).TNext 'Abblix\.Utils\.Result\\.BindAsync\\(System\.Func\\>\>\)\.TNext')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[TFailure](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.TFailure 'Abblix\.Utils\.Result\\.TFailure')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task representing the result of applying the function if successful; otherwise, the original failure\. ## Result\\.Deconstruct\(TSuccess, TFailure\) Method {#Abblix.Utils.Result_TSuccess,TFailure_.Deconstruct(TSuccess,TFailure)} Deconstructs the result into separate success and failure values\. ```csharp public abstract void Deconstruct(out TSuccess? success, out TFailure? failure); ``` #### Parameters ###### `success` [TSuccess](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.TSuccess 'Abblix\.Utils\.Result\\.TSuccess') {#Abblix.Utils.Result_TSuccess,TFailure_.Deconstruct(TSuccess,TFailure).success} The success value if available; otherwise, `null`\. ###### `failure` [TFailure](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.TFailure 'Abblix\.Utils\.Result\\.TFailure') {#Abblix.Utils.Result_TSuccess,TFailure_.Deconstruct(TSuccess,TFailure).failure} The failure value if available; otherwise, `null`\. ## Result\\.Ensure\(Func\, TFailure\) Method {#Abblix.Utils.Result_TSuccess,TFailure_.Ensure(System.Func_TSuccess,bool_,TFailure)} Ensures that the success value satisfies the specified predicate; otherwise, returns a failure result\. ```csharp public abstract Abblix.Utils.Result Ensure(System.Func predicate, TFailure failure); ``` #### Parameters ###### `predicate` [System\.Func<](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2')[TSuccess](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.TSuccess 'Abblix\.Utils\.Result\\.TSuccess')[,](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2')[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')[>](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2') {#Abblix.Utils.Result_TSuccess,TFailure_.Ensure(System.Func_TSuccess,bool_,TFailure).predicate} The predicate to evaluate the success value\. ###### `failure` [TFailure](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.TFailure 'Abblix\.Utils\.Result\\.TFailure') {#Abblix.Utils.Result_TSuccess,TFailure_.Ensure(System.Func_TSuccess,bool_,TFailure).failure} The failure value to return if the predicate is not satisfied\. #### Returns [Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[TSuccess](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.TSuccess 'Abblix\.Utils\.Result\\.TSuccess')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[TFailure](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.TFailure 'Abblix\.Utils\.Result\\.TFailure')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\') The original success result if the predicate is satisfied; otherwise, a failure result\. ## Result\\.Failure\(TFailure\) Method {#Abblix.Utils.Result_TSuccess,TFailure_.Failure(TFailure)} Creates a failed result with the specified value\. ```csharp public static Abblix.Utils.Result Failure(TFailure value); ``` #### Parameters ###### `value` [TFailure](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.TFailure 'Abblix\.Utils\.Result\\.TFailure') {#Abblix.Utils.Result_TSuccess,TFailure_.Failure(TFailure).value} The failure value\. #### Returns [Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[TSuccess](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.TSuccess 'Abblix\.Utils\.Result\\.TSuccess')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[TFailure](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.TFailure 'Abblix\.Utils\.Result\\.TFailure')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\') A [Result<TSuccess,TFailure>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\') representing a failed result\. ## Result\\.GetFailure\(\) Method {#Abblix.Utils.Result_TSuccess,TFailure_.GetFailure()} Gets the failure value\. ```csharp public abstract TFailure GetFailure(); ``` #### Returns [TFailure](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.TFailure 'Abblix\.Utils\.Result\\.TFailure') The failure value\. #### Exceptions [System\.InvalidOperationException](https://learn.microsoft.com/en-us/dotnet/api/system.invalidoperationexception 'System\.InvalidOperationException') Thrown if the result is a success\. ## Result\\.GetSuccess\(\) Method {#Abblix.Utils.Result_TSuccess,TFailure_.GetSuccess()} Gets the success value\. ```csharp public abstract TSuccess GetSuccess(); ``` #### Returns [TSuccess](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.TSuccess 'Abblix\.Utils\.Result\\.TSuccess') The success value\. #### Exceptions [System\.InvalidOperationException](https://learn.microsoft.com/en-us/dotnet/api/system.invalidoperationexception 'System\.InvalidOperationException') Thrown if the result is a failure\. ## Result\\.Map\\(Func\, Func\\) Method {#Abblix.Utils.Result_TSuccess,TFailure_.Map_TNewSuccess,TNewFailure_(System.Func_TSuccess,TNewSuccess_,System.Func_TFailure,TNewFailure_)} Maps both success and failure values to new types\. ```csharp public Abblix.Utils.Result Map(System.Func onSuccess, System.Func onFailure); ``` #### Type parameters ###### `TNewSuccess` {#Abblix.Utils.Result_TSuccess,TFailure_.Map_TNewSuccess,TNewFailure_(System.Func_TSuccess,TNewSuccess_,System.Func_TFailure,TNewFailure_).TNewSuccess} The type to map the success value to\. ###### `TNewFailure` {#Abblix.Utils.Result_TSuccess,TFailure_.Map_TNewSuccess,TNewFailure_(System.Func_TSuccess,TNewSuccess_,System.Func_TFailure,TNewFailure_).TNewFailure} The type to map the failure value to\. #### Parameters ###### `onSuccess` [System\.Func<](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2')[TSuccess](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.TSuccess 'Abblix\.Utils\.Result\\.TSuccess')[,](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2')[TNewSuccess](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.Map_TNewSuccess,TNewFailure_(System.Func_TSuccess,TNewSuccess_,System.Func_TFailure,TNewFailure_).TNewSuccess 'Abblix\.Utils\.Result\\.Map\\(System\.Func\, System\.Func\\)\.TNewSuccess')[>](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2') {#Abblix.Utils.Result_TSuccess,TFailure_.Map_TNewSuccess,TNewFailure_(System.Func_TSuccess,TNewSuccess_,System.Func_TFailure,TNewFailure_).onSuccess} The function to apply if the result is successful\. ###### `onFailure` [System\.Func<](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2')[TFailure](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.TFailure 'Abblix\.Utils\.Result\\.TFailure')[,](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2')[TNewFailure](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.Map_TNewSuccess,TNewFailure_(System.Func_TSuccess,TNewSuccess_,System.Func_TFailure,TNewFailure_).TNewFailure 'Abblix\.Utils\.Result\\.Map\\(System\.Func\, System\.Func\\)\.TNewFailure')[>](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2') {#Abblix.Utils.Result_TSuccess,TFailure_.Map_TNewSuccess,TNewFailure_(System.Func_TSuccess,TNewSuccess_,System.Func_TFailure,TNewFailure_).onFailure} The function to apply if the result is a failure\. #### Returns [Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[TNewSuccess](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.Map_TNewSuccess,TNewFailure_(System.Func_TSuccess,TNewSuccess_,System.Func_TFailure,TNewFailure_).TNewSuccess 'Abblix\.Utils\.Result\\.Map\\(System\.Func\, System\.Func\\)\.TNewSuccess')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[TNewFailure](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.Map_TNewSuccess,TNewFailure_(System.Func_TSuccess,TNewSuccess_,System.Func_TFailure,TNewFailure_).TNewFailure 'Abblix\.Utils\.Result\\.Map\\(System\.Func\, System\.Func\\)\.TNewFailure')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\') A new result with both success and failure values mapped to new types\. ## Result\\.MapFailure\\(Func\\) Method {#Abblix.Utils.Result_TSuccess,TFailure_.MapFailure_T_(System.Func_TFailure,T_)} Synchronously maps a failed result to another type\. ```csharp public abstract Abblix.Utils.Result MapFailure(System.Func onFailure); ``` #### Type parameters ###### `T` {#Abblix.Utils.Result_TSuccess,TFailure_.MapFailure_T_(System.Func_TFailure,T_).T} The type to map the failure value to\. #### Parameters ###### `onFailure` [System\.Func<](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2')[TFailure](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.TFailure 'Abblix\.Utils\.Result\\.TFailure')[,](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2')[T](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.MapFailure_T_(System.Func_TFailure,T_).T 'Abblix\.Utils\.Result\\.MapFailure\\(System\.Func\\)\.T')[>](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2') {#Abblix.Utils.Result_TSuccess,TFailure_.MapFailure_T_(System.Func_TFailure,T_).onFailure} The mapping function\. #### Returns [Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[TSuccess](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.TSuccess 'Abblix\.Utils\.Result\\.TSuccess')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[T](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.MapFailure_T_(System.Func_TFailure,T_).T 'Abblix\.Utils\.Result\\.MapFailure\\(System\.Func\\)\.T')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\') A new result with the mapped failure value or the original success\. ## Result\\.MapFailureAsync\\(Func\\>\) Method {#Abblix.Utils.Result_TSuccess,TFailure_.MapFailureAsync_T_(System.Func_TFailure,System.Threading.Tasks.Task_T__)} Asynchronously maps a failure result to another type\. ```csharp public abstract System.Threading.Tasks.Task> MapFailureAsync(System.Func> onFailure); ``` #### Type parameters ###### `T` {#Abblix.Utils.Result_TSuccess,TFailure_.MapFailureAsync_T_(System.Func_TFailure,System.Threading.Tasks.Task_T__).T} The type to map the failure value to\. #### Parameters ###### `onFailure` [System\.Func<](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2')[TFailure](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.TFailure 'Abblix\.Utils\.Result\\.TFailure')[,](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2')[System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[T](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.MapFailureAsync_T_(System.Func_TFailure,System.Threading.Tasks.Task_T__).T 'Abblix\.Utils\.Result\\.MapFailureAsync\\(System\.Func\\>\)\.T')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[>](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2') {#Abblix.Utils.Result_TSuccess,TFailure_.MapFailureAsync_T_(System.Func_TFailure,System.Threading.Tasks.Task_T__).onFailure} The asynchronous mapping function\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[TSuccess](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.TSuccess 'Abblix\.Utils\.Result\\.TSuccess')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[T](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.MapFailureAsync_T_(System.Func_TFailure,System.Threading.Tasks.Task_T__).T 'Abblix\.Utils\.Result\\.MapFailureAsync\\(System\.Func\\>\)\.T')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A new result with the mapped failure value or the original success\. ## Result\\.MapSuccess\\(Func\\) Method {#Abblix.Utils.Result_TSuccess,TFailure_.MapSuccess_T_(System.Func_TSuccess,T_)} Synchronously maps a successful result to another type\. ```csharp public abstract Abblix.Utils.Result MapSuccess(System.Func onSuccess); ``` #### Type parameters ###### `T` {#Abblix.Utils.Result_TSuccess,TFailure_.MapSuccess_T_(System.Func_TSuccess,T_).T} The type to map the success value to\. #### Parameters ###### `onSuccess` [System\.Func<](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2')[TSuccess](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.TSuccess 'Abblix\.Utils\.Result\\.TSuccess')[,](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2')[T](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.MapSuccess_T_(System.Func_TSuccess,T_).T 'Abblix\.Utils\.Result\\.MapSuccess\\(System\.Func\\)\.T')[>](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2') {#Abblix.Utils.Result_TSuccess,TFailure_.MapSuccess_T_(System.Func_TSuccess,T_).onSuccess} The mapping function\. #### Returns [Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[T](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.MapSuccess_T_(System.Func_TSuccess,T_).T 'Abblix\.Utils\.Result\\.MapSuccess\\(System\.Func\\)\.T')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[TFailure](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.TFailure 'Abblix\.Utils\.Result\\.TFailure')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\') A new result with the mapped success value or the original failure\. ## Result\\.MapSuccessAsync\\(Func\\>\) Method {#Abblix.Utils.Result_TSuccess,TFailure_.MapSuccessAsync_T_(System.Func_TSuccess,System.Threading.Tasks.Task_T__)} Asynchronously maps a successful result to another type\. ```csharp public abstract System.Threading.Tasks.Task> MapSuccessAsync(System.Func> onSuccess); ``` #### Type parameters ###### `T` {#Abblix.Utils.Result_TSuccess,TFailure_.MapSuccessAsync_T_(System.Func_TSuccess,System.Threading.Tasks.Task_T__).T} The type to map the success value to\. #### Parameters ###### `onSuccess` [System\.Func<](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2')[TSuccess](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.TSuccess 'Abblix\.Utils\.Result\\.TSuccess')[,](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2')[System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[T](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.MapSuccessAsync_T_(System.Func_TSuccess,System.Threading.Tasks.Task_T__).T 'Abblix\.Utils\.Result\\.MapSuccessAsync\\(System\.Func\\>\)\.T')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[>](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2') {#Abblix.Utils.Result_TSuccess,TFailure_.MapSuccessAsync_T_(System.Func_TSuccess,System.Threading.Tasks.Task_T__).onSuccess} The asynchronous mapping function\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[T](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.MapSuccessAsync_T_(System.Func_TSuccess,System.Threading.Tasks.Task_T__).T 'Abblix\.Utils\.Result\\.MapSuccessAsync\\(System\.Func\\>\)\.T')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[TFailure](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.TFailure 'Abblix\.Utils\.Result\\.TFailure')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A new result with the mapped success value or the original failure\. ## Result\\.Match\\(Func\, Func\\) Method {#Abblix.Utils.Result_TSuccess,TFailure_.Match_T_(System.Func_TSuccess,T_,System.Func_TFailure,T_)} Matches the result and invokes the appropriate function depending on whether the result is a success or failure\. ```csharp public abstract T Match(System.Func onSuccess, System.Func onFailure); ``` #### Type parameters ###### `T` {#Abblix.Utils.Result_TSuccess,TFailure_.Match_T_(System.Func_TSuccess,T_,System.Func_TFailure,T_).T} The return type of the matching functions\. #### Parameters ###### `onSuccess` [System\.Func<](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2')[TSuccess](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.TSuccess 'Abblix\.Utils\.Result\\.TSuccess')[,](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2')[T](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.Match_T_(System.Func_TSuccess,T_,System.Func_TFailure,T_).T 'Abblix\.Utils\.Result\\.Match\\(System\.Func\, System\.Func\\)\.T')[>](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2') {#Abblix.Utils.Result_TSuccess,TFailure_.Match_T_(System.Func_TSuccess,T_,System.Func_TFailure,T_).onSuccess} The function to invoke if the result is a success\. ###### `onFailure` [System\.Func<](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2')[TFailure](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.TFailure 'Abblix\.Utils\.Result\\.TFailure')[,](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2')[T](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.Match_T_(System.Func_TSuccess,T_,System.Func_TFailure,T_).T 'Abblix\.Utils\.Result\\.Match\\(System\.Func\, System\.Func\\)\.T')[>](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2') {#Abblix.Utils.Result_TSuccess,TFailure_.Match_T_(System.Func_TSuccess,T_,System.Func_TFailure,T_).onFailure} The function to invoke if the result is a failure\. #### Returns [T](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.Match_T_(System.Func_TSuccess,T_,System.Func_TFailure,T_).T 'Abblix\.Utils\.Result\\.Match\\(System\.Func\, System\.Func\\)\.T') The result of the matching function\. ## Result\\.MatchAsync\\(Func\\>, Func\\>\) Method {#Abblix.Utils.Result_TSuccess,TFailure_.MatchAsync_T_(System.Func_TSuccess,System.Threading.Tasks.Task_T__,System.Func_TFailure,System.Threading.Tasks.Task_T__)} Asynchronously matches the result and invokes the appropriate asynchronous function\. ```csharp public abstract System.Threading.Tasks.Task MatchAsync(System.Func> onSuccess, System.Func> onFailure); ``` #### Type parameters ###### `T` {#Abblix.Utils.Result_TSuccess,TFailure_.MatchAsync_T_(System.Func_TSuccess,System.Threading.Tasks.Task_T__,System.Func_TFailure,System.Threading.Tasks.Task_T__).T} The return type of the matching functions\. #### Parameters ###### `onSuccess` [System\.Func<](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2')[TSuccess](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.TSuccess 'Abblix\.Utils\.Result\\.TSuccess')[,](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2')[System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[T](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.MatchAsync_T_(System.Func_TSuccess,System.Threading.Tasks.Task_T__,System.Func_TFailure,System.Threading.Tasks.Task_T__).T 'Abblix\.Utils\.Result\\.MatchAsync\\(System\.Func\\>, System\.Func\\>\)\.T')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[>](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2') {#Abblix.Utils.Result_TSuccess,TFailure_.MatchAsync_T_(System.Func_TSuccess,System.Threading.Tasks.Task_T__,System.Func_TFailure,System.Threading.Tasks.Task_T__).onSuccess} The asynchronous function to invoke if the result is a success\. ###### `onFailure` [System\.Func<](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2')[TFailure](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.TFailure 'Abblix\.Utils\.Result\\.TFailure')[,](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2')[System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[T](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.MatchAsync_T_(System.Func_TSuccess,System.Threading.Tasks.Task_T__,System.Func_TFailure,System.Threading.Tasks.Task_T__).T 'Abblix\.Utils\.Result\\.MatchAsync\\(System\.Func\\>, System\.Func\\>\)\.T')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[>](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2') {#Abblix.Utils.Result_TSuccess,TFailure_.MatchAsync_T_(System.Func_TSuccess,System.Threading.Tasks.Task_T__,System.Func_TFailure,System.Threading.Tasks.Task_T__).onFailure} The asynchronous function to invoke if the result is a failure\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[T](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.MatchAsync_T_(System.Func_TSuccess,System.Threading.Tasks.Task_T__,System.Func_TFailure,System.Threading.Tasks.Task_T__).T 'Abblix\.Utils\.Result\\.MatchAsync\\(System\.Func\\>, System\.Func\\>\)\.T')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task representing the result of the matching function\. ## Result\\.MatchAsync\\(Func\\>, Func\\) Method {#Abblix.Utils.Result_TSuccess,TFailure_.MatchAsync_T_(System.Func_TSuccess,System.Threading.Tasks.Task_T__,System.Func_TFailure,T_)} Asynchronously matches the result and invokes the appropriate function\. ```csharp public abstract System.Threading.Tasks.Task MatchAsync(System.Func> onSuccess, System.Func onFailure); ``` #### Type parameters ###### `T` {#Abblix.Utils.Result_TSuccess,TFailure_.MatchAsync_T_(System.Func_TSuccess,System.Threading.Tasks.Task_T__,System.Func_TFailure,T_).T} The return type of the matching functions\. #### Parameters ###### `onSuccess` [System\.Func<](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2')[TSuccess](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.TSuccess 'Abblix\.Utils\.Result\\.TSuccess')[,](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2')[System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[T](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.MatchAsync_T_(System.Func_TSuccess,System.Threading.Tasks.Task_T__,System.Func_TFailure,T_).T 'Abblix\.Utils\.Result\\.MatchAsync\\(System\.Func\\>, System\.Func\\)\.T')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[>](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2') {#Abblix.Utils.Result_TSuccess,TFailure_.MatchAsync_T_(System.Func_TSuccess,System.Threading.Tasks.Task_T__,System.Func_TFailure,T_).onSuccess} The asynchronous function to invoke if the result is a success\. ###### `onFailure` [System\.Func<](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2')[TFailure](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.TFailure 'Abblix\.Utils\.Result\\.TFailure')[,](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2')[T](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.MatchAsync_T_(System.Func_TSuccess,System.Threading.Tasks.Task_T__,System.Func_TFailure,T_).T 'Abblix\.Utils\.Result\\.MatchAsync\\(System\.Func\\>, System\.Func\\)\.T')[>](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2') {#Abblix.Utils.Result_TSuccess,TFailure_.MatchAsync_T_(System.Func_TSuccess,System.Threading.Tasks.Task_T__,System.Func_TFailure,T_).onFailure} The function to invoke if the result is a failure\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[T](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.MatchAsync_T_(System.Func_TSuccess,System.Threading.Tasks.Task_T__,System.Func_TFailure,T_).T 'Abblix\.Utils\.Result\\.MatchAsync\\(System\.Func\\>, System\.Func\\)\.T')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task representing the result of the matching function\. ## Result\\.Success\(TSuccess\) Method {#Abblix.Utils.Result_TSuccess,TFailure_.Success(TSuccess)} Creates a successful result with the specified value\. ```csharp public static Abblix.Utils.Result Success(TSuccess value); ``` #### Parameters ###### `value` [TSuccess](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.TSuccess 'Abblix\.Utils\.Result\\.TSuccess') {#Abblix.Utils.Result_TSuccess,TFailure_.Success(TSuccess).value} The success value\. #### Returns [Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[TSuccess](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.TSuccess 'Abblix\.Utils\.Result\\.TSuccess')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[TFailure](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.TFailure 'Abblix\.Utils\.Result\\.TFailure')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\') A [Result<TSuccess,TFailure>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\') representing a successful result\. ## Result\\.TryGetFailure\(TFailure\) Method {#Abblix.Utils.Result_TSuccess,TFailure_.TryGetFailure(TFailure)} Determines whether the result is a failure\. ```csharp public abstract bool TryGetFailure(out TFailure value); ``` #### Parameters ###### `value` [TFailure](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.TFailure 'Abblix\.Utils\.Result\\.TFailure') {#Abblix.Utils.Result_TSuccess,TFailure_.TryGetFailure(TFailure).value} When this method returns, contains the failure value if the result is a failure; otherwise, the default value\. #### Returns [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') `true` if the result is a failure; otherwise, `false`\. ## Result\\.TryGetSuccess\(TSuccess\) Method {#Abblix.Utils.Result_TSuccess,TFailure_.TryGetSuccess(TSuccess)} Determines whether the result is a success\. ```csharp public abstract bool TryGetSuccess(out TSuccess value); ``` #### Parameters ###### `value` [TSuccess](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.TSuccess 'Abblix\.Utils\.Result\\.TSuccess') {#Abblix.Utils.Result_TSuccess,TFailure_.TryGetSuccess(TSuccess).value} When this method returns, contains the success value if the result is successful; otherwise, the default value\. #### Returns [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') `true` if the result is a success; otherwise, `false`\. ### Operators ## Result\\.explicit operator TSuccess\(Result\\) Operator {#Abblix.Utils.Result_TSuccess,TFailure_.op_ExplicitTSuccess(Abblix.Utils.Result_TSuccess,TFailure_)} Converts the result explicitly to the success value\. ```csharp public static TSuccess explicit operator TSuccess(Abblix.Utils.Result result); ``` #### Parameters ###### `result` [Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[TSuccess](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.TSuccess 'Abblix\.Utils\.Result\\.TSuccess')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[TFailure](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.TFailure 'Abblix\.Utils\.Result\\.TFailure')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\') {#Abblix.Utils.Result_TSuccess,TFailure_.op_ExplicitTSuccess(Abblix.Utils.Result_TSuccess,TFailure_).result} The result instance\. #### Returns [TSuccess](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.TSuccess 'Abblix\.Utils\.Result\\.TSuccess') The success value\. #### Exceptions [System\.InvalidOperationException](https://learn.microsoft.com/en-us/dotnet/api/system.invalidoperationexception 'System\.InvalidOperationException') Thrown if the result is a failure\. ## Result\\.implicit operator Result\\(TFailure\) Operator {#Abblix.Utils.Result_TSuccess,TFailure_.op_ImplicitAbblix.Utils.Result_TSuccess,TFailure_(TFailure)} Implicitly converts a value of type [TFailure](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.TFailure 'Abblix\.Utils\.Result\\.TFailure') to a failed result\. ```csharp public static Abblix.Utils.Result implicit operator Abblix.Utils.Result(TFailure error); ``` #### Parameters ###### `error` [TFailure](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.TFailure 'Abblix\.Utils\.Result\\.TFailure') {#Abblix.Utils.Result_TSuccess,TFailure_.op_ImplicitAbblix.Utils.Result_TSuccess,TFailure_(TFailure).error} The failure value\. #### Returns [Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[TSuccess](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.TSuccess 'Abblix\.Utils\.Result\\.TSuccess')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[TFailure](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.TFailure 'Abblix\.Utils\.Result\\.TFailure')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\') ## Result\\.implicit operator Result\\(TSuccess\) Operator {#Abblix.Utils.Result_TSuccess,TFailure_.op_ImplicitAbblix.Utils.Result_TSuccess,TFailure_(TSuccess)} Implicitly converts a value of type [TSuccess](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.TSuccess 'Abblix\.Utils\.Result\\.TSuccess') to a successful result\. ```csharp public static Abblix.Utils.Result implicit operator Abblix.Utils.Result(TSuccess value); ``` #### Parameters ###### `value` [TSuccess](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.TSuccess 'Abblix\.Utils\.Result\\.TSuccess') {#Abblix.Utils.Result_TSuccess,TFailure_.op_ImplicitAbblix.Utils.Result_TSuccess,TFailure_(TSuccess).value} The success value\. #### Returns [Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[TSuccess](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.TSuccess 'Abblix\.Utils\.Result\\.TSuccess')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[TFailure](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_#Abblix.Utils.Result_TSuccess,TFailure_.TFailure 'Abblix\.Utils\.Result\\.TFailure')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\') --- Source: https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.ResultExtensions.md #### [Abblix\.Utils](https://www.abblix.com/en/docs/api/abblix-utils 'index') ### [Abblix\.Utils](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils 'Abblix\.Utils') ## ResultExtensions Class Provides extension methods for working with [Result<TSuccess,TFailure>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\') types\. ```csharp public static class ResultExtensions ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ResultExtensions ### Methods ## ResultExtensions\.Bind\\(this Task\\>, Func\\>\) Method {#Abblix.Utils.ResultExtensions.Bind_TSuccess,TFailure,TNext_(thisSystem.Threading.Tasks.Task_Abblix.Utils.Result_TSuccess,TFailure__,System.Func_TSuccess,Abblix.Utils.Result_TNext,TFailure__)} Binds a synchronous result\-producing function to the result of a task, if the result is successful\. ```csharp public static System.Threading.Tasks.Task> Bind(this System.Threading.Tasks.Task> resultTask, System.Func> func); ``` #### Type parameters ###### `TSuccess` {#Abblix.Utils.ResultExtensions.Bind_TSuccess,TFailure,TNext_(thisSystem.Threading.Tasks.Task_Abblix.Utils.Result_TSuccess,TFailure__,System.Func_TSuccess,Abblix.Utils.Result_TNext,TFailure__).TSuccess} The type of the original success value\. ###### `TFailure` {#Abblix.Utils.ResultExtensions.Bind_TSuccess,TFailure,TNext_(thisSystem.Threading.Tasks.Task_Abblix.Utils.Result_TSuccess,TFailure__,System.Func_TSuccess,Abblix.Utils.Result_TNext,TFailure__).TFailure} The type of the failure\. ###### `TNext` {#Abblix.Utils.ResultExtensions.Bind_TSuccess,TFailure,TNext_(thisSystem.Threading.Tasks.Task_Abblix.Utils.Result_TSuccess,TFailure__,System.Func_TSuccess,Abblix.Utils.Result_TNext,TFailure__).TNext} The type of the next success value\. #### Parameters ###### `resultTask` [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[TSuccess](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.ResultExtensions#Abblix.Utils.ResultExtensions.Bind_TSuccess,TFailure,TNext_(thisSystem.Threading.Tasks.Task_Abblix.Utils.Result_TSuccess,TFailure__,System.Func_TSuccess,Abblix.Utils.Result_TNext,TFailure__).TSuccess 'Abblix\.Utils\.ResultExtensions\.Bind\\(this System\.Threading\.Tasks\.Task\\>, System\.Func\\>\)\.TSuccess')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[TFailure](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.ResultExtensions#Abblix.Utils.ResultExtensions.Bind_TSuccess,TFailure,TNext_(thisSystem.Threading.Tasks.Task_Abblix.Utils.Result_TSuccess,TFailure__,System.Func_TSuccess,Abblix.Utils.Result_TNext,TFailure__).TFailure 'Abblix\.Utils\.ResultExtensions\.Bind\\(this System\.Threading\.Tasks\.Task\\>, System\.Func\\>\)\.TFailure')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') {#Abblix.Utils.ResultExtensions.Bind_TSuccess,TFailure,TNext_(thisSystem.Threading.Tasks.Task_Abblix.Utils.Result_TSuccess,TFailure__,System.Func_TSuccess,Abblix.Utils.Result_TNext,TFailure__).resultTask} The asynchronous task producing a result\. ###### `func` [System\.Func<](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2')[TSuccess](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.ResultExtensions#Abblix.Utils.ResultExtensions.Bind_TSuccess,TFailure,TNext_(thisSystem.Threading.Tasks.Task_Abblix.Utils.Result_TSuccess,TFailure__,System.Func_TSuccess,Abblix.Utils.Result_TNext,TFailure__).TSuccess 'Abblix\.Utils\.ResultExtensions\.Bind\\(this System\.Threading\.Tasks\.Task\\>, System\.Func\\>\)\.TSuccess')[,](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[TNext](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.ResultExtensions#Abblix.Utils.ResultExtensions.Bind_TSuccess,TFailure,TNext_(thisSystem.Threading.Tasks.Task_Abblix.Utils.Result_TSuccess,TFailure__,System.Func_TSuccess,Abblix.Utils.Result_TNext,TFailure__).TNext 'Abblix\.Utils\.ResultExtensions\.Bind\\(this System\.Threading\.Tasks\.Task\\>, System\.Func\\>\)\.TNext')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[TFailure](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.ResultExtensions#Abblix.Utils.ResultExtensions.Bind_TSuccess,TFailure,TNext_(thisSystem.Threading.Tasks.Task_Abblix.Utils.Result_TSuccess,TFailure__,System.Func_TSuccess,Abblix.Utils.Result_TNext,TFailure__).TFailure 'Abblix\.Utils\.ResultExtensions\.Bind\\(this System\.Threading\.Tasks\.Task\\>, System\.Func\\>\)\.TFailure')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[>](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2') {#Abblix.Utils.ResultExtensions.Bind_TSuccess,TFailure,TNext_(thisSystem.Threading.Tasks.Task_Abblix.Utils.Result_TSuccess,TFailure__,System.Func_TSuccess,Abblix.Utils.Result_TNext,TFailure__).func} The synchronous function to bind if the result is successful\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[TNext](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.ResultExtensions#Abblix.Utils.ResultExtensions.Bind_TSuccess,TFailure,TNext_(thisSystem.Threading.Tasks.Task_Abblix.Utils.Result_TSuccess,TFailure__,System.Func_TSuccess,Abblix.Utils.Result_TNext,TFailure__).TNext 'Abblix\.Utils\.ResultExtensions\.Bind\\(this System\.Threading\.Tasks\.Task\\>, System\.Func\\>\)\.TNext')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[TFailure](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.ResultExtensions#Abblix.Utils.ResultExtensions.Bind_TSuccess,TFailure,TNext_(thisSystem.Threading.Tasks.Task_Abblix.Utils.Result_TSuccess,TFailure__,System.Func_TSuccess,Abblix.Utils.Result_TNext,TFailure__).TFailure 'Abblix\.Utils\.ResultExtensions\.Bind\\(this System\.Threading\.Tasks\.Task\\>, System\.Func\\>\)\.TFailure')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task representing the new result after binding\. ## ResultExtensions\.BindAsync\\(this Task\\>, Func\\>\>\) Method {#Abblix.Utils.ResultExtensions.BindAsync_TSuccess,TFailure,TNext_(thisSystem.Threading.Tasks.Task_Abblix.Utils.Result_TSuccess,TFailure__,System.Func_TSuccess,System.Threading.Tasks.Task_Abblix.Utils.Result_TNext,TFailure___)} Asynchronously binds a result\-producing function to the result of a task, if the result is successful\. ```csharp public static System.Threading.Tasks.Task> BindAsync(this System.Threading.Tasks.Task> resultTask, System.Func>> func); ``` #### Type parameters ###### `TSuccess` {#Abblix.Utils.ResultExtensions.BindAsync_TSuccess,TFailure,TNext_(thisSystem.Threading.Tasks.Task_Abblix.Utils.Result_TSuccess,TFailure__,System.Func_TSuccess,System.Threading.Tasks.Task_Abblix.Utils.Result_TNext,TFailure___).TSuccess} The type of the original success value\. ###### `TFailure` {#Abblix.Utils.ResultExtensions.BindAsync_TSuccess,TFailure,TNext_(thisSystem.Threading.Tasks.Task_Abblix.Utils.Result_TSuccess,TFailure__,System.Func_TSuccess,System.Threading.Tasks.Task_Abblix.Utils.Result_TNext,TFailure___).TFailure} The type of the failure\. ###### `TNext` {#Abblix.Utils.ResultExtensions.BindAsync_TSuccess,TFailure,TNext_(thisSystem.Threading.Tasks.Task_Abblix.Utils.Result_TSuccess,TFailure__,System.Func_TSuccess,System.Threading.Tasks.Task_Abblix.Utils.Result_TNext,TFailure___).TNext} The type of the next success value\. #### Parameters ###### `resultTask` [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[TSuccess](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.ResultExtensions#Abblix.Utils.ResultExtensions.BindAsync_TSuccess,TFailure,TNext_(thisSystem.Threading.Tasks.Task_Abblix.Utils.Result_TSuccess,TFailure__,System.Func_TSuccess,System.Threading.Tasks.Task_Abblix.Utils.Result_TNext,TFailure___).TSuccess 'Abblix\.Utils\.ResultExtensions\.BindAsync\\(this System\.Threading\.Tasks\.Task\\>, System\.Func\\>\>\)\.TSuccess')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[TFailure](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.ResultExtensions#Abblix.Utils.ResultExtensions.BindAsync_TSuccess,TFailure,TNext_(thisSystem.Threading.Tasks.Task_Abblix.Utils.Result_TSuccess,TFailure__,System.Func_TSuccess,System.Threading.Tasks.Task_Abblix.Utils.Result_TNext,TFailure___).TFailure 'Abblix\.Utils\.ResultExtensions\.BindAsync\\(this System\.Threading\.Tasks\.Task\\>, System\.Func\\>\>\)\.TFailure')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') {#Abblix.Utils.ResultExtensions.BindAsync_TSuccess,TFailure,TNext_(thisSystem.Threading.Tasks.Task_Abblix.Utils.Result_TSuccess,TFailure__,System.Func_TSuccess,System.Threading.Tasks.Task_Abblix.Utils.Result_TNext,TFailure___).resultTask} The asynchronous task producing a result\. ###### `func` [System\.Func<](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2')[TSuccess](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.ResultExtensions#Abblix.Utils.ResultExtensions.BindAsync_TSuccess,TFailure,TNext_(thisSystem.Threading.Tasks.Task_Abblix.Utils.Result_TSuccess,TFailure__,System.Func_TSuccess,System.Threading.Tasks.Task_Abblix.Utils.Result_TNext,TFailure___).TSuccess 'Abblix\.Utils\.ResultExtensions\.BindAsync\\(this System\.Threading\.Tasks\.Task\\>, System\.Func\\>\>\)\.TSuccess')[,](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2')[System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[TNext](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.ResultExtensions#Abblix.Utils.ResultExtensions.BindAsync_TSuccess,TFailure,TNext_(thisSystem.Threading.Tasks.Task_Abblix.Utils.Result_TSuccess,TFailure__,System.Func_TSuccess,System.Threading.Tasks.Task_Abblix.Utils.Result_TNext,TFailure___).TNext 'Abblix\.Utils\.ResultExtensions\.BindAsync\\(this System\.Threading\.Tasks\.Task\\>, System\.Func\\>\>\)\.TNext')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[TFailure](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.ResultExtensions#Abblix.Utils.ResultExtensions.BindAsync_TSuccess,TFailure,TNext_(thisSystem.Threading.Tasks.Task_Abblix.Utils.Result_TSuccess,TFailure__,System.Func_TSuccess,System.Threading.Tasks.Task_Abblix.Utils.Result_TNext,TFailure___).TFailure 'Abblix\.Utils\.ResultExtensions\.BindAsync\\(this System\.Threading\.Tasks\.Task\\>, System\.Func\\>\>\)\.TFailure')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[>](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2') {#Abblix.Utils.ResultExtensions.BindAsync_TSuccess,TFailure,TNext_(thisSystem.Threading.Tasks.Task_Abblix.Utils.Result_TSuccess,TFailure__,System.Func_TSuccess,System.Threading.Tasks.Task_Abblix.Utils.Result_TNext,TFailure___).func} The function to bind if the result is successful\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[TNext](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.ResultExtensions#Abblix.Utils.ResultExtensions.BindAsync_TSuccess,TFailure,TNext_(thisSystem.Threading.Tasks.Task_Abblix.Utils.Result_TSuccess,TFailure__,System.Func_TSuccess,System.Threading.Tasks.Task_Abblix.Utils.Result_TNext,TFailure___).TNext 'Abblix\.Utils\.ResultExtensions\.BindAsync\\(this System\.Threading\.Tasks\.Task\\>, System\.Func\\>\>\)\.TNext')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[TFailure](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.ResultExtensions#Abblix.Utils.ResultExtensions.BindAsync_TSuccess,TFailure,TNext_(thisSystem.Threading.Tasks.Task_Abblix.Utils.Result_TSuccess,TFailure__,System.Func_TSuccess,System.Threading.Tasks.Task_Abblix.Utils.Result_TNext,TFailure___).TFailure 'Abblix\.Utils\.ResultExtensions\.BindAsync\\(this System\.Threading\.Tasks\.Task\\>, System\.Func\\>\>\)\.TFailure')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task representing the new result after binding\. ## ResultExtensions\.Ensure\\(this TSuccess, Func\, TFailure\) Method {#Abblix.Utils.ResultExtensions.Ensure_TSuccess,TFailure_(thisTSuccess,System.Func_TSuccess,bool_,TFailure)} Ensures that a value satisfies a specified predicate; otherwise, returns a failure\. ```csharp public static Abblix.Utils.Result Ensure(this TSuccess value, System.Func predicate, TFailure failure); ``` #### Type parameters ###### `TSuccess` {#Abblix.Utils.ResultExtensions.Ensure_TSuccess,TFailure_(thisTSuccess,System.Func_TSuccess,bool_,TFailure).TSuccess} The type of the value\. ###### `TFailure` {#Abblix.Utils.ResultExtensions.Ensure_TSuccess,TFailure_(thisTSuccess,System.Func_TSuccess,bool_,TFailure).TFailure} The type of the failure\. #### Parameters ###### `value` [TSuccess](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.ResultExtensions#Abblix.Utils.ResultExtensions.Ensure_TSuccess,TFailure_(thisTSuccess,System.Func_TSuccess,bool_,TFailure).TSuccess 'Abblix\.Utils\.ResultExtensions\.Ensure\\(this TSuccess, System\.Func\, TFailure\)\.TSuccess') {#Abblix.Utils.ResultExtensions.Ensure_TSuccess,TFailure_(thisTSuccess,System.Func_TSuccess,bool_,TFailure).value} The value to validate\. ###### `predicate` [System\.Func<](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2')[TSuccess](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.ResultExtensions#Abblix.Utils.ResultExtensions.Ensure_TSuccess,TFailure_(thisTSuccess,System.Func_TSuccess,bool_,TFailure).TSuccess 'Abblix\.Utils\.ResultExtensions\.Ensure\\(this TSuccess, System\.Func\, TFailure\)\.TSuccess')[,](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2')[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')[>](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2') {#Abblix.Utils.ResultExtensions.Ensure_TSuccess,TFailure_(thisTSuccess,System.Func_TSuccess,bool_,TFailure).predicate} The predicate to evaluate\. ###### `failure` [TFailure](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.ResultExtensions#Abblix.Utils.ResultExtensions.Ensure_TSuccess,TFailure_(thisTSuccess,System.Func_TSuccess,bool_,TFailure).TFailure 'Abblix\.Utils\.ResultExtensions\.Ensure\\(this TSuccess, System\.Func\, TFailure\)\.TFailure') {#Abblix.Utils.ResultExtensions.Ensure_TSuccess,TFailure_(thisTSuccess,System.Func_TSuccess,bool_,TFailure).failure} The failure to return if the predicate is not satisfied\. #### Returns [Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[TSuccess](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.ResultExtensions#Abblix.Utils.ResultExtensions.Ensure_TSuccess,TFailure_(thisTSuccess,System.Func_TSuccess,bool_,TFailure).TSuccess 'Abblix\.Utils\.ResultExtensions\.Ensure\\(this TSuccess, System\.Func\, TFailure\)\.TSuccess')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[TFailure](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.ResultExtensions#Abblix.Utils.ResultExtensions.Ensure_TSuccess,TFailure_(thisTSuccess,System.Func_TSuccess,bool_,TFailure).TFailure 'Abblix\.Utils\.ResultExtensions\.Ensure\\(this TSuccess, System\.Func\, TFailure\)\.TFailure')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\') A successful result if the predicate is satisfied; otherwise, a failed result\. ## ResultExtensions\.EnsureAsync\\(this Task\, Func\, TFailure\) Method {#Abblix.Utils.ResultExtensions.EnsureAsync_TSuccess,TFailure_(thisSystem.Threading.Tasks.Task_TSuccess_,System.Func_TSuccess,bool_,TFailure)} Asynchronously ensures that a value satisfies a specified predicate; otherwise, returns a failure\. ```csharp public static System.Threading.Tasks.Task> EnsureAsync(this System.Threading.Tasks.Task valueTask, System.Func predicate, TFailure failure); ``` #### Type parameters ###### `TSuccess` {#Abblix.Utils.ResultExtensions.EnsureAsync_TSuccess,TFailure_(thisSystem.Threading.Tasks.Task_TSuccess_,System.Func_TSuccess,bool_,TFailure).TSuccess} The type of the value\. ###### `TFailure` {#Abblix.Utils.ResultExtensions.EnsureAsync_TSuccess,TFailure_(thisSystem.Threading.Tasks.Task_TSuccess_,System.Func_TSuccess,bool_,TFailure).TFailure} The type of the failure\. #### Parameters ###### `valueTask` [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[TSuccess](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.ResultExtensions#Abblix.Utils.ResultExtensions.EnsureAsync_TSuccess,TFailure_(thisSystem.Threading.Tasks.Task_TSuccess_,System.Func_TSuccess,bool_,TFailure).TSuccess 'Abblix\.Utils\.ResultExtensions\.EnsureAsync\\(this System\.Threading\.Tasks\.Task\, System\.Func\, TFailure\)\.TSuccess')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') {#Abblix.Utils.ResultExtensions.EnsureAsync_TSuccess,TFailure_(thisSystem.Threading.Tasks.Task_TSuccess_,System.Func_TSuccess,bool_,TFailure).valueTask} The asynchronous task producing the value\. ###### `predicate` [System\.Func<](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2')[TSuccess](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.ResultExtensions#Abblix.Utils.ResultExtensions.EnsureAsync_TSuccess,TFailure_(thisSystem.Threading.Tasks.Task_TSuccess_,System.Func_TSuccess,bool_,TFailure).TSuccess 'Abblix\.Utils\.ResultExtensions\.EnsureAsync\\(this System\.Threading\.Tasks\.Task\, System\.Func\, TFailure\)\.TSuccess')[,](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2')[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')[>](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2') {#Abblix.Utils.ResultExtensions.EnsureAsync_TSuccess,TFailure_(thisSystem.Threading.Tasks.Task_TSuccess_,System.Func_TSuccess,bool_,TFailure).predicate} The predicate to evaluate\. ###### `failure` [TFailure](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.ResultExtensions#Abblix.Utils.ResultExtensions.EnsureAsync_TSuccess,TFailure_(thisSystem.Threading.Tasks.Task_TSuccess_,System.Func_TSuccess,bool_,TFailure).TFailure 'Abblix\.Utils\.ResultExtensions\.EnsureAsync\\(this System\.Threading\.Tasks\.Task\, System\.Func\, TFailure\)\.TFailure') {#Abblix.Utils.ResultExtensions.EnsureAsync_TSuccess,TFailure_(thisSystem.Threading.Tasks.Task_TSuccess_,System.Func_TSuccess,bool_,TFailure).failure} The failure to return if the predicate is not satisfied\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[TSuccess](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.ResultExtensions#Abblix.Utils.ResultExtensions.EnsureAsync_TSuccess,TFailure_(thisSystem.Threading.Tasks.Task_TSuccess_,System.Func_TSuccess,bool_,TFailure).TSuccess 'Abblix\.Utils\.ResultExtensions\.EnsureAsync\\(this System\.Threading\.Tasks\.Task\, System\.Func\, TFailure\)\.TSuccess')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[TFailure](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.ResultExtensions#Abblix.Utils.ResultExtensions.EnsureAsync_TSuccess,TFailure_(thisSystem.Threading.Tasks.Task_TSuccess_,System.Func_TSuccess,bool_,TFailure).TFailure 'Abblix\.Utils\.ResultExtensions\.EnsureAsync\\(this System\.Threading\.Tasks\.Task\, System\.Func\, TFailure\)\.TFailure')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task representing the successful or failed result\. ## ResultExtensions\.FailIfNull\\(this TSuccess, Func\\) Method {#Abblix.Utils.ResultExtensions.FailIfNull_TSuccess,TFailure_(thisTSuccess,System.Func_TFailure_)} Converts a nullable value into a successful result if not null; otherwise, returns a failure\. ```csharp public static Abblix.Utils.Result FailIfNull(this TSuccess? value, System.Func failure); ``` #### Type parameters ###### `TSuccess` {#Abblix.Utils.ResultExtensions.FailIfNull_TSuccess,TFailure_(thisTSuccess,System.Func_TFailure_).TSuccess} The type of the value\. ###### `TFailure` {#Abblix.Utils.ResultExtensions.FailIfNull_TSuccess,TFailure_(thisTSuccess,System.Func_TFailure_).TFailure} The type of the failure\. #### Parameters ###### `value` [TSuccess](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.ResultExtensions#Abblix.Utils.ResultExtensions.FailIfNull_TSuccess,TFailure_(thisTSuccess,System.Func_TFailure_).TSuccess 'Abblix\.Utils\.ResultExtensions\.FailIfNull\\(this TSuccess, System\.Func\\)\.TSuccess') {#Abblix.Utils.ResultExtensions.FailIfNull_TSuccess,TFailure_(thisTSuccess,System.Func_TFailure_).value} The nullable value to check\. ###### `failure` [System\.Func<](https://learn.microsoft.com/en-us/dotnet/api/system.func-1 'System\.Func\`1')[TFailure](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.ResultExtensions#Abblix.Utils.ResultExtensions.FailIfNull_TSuccess,TFailure_(thisTSuccess,System.Func_TFailure_).TFailure 'Abblix\.Utils\.ResultExtensions\.FailIfNull\\(this TSuccess, System\.Func\\)\.TFailure')[>](https://learn.microsoft.com/en-us/dotnet/api/system.func-1 'System\.Func\`1') {#Abblix.Utils.ResultExtensions.FailIfNull_TSuccess,TFailure_(thisTSuccess,System.Func_TFailure_).failure} The failure to return if the value is null\. #### Returns [Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[TSuccess](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.ResultExtensions#Abblix.Utils.ResultExtensions.FailIfNull_TSuccess,TFailure_(thisTSuccess,System.Func_TFailure_).TSuccess 'Abblix\.Utils\.ResultExtensions\.FailIfNull\\(this TSuccess, System\.Func\\)\.TSuccess')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[TFailure](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.ResultExtensions#Abblix.Utils.ResultExtensions.FailIfNull_TSuccess,TFailure_(thisTSuccess,System.Func_TFailure_).TFailure 'Abblix\.Utils\.ResultExtensions\.FailIfNull\\(this TSuccess, System\.Func\\)\.TFailure')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\') A successful result if the value is not null; otherwise, a failed result\. ## ResultExtensions\.FailIfNull\\(this TSuccess, TFailure\) Method {#Abblix.Utils.ResultExtensions.FailIfNull_TSuccess,TFailure_(thisTSuccess,TFailure)} Converts a nullable value into a successful result if not null; otherwise, returns a failure\. ```csharp public static Abblix.Utils.Result FailIfNull(this TSuccess? value, TFailure failure); ``` #### Type parameters ###### `TSuccess` {#Abblix.Utils.ResultExtensions.FailIfNull_TSuccess,TFailure_(thisTSuccess,TFailure).TSuccess} The type of the value\. ###### `TFailure` {#Abblix.Utils.ResultExtensions.FailIfNull_TSuccess,TFailure_(thisTSuccess,TFailure).TFailure} The type of the failure\. #### Parameters ###### `value` [TSuccess](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.ResultExtensions#Abblix.Utils.ResultExtensions.FailIfNull_TSuccess,TFailure_(thisTSuccess,TFailure).TSuccess 'Abblix\.Utils\.ResultExtensions\.FailIfNull\\(this TSuccess, TFailure\)\.TSuccess') {#Abblix.Utils.ResultExtensions.FailIfNull_TSuccess,TFailure_(thisTSuccess,TFailure).value} The nullable value to check\. ###### `failure` [TFailure](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.ResultExtensions#Abblix.Utils.ResultExtensions.FailIfNull_TSuccess,TFailure_(thisTSuccess,TFailure).TFailure 'Abblix\.Utils\.ResultExtensions\.FailIfNull\\(this TSuccess, TFailure\)\.TFailure') {#Abblix.Utils.ResultExtensions.FailIfNull_TSuccess,TFailure_(thisTSuccess,TFailure).failure} The failure to return if the value is null\. #### Returns [Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[TSuccess](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.ResultExtensions#Abblix.Utils.ResultExtensions.FailIfNull_TSuccess,TFailure_(thisTSuccess,TFailure).TSuccess 'Abblix\.Utils\.ResultExtensions\.FailIfNull\\(this TSuccess, TFailure\)\.TSuccess')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[TFailure](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.ResultExtensions#Abblix.Utils.ResultExtensions.FailIfNull_TSuccess,TFailure_(thisTSuccess,TFailure).TFailure 'Abblix\.Utils\.ResultExtensions\.FailIfNull\\(this TSuccess, TFailure\)\.TFailure')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\') A successful result if the value is not null; otherwise, a failed result\. ## ResultExtensions\.FailIfNullAsync\\(this Task\, Func\\) Method {#Abblix.Utils.ResultExtensions.FailIfNullAsync_TSuccess,TFailure_(thisSystem.Threading.Tasks.Task_TSuccess_,System.Func_TFailure_)} Asynchronously converts a nullable value into a successful result if not null; otherwise, returns a failure\. ```csharp public static System.Threading.Tasks.Task> FailIfNullAsync(this System.Threading.Tasks.Task valueTask, System.Func failure); ``` #### Type parameters ###### `TSuccess` {#Abblix.Utils.ResultExtensions.FailIfNullAsync_TSuccess,TFailure_(thisSystem.Threading.Tasks.Task_TSuccess_,System.Func_TFailure_).TSuccess} The type of the value\. ###### `TFailure` {#Abblix.Utils.ResultExtensions.FailIfNullAsync_TSuccess,TFailure_(thisSystem.Threading.Tasks.Task_TSuccess_,System.Func_TFailure_).TFailure} The type of the failure\. #### Parameters ###### `valueTask` [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[TSuccess](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.ResultExtensions#Abblix.Utils.ResultExtensions.FailIfNullAsync_TSuccess,TFailure_(thisSystem.Threading.Tasks.Task_TSuccess_,System.Func_TFailure_).TSuccess 'Abblix\.Utils\.ResultExtensions\.FailIfNullAsync\\(this System\.Threading\.Tasks\.Task\, System\.Func\\)\.TSuccess')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') {#Abblix.Utils.ResultExtensions.FailIfNullAsync_TSuccess,TFailure_(thisSystem.Threading.Tasks.Task_TSuccess_,System.Func_TFailure_).valueTask} The asynchronous task producing the nullable value\. ###### `failure` [System\.Func<](https://learn.microsoft.com/en-us/dotnet/api/system.func-1 'System\.Func\`1')[TFailure](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.ResultExtensions#Abblix.Utils.ResultExtensions.FailIfNullAsync_TSuccess,TFailure_(thisSystem.Threading.Tasks.Task_TSuccess_,System.Func_TFailure_).TFailure 'Abblix\.Utils\.ResultExtensions\.FailIfNullAsync\\(this System\.Threading\.Tasks\.Task\, System\.Func\\)\.TFailure')[>](https://learn.microsoft.com/en-us/dotnet/api/system.func-1 'System\.Func\`1') {#Abblix.Utils.ResultExtensions.FailIfNullAsync_TSuccess,TFailure_(thisSystem.Threading.Tasks.Task_TSuccess_,System.Func_TFailure_).failure} The failure to return if the value is null\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[TSuccess](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.ResultExtensions#Abblix.Utils.ResultExtensions.FailIfNullAsync_TSuccess,TFailure_(thisSystem.Threading.Tasks.Task_TSuccess_,System.Func_TFailure_).TSuccess 'Abblix\.Utils\.ResultExtensions\.FailIfNullAsync\\(this System\.Threading\.Tasks\.Task\, System\.Func\\)\.TSuccess')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[TFailure](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.ResultExtensions#Abblix.Utils.ResultExtensions.FailIfNullAsync_TSuccess,TFailure_(thisSystem.Threading.Tasks.Task_TSuccess_,System.Func_TFailure_).TFailure 'Abblix\.Utils\.ResultExtensions\.FailIfNullAsync\\(this System\.Threading\.Tasks\.Task\, System\.Func\\)\.TFailure')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task representing the successful or failed result\. ## ResultExtensions\.FailIfNullAsync\\(this Task\, TFailure\) Method {#Abblix.Utils.ResultExtensions.FailIfNullAsync_TSuccess,TFailure_(thisSystem.Threading.Tasks.Task_TSuccess_,TFailure)} Asynchronously converts a nullable value into a successful result if not null; otherwise, returns a failure\. ```csharp public static System.Threading.Tasks.Task> FailIfNullAsync(this System.Threading.Tasks.Task valueTask, TFailure failure); ``` #### Type parameters ###### `TSuccess` {#Abblix.Utils.ResultExtensions.FailIfNullAsync_TSuccess,TFailure_(thisSystem.Threading.Tasks.Task_TSuccess_,TFailure).TSuccess} The type of the value\. ###### `TFailure` {#Abblix.Utils.ResultExtensions.FailIfNullAsync_TSuccess,TFailure_(thisSystem.Threading.Tasks.Task_TSuccess_,TFailure).TFailure} The type of the failure\. #### Parameters ###### `valueTask` [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[TSuccess](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.ResultExtensions#Abblix.Utils.ResultExtensions.FailIfNullAsync_TSuccess,TFailure_(thisSystem.Threading.Tasks.Task_TSuccess_,TFailure).TSuccess 'Abblix\.Utils\.ResultExtensions\.FailIfNullAsync\\(this System\.Threading\.Tasks\.Task\, TFailure\)\.TSuccess')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') {#Abblix.Utils.ResultExtensions.FailIfNullAsync_TSuccess,TFailure_(thisSystem.Threading.Tasks.Task_TSuccess_,TFailure).valueTask} The asynchronous task producing the nullable value\. ###### `failure` [TFailure](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.ResultExtensions#Abblix.Utils.ResultExtensions.FailIfNullAsync_TSuccess,TFailure_(thisSystem.Threading.Tasks.Task_TSuccess_,TFailure).TFailure 'Abblix\.Utils\.ResultExtensions\.FailIfNullAsync\\(this System\.Threading\.Tasks\.Task\, TFailure\)\.TFailure') {#Abblix.Utils.ResultExtensions.FailIfNullAsync_TSuccess,TFailure_(thisSystem.Threading.Tasks.Task_TSuccess_,TFailure).failure} The failure to return if the value is null\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[TSuccess](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.ResultExtensions#Abblix.Utils.ResultExtensions.FailIfNullAsync_TSuccess,TFailure_(thisSystem.Threading.Tasks.Task_TSuccess_,TFailure).TSuccess 'Abblix\.Utils\.ResultExtensions\.FailIfNullAsync\\(this System\.Threading\.Tasks\.Task\, TFailure\)\.TSuccess')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[TFailure](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.ResultExtensions#Abblix.Utils.ResultExtensions.FailIfNullAsync_TSuccess,TFailure_(thisSystem.Threading.Tasks.Task_TSuccess_,TFailure).TFailure 'Abblix\.Utils\.ResultExtensions\.FailIfNullAsync\\(this System\.Threading\.Tasks\.Task\, TFailure\)\.TFailure')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task representing the successful or failed result\. ## ResultExtensions\.MapSuccessAsync\\(this Task\\>, Func\\>\) Method {#Abblix.Utils.ResultExtensions.MapSuccessAsync_TSuccess,TFailure,TNext_(thisSystem.Threading.Tasks.Task_Abblix.Utils.Result_TSuccess,TFailure__,System.Func_TSuccess,System.Threading.Tasks.Task_TNext__)} Asynchronously maps a successful result to another type\. ```csharp public static System.Threading.Tasks.Task> MapSuccessAsync(this System.Threading.Tasks.Task> resultTask, System.Func> onSuccess); ``` #### Type parameters ###### `TSuccess` {#Abblix.Utils.ResultExtensions.MapSuccessAsync_TSuccess,TFailure,TNext_(thisSystem.Threading.Tasks.Task_Abblix.Utils.Result_TSuccess,TFailure__,System.Func_TSuccess,System.Threading.Tasks.Task_TNext__).TSuccess} The type of the original success value\. ###### `TFailure` {#Abblix.Utils.ResultExtensions.MapSuccessAsync_TSuccess,TFailure,TNext_(thisSystem.Threading.Tasks.Task_Abblix.Utils.Result_TSuccess,TFailure__,System.Func_TSuccess,System.Threading.Tasks.Task_TNext__).TFailure} The type of the failure\. ###### `TNext` {#Abblix.Utils.ResultExtensions.MapSuccessAsync_TSuccess,TFailure,TNext_(thisSystem.Threading.Tasks.Task_Abblix.Utils.Result_TSuccess,TFailure__,System.Func_TSuccess,System.Threading.Tasks.Task_TNext__).TNext} The type to map the success value to\. #### Parameters ###### `resultTask` [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[TSuccess](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.ResultExtensions#Abblix.Utils.ResultExtensions.MapSuccessAsync_TSuccess,TFailure,TNext_(thisSystem.Threading.Tasks.Task_Abblix.Utils.Result_TSuccess,TFailure__,System.Func_TSuccess,System.Threading.Tasks.Task_TNext__).TSuccess 'Abblix\.Utils\.ResultExtensions\.MapSuccessAsync\\(this System\.Threading\.Tasks\.Task\\>, System\.Func\\>\)\.TSuccess')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[TFailure](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.ResultExtensions#Abblix.Utils.ResultExtensions.MapSuccessAsync_TSuccess,TFailure,TNext_(thisSystem.Threading.Tasks.Task_Abblix.Utils.Result_TSuccess,TFailure__,System.Func_TSuccess,System.Threading.Tasks.Task_TNext__).TFailure 'Abblix\.Utils\.ResultExtensions\.MapSuccessAsync\\(this System\.Threading\.Tasks\.Task\\>, System\.Func\\>\)\.TFailure')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') {#Abblix.Utils.ResultExtensions.MapSuccessAsync_TSuccess,TFailure,TNext_(thisSystem.Threading.Tasks.Task_Abblix.Utils.Result_TSuccess,TFailure__,System.Func_TSuccess,System.Threading.Tasks.Task_TNext__).resultTask} The asynchronous task producing a result\. ###### `onSuccess` [System\.Func<](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2')[TSuccess](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.ResultExtensions#Abblix.Utils.ResultExtensions.MapSuccessAsync_TSuccess,TFailure,TNext_(thisSystem.Threading.Tasks.Task_Abblix.Utils.Result_TSuccess,TFailure__,System.Func_TSuccess,System.Threading.Tasks.Task_TNext__).TSuccess 'Abblix\.Utils\.ResultExtensions\.MapSuccessAsync\\(this System\.Threading\.Tasks\.Task\\>, System\.Func\\>\)\.TSuccess')[,](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2')[System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[TNext](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.ResultExtensions#Abblix.Utils.ResultExtensions.MapSuccessAsync_TSuccess,TFailure,TNext_(thisSystem.Threading.Tasks.Task_Abblix.Utils.Result_TSuccess,TFailure__,System.Func_TSuccess,System.Threading.Tasks.Task_TNext__).TNext 'Abblix\.Utils\.ResultExtensions\.MapSuccessAsync\\(this System\.Threading\.Tasks\.Task\\>, System\.Func\\>\)\.TNext')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[>](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2') {#Abblix.Utils.ResultExtensions.MapSuccessAsync_TSuccess,TFailure,TNext_(thisSystem.Threading.Tasks.Task_Abblix.Utils.Result_TSuccess,TFailure__,System.Func_TSuccess,System.Threading.Tasks.Task_TNext__).onSuccess} The asynchronous mapping function\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[TNext](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.ResultExtensions#Abblix.Utils.ResultExtensions.MapSuccessAsync_TSuccess,TFailure,TNext_(thisSystem.Threading.Tasks.Task_Abblix.Utils.Result_TSuccess,TFailure__,System.Func_TSuccess,System.Threading.Tasks.Task_TNext__).TNext 'Abblix\.Utils\.ResultExtensions\.MapSuccessAsync\\(this System\.Threading\.Tasks\.Task\\>, System\.Func\\>\)\.TNext')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[TFailure](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.ResultExtensions#Abblix.Utils.ResultExtensions.MapSuccessAsync_TSuccess,TFailure,TNext_(thisSystem.Threading.Tasks.Task_Abblix.Utils.Result_TSuccess,TFailure__,System.Func_TSuccess,System.Threading.Tasks.Task_TNext__).TFailure 'Abblix\.Utils\.ResultExtensions\.MapSuccessAsync\\(this System\.Threading\.Tasks\.Task\\>, System\.Func\\>\)\.TFailure')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task representing the new result with the mapped success value\. --- Source: https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Sanitized.md #### [Abblix\.Utils](https://www.abblix.com/en/docs/api/abblix-utils 'index') ### [Abblix\.Utils](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils 'Abblix\.Utils') ## Sanitized Struct A type that sanitizes a given string by removing control characters and escaping special characters to prevent log injection attacks\. ```csharp public readonly record struct Sanitized : System.IEquatable ``` Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[Sanitized](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Sanitized 'Abblix\.Utils\.Sanitized')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Properties ## Sanitized\.Source Property {#Abblix.Utils.Sanitized.Source} The original, untrusted value\. Sanitization is applied lazily inside [ToString\(\)](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Sanitized#Abblix.Utils.Sanitized.ToString() 'Abblix\.Utils\.Sanitized\.ToString\(\)'); reading this property directly bypasses sanitization and exposes raw input\. ```csharp public object? Source { get; init; } ``` #### Property Value [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') ### Methods ## Sanitized\.ToString\(\) Method {#Abblix.Utils.Sanitized.ToString()} Returns the sanitized string representation of the source string\. ```csharp public override string ToString(); ``` #### Returns [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') A sanitized string with control characters removed and special characters escaped\. ## Sanitized\.Value\(object\) Method {#Abblix.Utils.Sanitized.Value(object)} Creates a new [Sanitized](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Sanitized 'Abblix\.Utils\.Sanitized') instance with the specified source object\. ```csharp public static Abblix.Utils.Sanitized Value(object? source); ``` #### Parameters ###### `source` [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') {#Abblix.Utils.Sanitized.Value(object).source} The source object to be sanitized when converted to string\. #### Returns [Sanitized](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Sanitized 'Abblix\.Utils\.Sanitized') A new [Sanitized](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Sanitized 'Abblix\.Utils\.Sanitized') instance\. ### Operators ## Sanitized\.implicit operator Sanitized\(string\) Operator {#Abblix.Utils.Sanitized.op_ImplicitAbblix.Utils.Sanitized(string)} Wraps a raw string in a [Sanitized](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Sanitized 'Abblix\.Utils\.Sanitized') value so the stripping pass runs once at formatting time\. ```csharp public static Abblix.Utils.Sanitized implicit operator Abblix.Utils.Sanitized(string? source); ``` #### Parameters ###### `source` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Utils.Sanitized.op_ImplicitAbblix.Utils.Sanitized(string).source} The raw string to sanitize; may be `null`\. #### Returns [Sanitized](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Sanitized 'Abblix\.Utils\.Sanitized') ## Sanitized\.implicit operator Sanitized\(Uri\) Operator {#Abblix.Utils.Sanitized.op_ImplicitAbblix.Utils.Sanitized(System.Uri)} Wraps a [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri') in a [Sanitized](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Sanitized 'Abblix\.Utils\.Sanitized') value so the stripping pass runs once at formatting time\. The URI is converted to its string form before sanitization\. ```csharp public static Abblix.Utils.Sanitized implicit operator Abblix.Utils.Sanitized(System.Uri? source); ``` #### Parameters ###### `source` [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri') {#Abblix.Utils.Sanitized.op_ImplicitAbblix.Utils.Sanitized(System.Uri).source} The URI to sanitize; may be `null`\. #### Returns [Sanitized](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Sanitized 'Abblix\.Utils\.Sanitized') --- Source: https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.StringExtensions.md #### [Abblix\.Utils](https://www.abblix.com/en/docs/api/abblix-utils 'index') ### [Abblix\.Utils](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils 'Abblix\.Utils') ## StringExtensions Class The class provides extension methods for enhancing the functionality and ease of use of strings\. ```csharp public static class StringExtensions ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → StringExtensions ### Methods ## StringExtensions\.HasValue\(this string\) Method {#Abblix.Utils.StringExtensions.HasValue(thisstring)} Determines whether the specified string is neither null nor empty\. ```csharp public static bool HasValue(this string? value); ``` #### Parameters ###### `value` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Utils.StringExtensions.HasValue(thisstring).value} The string to test\. #### Returns [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') true if the value parameter is not null or an empty string \(""\); otherwise, false\. ## StringExtensions\.InsertAfter\(this string, string, string\) Method {#Abblix.Utils.StringExtensions.InsertAfter(thisstring,string,string)} Inserts a specified value into the source string after a specified fragment\. ```csharp public static string InsertAfter(this string source, string fragment, string value); ``` #### Parameters ###### `source` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Utils.StringExtensions.InsertAfter(thisstring,string,string).source} The source string where the value will be inserted\. ###### `fragment` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Utils.StringExtensions.InsertAfter(thisstring,string,string).fragment} The fragment after which the value will be inserted\. ###### `value` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Utils.StringExtensions.InsertAfter(thisstring,string,string).value} The value to insert into the source string\. #### Returns [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') A new string with the value inserted\. #### Exceptions [System\.InvalidOperationException](https://learn.microsoft.com/en-us/dotnet/api/system.invalidoperationexception 'System\.InvalidOperationException') Thrown when the fragment is not found in the source string\. ## StringExtensions\.NotNullOrEmpty\(this string, string\) Method {#Abblix.Utils.StringExtensions.NotNullOrEmpty(thisstring,string)} Ensures that a string is neither null nor empty, throwing an exception if it is\. ```csharp public static string NotNullOrEmpty(this string? value, string valueName); ``` #### Parameters ###### `value` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Utils.StringExtensions.NotNullOrEmpty(thisstring,string).value} The string to validate\. ###### `valueName` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Utils.StringExtensions.NotNullOrEmpty(thisstring,string).valueName} The name of the string variable, used in the exception message\. #### Returns [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') The original string if it is neither null nor empty\. #### Exceptions [System\.InvalidOperationException](https://learn.microsoft.com/en-us/dotnet/api/system.invalidoperationexception 'System\.InvalidOperationException') Thrown if the string is null or empty\. ## StringExtensions\.NotNullOrWhiteSpace\(this string\) Method {#Abblix.Utils.StringExtensions.NotNullOrWhiteSpace(thisstring)} Determines whether the specified string is not null, empty, or consists only of white\-space characters\. ```csharp public static bool NotNullOrWhiteSpace(this string? value); ``` #### Parameters ###### `value` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Utils.StringExtensions.NotNullOrWhiteSpace(thisstring).value} The string to test\. #### Returns [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') true if the value parameter is not null, empty, or whitespace\-only; otherwise, false\. ## StringExtensions\.TrimSuffixIfExists\(this string, string\) Method {#Abblix.Utils.StringExtensions.TrimSuffixIfExists(thisstring,string)} Trims the specified suffix from the end of the string, if it exists\. ```csharp public static string TrimSuffixIfExists(this string source, string suffix); ``` #### Parameters ###### `source` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Utils.StringExtensions.TrimSuffixIfExists(thisstring,string).source} The source string to trim\. ###### `suffix` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Utils.StringExtensions.TrimSuffixIfExists(thisstring,string).suffix} The suffix to remove if it exists at the end of the source string\. #### Returns [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') The string without the specified suffix\. --- Source: https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.UriBuilder.md #### [Abblix\.Utils](https://www.abblix.com/en/docs/api/abblix-utils 'index') ### [Abblix\.Utils](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils 'Abblix\.Utils') ## UriBuilder Class A wrapper around System\.UriBuilder, providing enhanced functionality for URI manipulation, specifically for handling query strings and fragments\. ```csharp public class UriBuilder ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → UriBuilder ### Constructors ## UriBuilder\(string\) Constructor {#Abblix.Utils.UriBuilder.UriBuilder(string)} Initializes a new instance of the UriBuilder class with the specified URI string\. Automatically detects and handles both absolute URIs and relative paths\. ```csharp public UriBuilder(string uri); ``` #### Parameters ###### `uri` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Utils.UriBuilder.UriBuilder(string).uri} A URI string to use as the base of the UriBuilder\. Can be an absolute URI \(e\.g\., "https://example.com/path"\) or a relative path \(e\.g\., "/path"\)\. ## UriBuilder\(Uri\) Constructor {#Abblix.Utils.UriBuilder.UriBuilder(System.Uri)} Initializes a new instance of the UriBuilder class with the specified Uri instance\. Supports both absolute and relative URIs\. ```csharp public UriBuilder(System.Uri uri); ``` #### Parameters ###### `uri` [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri') {#Abblix.Utils.UriBuilder.UriBuilder(System.Uri).uri} The Uri instance to use as the base of the UriBuilder\. ### Properties ## UriBuilder\.Fragment Property {#Abblix.Utils.UriBuilder.Fragment} ParametersBuilder for the fragment part of the URI\. Used for OAuth/OIDC implicit flow where parameters are passed in fragments\. ```csharp public Abblix.Utils.ParametersBuilder Fragment { get; } ``` #### Property Value [ParametersBuilder](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.ParametersBuilder 'Abblix\.Utils\.ParametersBuilder') ## UriBuilder\.Path Property {#Abblix.Utils.UriBuilder.Path} The path part of the URI\. ```csharp public string Path { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks Typed as a plain string rather than the framework's PathString: this is a foundation library, and that type would put an ASP\.NET Core dependency on every package beneath the server, including hosts that never serve HTTP\. A caller holding a PathString still assigns and reads it, since that type converts to and from string implicitly\. ## UriBuilder\.Query Property {#Abblix.Utils.UriBuilder.Query} ParametersBuilder for the query string\. ```csharp public Abblix.Utils.ParametersBuilder Query { get; } ``` #### Property Value [ParametersBuilder](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.ParametersBuilder 'Abblix\.Utils\.ParametersBuilder') ## UriBuilder\.Uri Property {#Abblix.Utils.UriBuilder.Uri} The URI constructed by the UriBuilder\. For relative URIs, returns the path, query, and fragment without scheme and host\. ```csharp public System.Uri Uri { get; } ``` #### Property Value [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri') ### Remarks Note: This property has side effects \(updates internal builder state\) and is not thread\-safe\. If thread safety is required, synchronize access to this instance externally\. ### Operators ## UriBuilder\.implicit operator string\(UriBuilder\) Operator {#Abblix.Utils.UriBuilder.op_Implicitstring(Abblix.Utils.UriBuilder)} Converts a UriBuilder instance to a string\. ```csharp public static string implicit operator string(Abblix.Utils.UriBuilder builder); ``` #### Parameters ###### `builder` [UriBuilder](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.UriBuilder 'Abblix\.Utils\.UriBuilder') {#Abblix.Utils.UriBuilder.op_Implicitstring(Abblix.Utils.UriBuilder).builder} The UriBuilder instance to convert\. #### Returns [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## UriBuilder\.implicit operator Uri\(UriBuilder\) Operator {#Abblix.Utils.UriBuilder.op_ImplicitSystem.Uri(Abblix.Utils.UriBuilder)} Converts a UriBuilder instance to a Uri\. ```csharp public static System.Uri implicit operator System.Uri(Abblix.Utils.UriBuilder builder); ``` #### Parameters ###### `builder` [UriBuilder](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.UriBuilder 'Abblix\.Utils\.UriBuilder') {#Abblix.Utils.UriBuilder.op_ImplicitSystem.Uri(Abblix.Utils.UriBuilder).builder} The UriBuilder instance to convert\. #### Returns [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri') --- Source: https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.UriExtensions.md #### [Abblix\.Utils](https://www.abblix.com/en/docs/api/abblix-utils 'index') ### [Abblix\.Utils](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils 'Abblix\.Utils') ## UriExtensions Class Helpers for adding parameters to a URI's query or fragment and for extracting standard parts \(origin, trailing slash\)\. Empty or null parameter values are dropped rather than serialized as bare keys, matching the OAuth 2\.0 / OpenID Connect convention for absent parameters\. ```csharp public static class UriExtensions ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → UriExtensions ### Methods ## UriExtensions\.AppendTrailingSlash\(this string\) Method {#Abblix.Utils.UriExtensions.AppendTrailingSlash(thisstring)} Appends a trailing slash to a URI string if it does not already end with one\. ```csharp public static string AppendTrailingSlash(this string uri); ``` #### Parameters ###### `uri` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Utils.UriExtensions.AppendTrailingSlash(thisstring).uri} The URI string to which a trailing slash will be appended\. #### Returns [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') A string representing the URI with a trailing slash\. ## UriExtensions\.GetOrigin\(this Uri\) Method {#Abblix.Utils.UriExtensions.GetOrigin(thisSystem.Uri)} Retrieves the origin \(scheme, host, and optionally port\) of the given URI\. ```csharp public static string GetOrigin(this System.Uri uri); ``` #### Parameters ###### `uri` [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri') {#Abblix.Utils.UriExtensions.GetOrigin(thisSystem.Uri).uri} The URI from which the origin will be extracted\. #### Returns [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') A string representing the origin of the URI\. --- Source: https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.WwwAuthenticate.md #### [Abblix\.Utils](https://www.abblix.com/en/docs/api/abblix-utils 'index') ### [Abblix\.Utils](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils 'Abblix\.Utils') ## WwwAuthenticate Class Builds `WWW-Authenticate` challenge values: the HTTP grammar, not any one protocol's vocabulary of errors\. ```csharp public static class WwwAuthenticate ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → WwwAuthenticate ### Remarks Two packages emit these headers for two different error vocabularies \- an authorization server answering with OpenID Connect errors, and a Shared Signals transmitter answering with the three RFC 6750 codes \- and they cannot share a type that names either\. What they do share is the quoted\-string grammar and the rule about when a challenge stays bare, which is what lives here\. ### Methods ## WwwAuthenticate\.Challenge\(string, string\) Method {#Abblix.Utils.WwwAuthenticate.Challenge(string,string)} A challenge advertising [scheme](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.WwwAuthenticate#Abblix.Utils.WwwAuthenticate.Challenge(string,string).scheme 'Abblix\.Utils\.WwwAuthenticate\.Challenge\(string, string\)\.scheme') and nothing else beyond the realm\. ```csharp public static string Challenge(string scheme, string? realm=null); ``` #### Parameters ###### `scheme` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Utils.WwwAuthenticate.Challenge(string,string).scheme} ###### `realm` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Utils.WwwAuthenticate.Challenge(string,string).realm} #### Returns [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks This is the form RFC 6750 Section 3\.1 requires when the request carried no credentials at all: "If the request lacks any authentication information \(e\.g\., the client was unaware that authentication is necessary or attempted using an unsupported authentication method\), the resource server SHOULD NOT include an error code or other error information\." A caller that has not tried yet has nothing to correct, and naming an error would describe a failure that did not happen\. ## WwwAuthenticate\.Challenge\(string, string, string, string\) Method {#Abblix.Utils.WwwAuthenticate.Challenge(string,string,string,string)} A challenge naming why the credentials that WERE presented did not suffice\. ```csharp public static string Challenge(string scheme, string? realm, string error, string? errorDescription); ``` #### Parameters ###### `scheme` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Utils.WwwAuthenticate.Challenge(string,string,string,string).scheme} The authentication scheme, such as `Bearer`\. ###### `realm` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Utils.WwwAuthenticate.Challenge(string,string,string,string).realm} The protection space, omitted when null or empty\. ###### `error` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Utils.WwwAuthenticate.Challenge(string,string,string,string).error} The error code, from whatever vocabulary the scheme defines\. ###### `errorDescription` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Utils.WwwAuthenticate.Challenge(string,string,string,string).errorDescription} Human\-readable detail, omitted when null or empty\. #### Returns [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') --- Source: https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Collections.md #### [Abblix\.Utils](https://www.abblix.com/en/docs/api/abblix-utils 'index') ## Abblix\.Utils\.Collections Namespace | Classes | | | :--- | :--- | | [ConcurrentSet<T>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Collections.ConcurrentSet_T_ 'Abblix\.Utils\.Collections\.ConcurrentSet\') | A set that several threads may add to and enumerate at the same time, losing neither what is already stored nor what is being added\. | --- Source: https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Collections.ConcurrentSet_T_.md #### [Abblix\.Utils](https://www.abblix.com/en/docs/api/abblix-utils 'index') ### [Abblix\.Utils\.Collections](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Collections 'Abblix\.Utils\.Collections') ## ConcurrentSet\ Class A set that several threads may add to and enumerate at the same time, losing neither what is already stored nor what is being added\. ```csharp public sealed class ConcurrentSet : System.Collections.Generic.ICollection, System.Collections.Generic.IEnumerable, System.Collections.IEnumerable where T : notnull ``` #### Type parameters ###### `T` {#Abblix.Utils.Collections.ConcurrentSet_T_.T} The element type\. Uses the type's default equality comparer\. Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ConcurrentSet\ Implements [System\.Collections\.Generic\.ICollection<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.icollection-1 'System\.Collections\.Generic\.ICollection\`1')[T](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Collections.ConcurrentSet_T_#Abblix.Utils.Collections.ConcurrentSet_T_.T 'Abblix\.Utils\.Collections\.ConcurrentSet\\.T')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.icollection-1 'System\.Collections\.Generic\.ICollection\`1'), [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[T](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Collections.ConcurrentSet_T_#Abblix.Utils.Collections.ConcurrentSet_T_.T 'Abblix\.Utils\.Collections\.ConcurrentSet\\.T')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1'), [System\.Collections\.IEnumerable](https://learn.microsoft.com/en-us/dotnet/api/system.collections.ienumerable 'System\.Collections\.IEnumerable') ### Remarks The \.NET base class library ships no concurrent set, so the choice is between a [System\.Collections\.Generic\.HashSet<>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.hashset-1 'System\.Collections\.Generic\.HashSet\`1') under a lock and the keys of a [System\.Collections\.Concurrent\.ConcurrentDictionary<>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.concurrent.concurrentdictionary-2 'System\.Collections\.Concurrent\.ConcurrentDictionary\`2'), which are exactly a concurrent set with a value nobody reads\. The dictionary wins on two counts\. Its `TryAdd` is an atomic test\-and\-add that also reports which caller performed the addition\. That is the operation the defect needed: `if (!Contains) Add` is two operations with a window between them, and a lock closes the window only for as long as every caller remembers to take it, whereas here the guarantee belongs to the type\. And its `Keys` property is documented to return "a copy of all the keys", not "kept in sync" with the dictionary\. That promise is what makes this usable from an `async` loop: a reader holding a lock cannot `await` inside the loop, so any lock\-based set would force the caller to copy first \- and a copy is what this returns to begin with\. A reader iterating while a writer adds therefore neither throws [System\.InvalidOperationException](https://learn.microsoft.com/en-us/dotnet/api/system.invalidoperationexception 'System\.InvalidOperationException') nor loses an element that was already there\. The alternative considered was an `ImmutableHashSet` field updated by [System\.Threading\.Interlocked\.CompareExchange<>\(@@0@,@@0,@@0\)](https://learn.microsoft.com/en-us/dotnet/api/system.threading.interlocked.compareexchange--1#system-threading-interlocked-compareexchange--1(--0@---0---0) 'System\.Threading\.Interlocked\.CompareExchange\`\`1\(\`\`0@,\`\`0,\`\`0\)'): correct, and lock\-free, but it allocates a new version of the set per addition and spins a retry loop under contention, for no gain over this\. The cost of what is here instead is a placeholder byte per element and a [Count](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Collections.ConcurrentSet_T_#Abblix.Utils.Collections.ConcurrentSet_T_.Count 'Abblix\.Utils\.Collections\.ConcurrentSet\\.Count') that takes every segment lock \- both irrelevant at the sizes this holds\. ### Constructors ## ConcurrentSet\(\) Constructor {#Abblix.Utils.Collections.ConcurrentSet_T_.ConcurrentSet()} Creates an empty set\. ```csharp public ConcurrentSet(); ``` ## ConcurrentSet\(IEnumerable\\) Constructor {#Abblix.Utils.Collections.ConcurrentSet_T_.ConcurrentSet(System.Collections.Generic.IEnumerable_T_)} Creates a set containing the distinct elements of [items](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Collections.ConcurrentSet_T_#Abblix.Utils.Collections.ConcurrentSet_T_.ConcurrentSet(System.Collections.Generic.IEnumerable_T_).items 'Abblix\.Utils\.Collections\.ConcurrentSet\\.ConcurrentSet\(System\.Collections\.Generic\.IEnumerable\\)\.items')\. ```csharp public ConcurrentSet(System.Collections.Generic.IEnumerable items); ``` #### Parameters ###### `items` [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[T](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Collections.ConcurrentSet_T_#Abblix.Utils.Collections.ConcurrentSet_T_.T 'Abblix\.Utils\.Collections\.ConcurrentSet\\.T')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') {#Abblix.Utils.Collections.ConcurrentSet_T_.ConcurrentSet(System.Collections.Generic.IEnumerable_T_).items} ### Properties ## ConcurrentSet\\.Count Property {#Abblix.Utils.Collections.ConcurrentSet_T_.Count} Gets the number of elements contained in the [System\.Collections\.Generic\.ICollection<>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.icollection-1 'System\.Collections\.Generic\.ICollection\`1')\. ```csharp public int Count { get; } ``` Implements [Count](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.icollection-1.count 'System\.Collections\.Generic\.ICollection\`1\.Count') #### Property Value [System\.Int32](https://learn.microsoft.com/en-us/dotnet/api/system.int32 'System\.Int32') ## ConcurrentSet\\.IsReadOnly Property {#Abblix.Utils.Collections.ConcurrentSet_T_.IsReadOnly} Gets a value indicating whether the [System\.Collections\.Generic\.ICollection<>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.icollection-1 'System\.Collections\.Generic\.ICollection\`1') is read\-only\. ```csharp public bool IsReadOnly { get; } ``` Implements [IsReadOnly](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.icollection-1.isreadonly 'System\.Collections\.Generic\.ICollection\`1\.IsReadOnly') #### Property Value [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') ### Methods ## ConcurrentSet\\.Add\(T\) Method {#Abblix.Utils.Collections.ConcurrentSet_T_.Add(T)} Adds an item to the [System\.Collections\.Generic\.ICollection<>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.icollection-1 'System\.Collections\.Generic\.ICollection\`1')\. ```csharp public void Add(T item); ``` #### Parameters ###### `item` [T](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Collections.ConcurrentSet_T_#Abblix.Utils.Collections.ConcurrentSet_T_.T 'Abblix\.Utils\.Collections\.ConcurrentSet\\.T') {#Abblix.Utils.Collections.ConcurrentSet_T_.Add(T).item} The object to add to the [System\.Collections\.Generic\.ICollection<>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.icollection-1 'System\.Collections\.Generic\.ICollection\`1')\. Implements [Add\(T\)](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.icollection-1.add#system-collections-generic-icollection-1-add(-0) 'System\.Collections\.Generic\.ICollection\`1\.Add\(\`0\)') #### Exceptions [System\.NotSupportedException](https://learn.microsoft.com/en-us/dotnet/api/system.notsupportedexception 'System\.NotSupportedException') The [System\.Collections\.Generic\.ICollection<>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.icollection-1 'System\.Collections\.Generic\.ICollection\`1') is read\-only\. ## ConcurrentSet\\.Clear\(\) Method {#Abblix.Utils.Collections.ConcurrentSet_T_.Clear()} Removes all items from the [System\.Collections\.Generic\.ICollection<>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.icollection-1 'System\.Collections\.Generic\.ICollection\`1')\. ```csharp public void Clear(); ``` Implements [Clear\(\)](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.icollection-1.clear 'System\.Collections\.Generic\.ICollection\`1\.Clear') #### Exceptions [System\.NotSupportedException](https://learn.microsoft.com/en-us/dotnet/api/system.notsupportedexception 'System\.NotSupportedException') The [System\.Collections\.Generic\.ICollection<>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.icollection-1 'System\.Collections\.Generic\.ICollection\`1') is read\-only\. ## ConcurrentSet\\.Contains\(T\) Method {#Abblix.Utils.Collections.ConcurrentSet_T_.Contains(T)} Determines whether the [System\.Collections\.Generic\.ICollection<>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.icollection-1 'System\.Collections\.Generic\.ICollection\`1') contains a specific value\. ```csharp public bool Contains(T item); ``` #### Parameters ###### `item` [T](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Collections.ConcurrentSet_T_#Abblix.Utils.Collections.ConcurrentSet_T_.T 'Abblix\.Utils\.Collections\.ConcurrentSet\\.T') {#Abblix.Utils.Collections.ConcurrentSet_T_.Contains(T).item} The object to locate in the [System\.Collections\.Generic\.ICollection<>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.icollection-1 'System\.Collections\.Generic\.ICollection\`1')\. Implements [Contains\(T\)](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.icollection-1.contains#system-collections-generic-icollection-1-contains(-0) 'System\.Collections\.Generic\.ICollection\`1\.Contains\(\`0\)') #### Returns [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') [true](https://docs.microsoft.com/en-us/dotnet/csharp/language-reference/builtin-types/bool 'https://docs.microsoft.com/en-us/dotnet/csharp/language-reference/builtin-types/bool') if [item](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Collections.ConcurrentSet_T_#Abblix.Utils.Collections.ConcurrentSet_T_.Contains(T).item 'Abblix\.Utils\.Collections\.ConcurrentSet\\.Contains\(T\)\.item') is found in the [System\.Collections\.Generic\.ICollection<>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.icollection-1 'System\.Collections\.Generic\.ICollection\`1'); otherwise, [false](https://docs.microsoft.com/en-us/dotnet/csharp/language-reference/builtin-types/bool 'https://docs.microsoft.com/en-us/dotnet/csharp/language-reference/builtin-types/bool')\. ## ConcurrentSet\\.CopyTo\(T\[\], int\) Method {#Abblix.Utils.Collections.ConcurrentSet_T_.CopyTo(T[],int)} Copies the elements of the [System\.Collections\.Generic\.ICollection<>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.icollection-1 'System\.Collections\.Generic\.ICollection\`1') to an [System\.Array](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array'), starting at a particular [System\.Array](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') index\. ```csharp public void CopyTo(T[] array, int arrayIndex); ``` #### Parameters ###### `array` [T](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Collections.ConcurrentSet_T_#Abblix.Utils.Collections.ConcurrentSet_T_.T 'Abblix\.Utils\.Collections\.ConcurrentSet\\.T')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Utils.Collections.ConcurrentSet_T_.CopyTo(T[],int).array} The one\-dimensional [System\.Array](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') that is the destination of the elements copied from [System\.Collections\.Generic\.ICollection<>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.icollection-1 'System\.Collections\.Generic\.ICollection\`1')\. The [System\.Array](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') must have zero\-based indexing\. ###### `arrayIndex` [System\.Int32](https://learn.microsoft.com/en-us/dotnet/api/system.int32 'System\.Int32') {#Abblix.Utils.Collections.ConcurrentSet_T_.CopyTo(T[],int).arrayIndex} The zero\-based index in [array](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Collections.ConcurrentSet_T_#Abblix.Utils.Collections.ConcurrentSet_T_.CopyTo(T[],int).array 'Abblix\.Utils\.Collections\.ConcurrentSet\\.CopyTo\(T\[\], int\)\.array') at which copying begins\. Implements [CopyTo\(T\[\], int\)](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.icollection-1.copyto#system-collections-generic-icollection-1-copyto(-0[]-system-int32) 'System\.Collections\.Generic\.ICollection\`1\.CopyTo\(\`0\[\],System\.Int32\)') #### Exceptions [System\.ArgumentNullException](https://learn.microsoft.com/en-us/dotnet/api/system.argumentnullexception 'System\.ArgumentNullException') [array](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Collections.ConcurrentSet_T_#Abblix.Utils.Collections.ConcurrentSet_T_.CopyTo(T[],int).array 'Abblix\.Utils\.Collections\.ConcurrentSet\\.CopyTo\(T\[\], int\)\.array') is [null](https://docs.microsoft.com/en-us/dotnet/csharp/language-reference/keywords/null 'https://docs.microsoft.com/en-us/dotnet/csharp/language-reference/keywords/null')\. [System\.ArgumentOutOfRangeException](https://learn.microsoft.com/en-us/dotnet/api/system.argumentoutofrangeexception 'System\.ArgumentOutOfRangeException') [arrayIndex](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Collections.ConcurrentSet_T_#Abblix.Utils.Collections.ConcurrentSet_T_.CopyTo(T[],int).arrayIndex 'Abblix\.Utils\.Collections\.ConcurrentSet\\.CopyTo\(T\[\], int\)\.arrayIndex') is less than 0\. [System\.ArgumentException](https://learn.microsoft.com/en-us/dotnet/api/system.argumentexception 'System\.ArgumentException') The number of elements in the source [System\.Collections\.Generic\.ICollection<>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.icollection-1 'System\.Collections\.Generic\.ICollection\`1') is greater than the available space from [arrayIndex](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Collections.ConcurrentSet_T_#Abblix.Utils.Collections.ConcurrentSet_T_.CopyTo(T[],int).arrayIndex 'Abblix\.Utils\.Collections\.ConcurrentSet\\.CopyTo\(T\[\], int\)\.arrayIndex') to the end of the destination [array](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Collections.ConcurrentSet_T_#Abblix.Utils.Collections.ConcurrentSet_T_.CopyTo(T[],int).array 'Abblix\.Utils\.Collections\.ConcurrentSet\\.CopyTo\(T\[\], int\)\.array')\. ## ConcurrentSet\\.GetEnumerator\(\) Method {#Abblix.Utils.Collections.ConcurrentSet_T_.GetEnumerator()} Enumerates a snapshot taken when enumeration begins, so what a reader sees does not depend on what a writer does while it reads\. ```csharp public System.Collections.Generic.IEnumerator GetEnumerator(); ``` Implements [GetEnumerator\(\)](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1.getenumerator 'System\.Collections\.Generic\.IEnumerable\`1\.GetEnumerator'), [GetEnumerator\(\)](https://learn.microsoft.com/en-us/dotnet/api/system.collections.ienumerable.getenumerator 'System\.Collections\.IEnumerable\.GetEnumerator') #### Returns [System\.Collections\.Generic\.IEnumerator<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerator-1 'System\.Collections\.Generic\.IEnumerator\`1')[T](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Collections.ConcurrentSet_T_#Abblix.Utils.Collections.ConcurrentSet_T_.T 'Abblix\.Utils\.Collections\.ConcurrentSet\\.T')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerator-1 'System\.Collections\.Generic\.IEnumerator\`1') ### Remarks Goes through `Keys` deliberately, and not through the dictionary's own enumerator: the latter is documented as "safe to use concurrently with reads and writes \.\.\. however it does not represent a moment\-in\-time snapshot", so it would show some later additions and not others depending on timing\. Neither form can throw, so this is not about safety \- it is about a caller that enumerates across `await` points getting a defined answer rather than a race\-dependent one\. Do not "simplify" this to the dictionary's enumerator to save the copy\. ## ConcurrentSet\\.Remove\(T\) Method {#Abblix.Utils.Collections.ConcurrentSet_T_.Remove(T)} Removes the first occurrence of a specific object from the [System\.Collections\.Generic\.ICollection<>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.icollection-1 'System\.Collections\.Generic\.ICollection\`1')\. ```csharp public bool Remove(T item); ``` #### Parameters ###### `item` [T](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Collections.ConcurrentSet_T_#Abblix.Utils.Collections.ConcurrentSet_T_.T 'Abblix\.Utils\.Collections\.ConcurrentSet\\.T') {#Abblix.Utils.Collections.ConcurrentSet_T_.Remove(T).item} The object to remove from the [System\.Collections\.Generic\.ICollection<>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.icollection-1 'System\.Collections\.Generic\.ICollection\`1')\. Implements [Remove\(T\)](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.icollection-1.remove#system-collections-generic-icollection-1-remove(-0) 'System\.Collections\.Generic\.ICollection\`1\.Remove\(\`0\)') #### Returns [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') [true](https://docs.microsoft.com/en-us/dotnet/csharp/language-reference/builtin-types/bool 'https://docs.microsoft.com/en-us/dotnet/csharp/language-reference/builtin-types/bool') if [item](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Collections.ConcurrentSet_T_#Abblix.Utils.Collections.ConcurrentSet_T_.Remove(T).item 'Abblix\.Utils\.Collections\.ConcurrentSet\\.Remove\(T\)\.item') was successfully removed from the [System\.Collections\.Generic\.ICollection<>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.icollection-1 'System\.Collections\.Generic\.ICollection\`1'); otherwise, [false](https://docs.microsoft.com/en-us/dotnet/csharp/language-reference/builtin-types/bool 'https://docs.microsoft.com/en-us/dotnet/csharp/language-reference/builtin-types/bool')\. This method also returns [false](https://docs.microsoft.com/en-us/dotnet/csharp/language-reference/builtin-types/bool 'https://docs.microsoft.com/en-us/dotnet/csharp/language-reference/builtin-types/bool') if [item](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Collections.ConcurrentSet_T_#Abblix.Utils.Collections.ConcurrentSet_T_.Remove(T).item 'Abblix\.Utils\.Collections\.ConcurrentSet\\.Remove\(T\)\.item') is not found in the original [System\.Collections\.Generic\.ICollection<>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.icollection-1 'System\.Collections\.Generic\.ICollection\`1')\. #### Exceptions [System\.NotSupportedException](https://learn.microsoft.com/en-us/dotnet/api/system.notsupportedexception 'System\.NotSupportedException') The [System\.Collections\.Generic\.ICollection<>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.icollection-1 'System\.Collections\.Generic\.ICollection\`1') is read\-only\. ## ConcurrentSet\\.TryAdd\(T\) Method {#Abblix.Utils.Collections.ConcurrentSet_T_.TryAdd(T)} Adds an item if it is not already present\. Returns whether this call is the one that added it, which lets a caller act on the transition \(persist, notify\) exactly once even under concurrency \- something [System\.Collections\.Generic\.ICollection<>\.Add\(@0\)](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.icollection-1.add#system-collections-generic-icollection-1-add(-0) 'System\.Collections\.Generic\.ICollection\`1\.Add\(\`0\)') cannot express, since it returns nothing\. ```csharp public bool TryAdd(T item); ``` #### Parameters ###### `item` [T](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Collections.ConcurrentSet_T_#Abblix.Utils.Collections.ConcurrentSet_T_.T 'Abblix\.Utils\.Collections\.ConcurrentSet\\.T') {#Abblix.Utils.Collections.ConcurrentSet_T_.TryAdd(T).item} #### Returns [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') --- Source: https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Json.md #### [Abblix\.Utils](https://www.abblix.com/en/docs/api/abblix-utils 'index') ## Abblix\.Utils\.Json Namespace | Classes | | | :--- | :--- | | [ArrayConverter<TElement,TConverter>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Json.ArrayConverter_TElement_TConverter_ 'Abblix\.Utils\.Json\.ArrayConverter\') | JSON converter for nullable\-element arrays of [TElement](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Json.ArrayConverter_TElement_TConverter_#Abblix.Utils.Json.ArrayConverter_TElement,TConverter_.TElement 'Abblix\.Utils\.Json\.ArrayConverter\\.TElement')\. Each non\-null element is delegated to an instance of [TConverter](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Json.ArrayConverter_TElement_TConverter_#Abblix.Utils.Json.ArrayConverter_TElement,TConverter_.TConverter 'Abblix\.Utils\.Json\.ArrayConverter\\.TConverter'); each `null` element is preserved as `default()` on read and emitted as a JSON `null` on write, independently of how the inner converter would handle null\. A whole\-array JSON `null` deserializes to a `null` array\. Read accepts any JSON value form the inner converter can consume \(string, number, boolean, object, nested array\), keeping it symmetric with whatever Write can produce\. | | [Base64UrlTextEncoderConverter](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Json.Base64UrlTextEncoderConverter 'Abblix\.Utils\.Json\.Base64UrlTextEncoderConverter') | A JSON converter for handling the serialization and deserialization of byte arrays as Base64 URL\-encoded strings\. | | [CultureInfoConverter](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Json.CultureInfoConverter 'Abblix\.Utils\.Json\.CultureInfoConverter') | A custom JSON converter for [System\.Globalization\.CultureInfo](https://learn.microsoft.com/en-us/dotnet/api/system.globalization.cultureinfo 'System\.Globalization\.CultureInfo') objects\. It allows for the serialization and deserialization of [System\.Globalization\.CultureInfo](https://learn.microsoft.com/en-us/dotnet/api/system.globalization.cultureinfo 'System\.Globalization\.CultureInfo') instances when working with JSON data\. | | [DateTimeOffsetUnixTimeSecondsConverter](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Json.DateTimeOffsetUnixTimeSecondsConverter 'Abblix\.Utils\.Json\.DateTimeOffsetUnixTimeSecondsConverter') | A custom JSON converter for handling [System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset') objects\. Converts to and from Unix time, which is the number of seconds that have elapsed since 00:00:00 UTC on 1 January 1970\. | | [JsonIgnoreNullsAttribute](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Json.JsonIgnoreNullsAttribute 'Abblix\.Utils\.Json\.JsonIgnoreNullsAttribute') | Marks a class or struct so that all nullable properties are omitted from the serialized JSON when their value is `null`, without requiring a per\-property [System\.Text\.Json\.Serialization\.JsonIgnoreAttribute](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.serialization.jsonignoreattribute 'System\.Text\.Json\.Serialization\.JsonIgnoreAttribute') on each one\. | | [JsonIgnoreNullsModifier](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Json.JsonIgnoreNullsModifier 'Abblix\.Utils\.Json\.JsonIgnoreNullsModifier') | Provides a [System\.Text\.Json\.Serialization\.Metadata\.JsonTypeInfo](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.serialization.metadata.jsontypeinfo 'System\.Text\.Json\.Serialization\.Metadata\.JsonTypeInfo') modifier that enforces null\-omission for all nullable properties of types decorated with [JsonIgnoreNullsAttribute](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Json.JsonIgnoreNullsAttribute 'Abblix\.Utils\.Json\.JsonIgnoreNullsAttribute')\. | | [SingleOrArrayConverter<T>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Json.SingleOrArrayConverter_T_ 'Abblix\.Utils\.Json\.SingleOrArrayConverter\') | Reads and writes a JSON value that may be either a single element of [T](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Json.SingleOrArrayConverter_T_#Abblix.Utils.Json.SingleOrArrayConverter_T_.T 'Abblix\.Utils\.Json\.SingleOrArrayConverter\\.T') or an array of such elements, exposing it uniformly to \.NET as `T[]`\. On write, a single\-element array is emitted as a bare scalar \(not an array\), matching the OAuth 2\.0 / OpenID Connect convention used for parameters such as `aud` and `response_type`\. | | [SpaceSeparatedValuesConverter](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Json.SpaceSeparatedValuesConverter 'Abblix\.Utils\.Json\.SpaceSeparatedValuesConverter') | A custom JSON converter that handles arrays of strings, converting them to and from space\-separated values in JSON\. | | [TimeSpanSecondsConverter](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Json.TimeSpanSecondsConverter 'Abblix\.Utils\.Json\.TimeSpanSecondsConverter') | A custom JSON converter for TimeSpan objects that serializes and deserializes them as a number of seconds\. | --- Source: https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Json.ArrayConverter_TElement_TConverter_.md #### [Abblix\.Utils](https://www.abblix.com/en/docs/api/abblix-utils 'index') ### [Abblix\.Utils\.Json](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Json 'Abblix\.Utils\.Json') ## ArrayConverter\ Class JSON converter for nullable\-element arrays of [TElement](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Json.ArrayConverter_TElement_TConverter_#Abblix.Utils.Json.ArrayConverter_TElement,TConverter_.TElement 'Abblix\.Utils\.Json\.ArrayConverter\\.TElement')\. Each non\-null element is delegated to an instance of [TConverter](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Json.ArrayConverter_TElement_TConverter_#Abblix.Utils.Json.ArrayConverter_TElement,TConverter_.TConverter 'Abblix\.Utils\.Json\.ArrayConverter\\.TConverter'); each `null` element is preserved as `default()` on read and emitted as a JSON `null` on write, independently of how the inner converter would handle null\. A whole\-array JSON `null` deserializes to a `null` array\. Read accepts any JSON value form the inner converter can consume \(string, number, boolean, object, nested array\), keeping it symmetric with whatever Write can produce\. ```csharp public class ArrayConverter : System.Text.Json.Serialization.JsonConverter where TConverter : System.Text.Json.Serialization.JsonConverter, new() ``` #### Type parameters ###### `TElement` {#Abblix.Utils.Json.ArrayConverter_TElement,TConverter_.TElement} The element type of the array\. ###### `TConverter` {#Abblix.Utils.Json.ArrayConverter_TElement,TConverter_.TConverter} The per\-element converter; instantiated once per [ArrayConverter<TElement,TConverter>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Json.ArrayConverter_TElement_TConverter_ 'Abblix\.Utils\.Json\.ArrayConverter\')\. Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [System\.Text\.Json\.Serialization\.JsonConverter](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.serialization.jsonconverter 'System\.Text\.Json\.Serialization\.JsonConverter') → [System\.Text\.Json\.Serialization\.JsonConverter<](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.serialization.jsonconverter-1 'System\.Text\.Json\.Serialization\.JsonConverter\`1')[TElement](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Json.ArrayConverter_TElement_TConverter_#Abblix.Utils.Json.ArrayConverter_TElement,TConverter_.TElement 'Abblix\.Utils\.Json\.ArrayConverter\\.TElement')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array')[>](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.serialization.jsonconverter-1 'System\.Text\.Json\.Serialization\.JsonConverter\`1') → ArrayConverter\ ### Methods ## ArrayConverter\\.Read\(Utf8JsonReader, Type, JsonSerializerOptions\) Method {#Abblix.Utils.Json.ArrayConverter_TElement,TConverter_.Read(System.Text.Json.Utf8JsonReader,System.Type,System.Text.Json.JsonSerializerOptions)} Deserializes a JSON array into [TElement](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Json.ArrayConverter_TElement_TConverter_#Abblix.Utils.Json.ArrayConverter_TElement,TConverter_.TElement 'Abblix\.Utils\.Json\.ArrayConverter\\.TElement')?\[\]?, or returns a `null` array when the whole value is JSON `null`\. Inside the array, a JSON `null` element becomes `default()` without invoking the inner converter; every other value\-start token \(string, number, boolean, object, nested array\) is forwarded to the inner converter\. ```csharp public override TElement?[]? Read(ref System.Text.Json.Utf8JsonReader reader, System.Type typeToConvert, System.Text.Json.JsonSerializerOptions options); ``` #### Parameters ###### `reader` [System\.Text\.Json\.Utf8JsonReader](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.utf8jsonreader 'System\.Text\.Json\.Utf8JsonReader') {#Abblix.Utils.Json.ArrayConverter_TElement,TConverter_.Read(System.Text.Json.Utf8JsonReader,System.Type,System.Text.Json.JsonSerializerOptions).reader} The reader positioned at the value to deserialize\. ###### `typeToConvert` [System\.Type](https://learn.microsoft.com/en-us/dotnet/api/system.type 'System\.Type') {#Abblix.Utils.Json.ArrayConverter_TElement,TConverter_.Read(System.Text.Json.Utf8JsonReader,System.Type,System.Text.Json.JsonSerializerOptions).typeToConvert} The CLR type the framework asked to deserialize into\. ###### `options` [System\.Text\.Json\.JsonSerializerOptions](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.jsonserializeroptions 'System\.Text\.Json\.JsonSerializerOptions') {#Abblix.Utils.Json.ArrayConverter_TElement,TConverter_.Read(System.Text.Json.Utf8JsonReader,System.Type,System.Text.Json.JsonSerializerOptions).options} Serializer options forwarded to the inner converter\. #### Returns [TElement](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Json.ArrayConverter_TElement_TConverter_#Abblix.Utils.Json.ArrayConverter_TElement,TConverter_.TElement 'Abblix\.Utils\.Json\.ArrayConverter\\.TElement')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') The deserialized array, or `null`\. ## ArrayConverter\\.Write\(Utf8JsonWriter, TElement\[\], JsonSerializerOptions\) Method {#Abblix.Utils.Json.ArrayConverter_TElement,TConverter_.Write(System.Text.Json.Utf8JsonWriter,TElement[],System.Text.Json.JsonSerializerOptions)} Writes an array of [TElement](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Json.ArrayConverter_TElement_TConverter_#Abblix.Utils.Json.ArrayConverter_TElement,TConverter_.TElement 'Abblix\.Utils\.Json\.ArrayConverter\\.TElement') to JSON\. ```csharp public override void Write(System.Text.Json.Utf8JsonWriter writer, TElement?[]? value, System.Text.Json.JsonSerializerOptions options); ``` #### Parameters ###### `writer` [System\.Text\.Json\.Utf8JsonWriter](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.utf8jsonwriter 'System\.Text\.Json\.Utf8JsonWriter') {#Abblix.Utils.Json.ArrayConverter_TElement,TConverter_.Write(System.Text.Json.Utf8JsonWriter,TElement[],System.Text.Json.JsonSerializerOptions).writer} The writer to write JSON to\. ###### `value` [TElement](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Json.ArrayConverter_TElement_TConverter_#Abblix.Utils.Json.ArrayConverter_TElement,TConverter_.TElement 'Abblix\.Utils\.Json\.ArrayConverter\\.TElement')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Utils.Json.ArrayConverter_TElement,TConverter_.Write(System.Text.Json.Utf8JsonWriter,TElement[],System.Text.Json.JsonSerializerOptions).value} The array of [TElement](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Json.ArrayConverter_TElement_TConverter_#Abblix.Utils.Json.ArrayConverter_TElement,TConverter_.TElement 'Abblix\.Utils\.Json\.ArrayConverter\\.TElement') to write\. ###### `options` [System\.Text\.Json\.JsonSerializerOptions](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.jsonserializeroptions 'System\.Text\.Json\.JsonSerializerOptions') {#Abblix.Utils.Json.ArrayConverter_TElement,TConverter_.Write(System.Text.Json.Utf8JsonWriter,TElement[],System.Text.Json.JsonSerializerOptions).options} Options for the serializer\. --- Source: https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Json.Base64UrlTextEncoderConverter.md #### [Abblix\.Utils](https://www.abblix.com/en/docs/api/abblix-utils 'index') ### [Abblix\.Utils\.Json](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Json 'Abblix\.Utils\.Json') ## Base64UrlTextEncoderConverter Class A JSON converter for handling the serialization and deserialization of byte arrays as Base64 URL\-encoded strings\. ```csharp public class Base64UrlTextEncoderConverter : System.Text.Json.Serialization.JsonConverter ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [System\.Text\.Json\.Serialization\.JsonConverter](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.serialization.jsonconverter 'System\.Text\.Json\.Serialization\.JsonConverter') → [System\.Text\.Json\.Serialization\.JsonConverter<](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.serialization.jsonconverter-1 'System\.Text\.Json\.Serialization\.JsonConverter\`1')[System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array')[>](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.serialization.jsonconverter-1 'System\.Text\.Json\.Serialization\.JsonConverter\`1') → Base64UrlTextEncoderConverter ### Methods ## Base64UrlTextEncoderConverter\.Read\(Utf8JsonReader, Type, JsonSerializerOptions\) Method {#Abblix.Utils.Json.Base64UrlTextEncoderConverter.Read(System.Text.Json.Utf8JsonReader,System.Type,System.Text.Json.JsonSerializerOptions)} Reads and converts the JSON token to a byte array\. ```csharp public override byte[]? Read(ref System.Text.Json.Utf8JsonReader reader, System.Type typeToConvert, System.Text.Json.JsonSerializerOptions options); ``` #### Parameters ###### `reader` [System\.Text\.Json\.Utf8JsonReader](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.utf8jsonreader 'System\.Text\.Json\.Utf8JsonReader') {#Abblix.Utils.Json.Base64UrlTextEncoderConverter.Read(System.Text.Json.Utf8JsonReader,System.Type,System.Text.Json.JsonSerializerOptions).reader} The reader to read the JSON token from\. ###### `typeToConvert` [System\.Type](https://learn.microsoft.com/en-us/dotnet/api/system.type 'System\.Type') {#Abblix.Utils.Json.Base64UrlTextEncoderConverter.Read(System.Text.Json.Utf8JsonReader,System.Type,System.Text.Json.JsonSerializerOptions).typeToConvert} The type of object to convert\. ###### `options` [System\.Text\.Json\.JsonSerializerOptions](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.jsonserializeroptions 'System\.Text\.Json\.JsonSerializerOptions') {#Abblix.Utils.Json.Base64UrlTextEncoderConverter.Read(System.Text.Json.Utf8JsonReader,System.Type,System.Text.Json.JsonSerializerOptions).options} Options for the serializer\. #### Returns [System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') A byte array if the token is a string, otherwise null\. #### Exceptions [System\.InvalidOperationException](https://learn.microsoft.com/en-us/dotnet/api/system.invalidoperationexception 'System\.InvalidOperationException') Thrown if the token is not a string or null\. [System\.Text\.Json\.JsonException](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.jsonexception 'System\.Text\.Json\.JsonException') Thrown if the string is not valid base64url encoding\. ## Base64UrlTextEncoderConverter\.Write\(Utf8JsonWriter, byte\[\], JsonSerializerOptions\) Method {#Abblix.Utils.Json.Base64UrlTextEncoderConverter.Write(System.Text.Json.Utf8JsonWriter,byte[],System.Text.Json.JsonSerializerOptions)} Writes a byte array as a Base64 URL\-encoded string to the JSON writer\. ```csharp public override void Write(System.Text.Json.Utf8JsonWriter writer, byte[]? value, System.Text.Json.JsonSerializerOptions options); ``` #### Parameters ###### `writer` [System\.Text\.Json\.Utf8JsonWriter](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.utf8jsonwriter 'System\.Text\.Json\.Utf8JsonWriter') {#Abblix.Utils.Json.Base64UrlTextEncoderConverter.Write(System.Text.Json.Utf8JsonWriter,byte[],System.Text.Json.JsonSerializerOptions).writer} The writer to write the JSON token to\. ###### `value` [System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Utils.Json.Base64UrlTextEncoderConverter.Write(System.Text.Json.Utf8JsonWriter,byte[],System.Text.Json.JsonSerializerOptions).value} The byte array to write\. ###### `options` [System\.Text\.Json\.JsonSerializerOptions](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.jsonserializeroptions 'System\.Text\.Json\.JsonSerializerOptions') {#Abblix.Utils.Json.Base64UrlTextEncoderConverter.Write(System.Text.Json.Utf8JsonWriter,byte[],System.Text.Json.JsonSerializerOptions).options} Options for the serializer\. --- Source: https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Json.CultureInfoConverter.md #### [Abblix\.Utils](https://www.abblix.com/en/docs/api/abblix-utils 'index') ### [Abblix\.Utils\.Json](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Json 'Abblix\.Utils\.Json') ## CultureInfoConverter Class A custom JSON converter for [System\.Globalization\.CultureInfo](https://learn.microsoft.com/en-us/dotnet/api/system.globalization.cultureinfo 'System\.Globalization\.CultureInfo') objects\. It allows for the serialization and deserialization of [System\.Globalization\.CultureInfo](https://learn.microsoft.com/en-us/dotnet/api/system.globalization.cultureinfo 'System\.Globalization\.CultureInfo') instances when working with JSON data\. ```csharp public class CultureInfoConverter : System.Text.Json.Serialization.JsonConverter ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [System\.Text\.Json\.Serialization\.JsonConverter](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.serialization.jsonconverter 'System\.Text\.Json\.Serialization\.JsonConverter') → [System\.Text\.Json\.Serialization\.JsonConverter<](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.serialization.jsonconverter-1 'System\.Text\.Json\.Serialization\.JsonConverter\`1')[System\.Globalization\.CultureInfo](https://learn.microsoft.com/en-us/dotnet/api/system.globalization.cultureinfo 'System\.Globalization\.CultureInfo')[>](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.serialization.jsonconverter-1 'System\.Text\.Json\.Serialization\.JsonConverter\`1') → CultureInfoConverter ### Methods ## CultureInfoConverter\.Read\(Utf8JsonReader, Type, JsonSerializerOptions\) Method {#Abblix.Utils.Json.CultureInfoConverter.Read(System.Text.Json.Utf8JsonReader,System.Type,System.Text.Json.JsonSerializerOptions)} Reads and converts the JSON to a [System\.Globalization\.CultureInfo](https://learn.microsoft.com/en-us/dotnet/api/system.globalization.cultureinfo 'System\.Globalization\.CultureInfo')\. ```csharp public override System.Globalization.CultureInfo Read(ref System.Text.Json.Utf8JsonReader reader, System.Type typeToConvert, System.Text.Json.JsonSerializerOptions options); ``` #### Parameters ###### `reader` [System\.Text\.Json\.Utf8JsonReader](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.utf8jsonreader 'System\.Text\.Json\.Utf8JsonReader') {#Abblix.Utils.Json.CultureInfoConverter.Read(System.Text.Json.Utf8JsonReader,System.Type,System.Text.Json.JsonSerializerOptions).reader} The reader to read the JSON from\. ###### `typeToConvert` [System\.Type](https://learn.microsoft.com/en-us/dotnet/api/system.type 'System\.Type') {#Abblix.Utils.Json.CultureInfoConverter.Read(System.Text.Json.Utf8JsonReader,System.Type,System.Text.Json.JsonSerializerOptions).typeToConvert} The type of object to convert to\. ###### `options` [System\.Text\.Json\.JsonSerializerOptions](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.jsonserializeroptions 'System\.Text\.Json\.JsonSerializerOptions') {#Abblix.Utils.Json.CultureInfoConverter.Read(System.Text.Json.Utf8JsonReader,System.Type,System.Text.Json.JsonSerializerOptions).options} The serializer options to use\. #### Returns [System\.Globalization\.CultureInfo](https://learn.microsoft.com/en-us/dotnet/api/system.globalization.cultureinfo 'System\.Globalization\.CultureInfo') The deserialized [System\.Globalization\.CultureInfo](https://learn.microsoft.com/en-us/dotnet/api/system.globalization.cultureinfo 'System\.Globalization\.CultureInfo') object\. #### Exceptions [System\.Text\.Json\.JsonException](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.jsonexception 'System\.Text\.Json\.JsonException') Thrown when the JSON token is not a string or null, or if the string is not a valid culture identifier\. ## CultureInfoConverter\.Write\(Utf8JsonWriter, CultureInfo, JsonSerializerOptions\) Method {#Abblix.Utils.Json.CultureInfoConverter.Write(System.Text.Json.Utf8JsonWriter,System.Globalization.CultureInfo,System.Text.Json.JsonSerializerOptions)} Writes a specified [System\.Globalization\.CultureInfo](https://learn.microsoft.com/en-us/dotnet/api/system.globalization.cultureinfo 'System\.Globalization\.CultureInfo') object as JSON\. ```csharp public override void Write(System.Text.Json.Utf8JsonWriter writer, System.Globalization.CultureInfo value, System.Text.Json.JsonSerializerOptions options); ``` #### Parameters ###### `writer` [System\.Text\.Json\.Utf8JsonWriter](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.utf8jsonwriter 'System\.Text\.Json\.Utf8JsonWriter') {#Abblix.Utils.Json.CultureInfoConverter.Write(System.Text.Json.Utf8JsonWriter,System.Globalization.CultureInfo,System.Text.Json.JsonSerializerOptions).writer} The writer to write the JSON to\. ###### `value` [System\.Globalization\.CultureInfo](https://learn.microsoft.com/en-us/dotnet/api/system.globalization.cultureinfo 'System\.Globalization\.CultureInfo') {#Abblix.Utils.Json.CultureInfoConverter.Write(System.Text.Json.Utf8JsonWriter,System.Globalization.CultureInfo,System.Text.Json.JsonSerializerOptions).value} The [System\.Globalization\.CultureInfo](https://learn.microsoft.com/en-us/dotnet/api/system.globalization.cultureinfo 'System\.Globalization\.CultureInfo') value to convert\. ###### `options` [System\.Text\.Json\.JsonSerializerOptions](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.jsonserializeroptions 'System\.Text\.Json\.JsonSerializerOptions') {#Abblix.Utils.Json.CultureInfoConverter.Write(System.Text.Json.Utf8JsonWriter,System.Globalization.CultureInfo,System.Text.Json.JsonSerializerOptions).options} The serializer options to use\. ### Remarks If the [System\.Globalization\.CultureInfo](https://learn.microsoft.com/en-us/dotnet/api/system.globalization.cultureinfo 'System\.Globalization\.CultureInfo') is [System\.Globalization\.CultureInfo\.InvariantCulture](https://learn.microsoft.com/en-us/dotnet/api/system.globalization.cultureinfo.invariantculture 'System\.Globalization\.CultureInfo\.InvariantCulture'), it writes a null value; otherwise, it writes the culture name as a string\. --- Source: https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Json.DateTimeOffsetUnixTimeSecondsConverter.md #### [Abblix\.Utils](https://www.abblix.com/en/docs/api/abblix-utils 'index') ### [Abblix\.Utils\.Json](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Json 'Abblix\.Utils\.Json') ## DateTimeOffsetUnixTimeSecondsConverter Class A custom JSON converter for handling [System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset') objects\. Converts to and from Unix time, which is the number of seconds that have elapsed since 00:00:00 UTC on 1 January 1970\. ```csharp public class DateTimeOffsetUnixTimeSecondsConverter : System.Text.Json.Serialization.JsonConverter ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [System\.Text\.Json\.Serialization\.JsonConverter](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.serialization.jsonconverter 'System\.Text\.Json\.Serialization\.JsonConverter') → [System\.Text\.Json\.Serialization\.JsonConverter<](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.serialization.jsonconverter-1 'System\.Text\.Json\.Serialization\.JsonConverter\`1')[System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset')[>](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.serialization.jsonconverter-1 'System\.Text\.Json\.Serialization\.JsonConverter\`1') → DateTimeOffsetUnixTimeSecondsConverter ### Methods ## DateTimeOffsetUnixTimeSecondsConverter\.Read\(Utf8JsonReader, Type, JsonSerializerOptions\) Method {#Abblix.Utils.Json.DateTimeOffsetUnixTimeSecondsConverter.Read(System.Text.Json.Utf8JsonReader,System.Type,System.Text.Json.JsonSerializerOptions)} Reads and converts the JSON to a [System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset') object\. ```csharp public override System.DateTimeOffset Read(ref System.Text.Json.Utf8JsonReader reader, System.Type typeToConvert, System.Text.Json.JsonSerializerOptions options); ``` #### Parameters ###### `reader` [System\.Text\.Json\.Utf8JsonReader](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.utf8jsonreader 'System\.Text\.Json\.Utf8JsonReader') {#Abblix.Utils.Json.DateTimeOffsetUnixTimeSecondsConverter.Read(System.Text.Json.Utf8JsonReader,System.Type,System.Text.Json.JsonSerializerOptions).reader} The reader to read JSON from\. ###### `typeToConvert` [System\.Type](https://learn.microsoft.com/en-us/dotnet/api/system.type 'System\.Type') {#Abblix.Utils.Json.DateTimeOffsetUnixTimeSecondsConverter.Read(System.Text.Json.Utf8JsonReader,System.Type,System.Text.Json.JsonSerializerOptions).typeToConvert} The type of object to convert to\. ###### `options` [System\.Text\.Json\.JsonSerializerOptions](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.jsonserializeroptions 'System\.Text\.Json\.JsonSerializerOptions') {#Abblix.Utils.Json.DateTimeOffsetUnixTimeSecondsConverter.Read(System.Text.Json.Utf8JsonReader,System.Type,System.Text.Json.JsonSerializerOptions).options} Options for the serializer\. #### Returns [System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset') A [System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset') object\. ## DateTimeOffsetUnixTimeSecondsConverter\.Write\(Utf8JsonWriter, DateTimeOffset, JsonSerializerOptions\) Method {#Abblix.Utils.Json.DateTimeOffsetUnixTimeSecondsConverter.Write(System.Text.Json.Utf8JsonWriter,System.DateTimeOffset,System.Text.Json.JsonSerializerOptions)} Writes a [System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset') object as a Unix time \(number of seconds since Unix epoch\) to JSON\. ```csharp public override void Write(System.Text.Json.Utf8JsonWriter writer, System.DateTimeOffset value, System.Text.Json.JsonSerializerOptions options); ``` #### Parameters ###### `writer` [System\.Text\.Json\.Utf8JsonWriter](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.utf8jsonwriter 'System\.Text\.Json\.Utf8JsonWriter') {#Abblix.Utils.Json.DateTimeOffsetUnixTimeSecondsConverter.Write(System.Text.Json.Utf8JsonWriter,System.DateTimeOffset,System.Text.Json.JsonSerializerOptions).writer} The writer to write JSON to\. ###### `value` [System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset') {#Abblix.Utils.Json.DateTimeOffsetUnixTimeSecondsConverter.Write(System.Text.Json.Utf8JsonWriter,System.DateTimeOffset,System.Text.Json.JsonSerializerOptions).value} The [System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset') value to write\. ###### `options` [System\.Text\.Json\.JsonSerializerOptions](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.jsonserializeroptions 'System\.Text\.Json\.JsonSerializerOptions') {#Abblix.Utils.Json.DateTimeOffsetUnixTimeSecondsConverter.Write(System.Text.Json.Utf8JsonWriter,System.DateTimeOffset,System.Text.Json.JsonSerializerOptions).options} Options for the serializer\. --- Source: https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Json.JsonIgnoreNullsAttribute.md #### [Abblix\.Utils](https://www.abblix.com/en/docs/api/abblix-utils 'index') ### [Abblix\.Utils\.Json](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Json 'Abblix\.Utils\.Json') ## JsonIgnoreNullsAttribute Class Marks a class or struct so that all nullable properties are omitted from the serialized JSON when their value is `null`, without requiring a per\-property [System\.Text\.Json\.Serialization\.JsonIgnoreAttribute](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.serialization.jsonignoreattribute 'System\.Text\.Json\.Serialization\.JsonIgnoreAttribute') on each one\. ```csharp public sealed class JsonIgnoreNullsAttribute : System.Attribute ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [System\.Attribute](https://learn.microsoft.com/en-us/dotnet/api/system.attribute 'System\.Attribute') → JsonIgnoreNullsAttribute ### Remarks This attribute is a marker only\. For it to take effect, the [System\.Text\.Json\.JsonSerializerOptions](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.jsonserializeroptions 'System\.Text\.Json\.JsonSerializerOptions') used during serialization must have [Apply\(JsonTypeInfo\)](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Json.JsonIgnoreNullsModifier#Abblix.Utils.Json.JsonIgnoreNullsModifier.Apply(System.Text.Json.Serialization.Metadata.JsonTypeInfo) 'Abblix\.Utils\.Json\.JsonIgnoreNullsModifier\.Apply\(System\.Text\.Json\.Serialization\.Metadata\.JsonTypeInfo\)') registered as a [System\.Text\.Json\.Serialization\.Metadata\.JsonTypeInfo](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.serialization.metadata.jsontypeinfo 'System\.Text\.Json\.Serialization\.Metadata\.JsonTypeInfo') modifier \- for example via [System\.Text\.Json\.Serialization\.Metadata\.DefaultJsonTypeInfoResolver\.Modifiers](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.serialization.metadata.defaultjsontypeinforesolver.modifiers 'System\.Text\.Json\.Serialization\.Metadata\.DefaultJsonTypeInfoResolver\.Modifiers') added to [System\.Text\.Json\.JsonSerializerOptions\.TypeInfoResolverChain](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.jsonserializeroptions.typeinforesolverchain 'System\.Text\.Json\.JsonSerializerOptions\.TypeInfoResolverChain')\. Abblix's `AddOidcControllers` registers the modifier automatically\. --- Source: https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Json.JsonIgnoreNullsModifier.md #### [Abblix\.Utils](https://www.abblix.com/en/docs/api/abblix-utils 'index') ### [Abblix\.Utils\.Json](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Json 'Abblix\.Utils\.Json') ## JsonIgnoreNullsModifier Class Provides a [System\.Text\.Json\.Serialization\.Metadata\.JsonTypeInfo](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.serialization.metadata.jsontypeinfo 'System\.Text\.Json\.Serialization\.Metadata\.JsonTypeInfo') modifier that enforces null\-omission for all nullable properties of types decorated with [JsonIgnoreNullsAttribute](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Json.JsonIgnoreNullsAttribute 'Abblix\.Utils\.Json\.JsonIgnoreNullsAttribute')\. ```csharp public static class JsonIgnoreNullsModifier ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → JsonIgnoreNullsModifier ### Remarks Register [Apply\(JsonTypeInfo\)](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Json.JsonIgnoreNullsModifier#Abblix.Utils.Json.JsonIgnoreNullsModifier.Apply(System.Text.Json.Serialization.Metadata.JsonTypeInfo) 'Abblix\.Utils\.Json\.JsonIgnoreNullsModifier\.Apply\(System\.Text\.Json\.Serialization\.Metadata\.JsonTypeInfo\)') via [System\.Text\.Json\.JsonSerializerOptions\.TypeInfoResolverChain](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.jsonserializeroptions.typeinforesolverchain 'System\.Text\.Json\.JsonSerializerOptions\.TypeInfoResolverChain') to activate the attribute: ```csharp options.TypeInfoResolverChain.Add( new DefaultJsonTypeInfoResolver { Modifiers = { JsonIgnoreNullsModifier.Apply } }); ``` ### Methods ## JsonIgnoreNullsModifier\.Apply\(JsonTypeInfo\) Method {#Abblix.Utils.Json.JsonIgnoreNullsModifier.Apply(System.Text.Json.Serialization.Metadata.JsonTypeInfo)} A [System\.Text\.Json\.Serialization\.Metadata\.JsonTypeInfo](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.serialization.metadata.jsontypeinfo 'System\.Text\.Json\.Serialization\.Metadata\.JsonTypeInfo') modifier that sets `ShouldSerialize` to skip `null` values on every nullable property of any type decorated with [JsonIgnoreNullsAttribute](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Json.JsonIgnoreNullsAttribute 'Abblix\.Utils\.Json\.JsonIgnoreNullsAttribute')\. ```csharp public static void Apply(System.Text.Json.Serialization.Metadata.JsonTypeInfo typeInfo); ``` #### Parameters `typeInfo` [System\.Text\.Json\.Serialization\.Metadata\.JsonTypeInfo](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.serialization.metadata.jsontypeinfo 'System\.Text\.Json\.Serialization\.Metadata\.JsonTypeInfo') --- Source: https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Json.SingleOrArrayConverter_T_.md #### [Abblix\.Utils](https://www.abblix.com/en/docs/api/abblix-utils 'index') ### [Abblix\.Utils\.Json](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Json 'Abblix\.Utils\.Json') ## SingleOrArrayConverter\ Class Reads and writes a JSON value that may be either a single element of [T](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Json.SingleOrArrayConverter_T_#Abblix.Utils.Json.SingleOrArrayConverter_T_.T 'Abblix\.Utils\.Json\.SingleOrArrayConverter\\.T') or an array of such elements, exposing it uniformly to \.NET as `T[]`\. On write, a single\-element array is emitted as a bare scalar \(not an array\), matching the OAuth 2\.0 / OpenID Connect convention used for parameters such as `aud` and `response_type`\. ```csharp public class SingleOrArrayConverter : System.Text.Json.Serialization.JsonConverter ``` #### Type parameters ###### `T` {#Abblix.Utils.Json.SingleOrArrayConverter_T_.T} The element type\. A converter for [T](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Json.SingleOrArrayConverter_T_#Abblix.Utils.Json.SingleOrArrayConverter_T_.T 'Abblix\.Utils\.Json\.SingleOrArrayConverter\\.T') must be available in the serializer options\. Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [System\.Text\.Json\.Serialization\.JsonConverter](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.serialization.jsonconverter 'System\.Text\.Json\.Serialization\.JsonConverter') → [System\.Text\.Json\.Serialization\.JsonConverter<](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.serialization.jsonconverter-1 'System\.Text\.Json\.Serialization\.JsonConverter\`1')[T](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Json.SingleOrArrayConverter_T_#Abblix.Utils.Json.SingleOrArrayConverter_T_.T 'Abblix\.Utils\.Json\.SingleOrArrayConverter\\.T')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array')[>](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.serialization.jsonconverter-1 'System\.Text\.Json\.Serialization\.JsonConverter\`1') → SingleOrArrayConverter\ ### Methods ## SingleOrArrayConverter\\.Read\(Utf8JsonReader, Type, JsonSerializerOptions\) Method {#Abblix.Utils.Json.SingleOrArrayConverter_T_.Read(System.Text.Json.Utf8JsonReader,System.Type,System.Text.Json.JsonSerializerOptions)} Reads and converts the JSON to a string array\. If the JSON token is a single string, it returns an array containing one element\. If it is an array of strings, it converts each element and returns them in an array\. ```csharp public override T[]? Read(ref System.Text.Json.Utf8JsonReader reader, System.Type typeToConvert, System.Text.Json.JsonSerializerOptions options); ``` #### Parameters ###### `reader` [System\.Text\.Json\.Utf8JsonReader](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.utf8jsonreader 'System\.Text\.Json\.Utf8JsonReader') {#Abblix.Utils.Json.SingleOrArrayConverter_T_.Read(System.Text.Json.Utf8JsonReader,System.Type,System.Text.Json.JsonSerializerOptions).reader} The reader from which to read the JSON document\. ###### `typeToConvert` [System\.Type](https://learn.microsoft.com/en-us/dotnet/api/system.type 'System\.Type') {#Abblix.Utils.Json.SingleOrArrayConverter_T_.Read(System.Text.Json.Utf8JsonReader,System.Type,System.Text.Json.JsonSerializerOptions).typeToConvert} The type to convert\. Expected to be a string array\. ###### `options` [System\.Text\.Json\.JsonSerializerOptions](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.jsonserializeroptions 'System\.Text\.Json\.JsonSerializerOptions') {#Abblix.Utils.Json.SingleOrArrayConverter_T_.Read(System.Text.Json.Utf8JsonReader,System.Type,System.Text.Json.JsonSerializerOptions).options} Options for the serializer\. #### Returns [T](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Json.SingleOrArrayConverter_T_#Abblix.Utils.Json.SingleOrArrayConverter_T_.T 'Abblix\.Utils\.Json\.SingleOrArrayConverter\\.T')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') An array of strings parsed from the JSON input\. #### Exceptions [System\.Text\.Json\.JsonException](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.jsonexception 'System\.Text\.Json\.JsonException') Thrown if an unexpected token type is encountered\. ## SingleOrArrayConverter\\.Write\(Utf8JsonWriter, T\[\], JsonSerializerOptions\) Method {#Abblix.Utils.Json.SingleOrArrayConverter_T_.Write(System.Text.Json.Utf8JsonWriter,T[],System.Text.Json.JsonSerializerOptions)} Writes a string array to a JSON writer\. If the array contains a single string, it writes it as a single string value\. If it contains multiple strings, it writes them as an array of strings\. ```csharp public override void Write(System.Text.Json.Utf8JsonWriter writer, T[]? value, System.Text.Json.JsonSerializerOptions options); ``` #### Parameters ###### `writer` [System\.Text\.Json\.Utf8JsonWriter](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.utf8jsonwriter 'System\.Text\.Json\.Utf8JsonWriter') {#Abblix.Utils.Json.SingleOrArrayConverter_T_.Write(System.Text.Json.Utf8JsonWriter,T[],System.Text.Json.JsonSerializerOptions).writer} The writer to which the JSON will be written\. ###### `value` [T](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Json.SingleOrArrayConverter_T_#Abblix.Utils.Json.SingleOrArrayConverter_T_.T 'Abblix\.Utils\.Json\.SingleOrArrayConverter\\.T')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Utils.Json.SingleOrArrayConverter_T_.Write(System.Text.Json.Utf8JsonWriter,T[],System.Text.Json.JsonSerializerOptions).value} The string array to write\. ###### `options` [System\.Text\.Json\.JsonSerializerOptions](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.jsonserializeroptions 'System\.Text\.Json\.JsonSerializerOptions') {#Abblix.Utils.Json.SingleOrArrayConverter_T_.Write(System.Text.Json.Utf8JsonWriter,T[],System.Text.Json.JsonSerializerOptions).options} Options for the serializer\. #### Exceptions [System\.ArgumentNullException](https://learn.microsoft.com/en-us/dotnet/api/system.argumentnullexception 'System\.ArgumentNullException') Thrown if the writer or value is null\. --- Source: https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Json.SpaceSeparatedValuesConverter.md #### [Abblix\.Utils](https://www.abblix.com/en/docs/api/abblix-utils 'index') ### [Abblix\.Utils\.Json](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Json 'Abblix\.Utils\.Json') ## SpaceSeparatedValuesConverter Class A custom JSON converter that handles arrays of strings, converting them to and from space\-separated values in JSON\. ```csharp public class SpaceSeparatedValuesConverter : System.Text.Json.Serialization.JsonConverter ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [System\.Text\.Json\.Serialization\.JsonConverter](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.serialization.jsonconverter 'System\.Text\.Json\.Serialization\.JsonConverter') → [System\.Text\.Json\.Serialization\.JsonConverter<](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.serialization.jsonconverter-1 'System\.Text\.Json\.Serialization\.JsonConverter\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array')[>](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.serialization.jsonconverter-1 'System\.Text\.Json\.Serialization\.JsonConverter\`1') → SpaceSeparatedValuesConverter ### Methods ## SpaceSeparatedValuesConverter\.Read\(Utf8JsonReader, Type, JsonSerializerOptions\) Method {#Abblix.Utils.Json.SpaceSeparatedValuesConverter.Read(System.Text.Json.Utf8JsonReader,System.Type,System.Text.Json.JsonSerializerOptions)} Reads a JSON string containing space\-separated values and converts it to an array of strings\. ```csharp public override string[]? Read(ref System.Text.Json.Utf8JsonReader reader, System.Type typeToConvert, System.Text.Json.JsonSerializerOptions options); ``` #### Parameters ###### `reader` [System\.Text\.Json\.Utf8JsonReader](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.utf8jsonreader 'System\.Text\.Json\.Utf8JsonReader') {#Abblix.Utils.Json.SpaceSeparatedValuesConverter.Read(System.Text.Json.Utf8JsonReader,System.Type,System.Text.Json.JsonSerializerOptions).reader} The reader to read JSON from\. ###### `typeToConvert` [System\.Type](https://learn.microsoft.com/en-us/dotnet/api/system.type 'System\.Type') {#Abblix.Utils.Json.SpaceSeparatedValuesConverter.Read(System.Text.Json.Utf8JsonReader,System.Type,System.Text.Json.JsonSerializerOptions).typeToConvert} The type of object to convert to\. Expected to be an array of strings\. ###### `options` [System\.Text\.Json\.JsonSerializerOptions](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.jsonserializeroptions 'System\.Text\.Json\.JsonSerializerOptions') {#Abblix.Utils.Json.SpaceSeparatedValuesConverter.Read(System.Text.Json.Utf8JsonReader,System.Type,System.Text.Json.JsonSerializerOptions).options} Options for the serializer\. #### Returns [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') An array of strings parsed from the space\-separated values in the JSON string\. ## SpaceSeparatedValuesConverter\.Write\(Utf8JsonWriter, string\[\], JsonSerializerOptions\) Method {#Abblix.Utils.Json.SpaceSeparatedValuesConverter.Write(System.Text.Json.Utf8JsonWriter,string[],System.Text.Json.JsonSerializerOptions)} Writes an array of strings to JSON as a single string with values separated by spaces\. ```csharp public override void Write(System.Text.Json.Utf8JsonWriter writer, string[] value, System.Text.Json.JsonSerializerOptions options); ``` #### Parameters ###### `writer` [System\.Text\.Json\.Utf8JsonWriter](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.utf8jsonwriter 'System\.Text\.Json\.Utf8JsonWriter') {#Abblix.Utils.Json.SpaceSeparatedValuesConverter.Write(System.Text.Json.Utf8JsonWriter,string[],System.Text.Json.JsonSerializerOptions).writer} The writer to write JSON to\. ###### `value` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Utils.Json.SpaceSeparatedValuesConverter.Write(System.Text.Json.Utf8JsonWriter,string[],System.Text.Json.JsonSerializerOptions).value} The array of strings to write\. ###### `options` [System\.Text\.Json\.JsonSerializerOptions](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.jsonserializeroptions 'System\.Text\.Json\.JsonSerializerOptions') {#Abblix.Utils.Json.SpaceSeparatedValuesConverter.Write(System.Text.Json.Utf8JsonWriter,string[],System.Text.Json.JsonSerializerOptions).options} Options for the serializer\. --- Source: https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Json.TimeSpanSecondsConverter.md #### [Abblix\.Utils](https://www.abblix.com/en/docs/api/abblix-utils 'index') ### [Abblix\.Utils\.Json](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Json 'Abblix\.Utils\.Json') ## TimeSpanSecondsConverter Class A custom JSON converter for TimeSpan objects that serializes and deserializes them as a number of seconds\. ```csharp public class TimeSpanSecondsConverter : System.Text.Json.Serialization.JsonConverter ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [System\.Text\.Json\.Serialization\.JsonConverter](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.serialization.jsonconverter 'System\.Text\.Json\.Serialization\.JsonConverter') → [System\.Text\.Json\.Serialization\.JsonConverter<](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.serialization.jsonconverter-1 'System\.Text\.Json\.Serialization\.JsonConverter\`1')[System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan')[>](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.serialization.jsonconverter-1 'System\.Text\.Json\.Serialization\.JsonConverter\`1') → TimeSpanSecondsConverter ### Methods ## TimeSpanSecondsConverter\.Read\(Utf8JsonReader, Type, JsonSerializerOptions\) Method {#Abblix.Utils.Json.TimeSpanSecondsConverter.Read(System.Text.Json.Utf8JsonReader,System.Type,System.Text.Json.JsonSerializerOptions)} Reads a JSON number representing the total seconds and converts it to a TimeSpan object\. ```csharp public override System.TimeSpan Read(ref System.Text.Json.Utf8JsonReader reader, System.Type typeToConvert, System.Text.Json.JsonSerializerOptions options); ``` #### Parameters ###### `reader` [System\.Text\.Json\.Utf8JsonReader](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.utf8jsonreader 'System\.Text\.Json\.Utf8JsonReader') {#Abblix.Utils.Json.TimeSpanSecondsConverter.Read(System.Text.Json.Utf8JsonReader,System.Type,System.Text.Json.JsonSerializerOptions).reader} The reader to read JSON data from\. ###### `typeToConvert` [System\.Type](https://learn.microsoft.com/en-us/dotnet/api/system.type 'System\.Type') {#Abblix.Utils.Json.TimeSpanSecondsConverter.Read(System.Text.Json.Utf8JsonReader,System.Type,System.Text.Json.JsonSerializerOptions).typeToConvert} The type to convert; expected to be TimeSpan\. ###### `options` [System\.Text\.Json\.JsonSerializerOptions](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.jsonserializeroptions 'System\.Text\.Json\.JsonSerializerOptions') {#Abblix.Utils.Json.TimeSpanSecondsConverter.Read(System.Text.Json.Utf8JsonReader,System.Type,System.Text.Json.JsonSerializerOptions).options} Options for the serializer\. #### Returns [System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan') A TimeSpan object representing the value read from the JSON\. ## TimeSpanSecondsConverter\.Write\(Utf8JsonWriter, TimeSpan, JsonSerializerOptions\) Method {#Abblix.Utils.Json.TimeSpanSecondsConverter.Write(System.Text.Json.Utf8JsonWriter,System.TimeSpan,System.Text.Json.JsonSerializerOptions)} Writes a TimeSpan object to JSON as a number representing its total seconds\. ```csharp public override void Write(System.Text.Json.Utf8JsonWriter writer, System.TimeSpan value, System.Text.Json.JsonSerializerOptions options); ``` #### Parameters ###### `writer` [System\.Text\.Json\.Utf8JsonWriter](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.utf8jsonwriter 'System\.Text\.Json\.Utf8JsonWriter') {#Abblix.Utils.Json.TimeSpanSecondsConverter.Write(System.Text.Json.Utf8JsonWriter,System.TimeSpan,System.Text.Json.JsonSerializerOptions).writer} The writer to write JSON data to\. ###### `value` [System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan') {#Abblix.Utils.Json.TimeSpanSecondsConverter.Write(System.Text.Json.Utf8JsonWriter,System.TimeSpan,System.Text.Json.JsonSerializerOptions).value} The TimeSpan value to write\. ###### `options` [System\.Text\.Json\.JsonSerializerOptions](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.jsonserializeroptions 'System\.Text\.Json\.JsonSerializerOptions') {#Abblix.Utils.Json.TimeSpanSecondsConverter.Write(System.Text.Json.Utf8JsonWriter,System.TimeSpan,System.Text.Json.JsonSerializerOptions).options} Options for the serializer\. --- Source: https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Validation.md #### [Abblix\.Utils](https://www.abblix.com/en/docs/api/abblix-utils 'index') ## Abblix\.Utils\.Validation Namespace | Classes | | | :--- | :--- | | [AbsoluteUriAttribute](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Validation.AbsoluteUriAttribute 'Abblix\.Utils\.Validation\.AbsoluteUriAttribute') | A validation attribute that requires the value to be an absolute URI and, optionally, to use a specific scheme\. Absence is valid \- combine with [System\.ComponentModel\.DataAnnotations\.RequiredAttribute](https://learn.microsoft.com/en-us/dotnet/api/system.componentmodel.dataannotations.requiredattribute 'System\.ComponentModel\.DataAnnotations\.RequiredAttribute') to also reject a missing value\. Shared by the MVC and Minimal API OIDC server adapters, whose source generators emit it \(with the marker's scheme argument\) from the declarative core `AbsoluteUri` marker\. \ The URI scheme the value must use \(e\.g\. "https"\); any absolute scheme is accepted when null\.\ | | [AllowedValuesAttribute](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Validation.AllowedValuesAttribute 'Abblix\.Utils\.Validation\.AllowedValuesAttribute') | A validation attribute that restricts a string \(or string\-collection\) value to a fixed set, matched exactly\. An absent value passes: whether a member is required is a separate question, asked by a separate attribute, which is why the framework's own `AllowedValues` cannot stand in for this one \- it refuses null\. Shared by the MVC and Minimal API OIDC server adapters, whose source generators emit it onto a generated model whenever the corresponding core property carries the declarative `AllowedValues` marker\. | | [ElementsRequiredAttribute](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Validation.ElementsRequiredAttribute 'Abblix\.Utils\.Validation\.ElementsRequiredAttribute') | A validation attribute that rejects a collection containing a null element; a non\-collection value is left untouched\. Shared by the MVC and Minimal API OIDC server adapters, whose source generators emit it from the declarative core `ElementsRequired` marker\. | --- Source: https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Validation.AbsoluteUriAttribute.md #### [Abblix\.Utils](https://www.abblix.com/en/docs/api/abblix-utils 'index') ### [Abblix\.Utils\.Validation](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Validation 'Abblix\.Utils\.Validation') ## AbsoluteUriAttribute Class A validation attribute that requires the value to be an absolute URI and, optionally, to use a specific scheme\. Absence is valid \- combine with [System\.ComponentModel\.DataAnnotations\.RequiredAttribute](https://learn.microsoft.com/en-us/dotnet/api/system.componentmodel.dataannotations.requiredattribute 'System\.ComponentModel\.DataAnnotations\.RequiredAttribute') to also reject a missing value\. Shared by the MVC and Minimal API OIDC server adapters, whose source generators emit it \(with the marker's scheme argument\) from the declarative core `AbsoluteUri` marker\. \ The URI scheme the value must use \(e\.g\. "https"\); any absolute scheme is accepted when null\.\ ```csharp public sealed class AbsoluteUriAttribute : System.ComponentModel.DataAnnotations.ValidationAttribute ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [System\.Attribute](https://learn.microsoft.com/en-us/dotnet/api/system.attribute 'System\.Attribute') → [System\.ComponentModel\.DataAnnotations\.ValidationAttribute](https://learn.microsoft.com/en-us/dotnet/api/system.componentmodel.dataannotations.validationattribute 'System\.ComponentModel\.DataAnnotations\.ValidationAttribute') → AbsoluteUriAttribute ### Constructors ## AbsoluteUriAttribute\(string\) Constructor {#Abblix.Utils.Validation.AbsoluteUriAttribute.AbsoluteUriAttribute(string)} A validation attribute that requires the value to be an absolute URI and, optionally, to use a specific scheme\. Absence is valid \- combine with [System\.ComponentModel\.DataAnnotations\.RequiredAttribute](https://learn.microsoft.com/en-us/dotnet/api/system.componentmodel.dataannotations.requiredattribute 'System\.ComponentModel\.DataAnnotations\.RequiredAttribute') to also reject a missing value\. Shared by the MVC and Minimal API OIDC server adapters, whose source generators emit it \(with the marker's scheme argument\) from the declarative core `AbsoluteUri` marker\. \ The URI scheme the value must use \(e\.g\. "https"\); any absolute scheme is accepted when null\.\ ```csharp public AbsoluteUriAttribute(string? requireScheme=null); ``` #### Parameters `requireScheme` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') --- Source: https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Validation.AllowedValuesAttribute.md #### [Abblix\.Utils](https://www.abblix.com/en/docs/api/abblix-utils 'index') ### [Abblix\.Utils\.Validation](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Validation 'Abblix\.Utils\.Validation') ## AllowedValuesAttribute Class A validation attribute that restricts a string \(or string\-collection\) value to a fixed set, matched exactly\. An absent value passes: whether a member is required is a separate question, asked by a separate attribute, which is why the framework's own `AllowedValues` cannot stand in for this one \- it refuses null\. Shared by the MVC and Minimal API OIDC server adapters, whose source generators emit it onto a generated model whenever the corresponding core property carries the declarative `AllowedValues` marker\. ```csharp public class AllowedValuesAttribute : System.ComponentModel.DataAnnotations.ValidationAttribute ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [System\.Attribute](https://learn.microsoft.com/en-us/dotnet/api/system.attribute 'System\.Attribute') → [System\.ComponentModel\.DataAnnotations\.ValidationAttribute](https://learn.microsoft.com/en-us/dotnet/api/system.componentmodel.dataannotations.validationattribute 'System\.ComponentModel\.DataAnnotations\.ValidationAttribute') → AllowedValuesAttribute ### Constructors ## AllowedValuesAttribute\(string\[\]\) Constructor {#Abblix.Utils.Validation.AllowedValuesAttribute.AllowedValuesAttribute(string[])} A validation attribute that restricts a string \(or string\-collection\) value to a fixed set, matched exactly\. An absent value passes: whether a member is required is a separate question, asked by a separate attribute, which is why the framework's own `AllowedValues` cannot stand in for this one \- it refuses null\. Shared by the MVC and Minimal API OIDC server adapters, whose source generators emit it onto a generated model whenever the corresponding core property carries the declarative `AllowedValues` marker\. ```csharp public AllowedValuesAttribute(params string[] allowedValues); ``` #### Parameters `allowedValues` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') --- Source: https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Validation.ElementsRequiredAttribute.md #### [Abblix\.Utils](https://www.abblix.com/en/docs/api/abblix-utils 'index') ### [Abblix\.Utils\.Validation](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Validation 'Abblix\.Utils\.Validation') ## ElementsRequiredAttribute Class A validation attribute that rejects a collection containing a null element; a non\-collection value is left untouched\. Shared by the MVC and Minimal API OIDC server adapters, whose source generators emit it from the declarative core `ElementsRequired` marker\. ```csharp public sealed class ElementsRequiredAttribute : System.ComponentModel.DataAnnotations.ValidationAttribute ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [System\.Attribute](https://learn.microsoft.com/en-us/dotnet/api/system.attribute 'System\.Attribute') → [System\.ComponentModel\.DataAnnotations\.ValidationAttribute](https://learn.microsoft.com/en-us/dotnet/api/system.componentmodel.dataannotations.validationattribute 'System\.ComponentModel\.DataAnnotations\.ValidationAttribute') → ElementsRequiredAttribute --- Source: https://www.abblix.com/en/docs/api/abblix-utils/System.Buffers.Text.md #### [Abblix\.Utils](https://www.abblix.com/en/docs/api/abblix-utils 'index') ## System\.Buffers\.Text Namespace | Classes | | | :--- | :--- | | [Base64Url](https://www.abblix.com/en/docs/api/abblix-utils/System.Buffers.Text.Base64Url 'System\.Buffers\.Text\.Base64Url') | Polyfill of the BCL [Base64Url](https://www.abblix.com/en/docs/api/abblix-utils/System.Buffers.Text.Base64Url 'System\.Buffers\.Text\.Base64Url') shipping in net9\.0\+, providing strict RFC 7515 §3 \(and RFC 4648 §5\) base64url decoding/encoding without padding for the net8\.0 target\. The shape mirrors the BCL surface so consumer code references `System.Buffers.Text.Base64Url` uniformly across all TFMs we ship to\. Removed in the same commit that drops the net8\.0 target after net8\.0 reaches end\-of\-life on 2026\-11\-10\. | --- Source: https://www.abblix.com/en/docs/api/abblix-utils/System.Buffers.Text.Base64Url.md #### [Abblix\.Utils](https://www.abblix.com/en/docs/api/abblix-utils 'index') ### [System\.Buffers\.Text](https://www.abblix.com/en/docs/api/abblix-utils/System.Buffers.Text 'System\.Buffers\.Text') ## Base64Url Class Polyfill of the BCL [Base64Url](https://www.abblix.com/en/docs/api/abblix-utils/System.Buffers.Text.Base64Url 'System\.Buffers\.Text\.Base64Url') shipping in net9\.0\+, providing strict RFC 7515 §3 \(and RFC 4648 §5\) base64url decoding/encoding without padding for the net8\.0 target\. The shape mirrors the BCL surface so consumer code references `System.Buffers.Text.Base64Url` uniformly across all TFMs we ship to\. Removed in the same commit that drops the net8\.0 target after net8\.0 reaches end\-of\-life on 2026\-11\-10\. ```csharp public static class Base64Url ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → Base64Url ### Methods ## Base64Url\.DecodeFromChars\(ReadOnlySpan\\) Method {#System.Buffers.Text.Base64Url.DecodeFromChars(System.ReadOnlySpan_char_)} Decodes a base64url\-encoded character span into a byte array\. Strict per RFC 7515 §3: rejects characters outside the alphabet `A-Z a-z 0-9 - _`, rejects standard\-base64 alphabet characters `+` and `/`, rejects padding `=`, and rejects inputs whose length leaves `length mod 4 == 1`\. ```csharp public static byte[] DecodeFromChars(System.ReadOnlySpan source); ``` #### Parameters ###### `source` [System\.ReadOnlySpan<](https://learn.microsoft.com/en-us/dotnet/api/system.readonlyspan-1 'System\.ReadOnlySpan\`1')[System\.Char](https://learn.microsoft.com/en-us/dotnet/api/system.char 'System\.Char')[>](https://learn.microsoft.com/en-us/dotnet/api/system.readonlyspan-1 'System\.ReadOnlySpan\`1') {#System.Buffers.Text.Base64Url.DecodeFromChars(System.ReadOnlySpan_char_).source} The base64url\-encoded characters\. #### Returns [System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') The decoded bytes; an empty array when [source](https://www.abblix.com/en/docs/api/abblix-utils/System.Buffers.Text.Base64Url#System.Buffers.Text.Base64Url.DecodeFromChars(System.ReadOnlySpan_char_).source 'System\.Buffers\.Text\.Base64Url\.DecodeFromChars\(System\.ReadOnlySpan\\)\.source') is empty\. #### Exceptions [System\.FormatException](https://learn.microsoft.com/en-us/dotnet/api/system.formatexception 'System\.FormatException') Thrown when [source](https://www.abblix.com/en/docs/api/abblix-utils/System.Buffers.Text.Base64Url#System.Buffers.Text.Base64Url.DecodeFromChars(System.ReadOnlySpan_char_).source 'System\.Buffers\.Text\.Base64Url\.DecodeFromChars\(System\.ReadOnlySpan\\)\.source') contains a character outside the base64url alphabet, or when its length leaves a 1\-character remainder modulo 4\. ## Base64Url\.EncodeToString\(ReadOnlySpan\\) Method {#System.Buffers.Text.Base64Url.EncodeToString(System.ReadOnlySpan_byte_)} Encodes a byte span as a base64url string per RFC 7515 §3, without trailing padding\. Replaces standard\-base64 `+` with `-` and `/` with `_`\. ```csharp public static string EncodeToString(System.ReadOnlySpan source); ``` #### Parameters ###### `source` [System\.ReadOnlySpan<](https://learn.microsoft.com/en-us/dotnet/api/system.readonlyspan-1 'System\.ReadOnlySpan\`1')[System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[>](https://learn.microsoft.com/en-us/dotnet/api/system.readonlyspan-1 'System\.ReadOnlySpan\`1') {#System.Buffers.Text.Base64Url.EncodeToString(System.ReadOnlySpan_byte_).source} The bytes to encode\. #### Returns [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') The base64url\-encoded string; [System\.String\.Empty](https://learn.microsoft.com/en-us/dotnet/api/system.string.empty 'System\.String\.Empty') when [source](https://www.abblix.com/en/docs/api/abblix-utils/System.Buffers.Text.Base64Url#System.Buffers.Text.Base64Url.EncodeToString(System.ReadOnlySpan_byte_).source 'System\.Buffers\.Text\.Base64Url\.EncodeToString\(System\.ReadOnlySpan\\)\.source') is empty\. ## Base64Url\.TryDecodeFromChars\(ReadOnlySpan\, Span\, int\) Method {#System.Buffers.Text.Base64Url.TryDecodeFromChars(System.ReadOnlySpan_char_,System.Span_byte_,int)} Decodes a base64url\-encoded character span into [destination](https://www.abblix.com/en/docs/api/abblix-utils/System.Buffers.Text.Base64Url#System.Buffers.Text.Base64Url.TryDecodeFromChars(System.ReadOnlySpan_char_,System.Span_byte_,int).destination 'System\.Buffers\.Text\.Base64Url\.TryDecodeFromChars\(System\.ReadOnlySpan\, System\.Span\, int\)\.destination')\. Mirrors the \.NET 9\+ BCL surface so consumer code can use a single call shape across TFMs\. Returns `false` when [destination](https://www.abblix.com/en/docs/api/abblix-utils/System.Buffers.Text.Base64Url#System.Buffers.Text.Base64Url.TryDecodeFromChars(System.ReadOnlySpan_char_,System.Span_byte_,int).destination 'System\.Buffers\.Text\.Base64Url\.TryDecodeFromChars\(System\.ReadOnlySpan\, System\.Span\, int\)\.destination') is too small to hold the decoded bytes; throws [System\.FormatException](https://learn.microsoft.com/en-us/dotnet/api/system.formatexception 'System\.FormatException') on invalid characters or length\-mod\-4\-of\-1 inputs, matching BCL semantics \- the "Try" prefix here covers buffer\-size failures, not malformed input\. ```csharp public static bool TryDecodeFromChars(System.ReadOnlySpan source, System.Span destination, out int bytesWritten); ``` #### Parameters ###### `source` [System\.ReadOnlySpan<](https://learn.microsoft.com/en-us/dotnet/api/system.readonlyspan-1 'System\.ReadOnlySpan\`1')[System\.Char](https://learn.microsoft.com/en-us/dotnet/api/system.char 'System\.Char')[>](https://learn.microsoft.com/en-us/dotnet/api/system.readonlyspan-1 'System\.ReadOnlySpan\`1') {#System.Buffers.Text.Base64Url.TryDecodeFromChars(System.ReadOnlySpan_char_,System.Span_byte_,int).source} The base64url\-encoded characters\. ###### `destination` [System\.Span<](https://learn.microsoft.com/en-us/dotnet/api/system.span-1 'System\.Span\`1')[System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[>](https://learn.microsoft.com/en-us/dotnet/api/system.span-1 'System\.Span\`1') {#System.Buffers.Text.Base64Url.TryDecodeFromChars(System.ReadOnlySpan_char_,System.Span_byte_,int).destination} Buffer to receive the decoded bytes\. ###### `bytesWritten` [System\.Int32](https://learn.microsoft.com/en-us/dotnet/api/system.int32 'System\.Int32') {#System.Buffers.Text.Base64Url.TryDecodeFromChars(System.ReadOnlySpan_char_,System.Span_byte_,int).bytesWritten} On success, the number of bytes written into [destination](https://www.abblix.com/en/docs/api/abblix-utils/System.Buffers.Text.Base64Url#System.Buffers.Text.Base64Url.TryDecodeFromChars(System.ReadOnlySpan_char_,System.Span_byte_,int).destination 'System\.Buffers\.Text\.Base64Url\.TryDecodeFromChars\(System\.ReadOnlySpan\, System\.Span\, int\)\.destination'); otherwise `0`\. #### Returns [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') `true` on successful decode; `false` when the destination is too small\. #### Exceptions [System\.FormatException](https://learn.microsoft.com/en-us/dotnet/api/system.formatexception 'System\.FormatException') Thrown when [source](https://www.abblix.com/en/docs/api/abblix-utils/System.Buffers.Text.Base64Url#System.Buffers.Text.Base64Url.TryDecodeFromChars(System.ReadOnlySpan_char_,System.Span_byte_,int).source 'System\.Buffers\.Text\.Base64Url\.TryDecodeFromChars\(System\.ReadOnlySpan\, System\.Span\, int\)\.source') contains a character outside the base64url alphabet, or when its length leaves a 1\-character remainder modulo 4\. --- Source: https://www.abblix.com/en/docs/api/abblix-utils/System.Threading.md #### [Abblix\.Utils](https://www.abblix.com/en/docs/api/abblix-utils 'index') ## System\.Threading Namespace | Classes | | | :--- | :--- | | [Lock](https://www.abblix.com/en/docs/api/abblix-utils/System.Threading.Lock 'System\.Threading\.Lock') | Stands in for `System.Threading.Lock`, which arrived in \.NET 9\. | | Structs | | | :--- | :--- | | [Lock\.Scope](https://www.abblix.com/en/docs/api/abblix-utils/System.Threading.Lock.Scope 'System\.Threading\.Lock\.Scope') | The holder of an entered lock, which releases it when disposed\. | --- Source: https://www.abblix.com/en/docs/api/abblix-utils/System.Threading.Lock.md #### [Abblix\.Utils](https://www.abblix.com/en/docs/api/abblix-utils 'index') ### [System\.Threading](https://www.abblix.com/en/docs/api/abblix-utils/System.Threading 'System\.Threading') ## Lock Class Stands in for `System.Threading.Lock`, which arrived in \.NET 9\. ```csharp public sealed class Lock ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → Lock ### Remarks Lets a single source file use the newer mutual\-exclusion type across every target this library supports\. On \.NET 9 and later the real type is used, and the compiler lowers `lock` on it to [EnterScope\(\)](https://www.abblix.com/en/docs/api/abblix-utils/System.Threading.Lock#System.Threading.Lock.EnterScope() 'System\.Threading\.Lock\.EnterScope\(\)'); on \.NET 8 this stands in and the same statement lowers to `Monitor`, which is what the code would have used anyway\. The shape mirrors the real type only as far as `lock` needs, because that is all this exists for: nothing should take a dependency on a polyfill beyond the syntax it enables\. ### Methods ## Lock\.EnterScope\(\) Method {#System.Threading.Lock.EnterScope()} Enters the lock, returning a scope that leaves it when disposed\. ```csharp public System.Threading.Lock.Scope EnterScope(); ``` #### Returns [Scope](https://www.abblix.com/en/docs/api/abblix-utils/System.Threading.Lock.Scope 'System\.Threading\.Lock\.Scope') --- Source: https://www.abblix.com/en/docs/api/abblix-utils/System.Threading.Lock.Scope.md #### [Abblix\.Utils](https://www.abblix.com/en/docs/api/abblix-utils 'index') ### [System\.Threading](https://www.abblix.com/en/docs/api/abblix-utils/System.Threading 'System\.Threading').[Lock](https://www.abblix.com/en/docs/api/abblix-utils/System.Threading.Lock 'System\.Threading\.Lock') ## Lock\.Scope Struct The holder of an entered lock, which releases it when disposed\. ```csharp public ref struct Lock.Scope ``` ### Methods ## Lock\.Scope\.Dispose\(\) Method {#System.Threading.Lock.Scope.Dispose()} Leaves the lock\. ```csharp public void Dispose(); ``` --- Source: https://www.abblix.com/en/docs/api/abblix-dependencyinjection.md #### [Abblix\.DependencyInjection](https://www.abblix.com/en/docs/api/abblix-dependencyinjection 'index') ## Abblix\.DependencyInjection Assembly | Namespaces | | | :--- | :--- | | [Abblix\.DependencyInjection](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection 'Abblix\.DependencyInjection') | | --- Source: https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.md #### [Abblix\.DependencyInjection](https://www.abblix.com/en/docs/api/abblix-dependencyinjection 'index') ## Abblix\.DependencyInjection Namespace | Classes | | | :--- | :--- | | [ServiceCollectionExtensions](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.ServiceCollectionExtensions 'Abblix\.DependencyInjection\.ServiceCollectionExtensions') | Provides extension methods for [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') to enhance dependency injection capabilities\. | | Structs | | | :--- | :--- | | [Dependency](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.Dependency 'Abblix\.DependencyInjection\.Dependency') | Represents a dependency that can be overridden in a service provider\. This struct provides various static methods to create dependency overrides based on type, instance, or factory functions\. | | Interfaces | | | :--- | :--- | | [IComposition<TInterface>](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.IComposition_TInterface_ 'Abblix\.DependencyInjection\.IComposition\') | A live editing cursor over a family's members\. Returned by [Decompose<TInterface>\(this IServiceCollection\)](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.ServiceCollectionExtensions#Abblix.DependencyInjection.ServiceCollectionExtensions.Decompose_TInterface_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection) 'Abblix\.DependencyInjection\.ServiceCollectionExtensions\.Decompose\\(this Microsoft\.Extensions\.DependencyInjection\.IServiceCollection\)'), it is an [System\.Collections\.Generic\.IList<>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ilist-1 'System\.Collections\.Generic\.IList\`1') of the member descriptors backed directly by the service collection: inserting, removing or reordering through it mutates the family's registrations in place\. A composed family's composite reads its members via `GetKeyedServices` at resolve time, so edits made through the cursor take effect with no separate recompose step \- the members simply differ when the composite is finally resolved\. | --- Source: https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.Dependency.md #### [Abblix\.DependencyInjection](https://www.abblix.com/en/docs/api/abblix-dependencyinjection 'index') ### [Abblix\.DependencyInjection](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection 'Abblix\.DependencyInjection') ## Dependency Struct Represents a dependency that can be overridden in a service provider\. This struct provides various static methods to create dependency overrides based on type, instance, or factory functions\. ```csharp public readonly struct Dependency ``` ### Methods ## Dependency\.Override\(Type, object\) Method {#Abblix.DependencyInjection.Dependency.Override(System.Type,object)} Creates a dependency override with a specific instance for the declared type\. ```csharp public static Abblix.DependencyInjection.Dependency Override(System.Type declared, object instance); ``` #### Parameters ###### `declared` [System\.Type](https://learn.microsoft.com/en-us/dotnet/api/system.type 'System\.Type') {#Abblix.DependencyInjection.Dependency.Override(System.Type,object).declared} The declared type of the dependency\. ###### `instance` [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') {#Abblix.DependencyInjection.Dependency.Override(System.Type,object).instance} The instance to use for the dependency\. #### Returns [Dependency](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.Dependency 'Abblix\.DependencyInjection\.Dependency') A new [Dependency](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.Dependency 'Abblix\.DependencyInjection\.Dependency') instance\. ## Dependency\.Override\(Type, Func\\) Method {#Abblix.DependencyInjection.Dependency.Override(System.Type,System.Func_System.IServiceProvider,object_)} Creates a dependency override using a factory function for the declared type\. ```csharp public static Abblix.DependencyInjection.Dependency Override(System.Type declared, System.Func factory); ``` #### Parameters ###### `declared` [System\.Type](https://learn.microsoft.com/en-us/dotnet/api/system.type 'System\.Type') {#Abblix.DependencyInjection.Dependency.Override(System.Type,System.Func_System.IServiceProvider,object_).declared} The declared type of the dependency\. ###### `factory` [System\.Func<](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2')[System\.IServiceProvider](https://learn.microsoft.com/en-us/dotnet/api/system.iserviceprovider 'System\.IServiceProvider')[,](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2')[System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object')[>](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2') {#Abblix.DependencyInjection.Dependency.Override(System.Type,System.Func_System.IServiceProvider,object_).factory} The factory function to create the dependency instance\. #### Returns [Dependency](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.Dependency 'Abblix\.DependencyInjection\.Dependency') A new [Dependency](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.Dependency 'Abblix\.DependencyInjection\.Dependency') instance\. ## Dependency\.Override\(Type, Type\) Method {#Abblix.DependencyInjection.Dependency.Override(System.Type,System.Type)} Creates a dependency override where a specified actual type fulfills the contract of a declared type\. ```csharp public static Abblix.DependencyInjection.Dependency Override(System.Type declared, System.Type actual); ``` #### Parameters ###### `declared` [System\.Type](https://learn.microsoft.com/en-us/dotnet/api/system.type 'System\.Type') {#Abblix.DependencyInjection.Dependency.Override(System.Type,System.Type).declared} The declared type of the dependency\. ###### `actual` [System\.Type](https://learn.microsoft.com/en-us/dotnet/api/system.type 'System\.Type') {#Abblix.DependencyInjection.Dependency.Override(System.Type,System.Type).actual} The actual type to be used as the implementation\. #### Returns [Dependency](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.Dependency 'Abblix\.DependencyInjection\.Dependency') A new [Dependency](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.Dependency 'Abblix\.DependencyInjection\.Dependency') instance\. ## Dependency\.Override\\(\) Method {#Abblix.DependencyInjection.Dependency.Override_TDeclared,TActual_()} Creates a dependency override where a specified actual type fulfills the contract of a declared type\. ```csharp public static Abblix.DependencyInjection.Dependency Override() where TActual : TDeclared; ``` #### Type parameters ###### `TDeclared` {#Abblix.DependencyInjection.Dependency.Override_TDeclared,TActual_().TDeclared} The declared type of the dependency\. ###### `TActual` {#Abblix.DependencyInjection.Dependency.Override_TDeclared,TActual_().TActual} The actual type to be used as the implementation\. #### Returns [Dependency](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.Dependency 'Abblix\.DependencyInjection\.Dependency') A new [Dependency](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.Dependency 'Abblix\.DependencyInjection\.Dependency') instance\. ## Dependency\.Override\\(Func\\) Method {#Abblix.DependencyInjection.Dependency.Override_TDeclared_(System.Func_System.IServiceProvider,TDeclared_)} Creates a dependency override using a factory function for the declared type\. ```csharp public static Abblix.DependencyInjection.Dependency Override(System.Func factory); ``` #### Type parameters ###### `TDeclared` {#Abblix.DependencyInjection.Dependency.Override_TDeclared_(System.Func_System.IServiceProvider,TDeclared_).TDeclared} The declared type of the dependency\. #### Parameters ###### `factory` [System\.Func<](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2')[System\.IServiceProvider](https://learn.microsoft.com/en-us/dotnet/api/system.iserviceprovider 'System\.IServiceProvider')[,](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2')[TDeclared](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.Dependency#Abblix.DependencyInjection.Dependency.Override_TDeclared_(System.Func_System.IServiceProvider,TDeclared_).TDeclared 'Abblix\.DependencyInjection\.Dependency\.Override\\(System\.Func\\)\.TDeclared')[>](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2') {#Abblix.DependencyInjection.Dependency.Override_TDeclared_(System.Func_System.IServiceProvider,TDeclared_).factory} The factory function to create the dependency instance\. #### Returns [Dependency](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.Dependency 'Abblix\.DependencyInjection\.Dependency') A new [Dependency](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.Dependency 'Abblix\.DependencyInjection\.Dependency') instance\. ## Dependency\.Override\\(TDeclared\) Method {#Abblix.DependencyInjection.Dependency.Override_TDeclared_(TDeclared)} Creates a dependency override with a specific instance for the declared type\. ```csharp public static Abblix.DependencyInjection.Dependency Override(TDeclared instance); ``` #### Type parameters ###### `TDeclared` {#Abblix.DependencyInjection.Dependency.Override_TDeclared_(TDeclared).TDeclared} The declared type of the dependency\. #### Parameters ###### `instance` [TDeclared](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.Dependency#Abblix.DependencyInjection.Dependency.Override_TDeclared_(TDeclared).TDeclared 'Abblix\.DependencyInjection\.Dependency\.Override\\(TDeclared\)\.TDeclared') {#Abblix.DependencyInjection.Dependency.Override_TDeclared_(TDeclared).instance} The instance to use for the dependency\. #### Returns [Dependency](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.Dependency 'Abblix\.DependencyInjection\.Dependency') A new [Dependency](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.Dependency 'Abblix\.DependencyInjection\.Dependency') instance\. --- Source: https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.IComposition_TInterface_.md #### [Abblix\.DependencyInjection](https://www.abblix.com/en/docs/api/abblix-dependencyinjection 'index') ### [Abblix\.DependencyInjection](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection 'Abblix\.DependencyInjection') ## IComposition\ Interface A live editing cursor over a family's members\. Returned by [Decompose<TInterface>\(this IServiceCollection\)](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.ServiceCollectionExtensions#Abblix.DependencyInjection.ServiceCollectionExtensions.Decompose_TInterface_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection) 'Abblix\.DependencyInjection\.ServiceCollectionExtensions\.Decompose\\(this Microsoft\.Extensions\.DependencyInjection\.IServiceCollection\)'), it is an [System\.Collections\.Generic\.IList<>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ilist-1 'System\.Collections\.Generic\.IList\`1') of the member descriptors backed directly by the service collection: inserting, removing or reordering through it mutates the family's registrations in place\. A composed family's composite reads its members via `GetKeyedServices` at resolve time, so edits made through the cursor take effect with no separate recompose step \- the members simply differ when the composite is finally resolved\. ```csharp public interface IComposition : System.Collections.Generic.IList, System.Collections.Generic.ICollection, System.Collections.Generic.IEnumerable, System.Collections.IEnumerable where TInterface : class ``` #### Type parameters ###### `TInterface` {#Abblix.DependencyInjection.IComposition_TInterface_.TInterface} The composed interface type\. Implements [System\.Collections\.Generic\.IList<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ilist-1 'System\.Collections\.Generic\.IList\`1')[Microsoft\.Extensions\.DependencyInjection\.ServiceDescriptor](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.servicedescriptor 'Microsoft\.Extensions\.DependencyInjection\.ServiceDescriptor')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ilist-1 'System\.Collections\.Generic\.IList\`1'), [System\.Collections\.Generic\.ICollection<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.icollection-1 'System\.Collections\.Generic\.ICollection\`1')[Microsoft\.Extensions\.DependencyInjection\.ServiceDescriptor](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.servicedescriptor 'Microsoft\.Extensions\.DependencyInjection\.ServiceDescriptor')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.icollection-1 'System\.Collections\.Generic\.ICollection\`1'), [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[Microsoft\.Extensions\.DependencyInjection\.ServiceDescriptor](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.servicedescriptor 'Microsoft\.Extensions\.DependencyInjection\.ServiceDescriptor')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1'), [System\.Collections\.IEnumerable](https://learn.microsoft.com/en-us/dotnet/api/system.collections.ienumerable 'System\.Collections\.IEnumerable') ### Remarks The position\-aware editing methods live here rather than as extension methods so that [TInterface](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.IComposition_TInterface_#Abblix.DependencyInjection.IComposition_TInterface_.TInterface 'Abblix\.DependencyInjection\.IComposition\\.TInterface') is bound by the cursor and never repeated at the call site \- only the anchor type is named \(`composition.AddAfter(step)`\)\. Each returns the cursor, so edits chain, and each anchor is matched by implementation type, throwing when the anchor is not a member\. ### Methods ## IComposition\\.AddAfter\\(ServiceDescriptor\) Method {#Abblix.DependencyInjection.IComposition_TInterface_.AddAfter_TExisting_(Microsoft.Extensions.DependencyInjection.ServiceDescriptor)} Inserts [member](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.IComposition_TInterface_#Abblix.DependencyInjection.IComposition_TInterface_.AddAfter_TExisting_(Microsoft.Extensions.DependencyInjection.ServiceDescriptor).member 'Abblix\.DependencyInjection\.IComposition\\.AddAfter\\(Microsoft\.Extensions\.DependencyInjection\.ServiceDescriptor\)\.member') immediately after the existing [TExisting](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.IComposition_TInterface_#Abblix.DependencyInjection.IComposition_TInterface_.AddAfter_TExisting_(Microsoft.Extensions.DependencyInjection.ServiceDescriptor).TExisting 'Abblix\.DependencyInjection\.IComposition\\.AddAfter\\(Microsoft\.Extensions\.DependencyInjection\.ServiceDescriptor\)\.TExisting') step\. ```csharp Abblix.DependencyInjection.IComposition AddAfter(Microsoft.Extensions.DependencyInjection.ServiceDescriptor member) where TExisting : TInterface; ``` #### Type parameters ###### `TExisting` {#Abblix.DependencyInjection.IComposition_TInterface_.AddAfter_TExisting_(Microsoft.Extensions.DependencyInjection.ServiceDescriptor).TExisting} #### Parameters ###### `member` [Microsoft\.Extensions\.DependencyInjection\.ServiceDescriptor](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.servicedescriptor 'Microsoft\.Extensions\.DependencyInjection\.ServiceDescriptor') {#Abblix.DependencyInjection.IComposition_TInterface_.AddAfter_TExisting_(Microsoft.Extensions.DependencyInjection.ServiceDescriptor).member} #### Returns [Abblix\.DependencyInjection\.IComposition<](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.IComposition_TInterface_ 'Abblix\.DependencyInjection\.IComposition\')[TInterface](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.IComposition_TInterface_#Abblix.DependencyInjection.IComposition_TInterface_.TInterface 'Abblix\.DependencyInjection\.IComposition\\.TInterface')[>](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.IComposition_TInterface_ 'Abblix\.DependencyInjection\.IComposition\') ## IComposition\\.AddBefore\\(ServiceDescriptor\) Method {#Abblix.DependencyInjection.IComposition_TInterface_.AddBefore_TExisting_(Microsoft.Extensions.DependencyInjection.ServiceDescriptor)} Inserts [member](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.IComposition_TInterface_#Abblix.DependencyInjection.IComposition_TInterface_.AddBefore_TExisting_(Microsoft.Extensions.DependencyInjection.ServiceDescriptor).member 'Abblix\.DependencyInjection\.IComposition\\.AddBefore\\(Microsoft\.Extensions\.DependencyInjection\.ServiceDescriptor\)\.member') immediately before the existing [TExisting](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.IComposition_TInterface_#Abblix.DependencyInjection.IComposition_TInterface_.AddBefore_TExisting_(Microsoft.Extensions.DependencyInjection.ServiceDescriptor).TExisting 'Abblix\.DependencyInjection\.IComposition\\.AddBefore\\(Microsoft\.Extensions\.DependencyInjection\.ServiceDescriptor\)\.TExisting') step\. ```csharp Abblix.DependencyInjection.IComposition AddBefore(Microsoft.Extensions.DependencyInjection.ServiceDescriptor member) where TExisting : TInterface; ``` #### Type parameters ###### `TExisting` {#Abblix.DependencyInjection.IComposition_TInterface_.AddBefore_TExisting_(Microsoft.Extensions.DependencyInjection.ServiceDescriptor).TExisting} #### Parameters ###### `member` [Microsoft\.Extensions\.DependencyInjection\.ServiceDescriptor](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.servicedescriptor 'Microsoft\.Extensions\.DependencyInjection\.ServiceDescriptor') {#Abblix.DependencyInjection.IComposition_TInterface_.AddBefore_TExisting_(Microsoft.Extensions.DependencyInjection.ServiceDescriptor).member} #### Returns [Abblix\.DependencyInjection\.IComposition<](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.IComposition_TInterface_ 'Abblix\.DependencyInjection\.IComposition\')[TInterface](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.IComposition_TInterface_#Abblix.DependencyInjection.IComposition_TInterface_.TInterface 'Abblix\.DependencyInjection\.IComposition\\.TInterface')[>](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.IComposition_TInterface_ 'Abblix\.DependencyInjection\.IComposition\') ## IComposition\\.AddFirst\(ServiceDescriptor\) Method {#Abblix.DependencyInjection.IComposition_TInterface_.AddFirst(Microsoft.Extensions.DependencyInjection.ServiceDescriptor)} Inserts [member](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.IComposition_TInterface_#Abblix.DependencyInjection.IComposition_TInterface_.AddFirst(Microsoft.Extensions.DependencyInjection.ServiceDescriptor).member 'Abblix\.DependencyInjection\.IComposition\\.AddFirst\(Microsoft\.Extensions\.DependencyInjection\.ServiceDescriptor\)\.member') as the first step of the family\. ```csharp Abblix.DependencyInjection.IComposition AddFirst(Microsoft.Extensions.DependencyInjection.ServiceDescriptor member); ``` #### Parameters ###### `member` [Microsoft\.Extensions\.DependencyInjection\.ServiceDescriptor](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.servicedescriptor 'Microsoft\.Extensions\.DependencyInjection\.ServiceDescriptor') {#Abblix.DependencyInjection.IComposition_TInterface_.AddFirst(Microsoft.Extensions.DependencyInjection.ServiceDescriptor).member} #### Returns [Abblix\.DependencyInjection\.IComposition<](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.IComposition_TInterface_ 'Abblix\.DependencyInjection\.IComposition\')[TInterface](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.IComposition_TInterface_#Abblix.DependencyInjection.IComposition_TInterface_.TInterface 'Abblix\.DependencyInjection\.IComposition\\.TInterface')[>](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.IComposition_TInterface_ 'Abblix\.DependencyInjection\.IComposition\') ## IComposition\\.AddLast\(ServiceDescriptor\) Method {#Abblix.DependencyInjection.IComposition_TInterface_.AddLast(Microsoft.Extensions.DependencyInjection.ServiceDescriptor)} Ensures [member](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.IComposition_TInterface_#Abblix.DependencyInjection.IComposition_TInterface_.AddLast(Microsoft.Extensions.DependencyInjection.ServiceDescriptor).member 'Abblix\.DependencyInjection\.IComposition\\.AddLast\(Microsoft\.Extensions\.DependencyInjection\.ServiceDescriptor\)\.member') is in the family, appending it as the last step when it is not\. A member already there stays where it is: a family holds one member per implementation type, so there is nothing to add and no second copy to place\. ```csharp Abblix.DependencyInjection.IComposition AddLast(Microsoft.Extensions.DependencyInjection.ServiceDescriptor member); ``` #### Parameters ###### `member` [Microsoft\.Extensions\.DependencyInjection\.ServiceDescriptor](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.servicedescriptor 'Microsoft\.Extensions\.DependencyInjection\.ServiceDescriptor') {#Abblix.DependencyInjection.IComposition_TInterface_.AddLast(Microsoft.Extensions.DependencyInjection.ServiceDescriptor).member} #### Returns [Abblix\.DependencyInjection\.IComposition<](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.IComposition_TInterface_ 'Abblix\.DependencyInjection\.IComposition\')[TInterface](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.IComposition_TInterface_#Abblix.DependencyInjection.IComposition_TInterface_.TInterface 'Abblix\.DependencyInjection\.IComposition\\.TInterface')[>](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.IComposition_TInterface_ 'Abblix\.DependencyInjection\.IComposition\') ## IComposition\\.Remove\\(\) Method {#Abblix.DependencyInjection.IComposition_TInterface_.Remove_TExisting_()} Removes the existing [TExisting](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.IComposition_TInterface_#Abblix.DependencyInjection.IComposition_TInterface_.Remove_TExisting_().TExisting 'Abblix\.DependencyInjection\.IComposition\\.Remove\\(\)\.TExisting') step from the family\. ```csharp Abblix.DependencyInjection.IComposition Remove() where TExisting : TInterface; ``` #### Type parameters ###### `TExisting` {#Abblix.DependencyInjection.IComposition_TInterface_.Remove_TExisting_().TExisting} #### Returns [Abblix\.DependencyInjection\.IComposition<](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.IComposition_TInterface_ 'Abblix\.DependencyInjection\.IComposition\')[TInterface](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.IComposition_TInterface_#Abblix.DependencyInjection.IComposition_TInterface_.TInterface 'Abblix\.DependencyInjection\.IComposition\\.TInterface')[>](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.IComposition_TInterface_ 'Abblix\.DependencyInjection\.IComposition\') ## IComposition\\.Replace\\(ServiceDescriptor\) Method {#Abblix.DependencyInjection.IComposition_TInterface_.Replace_TExisting_(Microsoft.Extensions.DependencyInjection.ServiceDescriptor)} Replaces the existing [TExisting](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.IComposition_TInterface_#Abblix.DependencyInjection.IComposition_TInterface_.Replace_TExisting_(Microsoft.Extensions.DependencyInjection.ServiceDescriptor).TExisting 'Abblix\.DependencyInjection\.IComposition\\.Replace\\(Microsoft\.Extensions\.DependencyInjection\.ServiceDescriptor\)\.TExisting') step with [member](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.IComposition_TInterface_#Abblix.DependencyInjection.IComposition_TInterface_.Replace_TExisting_(Microsoft.Extensions.DependencyInjection.ServiceDescriptor).member 'Abblix\.DependencyInjection\.IComposition\\.Replace\\(Microsoft\.Extensions\.DependencyInjection\.ServiceDescriptor\)\.member'), keeping its position\. ```csharp Abblix.DependencyInjection.IComposition Replace(Microsoft.Extensions.DependencyInjection.ServiceDescriptor member) where TExisting : TInterface; ``` #### Type parameters ###### `TExisting` {#Abblix.DependencyInjection.IComposition_TInterface_.Replace_TExisting_(Microsoft.Extensions.DependencyInjection.ServiceDescriptor).TExisting} #### Parameters ###### `member` [Microsoft\.Extensions\.DependencyInjection\.ServiceDescriptor](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.servicedescriptor 'Microsoft\.Extensions\.DependencyInjection\.ServiceDescriptor') {#Abblix.DependencyInjection.IComposition_TInterface_.Replace_TExisting_(Microsoft.Extensions.DependencyInjection.ServiceDescriptor).member} #### Returns [Abblix\.DependencyInjection\.IComposition<](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.IComposition_TInterface_ 'Abblix\.DependencyInjection\.IComposition\')[TInterface](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.IComposition_TInterface_#Abblix.DependencyInjection.IComposition_TInterface_.TInterface 'Abblix\.DependencyInjection\.IComposition\\.TInterface')[>](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.IComposition_TInterface_ 'Abblix\.DependencyInjection\.IComposition\') --- Source: https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.ServiceCollectionExtensions.md #### [Abblix\.DependencyInjection](https://www.abblix.com/en/docs/api/abblix-dependencyinjection 'index') ### [Abblix\.DependencyInjection](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection 'Abblix\.DependencyInjection') ## ServiceCollectionExtensions Class Provides extension methods for [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') to enhance dependency injection capabilities\. ```csharp public static class ServiceCollectionExtensions ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ServiceCollectionExtensions ### Methods ## ServiceCollectionExtensions\.AddAlias\\(this IServiceCollection\) Method {#Abblix.DependencyInjection.ServiceCollectionExtensions.AddAlias_TService,TImplementation_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection)} Creates an alias registration that allows resolving a service through a different interface or type\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection AddAlias(this Microsoft.Extensions.DependencyInjection.IServiceCollection services) where TService : class where TImplementation : class, TService; ``` #### Type parameters ###### `TService` {#Abblix.DependencyInjection.ServiceCollectionExtensions.AddAlias_TService,TImplementation_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).TService} The service type for the alias registration\. ###### `TImplementation` {#Abblix.DependencyInjection.ServiceCollectionExtensions.AddAlias_TService,TImplementation_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).TImplementation} The implementation service type that is already registered\. #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.DependencyInjection.ServiceCollectionExtensions.AddAlias_TService,TImplementation_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).services} The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') to add the service to\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') The updated [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection')\. #### Exceptions [System\.InvalidOperationException](https://learn.microsoft.com/en-us/dotnet/api/system.invalidoperationexception 'System\.InvalidOperationException') Thrown when no registration is found for [TImplementation](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.ServiceCollectionExtensions#Abblix.DependencyInjection.ServiceCollectionExtensions.AddAlias_TService,TImplementation_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).TImplementation 'Abblix\.DependencyInjection\.ServiceCollectionExtensions\.AddAlias\\(this Microsoft\.Extensions\.DependencyInjection\.IServiceCollection\)\.TImplementation')\. ### Remarks This method creates an alias by cloning the source service descriptor with a new service type. The alias preserves the lifetime of the source registration (Singleton, Scoped, or Transient). For Singleton lifetime with factory-based registrations, ensures the same instance is returned when resolving through either the source type or the alias. For Scoped and Transient lifetimes, the alias resolves through the source service to maintain proper lifetime semantics. Supports both interface-to-interface aliasing (e.g., `AddAlias()`) and interface-to-implementation aliasing (e.g., `AddAlias()`). When multiple different source services are aliased to the same target interface, `IEnumerable` resolution returns instances from all aliases. ## ServiceCollectionExtensions\.AddKeyedAlias\\(this IServiceCollection, object, object\) Method {#Abblix.DependencyInjection.ServiceCollectionExtensions.AddKeyedAlias_TService,TSource_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,object,object)} Creates a keyed alias registration that allows resolving a service through a different interface or type with a specific key\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection AddKeyedAlias(this Microsoft.Extensions.DependencyInjection.IServiceCollection services, object? serviceKey, object? sourceKey=null) where TService : class where TSource : class; ``` #### Type parameters ###### `TService` {#Abblix.DependencyInjection.ServiceCollectionExtensions.AddKeyedAlias_TService,TSource_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,object,object).TService} The service type for the alias registration\. ###### `TSource` {#Abblix.DependencyInjection.ServiceCollectionExtensions.AddKeyedAlias_TService,TSource_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,object,object).TSource} The source service type that is already registered\. #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.DependencyInjection.ServiceCollectionExtensions.AddKeyedAlias_TService,TSource_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,object,object).services} The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') to add the service to\. ###### `serviceKey` [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') {#Abblix.DependencyInjection.ServiceCollectionExtensions.AddKeyedAlias_TService,TSource_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,object,object).serviceKey} The service key to associate with the alias\. ###### `sourceKey` [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') {#Abblix.DependencyInjection.ServiceCollectionExtensions.AddKeyedAlias_TService,TSource_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,object,object).sourceKey} The service key of the source registration\. Use null for non\-keyed source\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') The updated [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection')\. #### Exceptions [System\.InvalidOperationException](https://learn.microsoft.com/en-us/dotnet/api/system.invalidoperationexception 'System\.InvalidOperationException') Thrown when no registration is found for [TSource](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.ServiceCollectionExtensions#Abblix.DependencyInjection.ServiceCollectionExtensions.AddKeyedAlias_TService,TSource_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,object,object).TSource 'Abblix\.DependencyInjection\.ServiceCollectionExtensions\.AddKeyedAlias\\(this Microsoft\.Extensions\.DependencyInjection\.IServiceCollection, object, object\)\.TSource') with the specified [sourceKey](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.ServiceCollectionExtensions#Abblix.DependencyInjection.ServiceCollectionExtensions.AddKeyedAlias_TService,TSource_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,object,object).sourceKey 'Abblix\.DependencyInjection\.ServiceCollectionExtensions\.AddKeyedAlias\\(this Microsoft\.Extensions\.DependencyInjection\.IServiceCollection, object, object\)\.sourceKey')\. ### Remarks This method creates a keyed alias by cloning the source service descriptor with a new service type and key. The alias preserves the lifetime of the source registration (Singleton, Scoped, or Transient). For factory-based registrations, the alias resolves through the source service to maintain proper lifetime semantics. ## ServiceCollectionExtensions\.AddScoped\\(this IServiceCollection, Dependency\[\]\) Method {#Abblix.DependencyInjection.ServiceCollectionExtensions.AddScoped_T_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,Abblix.DependencyInjection.Dependency[])} Registers a scoped service of the type specified in [T](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.ServiceCollectionExtensions#Abblix.DependencyInjection.ServiceCollectionExtensions.AddScoped_T_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,Abblix.DependencyInjection.Dependency[]).T 'Abblix\.DependencyInjection\.ServiceCollectionExtensions\.AddScoped\\(this Microsoft\.Extensions\.DependencyInjection\.IServiceCollection, Abblix\.DependencyInjection\.Dependency\[\]\)\.T') with custom dependencies\. A scoped service is created once per request within the scope\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection AddScoped(this Microsoft.Extensions.DependencyInjection.IServiceCollection services, params Abblix.DependencyInjection.Dependency[] dependencies) where T : class; ``` #### Type parameters ###### `T` {#Abblix.DependencyInjection.ServiceCollectionExtensions.AddScoped_T_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,Abblix.DependencyInjection.Dependency[]).T} The type of the service to add\. #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.DependencyInjection.ServiceCollectionExtensions.AddScoped_T_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,Abblix.DependencyInjection.Dependency[]).services} The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') to add the service to\. ###### `dependencies` [Dependency](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.Dependency 'Abblix\.DependencyInjection\.Dependency')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.DependencyInjection.ServiceCollectionExtensions.AddScoped_T_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,Abblix.DependencyInjection.Dependency[]).dependencies} An array of [Dependency](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.Dependency 'Abblix\.DependencyInjection\.Dependency') objects representing additional dependencies required by the service\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') The updated [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection')\. ## ServiceCollectionExtensions\.AddScoped\\(this IServiceCollection, Dependency\[\]\) Method {#Abblix.DependencyInjection.ServiceCollectionExtensions.AddScoped_TService,TImplementation_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,Abblix.DependencyInjection.Dependency[])} Registers a scoped service with the implementation type specified in [TImplementation](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.ServiceCollectionExtensions#Abblix.DependencyInjection.ServiceCollectionExtensions.AddScoped_TService,TImplementation_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,Abblix.DependencyInjection.Dependency[]).TImplementation 'Abblix\.DependencyInjection\.ServiceCollectionExtensions\.AddScoped\\(this Microsoft\.Extensions\.DependencyInjection\.IServiceCollection, Abblix\.DependencyInjection\.Dependency\[\]\)\.TImplementation') and the service type specified in [TService](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.ServiceCollectionExtensions#Abblix.DependencyInjection.ServiceCollectionExtensions.AddScoped_TService,TImplementation_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,Abblix.DependencyInjection.Dependency[]).TService 'Abblix\.DependencyInjection\.ServiceCollectionExtensions\.AddScoped\\(this Microsoft\.Extensions\.DependencyInjection\.IServiceCollection, Abblix\.DependencyInjection\.Dependency\[\]\)\.TService') with custom dependencies\. A scoped service is created once per request within the scope\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection AddScoped(this Microsoft.Extensions.DependencyInjection.IServiceCollection services, params Abblix.DependencyInjection.Dependency[] dependencies) where TService : class where TImplementation : class, TService; ``` #### Type parameters ###### `TService` {#Abblix.DependencyInjection.ServiceCollectionExtensions.AddScoped_TService,TImplementation_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,Abblix.DependencyInjection.Dependency[]).TService} The type of the service to add\. ###### `TImplementation` {#Abblix.DependencyInjection.ServiceCollectionExtensions.AddScoped_TService,TImplementation_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,Abblix.DependencyInjection.Dependency[]).TImplementation} The type of the implementation to use\. #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.DependencyInjection.ServiceCollectionExtensions.AddScoped_TService,TImplementation_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,Abblix.DependencyInjection.Dependency[]).services} The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') to add the service to\. ###### `dependencies` [Dependency](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.Dependency 'Abblix\.DependencyInjection\.Dependency')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.DependencyInjection.ServiceCollectionExtensions.AddScoped_TService,TImplementation_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,Abblix.DependencyInjection.Dependency[]).dependencies} An array of [Dependency](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.Dependency 'Abblix\.DependencyInjection\.Dependency') objects representing additional dependencies required by the service\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') The updated [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection')\. ## ServiceCollectionExtensions\.AddSingleton\\(this IServiceCollection, Dependency\[\]\) Method {#Abblix.DependencyInjection.ServiceCollectionExtensions.AddSingleton_T_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,Abblix.DependencyInjection.Dependency[])} Registers a singleton service of the type specified in [T](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.ServiceCollectionExtensions#Abblix.DependencyInjection.ServiceCollectionExtensions.AddSingleton_T_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,Abblix.DependencyInjection.Dependency[]).T 'Abblix\.DependencyInjection\.ServiceCollectionExtensions\.AddSingleton\\(this Microsoft\.Extensions\.DependencyInjection\.IServiceCollection, Abblix\.DependencyInjection\.Dependency\[\]\)\.T') with custom dependencies\. A singleton service is created the first time it is requested, and subsequent requests use the same instance\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection AddSingleton(this Microsoft.Extensions.DependencyInjection.IServiceCollection services, params Abblix.DependencyInjection.Dependency[] dependencies) where T : class; ``` #### Type parameters ###### `T` {#Abblix.DependencyInjection.ServiceCollectionExtensions.AddSingleton_T_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,Abblix.DependencyInjection.Dependency[]).T} The type of the service to add\. #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.DependencyInjection.ServiceCollectionExtensions.AddSingleton_T_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,Abblix.DependencyInjection.Dependency[]).services} The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') to add the service to\. ###### `dependencies` [Dependency](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.Dependency 'Abblix\.DependencyInjection\.Dependency')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.DependencyInjection.ServiceCollectionExtensions.AddSingleton_T_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,Abblix.DependencyInjection.Dependency[]).dependencies} An array of [Dependency](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.Dependency 'Abblix\.DependencyInjection\.Dependency') objects representing additional dependencies required by the service\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') The updated [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection')\. ## ServiceCollectionExtensions\.AddSingleton\\(this IServiceCollection, Dependency\[\]\) Method {#Abblix.DependencyInjection.ServiceCollectionExtensions.AddSingleton_TService,TImplementation_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,Abblix.DependencyInjection.Dependency[])} Registers a singleton service with the implementation type specified in [TImplementation](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.ServiceCollectionExtensions#Abblix.DependencyInjection.ServiceCollectionExtensions.AddSingleton_TService,TImplementation_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,Abblix.DependencyInjection.Dependency[]).TImplementation 'Abblix\.DependencyInjection\.ServiceCollectionExtensions\.AddSingleton\\(this Microsoft\.Extensions\.DependencyInjection\.IServiceCollection, Abblix\.DependencyInjection\.Dependency\[\]\)\.TImplementation') and the service type specified in [TService](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.ServiceCollectionExtensions#Abblix.DependencyInjection.ServiceCollectionExtensions.AddSingleton_TService,TImplementation_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,Abblix.DependencyInjection.Dependency[]).TService 'Abblix\.DependencyInjection\.ServiceCollectionExtensions\.AddSingleton\\(this Microsoft\.Extensions\.DependencyInjection\.IServiceCollection, Abblix\.DependencyInjection\.Dependency\[\]\)\.TService') with custom dependencies\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection AddSingleton(this Microsoft.Extensions.DependencyInjection.IServiceCollection services, params Abblix.DependencyInjection.Dependency[] dependencies) where TService : class where TImplementation : class, TService; ``` #### Type parameters ###### `TService` {#Abblix.DependencyInjection.ServiceCollectionExtensions.AddSingleton_TService,TImplementation_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,Abblix.DependencyInjection.Dependency[]).TService} The type of the service to add\. ###### `TImplementation` {#Abblix.DependencyInjection.ServiceCollectionExtensions.AddSingleton_TService,TImplementation_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,Abblix.DependencyInjection.Dependency[]).TImplementation} The type of the implementation to use\. #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.DependencyInjection.ServiceCollectionExtensions.AddSingleton_TService,TImplementation_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,Abblix.DependencyInjection.Dependency[]).services} The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') to add the service to\. ###### `dependencies` [Dependency](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.Dependency 'Abblix\.DependencyInjection\.Dependency')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.DependencyInjection.ServiceCollectionExtensions.AddSingleton_TService,TImplementation_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,Abblix.DependencyInjection.Dependency[]).dependencies} An array of [Dependency](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.Dependency 'Abblix\.DependencyInjection\.Dependency') objects representing additional dependencies required by the service\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') The updated [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection')\. ## ServiceCollectionExtensions\.AddTransient\\(this IServiceCollection, Dependency\[\]\) Method {#Abblix.DependencyInjection.ServiceCollectionExtensions.AddTransient_T_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,Abblix.DependencyInjection.Dependency[])} Registers a transient service of the type specified in [T](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.ServiceCollectionExtensions#Abblix.DependencyInjection.ServiceCollectionExtensions.AddTransient_T_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,Abblix.DependencyInjection.Dependency[]).T 'Abblix\.DependencyInjection\.ServiceCollectionExtensions\.AddTransient\\(this Microsoft\.Extensions\.DependencyInjection\.IServiceCollection, Abblix\.DependencyInjection\.Dependency\[\]\)\.T') with custom dependencies\. Transient services are created each time they are requested\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection AddTransient(this Microsoft.Extensions.DependencyInjection.IServiceCollection services, params Abblix.DependencyInjection.Dependency[] dependencies) where T : class; ``` #### Type parameters ###### `T` {#Abblix.DependencyInjection.ServiceCollectionExtensions.AddTransient_T_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,Abblix.DependencyInjection.Dependency[]).T} The service type to register\. #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.DependencyInjection.ServiceCollectionExtensions.AddTransient_T_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,Abblix.DependencyInjection.Dependency[]).services} The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') to add the service to\. ###### `dependencies` [Dependency](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.Dependency 'Abblix\.DependencyInjection\.Dependency')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.DependencyInjection.ServiceCollectionExtensions.AddTransient_T_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,Abblix.DependencyInjection.Dependency[]).dependencies} The dependencies required by the service\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') The updated [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection')\. ### Remarks This overload is useful when the service type and implementation type are the same\. ## ServiceCollectionExtensions\.AddTransient\\(this IServiceCollection, Dependency\[\]\) Method {#Abblix.DependencyInjection.ServiceCollectionExtensions.AddTransient_TService,TImplementation_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,Abblix.DependencyInjection.Dependency[])} Registers a transient service with the implementation type specified in [TImplementation](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.ServiceCollectionExtensions#Abblix.DependencyInjection.ServiceCollectionExtensions.AddTransient_TService,TImplementation_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,Abblix.DependencyInjection.Dependency[]).TImplementation 'Abblix\.DependencyInjection\.ServiceCollectionExtensions\.AddTransient\\(this Microsoft\.Extensions\.DependencyInjection\.IServiceCollection, Abblix\.DependencyInjection\.Dependency\[\]\)\.TImplementation') and the service type specified in [TService](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.ServiceCollectionExtensions#Abblix.DependencyInjection.ServiceCollectionExtensions.AddTransient_TService,TImplementation_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,Abblix.DependencyInjection.Dependency[]).TService 'Abblix\.DependencyInjection\.ServiceCollectionExtensions\.AddTransient\\(this Microsoft\.Extensions\.DependencyInjection\.IServiceCollection, Abblix\.DependencyInjection\.Dependency\[\]\)\.TService') with custom dependencies\. Transient services are created each time they are requested\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection AddTransient(this Microsoft.Extensions.DependencyInjection.IServiceCollection services, params Abblix.DependencyInjection.Dependency[] dependencies) where TService : class where TImplementation : class, TService; ``` #### Type parameters ###### `TService` {#Abblix.DependencyInjection.ServiceCollectionExtensions.AddTransient_TService,TImplementation_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,Abblix.DependencyInjection.Dependency[]).TService} The type of the service to add\. ###### `TImplementation` {#Abblix.DependencyInjection.ServiceCollectionExtensions.AddTransient_TService,TImplementation_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,Abblix.DependencyInjection.Dependency[]).TImplementation} The type of the implementation to use\. #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.DependencyInjection.ServiceCollectionExtensions.AddTransient_TService,TImplementation_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,Abblix.DependencyInjection.Dependency[]).services} The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') to add the service to\. ###### `dependencies` [Dependency](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.Dependency 'Abblix\.DependencyInjection\.Dependency')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.DependencyInjection.ServiceCollectionExtensions.AddTransient_TService,TImplementation_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,Abblix.DependencyInjection.Dependency[]).dependencies} The dependencies required by the service\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') The updated [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection')\. ## ServiceCollectionExtensions\.ChangeLifetime\\(this IServiceCollection, ServiceLifetime\) Method {#Abblix.DependencyInjection.ServiceCollectionExtensions.ChangeLifetime_T_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,Microsoft.Extensions.DependencyInjection.ServiceLifetime)} Changes the lifetime of a registered service of type [T](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.ServiceCollectionExtensions#Abblix.DependencyInjection.ServiceCollectionExtensions.ChangeLifetime_T_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,Microsoft.Extensions.DependencyInjection.ServiceLifetime).T 'Abblix\.DependencyInjection\.ServiceCollectionExtensions\.ChangeLifetime\\(this Microsoft\.Extensions\.DependencyInjection\.IServiceCollection, Microsoft\.Extensions\.DependencyInjection\.ServiceLifetime\)\.T') to the specified [lifetime](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.ServiceCollectionExtensions#Abblix.DependencyInjection.ServiceCollectionExtensions.ChangeLifetime_T_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,Microsoft.Extensions.DependencyInjection.ServiceLifetime).lifetime 'Abblix\.DependencyInjection\.ServiceCollectionExtensions\.ChangeLifetime\\(this Microsoft\.Extensions\.DependencyInjection\.IServiceCollection, Microsoft\.Extensions\.DependencyInjection\.ServiceLifetime\)\.lifetime')\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection ChangeLifetime(this Microsoft.Extensions.DependencyInjection.IServiceCollection services, Microsoft.Extensions.DependencyInjection.ServiceLifetime lifetime); ``` #### Type parameters ###### `T` {#Abblix.DependencyInjection.ServiceCollectionExtensions.ChangeLifetime_T_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,Microsoft.Extensions.DependencyInjection.ServiceLifetime).T} The service type whose lifetime is to be changed\. #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.DependencyInjection.ServiceCollectionExtensions.ChangeLifetime_T_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,Microsoft.Extensions.DependencyInjection.ServiceLifetime).services} The service collection to operate on\. ###### `lifetime` [Microsoft\.Extensions\.DependencyInjection\.ServiceLifetime](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.servicelifetime 'Microsoft\.Extensions\.DependencyInjection\.ServiceLifetime') {#Abblix.DependencyInjection.ServiceCollectionExtensions.ChangeLifetime_T_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,Microsoft.Extensions.DependencyInjection.ServiceLifetime).lifetime} The new [Microsoft\.Extensions\.DependencyInjection\.ServiceLifetime](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.servicelifetime 'Microsoft\.Extensions\.DependencyInjection\.ServiceLifetime') to apply\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') The modified [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') instance\. #### Exceptions [System\.InvalidOperationException](https://learn.microsoft.com/en-us/dotnet/api/system.invalidoperationexception 'System\.InvalidOperationException') Thrown if the service descriptor for [T](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.ServiceCollectionExtensions#Abblix.DependencyInjection.ServiceCollectionExtensions.ChangeLifetime_T_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,Microsoft.Extensions.DependencyInjection.ServiceLifetime).T 'Abblix\.DependencyInjection\.ServiceCollectionExtensions\.ChangeLifetime\\(this Microsoft\.Extensions\.DependencyInjection\.IServiceCollection, Microsoft\.Extensions\.DependencyInjection\.ServiceLifetime\)\.T') has an unexpected format\. ### Remarks Useful when you need to override the lifetime of an existing registration \(e\.g\., from Singleton to Scoped\)\. ## ServiceCollectionExtensions\.Clone\(this ServiceDescriptor, Type\) Method {#Abblix.DependencyInjection.ServiceCollectionExtensions.Clone(thisMicrosoft.Extensions.DependencyInjection.ServiceDescriptor,System.Type)} Creates a copy of the service descriptor with a different service type while preserving the implementation and lifetime\. For factory\-based registrations, resolves through the source service type to maintain same\-instance semantics across all aliases\. ```csharp public static Microsoft.Extensions.DependencyInjection.ServiceDescriptor Clone(this Microsoft.Extensions.DependencyInjection.ServiceDescriptor source, System.Type serviceType); ``` #### Parameters ###### `source` [Microsoft\.Extensions\.DependencyInjection\.ServiceDescriptor](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.servicedescriptor 'Microsoft\.Extensions\.DependencyInjection\.ServiceDescriptor') {#Abblix.DependencyInjection.ServiceCollectionExtensions.Clone(thisMicrosoft.Extensions.DependencyInjection.ServiceDescriptor,System.Type).source} The source service descriptor to clone\. ###### `serviceType` [System\.Type](https://learn.microsoft.com/en-us/dotnet/api/system.type 'System\.Type') {#Abblix.DependencyInjection.ServiceCollectionExtensions.Clone(thisMicrosoft.Extensions.DependencyInjection.ServiceDescriptor,System.Type).serviceType} The service type for the cloned descriptor\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.ServiceDescriptor](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.servicedescriptor 'Microsoft\.Extensions\.DependencyInjection\.ServiceDescriptor') A new service descriptor with the specified service type\. #### Exceptions [System\.InvalidOperationException](https://learn.microsoft.com/en-us/dotnet/api/system.invalidoperationexception 'System\.InvalidOperationException') Thrown when the source descriptor has an invalid configuration\. ## ServiceCollectionExtensions\.CloneKeyed\(this ServiceDescriptor, Type, object\) Method {#Abblix.DependencyInjection.ServiceCollectionExtensions.CloneKeyed(thisMicrosoft.Extensions.DependencyInjection.ServiceDescriptor,System.Type,object)} Creates a copy of the keyed service descriptor with a different service type and key while preserving the implementation and lifetime\. For factory\-based registrations, resolves through the source service type and key to maintain same\-instance semantics across all aliases\. ```csharp public static Microsoft.Extensions.DependencyInjection.ServiceDescriptor CloneKeyed(this Microsoft.Extensions.DependencyInjection.ServiceDescriptor source, System.Type serviceType, object? serviceKey); ``` #### Parameters ###### `source` [Microsoft\.Extensions\.DependencyInjection\.ServiceDescriptor](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.servicedescriptor 'Microsoft\.Extensions\.DependencyInjection\.ServiceDescriptor') {#Abblix.DependencyInjection.ServiceCollectionExtensions.CloneKeyed(thisMicrosoft.Extensions.DependencyInjection.ServiceDescriptor,System.Type,object).source} The source service descriptor to clone\. ###### `serviceType` [System\.Type](https://learn.microsoft.com/en-us/dotnet/api/system.type 'System\.Type') {#Abblix.DependencyInjection.ServiceCollectionExtensions.CloneKeyed(thisMicrosoft.Extensions.DependencyInjection.ServiceDescriptor,System.Type,object).serviceType} The service type for the cloned descriptor\. ###### `serviceKey` [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') {#Abblix.DependencyInjection.ServiceCollectionExtensions.CloneKeyed(thisMicrosoft.Extensions.DependencyInjection.ServiceDescriptor,System.Type,object).serviceKey} The service key for the cloned descriptor\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.ServiceDescriptor](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.servicedescriptor 'Microsoft\.Extensions\.DependencyInjection\.ServiceDescriptor') A new keyed service descriptor with the specified service type and key\. #### Exceptions [System\.InvalidOperationException](https://learn.microsoft.com/en-us/dotnet/api/system.invalidoperationexception 'System\.InvalidOperationException') Thrown when the source descriptor has an invalid configuration\. ## ServiceCollectionExtensions\.Compose\\(this IServiceCollection, Dependency\[\]\) Method {#Abblix.DependencyInjection.ServiceCollectionExtensions.Compose_TInterface,TComposite_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,Abblix.DependencyInjection.Dependency[])} Composes a service type with multiple implementations into a single composite service\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection Compose(this Microsoft.Extensions.DependencyInjection.IServiceCollection services, params Abblix.DependencyInjection.Dependency[] dependencies) where TInterface : class where TComposite : class, TInterface; ``` #### Type parameters ###### `TInterface` {#Abblix.DependencyInjection.ServiceCollectionExtensions.Compose_TInterface,TComposite_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,Abblix.DependencyInjection.Dependency[]).TInterface} The interface type to be composed\. ###### `TComposite` {#Abblix.DependencyInjection.ServiceCollectionExtensions.Compose_TInterface,TComposite_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,Abblix.DependencyInjection.Dependency[]).TComposite} The composite implementation type\. #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.DependencyInjection.ServiceCollectionExtensions.Compose_TInterface,TComposite_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,Abblix.DependencyInjection.Dependency[]).services} The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') to add the service to\. ###### `dependencies` [Dependency](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.Dependency 'Abblix\.DependencyInjection\.Dependency')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.DependencyInjection.ServiceCollectionExtensions.Compose_TInterface,TComposite_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,Abblix.DependencyInjection.Dependency[]).dependencies} The dependencies required by the composite service\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') The updated [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection')\. ### Remarks This method replaces the registrations of a service type with a single composite registration over them\. The composite type must have a constructor that accepts an array of the interface type\. The existing registrations move to keyed ones that the composite resolves in registration order; being keyed also hides them from plain resolution, so the singular resolve yields only the composite\. Their key is private to this library and deliberately unnamed here: a key written down in documentation goes stale, and a stale key answers a lookup with an empty sequence rather than an error\. The family thus remains descriptor data in the collection rather than a snapshot captured in a closure: [Decompose<TInterface>\(this IServiceCollection\)](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.ServiceCollectionExtensions#Abblix.DependencyInjection.ServiceCollectionExtensions.Decompose_TInterface_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection) 'Abblix\.DependencyInjection\.ServiceCollectionExtensions\.Decompose\\(this Microsoft\.Extensions\.DependencyInjection\.IServiceCollection\)') returns a live cursor over that data, and edits through it reach the composite at resolve \- without the host ever naming the composite type\. Members keep their own lifetimes and the composite adopts the shortest among them, so a longer\-lived member is simply shared; only a member shorter\-lived than the composite is rejected, since a composite may not capture something that dies before it\. ## ServiceCollectionExtensions\.ComposeKeyed\\(this IServiceCollection, object, Dependency\[\]\) Method {#Abblix.DependencyInjection.ServiceCollectionExtensions.ComposeKeyed_TInterface,TComposite_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,object,Abblix.DependencyInjection.Dependency[])} Composes keyed implementations of [TInterface](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.ServiceCollectionExtensions#Abblix.DependencyInjection.ServiceCollectionExtensions.ComposeKeyed_TInterface,TComposite_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,object,Abblix.DependencyInjection.Dependency[]).TInterface 'Abblix\.DependencyInjection\.ServiceCollectionExtensions\.ComposeKeyed\\(this Microsoft\.Extensions\.DependencyInjection\.IServiceCollection, object, Abblix\.DependencyInjection\.Dependency\[\]\)\.TInterface') registered under [serviceKey](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.ServiceCollectionExtensions#Abblix.DependencyInjection.ServiceCollectionExtensions.ComposeKeyed_TInterface,TComposite_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,object,Abblix.DependencyInjection.Dependency[]).serviceKey 'Abblix\.DependencyInjection\.ServiceCollectionExtensions\.ComposeKeyed\\(this Microsoft\.Extensions\.DependencyInjection\.IServiceCollection, object, Abblix\.DependencyInjection\.Dependency\[\]\)\.serviceKey') into a single composite resolvable under that same key \- the keyed counterpart of [Compose<TInterface,TComposite>\(this IServiceCollection, Dependency\[\]\)](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.ServiceCollectionExtensions#Abblix.DependencyInjection.ServiceCollectionExtensions.Compose_TInterface,TComposite_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,Abblix.DependencyInjection.Dependency[]) 'Abblix\.DependencyInjection\.ServiceCollectionExtensions\.Compose\\(this Microsoft\.Extensions\.DependencyInjection\.IServiceCollection, Abblix\.DependencyInjection\.Dependency\[\]\)')\. The members move to keyed registrations under the family's own key, so same\-interface families under different keys stay isolated and the family remains editable descriptor data for [DecomposeKeyed<TInterface>\(this IServiceCollection, object\)](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.ServiceCollectionExtensions#Abblix.DependencyInjection.ServiceCollectionExtensions.DecomposeKeyed_TInterface_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,object) 'Abblix\.DependencyInjection\.ServiceCollectionExtensions\.DecomposeKeyed\\(this Microsoft\.Extensions\.DependencyInjection\.IServiceCollection, object\)')\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection ComposeKeyed(this Microsoft.Extensions.DependencyInjection.IServiceCollection services, object serviceKey, params Abblix.DependencyInjection.Dependency[] dependencies) where TInterface : class where TComposite : class, TInterface; ``` #### Type parameters ###### `TInterface` {#Abblix.DependencyInjection.ServiceCollectionExtensions.ComposeKeyed_TInterface,TComposite_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,object,Abblix.DependencyInjection.Dependency[]).TInterface} The interface type to be composed\. ###### `TComposite` {#Abblix.DependencyInjection.ServiceCollectionExtensions.ComposeKeyed_TInterface,TComposite_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,object,Abblix.DependencyInjection.Dependency[]).TComposite} The composite implementation type\. #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.DependencyInjection.ServiceCollectionExtensions.ComposeKeyed_TInterface,TComposite_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,object,Abblix.DependencyInjection.Dependency[]).services} The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') to add the service to\. ###### `serviceKey` [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') {#Abblix.DependencyInjection.ServiceCollectionExtensions.ComposeKeyed_TInterface,TComposite_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,object,Abblix.DependencyInjection.Dependency[]).serviceKey} The service key whose registrations form the family\. ###### `dependencies` [Dependency](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.Dependency 'Abblix\.DependencyInjection\.Dependency')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.DependencyInjection.ServiceCollectionExtensions.ComposeKeyed_TInterface,TComposite_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,object,Abblix.DependencyInjection.Dependency[]).dependencies} The dependencies required by the composite service\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') The updated [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection')\. #### Exceptions [System\.InvalidOperationException](https://learn.microsoft.com/en-us/dotnet/api/system.invalidoperationexception 'System\.InvalidOperationException') The family is already composed under this key\. ## ServiceCollectionExtensions\.CreateService\(this IServiceProvider, Type, Dependency\[\]\) Method {#Abblix.DependencyInjection.ServiceCollectionExtensions.CreateService(thisSystem.IServiceProvider,System.Type,Abblix.DependencyInjection.Dependency[])} Creates an instance of the specified type using the provided dependencies\. ```csharp public static object CreateService(this System.IServiceProvider serviceProvider, System.Type type, params Abblix.DependencyInjection.Dependency[] dependencies); ``` #### Parameters ###### `serviceProvider` [System\.IServiceProvider](https://learn.microsoft.com/en-us/dotnet/api/system.iserviceprovider 'System\.IServiceProvider') {#Abblix.DependencyInjection.ServiceCollectionExtensions.CreateService(thisSystem.IServiceProvider,System.Type,Abblix.DependencyInjection.Dependency[]).serviceProvider} The service provider to resolve required services from\. ###### `type` [System\.Type](https://learn.microsoft.com/en-us/dotnet/api/system.type 'System\.Type') {#Abblix.DependencyInjection.ServiceCollectionExtensions.CreateService(thisSystem.IServiceProvider,System.Type,Abblix.DependencyInjection.Dependency[]).type} The type of service to create\. ###### `dependencies` [Dependency](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.Dependency 'Abblix\.DependencyInjection\.Dependency')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.DependencyInjection.ServiceCollectionExtensions.CreateService(thisSystem.IServiceProvider,System.Type,Abblix.DependencyInjection.Dependency[]).dependencies} A list of explicitly provided dependencies\. #### Returns [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') An instance of the specified [type](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.ServiceCollectionExtensions#Abblix.DependencyInjection.ServiceCollectionExtensions.CreateService(thisSystem.IServiceProvider,System.Type,Abblix.DependencyInjection.Dependency[]).type 'Abblix\.DependencyInjection\.ServiceCollectionExtensions\.CreateService\(this System\.IServiceProvider, System\.Type, Abblix\.DependencyInjection\.Dependency\[\]\)\.type')\. ### Remarks This method allows partial control over dependency injection by mixing resolved and custom parameters\. Useful in plugin scenarios, factory setups, or advanced test setups\. ## ServiceCollectionExtensions\.CreateService\\(this IServiceProvider, Dependency\[\]\) Method {#Abblix.DependencyInjection.ServiceCollectionExtensions.CreateService_T_(thisSystem.IServiceProvider,Abblix.DependencyInjection.Dependency[])} Creates an instance of the specified service type [T](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.ServiceCollectionExtensions#Abblix.DependencyInjection.ServiceCollectionExtensions.CreateService_T_(thisSystem.IServiceProvider,Abblix.DependencyInjection.Dependency[]).T 'Abblix\.DependencyInjection\.ServiceCollectionExtensions\.CreateService\\(this System\.IServiceProvider, Abblix\.DependencyInjection\.Dependency\[\]\)\.T') using the provided dependencies\. ```csharp public static T CreateService(this System.IServiceProvider serviceProvider, params Abblix.DependencyInjection.Dependency[] dependencies); ``` #### Type parameters ###### `T` {#Abblix.DependencyInjection.ServiceCollectionExtensions.CreateService_T_(thisSystem.IServiceProvider,Abblix.DependencyInjection.Dependency[]).T} The type of service to create\. #### Parameters ###### `serviceProvider` [System\.IServiceProvider](https://learn.microsoft.com/en-us/dotnet/api/system.iserviceprovider 'System\.IServiceProvider') {#Abblix.DependencyInjection.ServiceCollectionExtensions.CreateService_T_(thisSystem.IServiceProvider,Abblix.DependencyInjection.Dependency[]).serviceProvider} The service provider to resolve required services from\. ###### `dependencies` [Dependency](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.Dependency 'Abblix\.DependencyInjection\.Dependency')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.DependencyInjection.ServiceCollectionExtensions.CreateService_T_(thisSystem.IServiceProvider,Abblix.DependencyInjection.Dependency[]).dependencies} A list of explicitly provided dependencies\. #### Returns [T](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.ServiceCollectionExtensions#Abblix.DependencyInjection.ServiceCollectionExtensions.CreateService_T_(thisSystem.IServiceProvider,Abblix.DependencyInjection.Dependency[]).T 'Abblix\.DependencyInjection\.ServiceCollectionExtensions\.CreateService\\(this System\.IServiceProvider, Abblix\.DependencyInjection\.Dependency\[\]\)\.T') An instance of type [T](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.ServiceCollectionExtensions#Abblix.DependencyInjection.ServiceCollectionExtensions.CreateService_T_(thisSystem.IServiceProvider,Abblix.DependencyInjection.Dependency[]).T 'Abblix\.DependencyInjection\.ServiceCollectionExtensions\.CreateService\\(this System\.IServiceProvider, Abblix\.DependencyInjection\.Dependency\[\]\)\.T')\. ### Remarks This overload simplifies strongly typed creation of services with custom dependency injection\. ## ServiceCollectionExtensions\.Decompose\\(this IServiceCollection\) Method {#Abblix.DependencyInjection.ServiceCollectionExtensions.Decompose_TInterface_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection)} Opens the [TInterface](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.ServiceCollectionExtensions#Abblix.DependencyInjection.ServiceCollectionExtensions.Decompose_TInterface_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).TInterface 'Abblix\.DependencyInjection\.ServiceCollectionExtensions\.Decompose\\(this Microsoft\.Extensions\.DependencyInjection\.IServiceCollection\)\.TInterface') family for in\-place editing: returns a live [IComposition<TInterface>](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.IComposition_TInterface_ 'Abblix\.DependencyInjection\.IComposition\') cursor over its members\. Insert, remove or reorder through the cursor and the change is live \- a composed family's composite reads its members via `GetKeyedServices` at resolve, so the edit takes effect with no separate recompose\. ```csharp public static Abblix.DependencyInjection.IComposition Decompose(this Microsoft.Extensions.DependencyInjection.IServiceCollection services) where TInterface : class; ``` #### Type parameters ###### `TInterface` {#Abblix.DependencyInjection.ServiceCollectionExtensions.Decompose_TInterface_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).TInterface} The family interface type\. #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.DependencyInjection.ServiceCollectionExtensions.Decompose_TInterface_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).services} The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') holding the family\. #### Returns [Abblix\.DependencyInjection\.IComposition<](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.IComposition_TInterface_ 'Abblix\.DependencyInjection\.IComposition\')[TInterface](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.ServiceCollectionExtensions#Abblix.DependencyInjection.ServiceCollectionExtensions.Decompose_TInterface_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).TInterface 'Abblix\.DependencyInjection\.ServiceCollectionExtensions\.Decompose\\(this Microsoft\.Extensions\.DependencyInjection\.IServiceCollection\)\.TInterface')[>](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.IComposition_TInterface_ 'Abblix\.DependencyInjection\.IComposition\') A live cursor over the family's members, in execution order\. #### Exceptions [System\.InvalidOperationException](https://learn.microsoft.com/en-us/dotnet/api/system.invalidoperationexception 'System\.InvalidOperationException') The family is composed but what a composition leaves behind is no longer intact \- either the mark over its members or the composite that heads them has been removed from the collection\. No sequence of calls on this API produces that\. ### Remarks Whether the family has been composed is the cursor's business, not the caller's: editing its members is the only reason to ask for one\. Composed, the members live as keyed descriptors under a key private to this library, which hides them from plain resolution; this cursor and its resolve\-time counterpart [Decompose<TInterface>\(this IServiceProvider, object\)](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.ServiceCollectionExtensions#Abblix.DependencyInjection.ServiceCollectionExtensions.Decompose_TInterface_(thisSystem.IServiceProvider,object) 'Abblix\.DependencyInjection\.ServiceCollectionExtensions\.Decompose\\(this System\.IServiceProvider, object\)') are the only ways to reach them\. Uncomposed, they are the plain descriptors of the interface, and a later `Compose` takes them as they stand\. The cursor edits whichever of the two the family currently holds, so the same call adds a member before and after composition\. [IComposition<TInterface>](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.IComposition_TInterface_ 'Abblix\.DependencyInjection\.IComposition\') adds position\-aware sugar \(`AddAfter`, `AddBefore`, `Remove`, \.\.\.\); anchors are matched by implementation type via [ResolveImplementationType\(this ServiceDescriptor\)](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.ServiceCollectionExtensions#Abblix.DependencyInjection.ServiceCollectionExtensions.ResolveImplementationType(thisMicrosoft.Extensions.DependencyInjection.ServiceDescriptor) 'Abblix\.DependencyInjection\.ServiceCollectionExtensions\.ResolveImplementationType\(this Microsoft\.Extensions\.DependencyInjection\.ServiceDescriptor\)'), which identifies a member even when it was registered through a typed factory \(e\.g\. by [TryAddEnumerableAlias<TService,TImplementation>\(this IServiceCollection\)](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.ServiceCollectionExtensions#Abblix.DependencyInjection.ServiceCollectionExtensions.TryAddEnumerableAlias_TService,TImplementation_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection) 'Abblix\.DependencyInjection\.ServiceCollectionExtensions\.TryAddEnumerableAlias\\(this Microsoft\.Extensions\.DependencyInjection\.IServiceCollection\)')\)\. ```csharp services.Decompose() .AddAfter(ServiceDescriptor.Singleton()) .Remove(); ``` ## ServiceCollectionExtensions\.Decompose\\(this IServiceProvider, object\) Method {#Abblix.DependencyInjection.ServiceCollectionExtensions.Decompose_TInterface_(thisSystem.IServiceProvider,object)} The members of the [TInterface](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.ServiceCollectionExtensions#Abblix.DependencyInjection.ServiceCollectionExtensions.Decompose_TInterface_(thisSystem.IServiceProvider,object).TInterface 'Abblix\.DependencyInjection\.ServiceCollectionExtensions\.Decompose\\(this System\.IServiceProvider, object\)\.TInterface') family as the container will run them \- the resolve\-time counterpart of [Decompose<TInterface>\(this IServiceCollection\)](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.ServiceCollectionExtensions#Abblix.DependencyInjection.ServiceCollectionExtensions.Decompose_TInterface_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection) 'Abblix\.DependencyInjection\.ServiceCollectionExtensions\.Decompose\\(this Microsoft\.Extensions\.DependencyInjection\.IServiceCollection\)'), which edits the same family before the container is built\. ```csharp public static System.Collections.Generic.IReadOnlyList Decompose(this System.IServiceProvider serviceProvider, object? serviceKey=null) where TInterface : class; ``` #### Type parameters ###### `TInterface` {#Abblix.DependencyInjection.ServiceCollectionExtensions.Decompose_TInterface_(thisSystem.IServiceProvider,object).TInterface} The family interface\. #### Parameters ###### `serviceProvider` [System\.IServiceProvider](https://learn.microsoft.com/en-us/dotnet/api/system.iserviceprovider 'System\.IServiceProvider') {#Abblix.DependencyInjection.ServiceCollectionExtensions.Decompose_TInterface_(thisSystem.IServiceProvider,object).serviceProvider} The provider built from the collection the family lives in\. ###### `serviceKey` [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') {#Abblix.DependencyInjection.ServiceCollectionExtensions.Decompose_TInterface_(thisSystem.IServiceProvider,object).serviceKey} The key a keyed family lives under, or null for a plain family\. #### Returns [System\.Collections\.Generic\.IReadOnlyList<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ireadonlylist-1 'System\.Collections\.Generic\.IReadOnlyList\`1')[TInterface](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.ServiceCollectionExtensions#Abblix.DependencyInjection.ServiceCollectionExtensions.Decompose_TInterface_(thisSystem.IServiceProvider,object).TInterface 'Abblix\.DependencyInjection\.ServiceCollectionExtensions\.Decompose\\(this System\.IServiceProvider, object\)\.TInterface')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ireadonlylist-1 'System\.Collections\.Generic\.IReadOnlyList\`1') The family's members, in execution order\. #### Exceptions [System\.InvalidOperationException](https://learn.microsoft.com/en-us/dotnet/api/system.invalidoperationexception 'System\.InvalidOperationException') The family has no members\. ### Remarks Whether the family was composed is this method's business, not the caller's: composed, the members are keyed and hidden from plain resolution; loose, they are the plain registrations\. Asking for them by the key composition happens to use is what a caller must not do, because a key that is merely out of date answers with an empty set rather than an error \- and an empty set reads as a family with nothing in it\. For that reason an empty family is refused rather than returned. A caller that wants a possibly-empty answer is asking about registrations rather than about a family, and [Microsoft\.Extensions\.DependencyInjection\.ServiceProviderServiceExtensions\.GetServices<>\.IServiceProvider\)](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.serviceproviderserviceextensions.getservices--1#microsoft-extensions-dependencyinjection-serviceproviderserviceextensions-getservices--1(system-iserviceprovider) 'Microsoft\.Extensions\.DependencyInjection\.ServiceProviderServiceExtensions\.GetServices\`\`1\(System\.IServiceProvider\)') is that question. ## ServiceCollectionExtensions\.DecomposeKeyed\\(this IServiceCollection, object\) Method {#Abblix.DependencyInjection.ServiceCollectionExtensions.DecomposeKeyed_TInterface_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,object)} Opens the keyed [TInterface](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.ServiceCollectionExtensions#Abblix.DependencyInjection.ServiceCollectionExtensions.DecomposeKeyed_TInterface_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,object).TInterface 'Abblix\.DependencyInjection\.ServiceCollectionExtensions\.DecomposeKeyed\\(this Microsoft\.Extensions\.DependencyInjection\.IServiceCollection, object\)\.TInterface') family for in\-place editing: returns a live [IComposition<TInterface>](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.IComposition_TInterface_ 'Abblix\.DependencyInjection\.IComposition\') cursor over its members\. Insert, remove or reorder through the cursor and the change is live \- a composed family's keyed composite reads its members via `GetKeyedServices` at resolve, so the edit takes effect with no separate recompose\. Uncomposed, the members are the descriptors registered under the service key itself, and the cursor edits those\. ```csharp public static Abblix.DependencyInjection.IComposition DecomposeKeyed(this Microsoft.Extensions.DependencyInjection.IServiceCollection services, object serviceKey) where TInterface : class; ``` #### Type parameters ###### `TInterface` {#Abblix.DependencyInjection.ServiceCollectionExtensions.DecomposeKeyed_TInterface_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,object).TInterface} The composed interface type\. #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.DependencyInjection.ServiceCollectionExtensions.DecomposeKeyed_TInterface_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,object).services} The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') holding the composed family\. ###### `serviceKey` [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') {#Abblix.DependencyInjection.ServiceCollectionExtensions.DecomposeKeyed_TInterface_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,object).serviceKey} The service key the family was composed under\. #### Returns [Abblix\.DependencyInjection\.IComposition<](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.IComposition_TInterface_ 'Abblix\.DependencyInjection\.IComposition\')[TInterface](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.ServiceCollectionExtensions#Abblix.DependencyInjection.ServiceCollectionExtensions.DecomposeKeyed_TInterface_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,object).TInterface 'Abblix\.DependencyInjection\.ServiceCollectionExtensions\.DecomposeKeyed\\(this Microsoft\.Extensions\.DependencyInjection\.IServiceCollection, object\)\.TInterface')[>](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.IComposition_TInterface_ 'Abblix\.DependencyInjection\.IComposition\') A live cursor over the family's members, in execution order\. #### Exceptions [System\.InvalidOperationException](https://learn.microsoft.com/en-us/dotnet/api/system.invalidoperationexception 'System\.InvalidOperationException') The family is composed under this key but what a composition leaves behind is no longer intact \- either the mark over its members or the composite that heads them has been removed from the collection\. No sequence of calls on this API produces that\. ### Remarks The mechanics mirror [Decompose<TInterface>\(this IServiceCollection\)](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.ServiceCollectionExtensions#Abblix.DependencyInjection.ServiceCollectionExtensions.Decompose_TInterface_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection) 'Abblix\.DependencyInjection\.ServiceCollectionExtensions\.Decompose\\(this Microsoft\.Extensions\.DependencyInjection\.IServiceCollection\)'), except the family's key carries the service key too, so pipelines of the same interface under different keys stay isolated\. [IComposition<TInterface>](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.IComposition_TInterface_ 'Abblix\.DependencyInjection\.IComposition\') adds the same position\-aware sugar \(`AddAfter`, `Remove`, \.\.\.\)\. ## ServiceCollectionExtensions\.Decorate\\(this IServiceCollection, Dependency\[\]\) Method {#Abblix.DependencyInjection.ServiceCollectionExtensions.Decorate_TInterface,TDecorator_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,Abblix.DependencyInjection.Dependency[])} Decorates a registered service with a decorator implementation\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection Decorate(this Microsoft.Extensions.DependencyInjection.IServiceCollection services, params Abblix.DependencyInjection.Dependency[] dependencies) where TInterface : class where TDecorator : class, TInterface; ``` #### Type parameters ###### `TInterface` {#Abblix.DependencyInjection.ServiceCollectionExtensions.Decorate_TInterface,TDecorator_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,Abblix.DependencyInjection.Dependency[]).TInterface} The service type to be decorated\. ###### `TDecorator` {#Abblix.DependencyInjection.ServiceCollectionExtensions.Decorate_TInterface,TDecorator_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,Abblix.DependencyInjection.Dependency[]).TDecorator} The decorator implementation type\. #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.DependencyInjection.ServiceCollectionExtensions.Decorate_TInterface,TDecorator_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,Abblix.DependencyInjection.Dependency[]).services} The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') to add the service to\. ###### `dependencies` [Dependency](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.Dependency 'Abblix\.DependencyInjection\.Dependency')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.DependencyInjection.ServiceCollectionExtensions.Decorate_TInterface,TDecorator_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,Abblix.DependencyInjection.Dependency[]).dependencies} The dependencies required by the decorator\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') The updated [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection')\. ### Remarks The decorator pattern allows you to add behavior to existing service implementations without modifying their code\. The decorator wraps the original service and preserves its lifetime registration\. The decorator must implement the same interface as the service being decorated\. ## ServiceCollectionExtensions\.DecorateKeyed\\(this IServiceCollection, object, Dependency\[\]\) Method {#Abblix.DependencyInjection.ServiceCollectionExtensions.DecorateKeyed_TInterface,TDecorator_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,object,Abblix.DependencyInjection.Dependency[])} Decorates a registered keyed service with a decorator implementation\. If no keyed service is found, falls back to decorating the non\-keyed service and registers the result as a keyed service\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection DecorateKeyed(this Microsoft.Extensions.DependencyInjection.IServiceCollection services, object? serviceKey, params Abblix.DependencyInjection.Dependency[] dependencies) where TInterface : class where TDecorator : class, TInterface; ``` #### Type parameters ###### `TInterface` {#Abblix.DependencyInjection.ServiceCollectionExtensions.DecorateKeyed_TInterface,TDecorator_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,object,Abblix.DependencyInjection.Dependency[]).TInterface} The service type to be decorated\. ###### `TDecorator` {#Abblix.DependencyInjection.ServiceCollectionExtensions.DecorateKeyed_TInterface,TDecorator_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,object,Abblix.DependencyInjection.Dependency[]).TDecorator} The decorator implementation type\. #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.DependencyInjection.ServiceCollectionExtensions.DecorateKeyed_TInterface,TDecorator_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,object,Abblix.DependencyInjection.Dependency[]).services} The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') to add the service to\. ###### `serviceKey` [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') {#Abblix.DependencyInjection.ServiceCollectionExtensions.DecorateKeyed_TInterface,TDecorator_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,object,Abblix.DependencyInjection.Dependency[]).serviceKey} The service key for the decorated service registration\. ###### `dependencies` [Dependency](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.Dependency 'Abblix\.DependencyInjection\.Dependency')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.DependencyInjection.ServiceCollectionExtensions.DecorateKeyed_TInterface,TDecorator_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,object,Abblix.DependencyInjection.Dependency[]).dependencies} The dependencies required by the decorator\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') The updated [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection')\. ### Remarks This method allows decoration of keyed services registered using the keyed service APIs\. If the keyed service is not found, it falls back to decorating the non\-keyed service and registers the decorator as a keyed service\. This is useful when you want to create a keyed variant of an existing non\-keyed service with additional behavior\. The decorator will wrap the existing implementation while preserving the service lifetime\. ## ServiceCollectionExtensions\.Find\\(this IServiceCollection\) Method {#Abblix.DependencyInjection.ServiceCollectionExtensions.Find_T_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection)} Finds the registered service descriptor for type [T](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.ServiceCollectionExtensions#Abblix.DependencyInjection.ServiceCollectionExtensions.Find_T_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).T 'Abblix\.DependencyInjection\.ServiceCollectionExtensions\.Find\\(this Microsoft\.Extensions\.DependencyInjection\.IServiceCollection\)\.T'), or returns `null` if none exists\. ```csharp public static Microsoft.Extensions.DependencyInjection.ServiceDescriptor? Find(this Microsoft.Extensions.DependencyInjection.IServiceCollection services); ``` #### Type parameters ###### `T` {#Abblix.DependencyInjection.ServiceCollectionExtensions.Find_T_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).T} The service type to locate\. #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.DependencyInjection.ServiceCollectionExtensions.Find_T_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).services} The service collection to search\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.ServiceDescriptor](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.servicedescriptor 'Microsoft\.Extensions\.DependencyInjection\.ServiceDescriptor') The matching [Microsoft\.Extensions\.DependencyInjection\.ServiceDescriptor](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.servicedescriptor 'Microsoft\.Extensions\.DependencyInjection\.ServiceDescriptor'), or `null` if not found\. ## ServiceCollectionExtensions\.FindAll\\(this IServiceCollection\) Method {#Abblix.DependencyInjection.ServiceCollectionExtensions.FindAll_T_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection)} Finds all registered service descriptors for type [T](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.ServiceCollectionExtensions#Abblix.DependencyInjection.ServiceCollectionExtensions.FindAll_T_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).T 'Abblix\.DependencyInjection\.ServiceCollectionExtensions\.FindAll\\(this Microsoft\.Extensions\.DependencyInjection\.IServiceCollection\)\.T')\. ```csharp public static System.Collections.Generic.IEnumerable FindAll(this Microsoft.Extensions.DependencyInjection.IServiceCollection services); ``` #### Type parameters ###### `T` {#Abblix.DependencyInjection.ServiceCollectionExtensions.FindAll_T_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).T} The service type to locate\. #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.DependencyInjection.ServiceCollectionExtensions.FindAll_T_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).services} The service collection to search\. #### Returns [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[Microsoft\.Extensions\.DependencyInjection\.ServiceDescriptor](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.servicedescriptor 'Microsoft\.Extensions\.DependencyInjection\.ServiceDescriptor')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') An [System\.Collections\.Generic\.IEnumerable<>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') of matching [Microsoft\.Extensions\.DependencyInjection\.ServiceDescriptor](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.servicedescriptor 'Microsoft\.Extensions\.DependencyInjection\.ServiceDescriptor') instances\. ## ServiceCollectionExtensions\.FindRequired\\(this IServiceCollection\) Method {#Abblix.DependencyInjection.ServiceCollectionExtensions.FindRequired_T_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection)} Finds the first registered service descriptor for type [T](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.ServiceCollectionExtensions#Abblix.DependencyInjection.ServiceCollectionExtensions.FindRequired_T_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).T 'Abblix\.DependencyInjection\.ServiceCollectionExtensions\.FindRequired\\(this Microsoft\.Extensions\.DependencyInjection\.IServiceCollection\)\.T')\. Throws if no descriptor is found\. ```csharp public static Microsoft.Extensions.DependencyInjection.ServiceDescriptor FindRequired(this Microsoft.Extensions.DependencyInjection.IServiceCollection services); ``` #### Type parameters ###### `T` {#Abblix.DependencyInjection.ServiceCollectionExtensions.FindRequired_T_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).T} The service type to locate\. #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.DependencyInjection.ServiceCollectionExtensions.FindRequired_T_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).services} The service collection to search\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.ServiceDescriptor](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.servicedescriptor 'Microsoft\.Extensions\.DependencyInjection\.ServiceDescriptor') The matching [Microsoft\.Extensions\.DependencyInjection\.ServiceDescriptor](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.servicedescriptor 'Microsoft\.Extensions\.DependencyInjection\.ServiceDescriptor')\. #### Exceptions [System\.InvalidOperationException](https://learn.microsoft.com/en-us/dotnet/api/system.invalidoperationexception 'System\.InvalidOperationException') Thrown if no descriptor is found for the specified type\. ## ServiceCollectionExtensions\.RemoveAll\\(this IServiceCollection\) Method {#Abblix.DependencyInjection.ServiceCollectionExtensions.RemoveAll_T_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection)} Removes all registrations of type [T](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.ServiceCollectionExtensions#Abblix.DependencyInjection.ServiceCollectionExtensions.RemoveAll_T_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).T 'Abblix\.DependencyInjection\.ServiceCollectionExtensions\.RemoveAll\\(this Microsoft\.Extensions\.DependencyInjection\.IServiceCollection\)\.T') from the service collection\. ```csharp public static Microsoft.Extensions.DependencyInjection.ServiceDescriptor[] RemoveAll(this Microsoft.Extensions.DependencyInjection.IServiceCollection services); ``` #### Type parameters ###### `T` {#Abblix.DependencyInjection.ServiceCollectionExtensions.RemoveAll_T_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).T} The service type to remove\. #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.DependencyInjection.ServiceCollectionExtensions.RemoveAll_T_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).services} The service collection to operate on\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.ServiceDescriptor](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.servicedescriptor 'Microsoft\.Extensions\.DependencyInjection\.ServiceDescriptor')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') `true` if any descriptors were removed; otherwise, `false`\. ### Remarks Can be used to clean up pre\-registered services before adding custom implementations\. ## ServiceCollectionExtensions\.ResolveImplementationType\(this ServiceDescriptor\) Method {#Abblix.DependencyInjection.ServiceCollectionExtensions.ResolveImplementationType(thisMicrosoft.Extensions.DependencyInjection.ServiceDescriptor)} Stand\-in for the internal `ServiceDescriptor.GetImplementationType()`: returns the implementation type whether the descriptor was registered with an explicit implementation type, an implementation instance, or a typed factory `Func` \(\.NET 10 generic AddSingleton uses the last shape, so the property alone returns null for those registrations\)\. Supports both plain and keyed descriptors \- for keyed ones the type is derived from the `Keyed*` counterparts, including the keyed factory shape `Func` produced when [Compose<TInterface,TComposite>\(this IServiceCollection, Dependency\[\]\)](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.ServiceCollectionExtensions#Abblix.DependencyInjection.ServiceCollectionExtensions.Compose_TInterface,TComposite_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,Abblix.DependencyInjection.Dependency[]) 'Abblix\.DependencyInjection\.ServiceCollectionExtensions\.Compose\\(this Microsoft\.Extensions\.DependencyInjection\.IServiceCollection, Abblix\.DependencyInjection\.Dependency\[\]\)') moves a family member into its keyed registration\. ```csharp public static System.Type? ResolveImplementationType(this Microsoft.Extensions.DependencyInjection.ServiceDescriptor descriptor); ``` #### Parameters ###### `descriptor` [Microsoft\.Extensions\.DependencyInjection\.ServiceDescriptor](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.servicedescriptor 'Microsoft\.Extensions\.DependencyInjection\.ServiceDescriptor') {#Abblix.DependencyInjection.ServiceCollectionExtensions.ResolveImplementationType(thisMicrosoft.Extensions.DependencyInjection.ServiceDescriptor).descriptor} The descriptor whose implementation type to derive\. #### Returns [System\.Type](https://learn.microsoft.com/en-us/dotnet/api/system.type 'System\.Type') The implementation type, or null when it cannot be derived \(untyped factory\)\. ## ServiceCollectionExtensions\.TryAddAlias\\(this IServiceCollection\) Method {#Abblix.DependencyInjection.ServiceCollectionExtensions.TryAddAlias_TService,TImplementation_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection)} Adds [TService](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.ServiceCollectionExtensions#Abblix.DependencyInjection.ServiceCollectionExtensions.TryAddAlias_TService,TImplementation_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).TService 'Abblix\.DependencyInjection\.ServiceCollectionExtensions\.TryAddAlias\\(this Microsoft\.Extensions\.DependencyInjection\.IServiceCollection\)\.TService') as a SHARED\-instance alias for the existing [TImplementation](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.ServiceCollectionExtensions#Abblix.DependencyInjection.ServiceCollectionExtensions.TryAddAlias_TService,TImplementation_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).TImplementation 'Abblix\.DependencyInjection\.ServiceCollectionExtensions\.TryAddAlias\\(this Microsoft\.Extensions\.DependencyInjection\.IServiceCollection\)\.TImplementation') registration \- unless [TService](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.ServiceCollectionExtensions#Abblix.DependencyInjection.ServiceCollectionExtensions.TryAddAlias_TService,TImplementation_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).TService 'Abblix\.DependencyInjection\.ServiceCollectionExtensions\.TryAddAlias\\(this Microsoft\.Extensions\.DependencyInjection\.IServiceCollection\)\.TService') is already registered\. Sister of [AddAlias<TService,TImplementation>\(this IServiceCollection\)](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.ServiceCollectionExtensions#Abblix.DependencyInjection.ServiceCollectionExtensions.AddAlias_TService,TImplementation_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection) 'Abblix\.DependencyInjection\.ServiceCollectionExtensions\.AddAlias\\(this Microsoft\.Extensions\.DependencyInjection\.IServiceCollection\)') with `TryAdd` semantics on the alias service type: a host pre\-registration of the aliased contract wins, which keeps the library\-wide "host pre\-registration wins" convention on singular seams whose library default is routed through an alias\. Use plain [AddAlias<TService,TImplementation>\(this IServiceCollection\)](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.ServiceCollectionExtensions#Abblix.DependencyInjection.ServiceCollectionExtensions.AddAlias_TService,TImplementation_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection) 'Abblix\.DependencyInjection\.ServiceCollectionExtensions\.AddAlias\\(this Microsoft\.Extensions\.DependencyInjection\.IServiceCollection\)') only where the alias must be added unconditionally \(e\.g\. composition machinery that appends to an enumerable set\)\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection TryAddAlias(this Microsoft.Extensions.DependencyInjection.IServiceCollection services) where TService : class where TImplementation : class, TService; ``` #### Type parameters ###### `TService` {#Abblix.DependencyInjection.ServiceCollectionExtensions.TryAddAlias_TService,TImplementation_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).TService} The service type to register the alias under\. ###### `TImplementation` {#Abblix.DependencyInjection.ServiceCollectionExtensions.TryAddAlias_TService,TImplementation_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).TImplementation} The implementation type already registered as a concrete \(or as another service\) in the service collection\. #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.DependencyInjection.ServiceCollectionExtensions.TryAddAlias_TService,TImplementation_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).services} The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') to add to\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') so additional calls can be chained\. #### Exceptions [System\.InvalidOperationException](https://learn.microsoft.com/en-us/dotnet/api/system.invalidoperationexception 'System\.InvalidOperationException') Thrown when no registration is found for [TImplementation](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.ServiceCollectionExtensions#Abblix.DependencyInjection.ServiceCollectionExtensions.TryAddAlias_TService,TImplementation_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).TImplementation 'Abblix\.DependencyInjection\.ServiceCollectionExtensions\.TryAddAlias\\(this Microsoft\.Extensions\.DependencyInjection\.IServiceCollection\)\.TImplementation')\. ## ServiceCollectionExtensions\.TryAddEnumerableAlias\\(this IServiceCollection\) Method {#Abblix.DependencyInjection.ServiceCollectionExtensions.TryAddEnumerableAlias_TService,TImplementation_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection)} Adds [TService](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.ServiceCollectionExtensions#Abblix.DependencyInjection.ServiceCollectionExtensions.TryAddEnumerableAlias_TService,TImplementation_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).TService 'Abblix\.DependencyInjection\.ServiceCollectionExtensions\.TryAddEnumerableAlias\\(this Microsoft\.Extensions\.DependencyInjection\.IServiceCollection\)\.TService') to an enumerable strategy set as a SHARED\-instance alias for the existing [TImplementation](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.ServiceCollectionExtensions#Abblix.DependencyInjection.ServiceCollectionExtensions.TryAddEnumerableAlias_TService,TImplementation_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).TImplementation 'Abblix\.DependencyInjection\.ServiceCollectionExtensions\.TryAddEnumerableAlias\\(this Microsoft\.Extensions\.DependencyInjection\.IServiceCollection\)\.TImplementation') registration\. Sister of [AddAlias<TService,TImplementation>\(this IServiceCollection\)](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.ServiceCollectionExtensions#Abblix.DependencyInjection.ServiceCollectionExtensions.AddAlias_TService,TImplementation_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection) 'Abblix\.DependencyInjection\.ServiceCollectionExtensions\.AddAlias\\(this Microsoft\.Extensions\.DependencyInjection\.IServiceCollection\)'): same semantic of "route this service to that already\-registered impl", but adds via `TryAddEnumerable` \(so repeated calls dedupe on `(ServiceType, ImplementationType)`\) and always uses a typed factory delegate that resolves through the source registration \- guaranteeing the alias and the source share one instance\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection TryAddEnumerableAlias(this Microsoft.Extensions.DependencyInjection.IServiceCollection services) where TService : class where TImplementation : class, TService; ``` #### Type parameters ###### `TService` {#Abblix.DependencyInjection.ServiceCollectionExtensions.TryAddEnumerableAlias_TService,TImplementation_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).TService} The enumerable service type to register the alias under\. ###### `TImplementation` {#Abblix.DependencyInjection.ServiceCollectionExtensions.TryAddEnumerableAlias_TService,TImplementation_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).TImplementation} The implementation type already registered as a concrete \(or as another [TService](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.ServiceCollectionExtensions#Abblix.DependencyInjection.ServiceCollectionExtensions.TryAddEnumerableAlias_TService,TImplementation_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).TService 'Abblix\.DependencyInjection\.ServiceCollectionExtensions\.TryAddEnumerableAlias\\(this Microsoft\.Extensions\.DependencyInjection\.IServiceCollection\)\.TService')\) in the service collection\. #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.DependencyInjection.ServiceCollectionExtensions.TryAddEnumerableAlias_TService,TImplementation_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).services} The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') to add to\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') so additional calls can be chained\. #### Exceptions [System\.InvalidOperationException](https://learn.microsoft.com/en-us/dotnet/api/system.invalidoperationexception 'System\.InvalidOperationException') No registration was found for [TImplementation](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.ServiceCollectionExtensions#Abblix.DependencyInjection.ServiceCollectionExtensions.TryAddEnumerableAlias_TService,TImplementation_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).TImplementation 'Abblix\.DependencyInjection\.ServiceCollectionExtensions\.TryAddEnumerableAlias\\(this Microsoft\.Extensions\.DependencyInjection\.IServiceCollection\)\.TImplementation')\. ## ServiceCollectionExtensions\.TryAddKeyedAlias\\(this IServiceCollection, object, object\) Method {#Abblix.DependencyInjection.ServiceCollectionExtensions.TryAddKeyedAlias_TService,TSource_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,object,object)} Creates a keyed alias registration for [TService](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.ServiceCollectionExtensions#Abblix.DependencyInjection.ServiceCollectionExtensions.TryAddKeyedAlias_TService,TSource_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,object,object).TService 'Abblix\.DependencyInjection\.ServiceCollectionExtensions\.TryAddKeyedAlias\\(this Microsoft\.Extensions\.DependencyInjection\.IServiceCollection, object, object\)\.TService') under [serviceKey](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.ServiceCollectionExtensions#Abblix.DependencyInjection.ServiceCollectionExtensions.TryAddKeyedAlias_TService,TSource_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,object,object).serviceKey 'Abblix\.DependencyInjection\.ServiceCollectionExtensions\.TryAddKeyedAlias\\(this Microsoft\.Extensions\.DependencyInjection\.IServiceCollection, object, object\)\.serviceKey') \- unless that \(service type, key\) pair is already registered\. Sister of [AddKeyedAlias<TService,TSource>\(this IServiceCollection, object, object\)](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.ServiceCollectionExtensions#Abblix.DependencyInjection.ServiceCollectionExtensions.AddKeyedAlias_TService,TSource_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,object,object) 'Abblix\.DependencyInjection\.ServiceCollectionExtensions\.AddKeyedAlias\\(this Microsoft\.Extensions\.DependencyInjection\.IServiceCollection, object, object\)') with `TryAdd` semantics on the alias identity: a pre\-existing registration under the same key wins, mirroring [TryAddAlias<TService,TImplementation>\(this IServiceCollection\)](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.ServiceCollectionExtensions#Abblix.DependencyInjection.ServiceCollectionExtensions.TryAddAlias_TService,TImplementation_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection) 'Abblix\.DependencyInjection\.ServiceCollectionExtensions\.TryAddAlias\\(this Microsoft\.Extensions\.DependencyInjection\.IServiceCollection\)') for keyed seams and keeping the library\-wide "host pre\-registration wins" convention\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection TryAddKeyedAlias(this Microsoft.Extensions.DependencyInjection.IServiceCollection services, object? serviceKey, object? sourceKey=null) where TService : class where TSource : class; ``` #### Type parameters ###### `TService` {#Abblix.DependencyInjection.ServiceCollectionExtensions.TryAddKeyedAlias_TService,TSource_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,object,object).TService} The service type for the alias registration\. ###### `TSource` {#Abblix.DependencyInjection.ServiceCollectionExtensions.TryAddKeyedAlias_TService,TSource_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,object,object).TSource} The source service type that is already registered\. #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.DependencyInjection.ServiceCollectionExtensions.TryAddKeyedAlias_TService,TSource_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,object,object).services} The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') to add the service to\. ###### `serviceKey` [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') {#Abblix.DependencyInjection.ServiceCollectionExtensions.TryAddKeyedAlias_TService,TSource_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,object,object).serviceKey} The service key to associate with the alias\. ###### `sourceKey` [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') {#Abblix.DependencyInjection.ServiceCollectionExtensions.TryAddKeyedAlias_TService,TSource_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,object,object).sourceKey} The service key of the source registration\. Use null for non\-keyed source\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') The updated [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection')\. #### Exceptions [System\.InvalidOperationException](https://learn.microsoft.com/en-us/dotnet/api/system.invalidoperationexception 'System\.InvalidOperationException') Thrown when no registration is found for [TSource](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.ServiceCollectionExtensions#Abblix.DependencyInjection.ServiceCollectionExtensions.TryAddKeyedAlias_TService,TSource_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,object,object).TSource 'Abblix\.DependencyInjection\.ServiceCollectionExtensions\.TryAddKeyedAlias\\(this Microsoft\.Extensions\.DependencyInjection\.IServiceCollection, object, object\)\.TSource') with the specified [sourceKey](https://www.abblix.com/en/docs/api/abblix-dependencyinjection/Abblix.DependencyInjection.ServiceCollectionExtensions#Abblix.DependencyInjection.ServiceCollectionExtensions.TryAddKeyedAlias_TService,TSource_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,object,object).sourceKey 'Abblix\.DependencyInjection\.ServiceCollectionExtensions\.TryAddKeyedAlias\\(this Microsoft\.Extensions\.DependencyInjection\.IServiceCollection, object, object\)\.sourceKey')\. --- Source: https://www.abblix.com/en/docs/api/abblix-jwt.md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ## Abblix\.Jwt Assembly | Namespaces | | | :--- | :--- | | [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt 'Abblix\.Jwt') | | | [Abblix\.Jwt\.Encryption](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Encryption 'Abblix\.Jwt\.Encryption') | | | [Abblix\.Jwt\.ExternalKeys](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys 'Abblix\.Jwt\.ExternalKeys') | | | [Abblix\.Jwt\.ReplayPrevention](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ReplayPrevention 'Abblix\.Jwt\.ReplayPrevention') | | | [Abblix\.Jwt\.Signing](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Signing 'Abblix\.Jwt\.Signing') | | --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ## Abblix\.Jwt Namespace | Classes | | | :--- | :--- | | [AuthorizationDetail](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.AuthorizationDetail 'Abblix\.Jwt\.AuthorizationDetail') | One entry in the OAuth 2\.0 Rich Authorization Requests `authorization_details` array \(RFC 9396 §2\), wrapped over a [System\.Text\.Json\.Nodes\.JsonNode](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonnode 'System\.Text\.Json\.Nodes\.JsonNode') which is the source of truth for the entry's content\. The wrapper exposes the RFC 9396 §2\.2 common\-data members as strongly\-typed accessors that read from and write to the underlying [Json](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.AuthorizationDetail#Abblix.Jwt.AuthorizationDetail.Json 'Abblix\.Jwt\.AuthorizationDetail\.Json') directly \- the same shape [JsonWebTokenPayload](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenPayload 'Abblix\.Jwt\.JsonWebTokenPayload') uses over its [System\.Text\.Json\.Nodes\.JsonObject](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonobject 'System\.Text\.Json\.Nodes\.JsonObject')\. | | [AuthorizationDetail\.Parameters](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.AuthorizationDetail.Parameters 'Abblix\.Jwt\.AuthorizationDetail\.Parameters') | RFC 9396 §2\.2 member names\. Type\-specific members outside this set live alongside in [Json](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.AuthorizationDetail#Abblix.Jwt.AuthorizationDetail.Json 'Abblix\.Jwt\.AuthorizationDetail\.Json') and are accessed by per\-type validators directly through the [System\.Text\.Json\.Nodes](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes 'System\.Text\.Json\.Nodes') API on the wrapped node\. | | [ClaimExtensions](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ClaimExtensions 'Abblix\.Jwt\.ClaimExtensions') | Provides extension methods for handling claims, particularly for converting between JWT claims and security claims\. | | [CriticalHeaderContext](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.CriticalHeaderContext 'Abblix\.Jwt\.CriticalHeaderContext') | Per\-call context passed to [HandleAsync\(CriticalHeaderContext, CancellationToken\)](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ICriticalHeaderHandler#Abblix.Jwt.ICriticalHeaderHandler.HandleAsync(Abblix.Jwt.CriticalHeaderContext,System.Threading.CancellationToken) 'Abblix\.Jwt\.ICriticalHeaderHandler\.HandleAsync\(Abblix\.Jwt\.CriticalHeaderContext, System\.Threading\.CancellationToken\)')\. Reference type with init\-only properties so adding a future field is a non\-breaking change for handler implementations\. | | [EllipticCurveJsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.EllipticCurveJsonWebKey 'Abblix\.Jwt\.EllipticCurveJsonWebKey') | Represents an Elliptic Curve JSON Web Key \(JWK\) containing EC\-specific cryptographic parameters\. Supports both public and private EC keys per RFC 7518 Section 6\.2\. | | [EllipticCurveOids](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.EllipticCurveOids 'Abblix\.Jwt\.EllipticCurveOids') | ASN\.1 object identifiers \(OIDs\) for NIST\-recommended elliptic curves used in ECDSA cryptography\. | | [EllipticCurveTypes](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.EllipticCurveTypes 'Abblix\.Jwt\.EllipticCurveTypes') | Elliptic curve identifiers for the JWK "crv" parameter, as defined in RFC 7518 Section 6\.2\.1\.1\. | | [EncryptionAlgorithms](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.EncryptionAlgorithms 'Abblix\.Jwt\.EncryptionAlgorithms') | JWE algorithm identifiers \("alg" and "enc" header values\) defined in RFC 7516 \(JWE\) and RFC 7518 Sections 4 \(key management\) and 5 \(content encryption\)\. Constants on this class are recognized by the library; some are listed but not yet supported because their underlying primitives are not provided by \.NET \(see remarks on each member\)\. | | [EncryptionAlgorithms\.ContentEncryption](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.EncryptionAlgorithms.ContentEncryption 'Abblix\.Jwt\.EncryptionAlgorithms\.ContentEncryption') | Content encryption algorithms \("enc" parameter in the JWE header\)\. These encrypt the JWE payload using the Content Encryption Key produced by the key management algorithm\. | | [EncryptionAlgorithms\.KeyManagement](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.EncryptionAlgorithms.KeyManagement 'Abblix\.Jwt\.EncryptionAlgorithms\.KeyManagement') | Key management algorithms \("alg" parameter in the JWE header\)\. These wrap or derive the Content Encryption Key \(CEK\) that is then used by a content encryption algorithm\. | | [HashCalculator](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.HashCalculator 'Abblix\.Jwt\.HashCalculator') | Computes the detached\-signature hashes an ID Token carries for values delivered beside it: `at_hash` for an access token and `c_hash` for an authorization code\. | | [IanaClaimTypes](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.IanaClaimTypes 'Abblix\.Jwt\.IanaClaimTypes') | Provides constants for various JWT and OpenID Connect claim types\. Includes both registered claim types and public claim types as defined in various standards\. This classification helps in ensuring interoperability across different systems and services by adhering to a common set of identifiers for claims\. | | [IanaClaimTypes\.ConfirmationMethods](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.IanaClaimTypes.ConfirmationMethods 'Abblix\.Jwt\.IanaClaimTypes\.ConfirmationMethods') | Member names of the `cnf` confirmation\-method JSON object \(RFC 7800 §3\.1 / IANA "JWT Confirmation Methods" registry\)\. Each member encodes a different proof\-of\-possession binding scheme; multiple members can coexist when a deployment uses several schemes concurrently \(e\.g\. mTLS for client authentication and DPoP for token binding\)\. | | [JsonArrayExtensions](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonArrayExtensions 'Abblix\.Jwt\.JsonArrayExtensions') | Conversion helpers between a raw [System\.Text\.Json\.Nodes\.JsonArray](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonarray 'System\.Text\.Json\.Nodes\.JsonArray') wire form and a sequence of [AuthorizationDetail](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.AuthorizationDetail 'Abblix\.Jwt\.AuthorizationDetail') wrappers\. Parallels [JsonObjectExtensions](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonObjectExtensions 'Abblix\.Jwt\.JsonObjectExtensions') for object\-shaped claims; here the shape is a JSON array and each element is a wrapper over its underlying [System\.Text\.Json\.Nodes\.JsonNode](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonnode 'System\.Text\.Json\.Nodes\.JsonNode')\. | | [JsonObjectExtensions](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonObjectExtensions 'Abblix\.Jwt\.JsonObjectExtensions') | Provides extension methods for the [System\.Text\.Json\.Nodes\.JsonObject](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonobject 'System\.Text\.Json\.Nodes\.JsonObject') class, enhancing its usability by simplifying the process of accessing and manipulating JSON properties\. | | [JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey') | Base class representing a JSON Web Key \(JWK\), a versatile structure for representing cryptographic keys using JSON\. JWKs are crucial for digital signatures, encryption, and ensuring secure communication in web\-based protocols\. | | [JsonWebKeyConverter](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKeyConverter 'Abblix\.Jwt\.JsonWebKeyConverter') | Custom JSON converter for JsonWebKey that handles polymorphic serialization/deserialization based on the "kty" \(key type\) discriminator while ensuring the KeyType property is serialized in both polymorphic and direct serialization scenarios\. | | [JsonWebKeyExtensions](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKeyExtensions 'Abblix\.Jwt\.JsonWebKeyExtensions') | Provides extension methods for the JsonWebKey model to simplify the process of populating its properties from different sources\. These methods enable easy conversion between JsonWebKey and various cryptographic representations\. | | [JsonWebKeyFactory](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKeyFactory 'Abblix\.Jwt\.JsonWebKeyFactory') | A factory for creating JsonWebKey objects for various cryptographic key types\. Supports RSA, Elliptic Curve, and symmetric \(HMAC\) keys for JWT operations\. | | [JsonWebKeyPropertyNames](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKeyPropertyNames 'Abblix\.Jwt\.JsonWebKeyPropertyNames') | JSON property names used in the JSON serialization of a JWK as defined in RFC 7517 Section 4 and RFC 7518 Section 6\. These are the wire\-level names; consumers normally interact with the strongly\-typed properties on [JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey') and its subclasses\. | | [JsonWebKeySet](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKeySet 'Abblix\.Jwt\.JsonWebKeySet') | A JSON Web Key Set \(JWK Set\) per RFC 7517 Section 5: a JSON document containing an array of JSON Web Keys\. Authorization servers publish their JWK Set at the `jwks_uri` endpoint so that relying parties can discover the keys used to validate or encrypt tokens\. | | [JsonWebKeyTypes](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKeyTypes 'Abblix\.Jwt\.JsonWebKeyTypes') | Values for the JWK "kty" parameter \(RFC 7517 Section 4\.1, RFC 7518 Section 6\.1\) identifying the cryptographic family a key belongs to\. Used as the discriminator when deserializing a [JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey') into the correct concrete subtype\. | | [JsonWebToken](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebToken 'Abblix\.Jwt\.JsonWebToken') | Represents a JSON Web Token \(JWT\), a compact, URL\-safe means of representing claims to be transferred between two parties\. This record encapsulates the standard JWT structure, offering properties to access and manipulate the header, payload, and claims\. | | [JsonWebTokenConfirmation](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenConfirmation 'Abblix\.Jwt\.JsonWebTokenConfirmation') | Typed wrapper over the `cnf` confirmation\-method JSON object \(RFC 7800 §3\.1\)\. Exposes the proof\-of\-possession binding members an issued JWT can carry: the mutual\-TLS client certificate thumbprint \(`x5t#S256`, RFC 8705 §3\.1\) and the DPoP proof\-key JWK thumbprint \(`jkt`, RFC 9449 §6\.1\)\. Symmetric with [JsonWebTokenPayload](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenPayload 'Abblix\.Jwt\.JsonWebTokenPayload'): each member is a typed accessor over the underlying [System\.Text\.Json\.Nodes\.JsonObject](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonobject 'System\.Text\.Json\.Nodes\.JsonObject'); constants live in [ConfirmationMethods](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.IanaClaimTypes.ConfirmationMethods 'Abblix\.Jwt\.IanaClaimTypes\.ConfirmationMethods') so adding a new member is a single\-file edit\. | | [JsonWebTokenExtensions](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenExtensions 'Abblix\.Jwt\.JsonWebTokenExtensions') | Provides extension methods for handling JSON data within JWTs\. | | [JsonWebTokenHeader](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenHeader 'Abblix\.Jwt\.JsonWebTokenHeader') | Represents the header part of a JSON Web Token \(JWT\), containing metadata about the token such as the type and the algorithm used for signing\. | | [JsonWebTokenPayload](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenPayload 'Abblix\.Jwt\.JsonWebTokenPayload') | Represents the payload part of a JSON Web Token \(JWT\), containing the claims or statements about the subject\. | | [JsonWebTokenTypes](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenTypes 'Abblix\.Jwt\.JsonWebTokenTypes') | The registry of `typ` header values that specifications fix: each is registered with IANA \(or by the body that owns the profile\) and required verbatim by its counterparties, so none may be changed\. The registry sits in the JWT core the way [JsonWebKeyTypes](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKeyTypes 'Abblix\.Jwt\.JsonWebKeyTypes') does for `kty` values: every package building on the core shares one copy of the vocabulary instead of drifting its own\. | | [JwtClaimTypes](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JwtClaimTypes 'Abblix\.Jwt\.JwtClaimTypes') | Names of the JWT claims and JOSE header parameters used by this library, including the registered claims from RFC 7519 Section 4\.1, common OpenID Connect claims, and several extensions \(token exchange, security event tokens, etc\.\)\. Use these constants whenever reading from or writing to a [JsonWebTokenHeader](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenHeader 'Abblix\.Jwt\.JsonWebTokenHeader') or [JsonWebTokenPayload](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenPayload 'Abblix\.Jwt\.JsonWebTokenPayload') by raw name\. | | [JwtTypeName](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JwtTypeName 'Abblix\.Jwt\.JwtTypeName') | Compares JWT `typ` header values, which name a media type and therefore have more than one spelling for the same value\. | | [JwtValidationError](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JwtValidationError 'Abblix\.Jwt\.JwtValidationError') | Represents an error encountered during the validation of a JSON Web Token \(JWT\)\. | | [OctetJsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.OctetJsonWebKey 'Abblix\.Jwt\.OctetJsonWebKey') | Represents a Symmetric JSON Web Key \(JWK\) containing symmetric key material for algorithms like HMAC\. Supports symmetric keys per RFC 7518 Section 6\.4\. | | [PublicKeyUsages](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.PublicKeyUsages 'Abblix\.Jwt\.PublicKeyUsages') | Values for the JWK "use" parameter \(RFC 7517 Section 4\.2\), declaring whether a key is intended for signing or encryption\. Lets clients pick the right key from a JWK Set when a JWKS contains keys for both purposes\. | | [RsaJsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.RsaJsonWebKey 'Abblix\.Jwt\.RsaJsonWebKey') | Represents an RSA JSON Web Key \(JWK\) containing RSA\-specific cryptographic parameters\. Supports both public and private RSA keys per RFC 7518 Section 6\.3\. | | [ServiceCollectionExtensions](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ServiceCollectionExtensions 'Abblix\.Jwt\.ServiceCollectionExtensions') | Provides extension methods for [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') to register JwT\-related services within the application\. | | [SigningAlgorithms](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.SigningAlgorithms 'Abblix\.Jwt\.SigningAlgorithms') | JWS signing algorithm identifiers \("alg" header values\) defined in RFC 7518 Section 3\. Used to indicate how a JWT was signed and to look up the matching signer or verifier\. | | [ValidationParameters](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ValidationParameters 'Abblix\.Jwt\.ValidationParameters') | Defines parameters used during the validation of a JSON Web Token \(JWT\)\. | | Structs | | | :--- | :--- | | [ClockSkew](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ClockSkew 'Abblix\.Jwt\.ClockSkew') | How far a token's timestamps may sit either side of this clock and still be honoured\. | | [KeyVersion](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.KeyVersion 'Abblix\.Jwt\.KeyVersion') | One version of a custodian\-held key: its public half and when the custodian created that version\. The public key carries the version\-specific `kid` that routes a private operation back to this exact version, so publishing a key's versions lets a client verify a signature made by any of them and lets the server unwrap a JWE encrypted to any of them\. The creation time is what a rotation policy reads to hold a freshly minted version as announced\-but\-not\-yet\-signing until client JWKS caches catch up \(the propagation window\), and to keep a superseded version published until its tokens expire\. | | Interfaces | | | :--- | :--- | | [ICriticalHeaderHandler](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ICriticalHeaderHandler 'Abblix\.Jwt\.ICriticalHeaderHandler') | Recipient\-side handler for one JWS 'crit' header extension spec \(RFC 7515 §4\.1\.11\)\. Covers «understood AND processed»: the handler applies the extension's recipient\-side semantics via [HandleAsync\(CriticalHeaderContext, CancellationToken\)](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ICriticalHeaderHandler#Abblix.Jwt.ICriticalHeaderHandler.HandleAsync(Abblix.Jwt.CriticalHeaderContext,System.Threading.CancellationToken) 'Abblix\.Jwt\.ICriticalHeaderHandler\.HandleAsync\(Abblix\.Jwt\.CriticalHeaderContext, System\.Threading\.CancellationToken\)')\. The JOSE header parameter name the handler implements is the DI key it is registered under \- see [AddCriticalHeaderHandler<THandler>\(this IServiceCollection, string\)](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ServiceCollectionExtensions#Abblix.Jwt.ServiceCollectionExtensions.AddCriticalHeaderHandler_THandler_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,string) 'Abblix\.Jwt\.ServiceCollectionExtensions\.AddCriticalHeaderHandler\\(this Microsoft\.Extensions\.DependencyInjection\.IServiceCollection, string\)') \- so name and behaviour are inseparable: a name cannot be registered without a handler behind it\. | | [IJsonWebTokenCreator](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.IJsonWebTokenCreator 'Abblix\.Jwt\.IJsonWebTokenCreator') | Defines the contract for a service that creates JSON Web Tokens \(JWTs\)\. | | [IJsonWebTokenEncryptor](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.IJsonWebTokenEncryptor 'Abblix\.Jwt\.IJsonWebTokenEncryptor') | Defines the contract for JSON Web Encryption \(JWE\) token encryption and decryption services\. | | [IJsonWebTokenSigner](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.IJsonWebTokenSigner 'Abblix\.Jwt\.IJsonWebTokenSigner') | Defines the contract for JSON Web Signature \(JWS\) signing and verification services\. | | [IJsonWebTokenValidator](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.IJsonWebTokenValidator 'Abblix\.Jwt\.IJsonWebTokenValidator') | Defines the contract for a service that validates JSON Web Tokens \(JWTs\)\. | | Enums | | | :--- | :--- | | [JwtError](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JwtError 'Abblix\.Jwt\.JwtError') | High\-level categories of JWT processing failures returned by the validator and by callers that consume validated tokens\. Pair with [ErrorDescription](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JwtValidationError#Abblix.Jwt.JwtValidationError.ErrorDescription 'Abblix\.Jwt\.JwtValidationError\.ErrorDescription') for a human\-readable explanation\. Categories let callers branch on the failure cause without parsing the description string\. | | [ValidationOptions](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ValidationOptions 'Abblix\.Jwt\.ValidationOptions') | Set of flags for specifying various validation options for JWT tokens\. These options can be combined using bitwise operations to create a customized set of validation rules\. | | Delegates | | | :--- | :--- | | [ValidationParameters\.ResolveIssuerSigningKeysDelegate\(string\)](Abblix.Jwt.ValidationParameters.ResolveIssuerSigningKeysDelegate(string).md 'Abblix\.Jwt\.ValidationParameters\.ResolveIssuerSigningKeysDelegate\(string\)') | Resolves signing keys \(JWKs\) asynchronously for a specified issuer\. | | [ValidationParameters\.ResolveTokenDecryptionKeysDelegate\(string\)](Abblix.Jwt.ValidationParameters.ResolveTokenDecryptionKeysDelegate(string).md 'Abblix\.Jwt\.ValidationParameters\.ResolveTokenDecryptionKeysDelegate\(string\)') | Resolves decryption keys \(JWKs\) asynchronously for a specified issuer\. | | [ValidationParameters\.ValidateAudienceDelegate\(IEnumerable<string>\)](Abblix.Jwt.ValidationParameters.ValidateAudienceDelegate(System.Collections.Generic.IEnumerable_string_).md 'Abblix\.Jwt\.ValidationParameters\.ValidateAudienceDelegate\(System\.Collections\.Generic\.IEnumerable\\)') | Validates a collection of audiences against expected values\. | | [ValidationParameters\.ValidateIssuersDelegate\(string\)](Abblix.Jwt.ValidationParameters.ValidateIssuersDelegate(string).md 'Abblix\.Jwt\.ValidationParameters\.ValidateIssuersDelegate\(string\)') | Validates a token issuer against expected values\. | --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.AuthorizationDetail.md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt 'Abblix\.Jwt') ## AuthorizationDetail Class One entry in the OAuth 2\.0 Rich Authorization Requests `authorization_details` array \(RFC 9396 §2\), wrapped over a [System\.Text\.Json\.Nodes\.JsonNode](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonnode 'System\.Text\.Json\.Nodes\.JsonNode') which is the source of truth for the entry's content\. The wrapper exposes the RFC 9396 §2\.2 common\-data members as strongly\-typed accessors that read from and write to the underlying [Json](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.AuthorizationDetail#Abblix.Jwt.AuthorizationDetail.Json 'Abblix\.Jwt\.AuthorizationDetail\.Json') directly \- the same shape [JsonWebTokenPayload](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenPayload 'Abblix\.Jwt\.JsonWebTokenPayload') uses over its [System\.Text\.Json\.Nodes\.JsonObject](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonobject 'System\.Text\.Json\.Nodes\.JsonObject')\. ```csharp public record AuthorizationDetail : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → AuthorizationDetail Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[AuthorizationDetail](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.AuthorizationDetail 'Abblix\.Jwt\.AuthorizationDetail')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Remarks Type\-specific members outside the §2\.2 common\-data set \(for example the `instructedAmount` / `creditorAccount` fields of a PSD2 `payment_initiation` entry\) are accessed directly through [Json](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.AuthorizationDetail#Abblix.Jwt.AuthorizationDetail.Json 'Abblix\.Jwt\.AuthorizationDetail\.Json'); the per\-type validator that owns the schema for a given `type` reads and writes them via the [System\.Text\.Json\.Nodes](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes 'System\.Text\.Json\.Nodes') API on the wrapped node\. ### Constructors ## AuthorizationDetail\(JsonObject\) Constructor {#Abblix.Jwt.AuthorizationDetail.AuthorizationDetail(System.Text.Json.Nodes.JsonObject)} One entry in the OAuth 2\.0 Rich Authorization Requests `authorization_details` array \(RFC 9396 §2\), wrapped over a [System\.Text\.Json\.Nodes\.JsonNode](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonnode 'System\.Text\.Json\.Nodes\.JsonNode') which is the source of truth for the entry's content\. The wrapper exposes the RFC 9396 §2\.2 common\-data members as strongly\-typed accessors that read from and write to the underlying [Json](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.AuthorizationDetail#Abblix.Jwt.AuthorizationDetail.Json 'Abblix\.Jwt\.AuthorizationDetail\.Json') directly \- the same shape [JsonWebTokenPayload](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenPayload 'Abblix\.Jwt\.JsonWebTokenPayload') uses over its [System\.Text\.Json\.Nodes\.JsonObject](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonobject 'System\.Text\.Json\.Nodes\.JsonObject')\. ```csharp public AuthorizationDetail(System.Text.Json.Nodes.JsonObject Json); ``` #### Parameters ###### `Json` [System\.Text\.Json\.Nodes\.JsonObject](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonobject 'System\.Text\.Json\.Nodes\.JsonObject') {#Abblix.Jwt.AuthorizationDetail.AuthorizationDetail(System.Text.Json.Nodes.JsonObject).Json} The underlying JSON node carrying the entry's wire shape\. Member order, type\-specific payload \(RFC 9396 §2\.2 extension members\), and any unknown fields the AS does not model survive the authorize → code → token round\-trip byte\-exact because no typed deserialise / re\-serialise cycle ever runs over them\. ### Remarks Type\-specific members outside the §2\.2 common\-data set \(for example the `instructedAmount` / `creditorAccount` fields of a PSD2 `payment_initiation` entry\) are accessed directly through [Json](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.AuthorizationDetail#Abblix.Jwt.AuthorizationDetail.Json 'Abblix\.Jwt\.AuthorizationDetail\.Json'); the per\-type validator that owns the schema for a given `type` reads and writes them via the [System\.Text\.Json\.Nodes](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes 'System\.Text\.Json\.Nodes') API on the wrapped node\. ### Properties ## AuthorizationDetail\.Actions Property {#Abblix.Jwt.AuthorizationDetail.Actions} Kinds of actions to be taken at the resource, per RFC 9396 §2\.2\. ```csharp public System.Collections.Generic.IEnumerable? Actions { get; set; } ``` #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ## AuthorizationDetail\.Datatypes Property {#Abblix.Jwt.AuthorizationDetail.Datatypes} Kinds of data being requested from the resource, per RFC 9396 §2\.2\. ```csharp public System.Collections.Generic.IEnumerable? Datatypes { get; set; } ``` #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ## AuthorizationDetail\.Identifier Property {#Abblix.Jwt.AuthorizationDetail.Identifier} A specific resource identifier at the API, per RFC 9396 §2\.2\. ```csharp public string? Identifier { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## AuthorizationDetail\.Json Property {#Abblix.Jwt.AuthorizationDetail.Json} The underlying JSON node carrying the entry's wire shape\. Member order, type\-specific payload \(RFC 9396 §2\.2 extension members\), and any unknown fields the AS does not model survive the authorize → code → token round\-trip byte\-exact because no typed deserialise / re\-serialise cycle ever runs over them\. ```csharp public System.Text.Json.Nodes.JsonObject Json { get; } ``` #### Property Value [System\.Text\.Json\.Nodes\.JsonObject](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonobject 'System\.Text\.Json\.Nodes\.JsonObject') ## AuthorizationDetail\.Locations Property {#Abblix.Jwt.AuthorizationDetail.Locations} Locations of the resource server\(s\) the client wants to access, per RFC 9396 §2\.2\. Typically URIs identifying resource servers\. ```csharp public System.Collections.Generic.IEnumerable? Locations { get; set; } ``` #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ## AuthorizationDetail\.Privileges Property {#Abblix.Jwt.AuthorizationDetail.Privileges} Types or levels of privilege being requested at the resource, per RFC 9396 §2\.2\. ```csharp public System.Collections.Generic.IEnumerable? Privileges { get; set; } ``` #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ## AuthorizationDetail\.Type Property {#Abblix.Jwt.AuthorizationDetail.Type} The authorization\-detail type identifier\. RFC 9396 §2 makes it REQUIRED, and §2\.1 governs what a value may be; the per\-type validator rejects entries where this member is missing with `invalid_authorization_details`\. ```csharp public string? Type { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.AuthorizationDetail.Parameters.md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt 'Abblix\.Jwt').[AuthorizationDetail](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.AuthorizationDetail 'Abblix\.Jwt\.AuthorizationDetail') ## AuthorizationDetail\.Parameters Class RFC 9396 §2\.2 member names\. Type\-specific members outside this set live alongside in [Json](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.AuthorizationDetail#Abblix.Jwt.AuthorizationDetail.Json 'Abblix\.Jwt\.AuthorizationDetail\.Json') and are accessed by per\-type validators directly through the [System\.Text\.Json\.Nodes](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes 'System\.Text\.Json\.Nodes') API on the wrapped node\. ```csharp public static class AuthorizationDetail.Parameters ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → Parameters ### Fields ## AuthorizationDetail\.Parameters\.Actions Field {#Abblix.Jwt.AuthorizationDetail.Parameters.Actions} The actions the entry authorises at those locations\. ```csharp public const string Actions = "actions"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## AuthorizationDetail\.Parameters\.Datatypes Field {#Abblix.Jwt.AuthorizationDetail.Parameters.Datatypes} The kinds of data the entry authorises access to\. ```csharp public const string Datatypes = "datatypes"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## AuthorizationDetail\.Parameters\.Identifier Field {#Abblix.Jwt.AuthorizationDetail.Parameters.Identifier} The identifier of the specific resource the entry is about\. ```csharp public const string Identifier = "identifier"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## AuthorizationDetail\.Parameters\.Locations Field {#Abblix.Jwt.AuthorizationDetail.Parameters.Locations} The locations of the resource servers the entry is addressed to\. ```csharp public const string Locations = "locations"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## AuthorizationDetail\.Parameters\.Privileges Field {#Abblix.Jwt.AuthorizationDetail.Parameters.Privileges} The privileges the entry asks for at those locations\. ```csharp public const string Privileges = "privileges"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## AuthorizationDetail\.Parameters\.Type Field {#Abblix.Jwt.AuthorizationDetail.Parameters.Type} The authorization detail type identifier, REQUIRED on every entry\. ```csharp public const string Type = "type"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ClaimExtensions.md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt 'Abblix\.Jwt') ## ClaimExtensions Class Provides extension methods for handling claims, particularly for converting between JWT claims and security claims\. ```csharp public static class ClaimExtensions ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ClaimExtensions ### Methods ## ClaimExtensions\.AsString\(this JsonNode\) Method {#Abblix.Jwt.ClaimExtensions.AsString(thisSystem.Text.Json.Nodes.JsonNode)} Converts a [System\.Text\.Json\.Nodes\.JsonNode](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonnode 'System\.Text\.Json\.Nodes\.JsonNode') to a string representation\. If the node is a [System\.Text\.Json\.Nodes\.JsonValue](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonvalue 'System\.Text\.Json\.Nodes\.JsonValue'), the value is extracted as a string; otherwise, the JSON string representation of the node is returned\. ```csharp public static string AsString(this System.Text.Json.Nodes.JsonNode node); ``` #### Parameters ###### `node` [System\.Text\.Json\.Nodes\.JsonNode](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonnode 'System\.Text\.Json\.Nodes\.JsonNode') {#Abblix.Jwt.ClaimExtensions.AsString(thisSystem.Text.Json.Nodes.JsonNode).node} The [System\.Text\.Json\.Nodes\.JsonNode](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonnode 'System\.Text\.Json\.Nodes\.JsonNode') to convert to a string\. #### Returns [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') A string representation of the [System\.Text\.Json\.Nodes\.JsonNode](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonnode 'System\.Text\.Json\.Nodes\.JsonNode')\. --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ClockSkew.md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt 'Abblix\.Jwt') ## ClockSkew Struct How far a token's timestamps may sit either side of this clock and still be honoured\. ```csharp public readonly record struct ClockSkew : System.IEquatable ``` Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[ClockSkew](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ClockSkew 'Abblix\.Jwt\.ClockSkew')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Remarks The two directions are separate numbers because only one of them is governed by anything. FAPI 2.0 Security Profile section 5.3.2.1 speaks exclusively of `iat` and `nbf` "in the future"; `exp` appears nowhere in that section, so how long a token stays usable past its stated end is this library's question to answer and a profile's to leave alone. They travel as one type so that a caller passing a tolerance passes both halves or neither. A value carrying one half is indistinguishable from a deliberate asymmetry, which is what the profile below expresses on purpose. ### Fields ## ClockSkew\.Fapi2 Field {#Abblix.Jwt.ClockSkew.Fapi2} What FAPI 2\.0 Security Profile section 5\.3\.2\.1 asks a server to accept: an `iat` or `nbf` "between 0 and 10 seconds in the future"\. ```csharp public static readonly ClockSkew Fapi2; ``` #### Field Value [ClockSkew](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ClockSkew 'Abblix\.Jwt\.ClockSkew') ### Remarks The asymmetry is the specification's, not a choice made here\. That sentence speaks only of the future direction, so nothing in it extends the life of a token past the `exp` its own issuer chose \- which is a deadline this server has no reason to move\. ## ClockSkew\.Fapi2Ceiling Field {#Abblix.Jwt.ClockSkew.Fapi2Ceiling} The furthest anything may be dated under FAPI 2\.0 Security Profile section 5\.3\.2\.1, which requires a server to "reject JWTs with an `iat` or `nbf` timestamp greater than 60 seconds in the future"\. ```csharp public static readonly TimeSpan Fapi2Ceiling; ``` #### Field Value [System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan') ### Remarks A bound on whatever a caller asks for, which is why it is separate from [Fapi2](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ClockSkew#Abblix.Jwt.ClockSkew.Fapi2 'Abblix\.Jwt\.ClockSkew\.Fapi2') rather than folded into it\. Note 3 of that section says the number is in the document "to prevent implementations switching off `iat` and `nbf` checks completely", so it belongs to the profile: a deployment outside one answers to RFC 7523 Section 3, which names no bound at all\. The quoted sentence governs the forward direction; holding the backward one to the same number is this server's decision rather than the specification's\. A profile distrusting a clock past some point one way has no reason to trust it further the other, and the alternative is a ceiling that reads as a bound on the tolerance while leaving half of it unbounded\. ## ClockSkew\.None Field {#Abblix.Jwt.ClockSkew.None} No tolerance in either direction, and what a caller gets by saying nothing\. ```csharp public static readonly ClockSkew None; ``` #### Field Value [ClockSkew](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ClockSkew 'Abblix\.Jwt\.ClockSkew') ### Remarks A default that granted time would widen an expiry check for every caller that never asked \- including one enforcing a deadline of its own, which is what most callers of this type are doing\. A tolerance is granted deliberately or not at all: a deployment\-wide answer belongs to the security profile a host opts into, and a number a profile requires is the profile's to supply\. ### Properties ## ClockSkew\.Future Property {#Abblix.Jwt.ClockSkew.Future} How far into the future a timestamp may reach and still be honoured: how far off a token's `nbf` or `iat` may be dated\. This is the direction FAPI 2\.0 section 5\.3\.2\.1 speaks of, and the only one any specification here bounds\. ```csharp public System.TimeSpan Future { get; init; } ``` #### Property Value [System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan') ## ClockSkew\.Past Property {#Abblix.Jwt.ClockSkew.Past} How far into the past a timestamp may reach and still be honoured: how long a token stays usable after the `exp` it carries\. ```csharp public System.TimeSpan Past { get; init; } ``` #### Property Value [System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan') ### Methods ## ClockSkew\.BoundedBy\(Nullable\\) Method {#Abblix.Jwt.ClockSkew.BoundedBy(System.Nullable_System.TimeSpan_)} This tolerance with neither direction exceeding [ceiling](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ClockSkew#Abblix.Jwt.ClockSkew.BoundedBy(System.Nullable_System.TimeSpan_).ceiling 'Abblix\.Jwt\.ClockSkew\.BoundedBy\(System\.Nullable\\)\.ceiling'), or unchanged where there is no ceiling to hold it to\. ```csharp public Abblix.Jwt.ClockSkew BoundedBy(System.Nullable ceiling); ``` #### Parameters ###### `ceiling` [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') {#Abblix.Jwt.ClockSkew.BoundedBy(System.Nullable_System.TimeSpan_).ceiling} The furthest either direction may reach, or null for no bound\. #### Returns [ClockSkew](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ClockSkew 'Abblix\.Jwt\.ClockSkew') ## ClockSkew\.WhyRefused\(DateTimeOffset, Nullable\, Nullable\, Nullable\\) Method {#Abblix.Jwt.ClockSkew.WhyRefused(System.DateTimeOffset,System.Nullable_System.DateTimeOffset_,System.Nullable_System.DateTimeOffset_,System.Nullable_System.DateTimeOffset_)} Why a token's timestamps are refused at [now](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ClockSkew#Abblix.Jwt.ClockSkew.WhyRefused(System.DateTimeOffset,System.Nullable_System.DateTimeOffset_,System.Nullable_System.DateTimeOffset_,System.Nullable_System.DateTimeOffset_).now 'Abblix\.Jwt\.ClockSkew\.WhyRefused\(System\.DateTimeOffset, System\.Nullable\, System\.Nullable\, System\.Nullable\\)\.now'), or null where this tolerance admits them\. ```csharp public string? WhyRefused(System.DateTimeOffset now, System.Nullable notBefore, System.Nullable expiresAt, System.Nullable issuedAt); ``` #### Parameters ###### `now` [System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset') {#Abblix.Jwt.ClockSkew.WhyRefused(System.DateTimeOffset,System.Nullable_System.DateTimeOffset_,System.Nullable_System.DateTimeOffset_,System.Nullable_System.DateTimeOffset_).now} The instant the timestamps are judged against\. ###### `notBefore` [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') {#Abblix.Jwt.ClockSkew.WhyRefused(System.DateTimeOffset,System.Nullable_System.DateTimeOffset_,System.Nullable_System.DateTimeOffset_,System.Nullable_System.DateTimeOffset_).notBefore} When the token says it starts, if it says\. ###### `expiresAt` [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') {#Abblix.Jwt.ClockSkew.WhyRefused(System.DateTimeOffset,System.Nullable_System.DateTimeOffset_,System.Nullable_System.DateTimeOffset_,System.Nullable_System.DateTimeOffset_).expiresAt} When the token says it ends, if it says\. ###### `issuedAt` [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') {#Abblix.Jwt.ClockSkew.WhyRefused(System.DateTimeOffset,System.Nullable_System.DateTimeOffset_,System.Nullable_System.DateTimeOffset_,System.Nullable_System.DateTimeOffset_).issuedAt} When the token says it was minted, if it says\. #### Returns [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks The comparison belongs here rather than to whoever validates, because more than one caller asks it: a token is checked once against the tolerance it arrived under, and again wherever a tighter one turns out to apply\. Two copies would part company on the boundaries, which is where they are least likely to be noticed \- expiry is compared with `<=`, so a token exactly its whole tolerance past the end is already expired, while one exactly the whole tolerance ahead is still accepted\. The order is deliberate: a token both post\-dated and expired answers "not yet valid", which is what its sender meant to send and what tells them so\. ### Operators ## ClockSkew\.implicit operator ClockSkew\(TimeSpan\) Operator {#Abblix.Jwt.ClockSkew.op_ImplicitAbblix.Jwt.ClockSkew(System.TimeSpan)} One number means the same tolerance either way, so a caller holding a single window assigns it directly\. ```csharp public static Abblix.Jwt.ClockSkew implicit operator Abblix.Jwt.ClockSkew(System.TimeSpan symmetric); ``` #### Parameters ###### `symmetric` [System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan') {#Abblix.Jwt.ClockSkew.op_ImplicitAbblix.Jwt.ClockSkew(System.TimeSpan).symmetric} The tolerance to apply either way\. #### Returns [ClockSkew](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ClockSkew 'Abblix\.Jwt\.ClockSkew') ### Remarks Implicit because the conversion loses nothing and cannot fail: a caller with one number has said what both halves are\. The asymmetry belongs to a profile that prescribes one, never to a value somebody typed \- a host naming one window means it in each direction, and having to spell that out is the sort of ceremony that gets one half set and the other forgotten\. --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.CriticalHeaderContext.md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt 'Abblix\.Jwt') ## CriticalHeaderContext Class Per\-call context passed to [HandleAsync\(CriticalHeaderContext, CancellationToken\)](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ICriticalHeaderHandler#Abblix.Jwt.ICriticalHeaderHandler.HandleAsync(Abblix.Jwt.CriticalHeaderContext,System.Threading.CancellationToken) 'Abblix\.Jwt\.ICriticalHeaderHandler\.HandleAsync\(Abblix\.Jwt\.CriticalHeaderContext, System\.Threading\.CancellationToken\)')\. Reference type with init\-only properties so adding a future field is a non\-breaking change for handler implementations\. ```csharp public sealed class CriticalHeaderContext ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → CriticalHeaderContext ### Properties ## CriticalHeaderContext\.Parameters Property {#Abblix.Jwt.CriticalHeaderContext.Parameters} The host\-supplied validation parameters in force for this call\. Handlers consult these to honour caller policy \(algorithm allowlists, time skew, audience/issuer hooks\)\. ```csharp public Abblix.Jwt.ValidationParameters Parameters { get; init; } ``` #### Property Value [ValidationParameters](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ValidationParameters 'Abblix\.Jwt\.ValidationParameters') ## CriticalHeaderContext\.Token Property {#Abblix.Jwt.CriticalHeaderContext.Token} The parsed JWS being validated\. Handlers typically read `Token.Header.Json[name]` for their declared name; payload access is available when the extension's semantics span both halves \(e\.g\. RFC 8225 PASSporT profile rules\)\. ```csharp public Abblix.Jwt.JsonWebToken Token { get; init; } ``` #### Property Value [JsonWebToken](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebToken 'Abblix\.Jwt\.JsonWebToken') --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.EllipticCurveJsonWebKey.md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt 'Abblix\.Jwt') ## EllipticCurveJsonWebKey Class Represents an Elliptic Curve JSON Web Key \(JWK\) containing EC\-specific cryptographic parameters\. Supports both public and private EC keys per RFC 7518 Section 6\.2\. ```csharp public sealed record EllipticCurveJsonWebKey : Abblix.Jwt.JsonWebKey, System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey') → EllipticCurveJsonWebKey Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[EllipticCurveJsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.EllipticCurveJsonWebKey 'Abblix\.Jwt\.EllipticCurveJsonWebKey')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Properties ## EllipticCurveJsonWebKey\.Curve Property {#Abblix.Jwt.EllipticCurveJsonWebKey.Curve} Elliptic Curve Type \(crv\)\. Identifies the curve type for an Elliptic Curve key\. Common values include "P\-256", "P\-384", "P\-521" for NIST curves\. This is a required parameter for EC keys\. ```csharp public string? Curve { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## EllipticCurveJsonWebKey\.HasPrivateKey Property {#Abblix.Jwt.EllipticCurveJsonWebKey.HasPrivateKey} Checks if the key contains private key material\. ```csharp public override bool HasPrivateKey { get; } ``` #### Property Value [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') ## EllipticCurveJsonWebKey\.HasPublicKey Property {#Abblix.Jwt.EllipticCurveJsonWebKey.HasPublicKey} Checks if the key contains public key material\. ```csharp public override bool HasPublicKey { get; } ``` #### Property Value [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') ## EllipticCurveJsonWebKey\.KeyType Property {#Abblix.Jwt.EllipticCurveJsonWebKey.KeyType} The key type identifier for Elliptic Curve keys\. Always returns "EC"\. ```csharp public override string KeyType { get; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## EllipticCurveJsonWebKey\.PrivateKey Property {#Abblix.Jwt.EllipticCurveJsonWebKey.PrivateKey} ECC Private Key \(d\)\. Represents the private part of an Elliptic Curve key\. This parameter must be kept confidential and should only be present in private keys\. ```csharp public byte[]? PrivateKey { get; set; } ``` #### Property Value [System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') ## EllipticCurveJsonWebKey\.X Property {#Abblix.Jwt.EllipticCurveJsonWebKey.X} X\-coordinate for Elliptic Curve \(x\)\. Part of the Elliptic Curve public key\. This is a required parameter for EC public keys\. ```csharp public byte[]? X { get; set; } ``` #### Property Value [System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') ## EllipticCurveJsonWebKey\.Y Property {#Abblix.Jwt.EllipticCurveJsonWebKey.Y} Y\-coordinate for Elliptic Curve \(y\)\. Part of the Elliptic Curve public key\. This is a required parameter for EC public keys\. ```csharp public byte[]? Y { get; set; } ``` #### Property Value [System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') ### Methods ## EllipticCurveJsonWebKey\.Sanitize\(bool\) Method {#Abblix.Jwt.EllipticCurveJsonWebKey.Sanitize(bool)} Prepares a sanitized version of the EC JWK that excludes private key information unless explicitly included\. ```csharp public override Abblix.Jwt.JsonWebKey Sanitize(bool includePrivateKeys); ``` #### Parameters ###### `includePrivateKeys` [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') {#Abblix.Jwt.EllipticCurveJsonWebKey.Sanitize(bool).includePrivateKeys} Whether to include private key data in the sanitized output\. #### Returns [JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey') A new instance of [EllipticCurveJsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.EllipticCurveJsonWebKey 'Abblix\.Jwt\.EllipticCurveJsonWebKey') with or without private key data based on the input parameter\. #### Exceptions [System\.InvalidOperationException](https://learn.microsoft.com/en-us/dotnet/api/system.invalidoperationexception 'System\.InvalidOperationException') Thrown when includePrivateKeys is true but the key contains no private key data\. --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.EllipticCurveOids.md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt 'Abblix\.Jwt') ## EllipticCurveOids Class ASN\.1 object identifiers \(OIDs\) for NIST\-recommended elliptic curves used in ECDSA cryptography\. ```csharp public static class EllipticCurveOids ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → EllipticCurveOids ### Fields ## EllipticCurveOids\.P256 Field {#Abblix.Jwt.EllipticCurveOids.P256} OID for the P\-256 curve \(secp256r1/prime256v1\), a 256\-bit prime field Weierstrass curve\. ```csharp public const string P256 = "1.2.840.10045.3.1.7"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## EllipticCurveOids\.P384 Field {#Abblix.Jwt.EllipticCurveOids.P384} OID for the P\-384 curve \(secp384r1\), a 384\-bit prime field Weierstrass curve\. ```csharp public const string P384 = "1.3.132.0.34"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## EllipticCurveOids\.P521 Field {#Abblix.Jwt.EllipticCurveOids.P521} OID for the P\-521 curve \(secp521r1\), a 521\-bit prime field Weierstrass curve\. ```csharp public const string P521 = "1.3.132.0.35"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.EllipticCurveTypes.md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt 'Abblix\.Jwt') ## EllipticCurveTypes Class Elliptic curve identifiers for the JWK "crv" parameter, as defined in RFC 7518 Section 6\.2\.1\.1\. ```csharp public static class EllipticCurveTypes ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → EllipticCurveTypes ### Fields ## EllipticCurveTypes\.P256 Field {#Abblix.Jwt.EllipticCurveTypes.P256} NIST P\-256 \(secp256r1 / prime256v1 / X9\.62 prime256v1\), a 256\-bit prime\-field curve\. Pairs with [ES256](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.SigningAlgorithms#Abblix.Jwt.SigningAlgorithms.ES256 'Abblix\.Jwt\.SigningAlgorithms\.ES256')\. ```csharp public const string P256 = "P-256"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## EllipticCurveTypes\.P384 Field {#Abblix.Jwt.EllipticCurveTypes.P384} NIST P\-384 \(secp384r1\), a 384\-bit prime\-field curve\. Pairs with [ES384](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.SigningAlgorithms#Abblix.Jwt.SigningAlgorithms.ES384 'Abblix\.Jwt\.SigningAlgorithms\.ES384')\. ```csharp public const string P384 = "P-384"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## EllipticCurveTypes\.P521 Field {#Abblix.Jwt.EllipticCurveTypes.P521} NIST P\-521 \(secp521r1\), a 521\-bit prime\-field curve\. Pairs with [ES512](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.SigningAlgorithms#Abblix.Jwt.SigningAlgorithms.ES512 'Abblix\.Jwt\.SigningAlgorithms\.ES512') \(note the algorithm name uses 512, referring to the SHA\-512 hash, while the curve itself is 521 bits\)\. ```csharp public const string P521 = "P-521"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.EncryptionAlgorithms.md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt 'Abblix\.Jwt') ## EncryptionAlgorithms Class JWE algorithm identifiers \("alg" and "enc" header values\) defined in RFC 7516 \(JWE\) and RFC 7518 Sections 4 \(key management\) and 5 \(content encryption\)\. Constants on this class are recognized by the library; some are listed but not yet supported because their underlying primitives are not provided by \.NET \(see remarks on each member\)\. ```csharp public static class EncryptionAlgorithms ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → EncryptionAlgorithms --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.EncryptionAlgorithms.ContentEncryption.md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt 'Abblix\.Jwt').[EncryptionAlgorithms](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.EncryptionAlgorithms 'Abblix\.Jwt\.EncryptionAlgorithms') ## EncryptionAlgorithms\.ContentEncryption Class Content encryption algorithms \("enc" parameter in the JWE header\)\. These encrypt the JWE payload using the Content Encryption Key produced by the key management algorithm\. ```csharp public static class EncryptionAlgorithms.ContentEncryption ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ContentEncryption ### Fields ## EncryptionAlgorithms\.ContentEncryption\.Aes128CbcHmacSha256 Field {#Abblix.Jwt.EncryptionAlgorithms.ContentEncryption.Aes128CbcHmacSha256} AES\-128\-CBC with HMAC\-SHA\-256 authentication \(RFC 7518 Section 5\.2\)\. Backed by \.NET `Aes` in CBC/PKCS7 mode and `HMACSHA256`; the 256\-bit CEK is split into a 128\-bit MAC key and a 128\-bit AES key\. ```csharp public const string Aes128CbcHmacSha256 = "A128CBC-HS256"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## EncryptionAlgorithms\.ContentEncryption\.Aes128Gcm Field {#Abblix.Jwt.EncryptionAlgorithms.ContentEncryption.Aes128Gcm} AES\-128 in Galois/Counter Mode \(RFC 7518 Section 5\.3\)\. Backed by \.NET `AesGcm` with a 96\-bit IV and 128\-bit authentication tag\. Single\-pass authenticated encryption\. ```csharp public const string Aes128Gcm = "A128GCM"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## EncryptionAlgorithms\.ContentEncryption\.Aes192CbcHmacSha384 Field {#Abblix.Jwt.EncryptionAlgorithms.ContentEncryption.Aes192CbcHmacSha384} AES\-192\-CBC with HMAC\-SHA\-384 authentication \(RFC 7518 Section 5\.2\)\. Backed by \.NET `Aes` in CBC/PKCS7 mode and `HMACSHA384`; uses a 384\-bit CEK\. ```csharp public const string Aes192CbcHmacSha384 = "A192CBC-HS384"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## EncryptionAlgorithms\.ContentEncryption\.Aes192Gcm Field {#Abblix.Jwt.EncryptionAlgorithms.ContentEncryption.Aes192Gcm} AES\-192 in Galois/Counter Mode \(RFC 7518 Section 5\.3\)\. Backed by \.NET `AesGcm` with a 96\-bit IV and 128\-bit authentication tag\. ```csharp public const string Aes192Gcm = "A192GCM"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## EncryptionAlgorithms\.ContentEncryption\.Aes256CbcHmacSha512 Field {#Abblix.Jwt.EncryptionAlgorithms.ContentEncryption.Aes256CbcHmacSha512} AES\-256\-CBC with HMAC\-SHA\-512 authentication \(RFC 7518 Section 5\.2\)\. Backed by \.NET `Aes` in CBC/PKCS7 mode and `HMACSHA512`; uses a 512\-bit CEK\. Default content encryption used by this library when issuing encrypted tokens\. ```csharp public const string Aes256CbcHmacSha512 = "A256CBC-HS512"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## EncryptionAlgorithms\.ContentEncryption\.Aes256Gcm Field {#Abblix.Jwt.EncryptionAlgorithms.ContentEncryption.Aes256Gcm} AES\-256 in Galois/Counter Mode \(RFC 7518 Section 5\.3\)\. Backed by \.NET `AesGcm` with a 96\-bit IV and 128\-bit authentication tag\. Recommended where peers support GCM\. ```csharp public const string Aes256Gcm = "A256GCM"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.EncryptionAlgorithms.KeyManagement.md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt 'Abblix\.Jwt').[EncryptionAlgorithms](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.EncryptionAlgorithms 'Abblix\.Jwt\.EncryptionAlgorithms') ## EncryptionAlgorithms\.KeyManagement Class Key management algorithms \("alg" parameter in the JWE header\)\. These wrap or derive the Content Encryption Key \(CEK\) that is then used by a content encryption algorithm\. ```csharp public static class EncryptionAlgorithms.KeyManagement ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → KeyManagement ### Fields ## EncryptionAlgorithms\.KeyManagement\.Aes128Gcmkw Field {#Abblix.Jwt.EncryptionAlgorithms.KeyManagement.Aes128Gcmkw} AES\-GCM Key Wrap with a 128\-bit key \(RFC 7518 Section 4\.7\)\. Backed by \.NET `AesGcm`\. The 96\-bit IV and 128\-bit authentication tag are carried in the JOSE header parameters `iv` and `tag` \(RFC 7518 Section 4\.7\.1\); the JWE Encrypted Key is the wrapped\-CEK ciphertext\. ```csharp public const string Aes128Gcmkw = "A128GCMKW"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## EncryptionAlgorithms\.KeyManagement\.Aes128KW Field {#Abblix.Jwt.EncryptionAlgorithms.KeyManagement.Aes128KW} AES Key Wrap with a 128\-bit key \(RFC 7518 Section 4\.4\)\. The CEK is wrapped with the RFC 3394 AES Key Wrap construction over the platform AES\-ECB primitive; the wrap's own integrity check register protects the wrapped key, so no extra header parameters are used\. ```csharp public const string Aes128KW = "A128KW"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## EncryptionAlgorithms\.KeyManagement\.Aes192Gcmkw Field {#Abblix.Jwt.EncryptionAlgorithms.KeyManagement.Aes192Gcmkw} AES\-GCM Key Wrap with a 192\-bit key \(RFC 7518 Section 4\.7\)\. Backed by \.NET `AesGcm`\. ```csharp public const string Aes192Gcmkw = "A192GCMKW"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## EncryptionAlgorithms\.KeyManagement\.Aes192KW Field {#Abblix.Jwt.EncryptionAlgorithms.KeyManagement.Aes192KW} AES Key Wrap with a 192\-bit key \(RFC 7518 Section 4\.4\)\. See [Aes128KW](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.EncryptionAlgorithms.KeyManagement#Abblix.Jwt.EncryptionAlgorithms.KeyManagement.Aes128KW 'Abblix\.Jwt\.EncryptionAlgorithms\.KeyManagement\.Aes128KW')\. ```csharp public const string Aes192KW = "A192KW"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## EncryptionAlgorithms\.KeyManagement\.Aes256Gcmkw Field {#Abblix.Jwt.EncryptionAlgorithms.KeyManagement.Aes256Gcmkw} AES\-GCM Key Wrap with a 256\-bit key \(RFC 7518 Section 4\.7\)\. Backed by \.NET `AesGcm`\. Recommended choice when both peers can share a symmetric key\. ```csharp public const string Aes256Gcmkw = "A256GCMKW"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## EncryptionAlgorithms\.KeyManagement\.Aes256KW Field {#Abblix.Jwt.EncryptionAlgorithms.KeyManagement.Aes256KW} AES Key Wrap with a 256\-bit key \(RFC 7518 Section 4\.4\)\. See [Aes128KW](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.EncryptionAlgorithms.KeyManagement#Abblix.Jwt.EncryptionAlgorithms.KeyManagement.Aes128KW 'Abblix\.Jwt\.EncryptionAlgorithms\.KeyManagement\.Aes128KW')\. Recommended choice when a peer requires plain AES Key Wrap; otherwise prefer [Aes256Gcmkw](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.EncryptionAlgorithms.KeyManagement#Abblix.Jwt.EncryptionAlgorithms.KeyManagement.Aes256Gcmkw 'Abblix\.Jwt\.EncryptionAlgorithms\.KeyManagement\.Aes256Gcmkw') for authenticated wrapping with a random IV\. ```csharp public const string Aes256KW = "A256KW"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## EncryptionAlgorithms\.KeyManagement\.Dir Field {#Abblix.Jwt.EncryptionAlgorithms.KeyManagement.Dir} Direct use of a shared symmetric key as the Content Encryption Key \(RFC 7518 Section 4\.5\)\. No key wrap is performed and the JWE "encrypted\_key" is the empty octet sequence\. The shared key length must match the key size required by the chosen content encryption algorithm\. ```csharp public const string Dir = "dir"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## EncryptionAlgorithms\.KeyManagement\.EcdhEs Field {#Abblix.Jwt.EncryptionAlgorithms.KeyManagement.EcdhEs} Elliptic Curve Diffie\-Hellman Ephemeral Static key agreement in Direct Key Agreement mode \(RFC 7518 Section 4\.6\)\. The CEK is derived from the ephemeral\-static agreement via the Concat KDF \(computed natively by `ECDiffieHellman.DeriveKeyFromHash`\) and the JWE Encrypted Key is empty\. Supports the NIST curves P\-256, P\-384 and P\-521\. ```csharp public const string EcdhEs = "ECDH-ES"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## EncryptionAlgorithms\.KeyManagement\.EcdhEsAes128KW Field {#Abblix.Jwt.EncryptionAlgorithms.KeyManagement.EcdhEsAes128KW} ECDH\-ES key agreement wrapping the CEK with AES\-128 Key Wrap \(RFC 7518 Section 4\.6\)\. The agreement derives a 128\-bit KEK that wraps a random CEK per RFC 3394\. ```csharp public const string EcdhEsAes128KW = "ECDH-ES+A128KW"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## EncryptionAlgorithms\.KeyManagement\.EcdhEsAes192KW Field {#Abblix.Jwt.EncryptionAlgorithms.KeyManagement.EcdhEsAes192KW} ECDH\-ES key agreement wrapping the CEK with AES\-192 Key Wrap \(RFC 7518 Section 4\.6\)\. See [EcdhEsAes128KW](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.EncryptionAlgorithms.KeyManagement#Abblix.Jwt.EncryptionAlgorithms.KeyManagement.EcdhEsAes128KW 'Abblix\.Jwt\.EncryptionAlgorithms\.KeyManagement\.EcdhEsAes128KW')\. ```csharp public const string EcdhEsAes192KW = "ECDH-ES+A192KW"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## EncryptionAlgorithms\.KeyManagement\.EcdhEsAes256KW Field {#Abblix.Jwt.EncryptionAlgorithms.KeyManagement.EcdhEsAes256KW} ECDH\-ES key agreement wrapping the CEK with AES\-256 Key Wrap \(RFC 7518 Section 4\.6\)\. See [EcdhEsAes128KW](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.EncryptionAlgorithms.KeyManagement#Abblix.Jwt.EncryptionAlgorithms.KeyManagement.EcdhEsAes128KW 'Abblix\.Jwt\.EncryptionAlgorithms\.KeyManagement\.EcdhEsAes128KW')\. Recommended choice for EC\-key\-based JWE deployments\. ```csharp public const string EcdhEsAes256KW = "ECDH-ES+A256KW"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## EncryptionAlgorithms\.KeyManagement\.Pbes2HmacSha256Aes128KW Field {#Abblix.Jwt.EncryptionAlgorithms.KeyManagement.Pbes2HmacSha256Aes128KW} PBES2 with HMAC SHA\-256 and AES\-128 Key Wrap \(RFC 7518 Section 4\.8\)\. The KEK is derived from a password with PBKDF2 \(native `Rfc2898DeriveBytes.Pbkdf2`\) using the 'p2s'/'p2c' header parameters, then wraps the CEK per RFC 3394\. Inbound iteration counts are bounded to keep an attacker\-supplied token from demanding arbitrary PBKDF2 work\. Opt\-in: the PBES2 family is enabled by `AddPbes2KeyManagement`, not by default \- accepting password\-based key management from token producers is an explicit hosting decision\. ```csharp public const string Pbes2HmacSha256Aes128KW = "PBES2-HS256+A128KW"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## EncryptionAlgorithms\.KeyManagement\.Pbes2HmacSha384Aes192KW Field {#Abblix.Jwt.EncryptionAlgorithms.KeyManagement.Pbes2HmacSha384Aes192KW} PBES2 with HMAC SHA\-384 and AES\-192 Key Wrap \(RFC 7518 Section 4\.8\)\. See [Pbes2HmacSha256Aes128KW](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.EncryptionAlgorithms.KeyManagement#Abblix.Jwt.EncryptionAlgorithms.KeyManagement.Pbes2HmacSha256Aes128KW 'Abblix\.Jwt\.EncryptionAlgorithms\.KeyManagement\.Pbes2HmacSha256Aes128KW')\. ```csharp public const string Pbes2HmacSha384Aes192KW = "PBES2-HS384+A192KW"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## EncryptionAlgorithms\.KeyManagement\.Pbes2HmacSha512Aes256KW Field {#Abblix.Jwt.EncryptionAlgorithms.KeyManagement.Pbes2HmacSha512Aes256KW} PBES2 with HMAC SHA\-512 and AES\-256 Key Wrap \(RFC 7518 Section 4\.8\)\. See [Pbes2HmacSha256Aes128KW](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.EncryptionAlgorithms.KeyManagement#Abblix.Jwt.EncryptionAlgorithms.KeyManagement.Pbes2HmacSha256Aes128KW 'Abblix\.Jwt\.EncryptionAlgorithms\.KeyManagement\.Pbes2HmacSha256Aes128KW')\. ```csharp public const string Pbes2HmacSha512Aes256KW = "PBES2-HS512+A256KW"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## EncryptionAlgorithms\.KeyManagement\.Rsa1\_5 Field {#Abblix.Jwt.EncryptionAlgorithms.KeyManagement.Rsa1_5} RSAES\-PKCS1\-v1\_5 key encryption \(RFC 7518 Section 4\.2\)\. Backed by \.NET `RSA` with `RSAEncryptionPadding.Pkcs1`\. Kept for interoperability with legacy peers; OAEP variants should be preferred because PKCS\#1 v1\.5 padding is vulnerable to chosen\-ciphertext attacks \(Bleichenbacher\) and NIST SP 800\-131A Rev\. 2 disallows it for key transport\. Opt\-in: enabled by `AddRsaPkcs1KeyManagement`, not by default\. ```csharp public const string Rsa1_5 = "RSA1_5"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## EncryptionAlgorithms\.KeyManagement\.RsaOaep Field {#Abblix.Jwt.EncryptionAlgorithms.KeyManagement.RsaOaep} RSAES\-OAEP with SHA\-1 and MGF1\-SHA\-1 \(RFC 7518 Section 4\.3\)\. Backed by \.NET `RSA` with `RSAEncryptionPadding.OaepSHA1`\. Use when interoperating with peers that have not adopted RSA\-OAEP\-256; otherwise prefer [RsaOaep256](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.EncryptionAlgorithms.KeyManagement#Abblix.Jwt.EncryptionAlgorithms.KeyManagement.RsaOaep256 'Abblix\.Jwt\.EncryptionAlgorithms\.KeyManagement\.RsaOaep256')\. ```csharp public const string RsaOaep = "RSA-OAEP"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## EncryptionAlgorithms\.KeyManagement\.RsaOaep256 Field {#Abblix.Jwt.EncryptionAlgorithms.KeyManagement.RsaOaep256} RSAES\-OAEP with SHA\-256 and MGF1\-SHA\-256 \(RFC 7518 Section 4\.3\)\. Backed by \.NET `RSA` with `RSAEncryptionPadding.OaepSHA256`\. Recommended choice for new RSA\-based JWE deployments\. ```csharp public const string RsaOaep256 = "RSA-OAEP-256"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.HashCalculator.md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt 'Abblix\.Jwt') ## HashCalculator Class Computes the detached\-signature hashes an ID Token carries for values delivered beside it: `at_hash` for an access token and `c_hash` for an authorization code\. ```csharp public static class HashCalculator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → HashCalculator ### Remarks OpenID Connect Core 1\.0 gives one recipe for all of them, in section 3\.2\.2\.9 for `at_hash` and section 3\.3\.2\.10 for `c_hash`: hash the ASCII octets of the value with the algorithm JWA pairs with the `alg` of the ID Token's own JOSE header, take the left\-most half of the digest, and base64url\-encode it\. The point of the construction is to bind the ID Token to the value: an attacker who swaps the code or the access token for one of their own is caught, because the signed ID Token still carries the hash of the original\. Which is why the issuing and the verifying side must compute it identically \- they live in different packages, and this is the single place both take it from\. ### Methods ## HashCalculator\.Compute\(string, string\) Method {#Abblix.Jwt.HashCalculator.Compute(string,string)} Returns the base64url\-encoded left\-most half of [value](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.HashCalculator#Abblix.Jwt.HashCalculator.Compute(string,string).value 'Abblix\.Jwt\.HashCalculator\.Compute\(string, string\)\.value')'s digest, or [null](https://docs.microsoft.com/en-us/dotnet/csharp/language-reference/keywords/null 'https://docs.microsoft.com/en-us/dotnet/csharp/language-reference/keywords/null') when [signingAlgorithm](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.HashCalculator#Abblix.Jwt.HashCalculator.Compute(string,string).signingAlgorithm 'Abblix\.Jwt\.HashCalculator\.Compute\(string, string\)\.signingAlgorithm') has no hash paired with it\. ```csharp public static string? Compute(string signingAlgorithm, string value); ``` #### Parameters ###### `signingAlgorithm` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Jwt.HashCalculator.Compute(string,string).signingAlgorithm} The `alg` from the ID Token's JOSE header\. ###### `value` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Jwt.HashCalculator.Compute(string,string).value} The access token, authorization code or state to bind\. #### Returns [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks The pairing is by digest size rather than by signature family, because every JWS algorithm name ends in the size of the hash it uses: RS256, PS256, ES256 and HS256 all pair with SHA\-256, and so on up\. ES512 is the one that looks irregular and is not \- it signs with SHA\-512, matching its name rather than its P\-521 curve\. A null result is a real answer, not a failure to compute: `none` has no digest, and neither does an algorithm this library does not recognise\. The two sides then part ways, which is why the decision is left here to the caller \- an issuer omits the claim, while a client MUST refuse to treat the binding as satisfied, since "no hash was computable" and "the hash matched" would otherwise look the same to it\. --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.IanaClaimTypes.md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt 'Abblix\.Jwt') ## IanaClaimTypes Class Provides constants for various JWT and OpenID Connect claim types\. Includes both registered claim types and public claim types as defined in various standards\. This classification helps in ensuring interoperability across different systems and services by adhering to a common set of identifiers for claims\. ```csharp public static class IanaClaimTypes ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → IanaClaimTypes ### Fields ## IanaClaimTypes\.AceProfile Field {#Abblix.Jwt.IanaClaimTypes.AceProfile} Specifies the ACE profile a token is used with, indicating its application in constrained environments\. ```csharp public const string AceProfile = "ace_profile"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks This claim is significant in scenarios utilizing the Authentication and Authorization for Constrained Environments \(ACE\) framework, ensuring that tokens are applied in accordance with the specific requirements and constraints of the ACE profile in use\. ## IanaClaimTypes\.Acr Field {#Abblix.Jwt.IanaClaimTypes.Acr} Represents the Authentication Context Class Reference\. ```csharp public const string Acr = "acr"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks Used in OpenID Connect\. This claim specifies the authentication context class that the authentication performed satisfied\. It allows clients to request and services to assert the strength of an authentication process\. ## IanaClaimTypes\.Act Field {#Abblix.Jwt.IanaClaimTypes.Act} Represents the actor in OAuth 2\.0 token exchange\. ```csharp public const string Act = "act"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks This claim is used to indicate the party that the token represents, especially in delegation and impersonation scenarios, allowing APIs and services to verify the actual party making a request\. ## IanaClaimTypes\.Address Field {#Abblix.Jwt.IanaClaimTypes.Address} Represents the user's postal address\. ```csharp public const string Address = "address"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks Used in OpenID Connect\. This JSON structured claim contains components of the user's address such as street address, locality, region, postal code, and country\. ## IanaClaimTypes\.Amr Field {#Abblix.Jwt.IanaClaimTypes.Amr} Represents the Authentication Methods References\. ```csharp public const string Amr = "amr"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks Used in OpenID Connect\. This claim is used to specify the authentication methods used in the authentication process\. It provides transparency about how the authentication was performed, such as 'pwd' for password\-based or 'mfa' for multi\-factor authentication\. ## IanaClaimTypes\.AtHash Field {#Abblix.Jwt.IanaClaimTypes.AtHash} Represents the hash of the access token issued\. ```csharp public const string AtHash = "at_hash"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks Used in OpenID Connect\. This claim is included in the ID Token and is a hash of the access token, allowing the recipient to validate the integrity of the access token\. It is particularly useful in implicit and authorization code flows\. ## IanaClaimTypes\.Attest Field {#Abblix.Jwt.IanaClaimTypes.Attest} Represents the attestation level in SHAKEN/STIR frameworks\. ```csharp public const string Attest = "attest"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks This claim is used within the SHAKEN/STIR framework for telecommunication services, indicating the level of attestation for the origin of a call, which aids in combating caller ID spoofing and fraud\. ## IanaClaimTypes\.AtUseNbr Field {#Abblix.Jwt.IanaClaimTypes.AtUseNbr} Indicates the number of API requests for which the access token can be used\. ```csharp public const string AtUseNbr = "at_use_nbr"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks This claim is used primarily in environments where token usage is tightly controlled and monitored, providing a mechanism for limiting the number of requests a token can authorize to enhance security and manage resource utilization\. ## IanaClaimTypes\.Aud Field {#Abblix.Jwt.IanaClaimTypes.Aud} Identifies the recipients that the JWT is intended for\. ```csharp public const string Aud = "aud"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks Defined in RFC 7519, Section 4\.1\.3\. It is generally a case\-sensitive string or an array of strings containing StringOrURI values\. The audience claim ensures that the JWT is sent to the intended recipients\. ## IanaClaimTypes\.AuthorizationDetails Field {#Abblix.Jwt.IanaClaimTypes.AuthorizationDetails} JSON array representing the authorization requirements for a specific resource or set of resources\. ```csharp public const string AuthorizationDetails = "authorization_details"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks This claim is used in OAuth Rich Authorization Requests \(RAR\) to specify detailed authorization data for a transaction, enabling fine\-grained access control and tailored authorization experiences\. ## IanaClaimTypes\.AuthTime Field {#Abblix.Jwt.IanaClaimTypes.AuthTime} Indicates the time when the authentication occurred\. ```csharp public const string AuthTime = "auth_time"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks Used in OpenID Connect\. This claim is critical in scenarios where the application requires assurance about the moment of authentication, such as re\-authentication or step\-up authentication\. ## IanaClaimTypes\.Azp Field {#Abblix.Jwt.IanaClaimTypes.Azp} Represents the authorized party \- the party to which the ID Token was issued\. ```csharp public const string Azp = "azp"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks Used in OpenID Connect\. This claim is particularly useful in delegated scenarios to identify the party using the ID Token\. ## IanaClaimTypes\.Birthdate Field {#Abblix.Jwt.IanaClaimTypes.Birthdate} Represents the user's date of birth\. ```csharp public const string Birthdate = "birthdate"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks Used in OpenID Connect\. This claim is for the user's birthdate, typically represented in the ISO 8601:2004 YYYY\-MM\-DD format\. ## IanaClaimTypes\.Cdnicrit Field {#Abblix.Jwt.IanaClaimTypes.Cdnicrit} Identifies critical claims within the CDNI claim set\. ```csharp public const string Cdnicrit = "cdnicrit"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks This claim is used to mark certain claims as critical within the context of CDNI, indicating that the JWT should be processed differently or not at all if these claims are not understood or cannot be fulfilled\. ## IanaClaimTypes\.Cdniets Field {#Abblix.Jwt.IanaClaimTypes.Cdniets} Expiration time setting for token renewal in CDNI\. ```csharp public const string Cdniets = "cdniets"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks This claim specifies the expiration time for a CDNI token, guiding the renewal process by indicating when a new token must be obtained to continue accessing CDNI content or services\. ## IanaClaimTypes\.Cdniip Field {#Abblix.Jwt.IanaClaimTypes.Cdniip} Represents an IP address in CDNI scenarios\. ```csharp public const string Cdniip = "cdniip"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks This claim is used to convey IP address information within CDNI, supporting operations such as tokenized redirection or content delivery optimizations based on geographical or network\-based criteria\. ## IanaClaimTypes\.Cdnistd Field {#Abblix.Jwt.IanaClaimTypes.Cdnistd} Depth of the signed token in CDNI\. ```csharp public const string Cdnistd = "cdnistd"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks This claim provides information on the depth or hierarchy level of a signed token within CDNI, potentially influencing content delivery paths or access control decisions based on the token's scope and applicability\. ## IanaClaimTypes\.Cdnistt Field {#Abblix.Jwt.IanaClaimTypes.Cdnistt} Transport method for signed token renewal in CDNI\. ```csharp public const string Cdnistt = "cdnistt"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks This claim indicates the transport method to be used for renewing signed tokens in CDNI, ensuring secure and efficient token exchange mechanisms are employed for content delivery and interconnection services\. ## IanaClaimTypes\.Cdniuc Field {#Abblix.Jwt.IanaClaimTypes.Cdniuc} Contains a URI in CDNI contexts\. ```csharp public const string Cdniuc = "cdniuc"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks This claim is utilized to reference specific resources or content within CDNI, allowing for dynamic content delivery configurations and optimizations based on the content identified by the URI\. ## IanaClaimTypes\.Cdniv Field {#Abblix.Jwt.IanaClaimTypes.Cdniv} Version of the claim set used in Content Delivery Network Interconnection \(CDNI\)\. ```csharp public const string Cdniv = "cdniv"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks This claim facilitates interoperability in CDNI contexts by specifying the version of the claim set, ensuring that both the issuer and recipient of a JWT understand the structure and semantics of the claims contained within\. ## IanaClaimTypes\.CHash Field {#Abblix.Jwt.IanaClaimTypes.CHash} Represents the Code Hash Value\. ```csharp public const string CHash = "c_hash"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks Used in OpenID Connect\. This claim is used in the ID Token to provide a hash of the authorization code\. It ensures that the authorization code is bound to the ID Token, enhancing the security of the code exchange process\. ## IanaClaimTypes\.ClientId Field {#Abblix.Jwt.IanaClaimTypes.ClientId} Represents the client identifier in OAuth 2\.0 contexts\. ```csharp public const string ClientId = "client_id"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks Identifies the OAuth 2\.0 client that requested the token, providing a mechanism for associating a token with a specific registered client application, critical for enforcing client\-specific access policies\. ## IanaClaimTypes\.Cnf Field {#Abblix.Jwt.IanaClaimTypes.Cnf} Represents confirmation methods used by the token\. ```csharp public const string Cnf = "cnf"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks Utilized in scenarios that require additional confirmation of token validity, such as DPoP \(Demonstrating Proof of Possession\)\. This claim helps in binding tokens to specific cryptographic keys\. ## IanaClaimTypes\.Cnonce Field {#Abblix.Jwt.IanaClaimTypes.Cnonce} Nonce provided by the Resource Server to the Authorization Server via the client, verifying token freshness\. ```csharp public const string Cnonce = "cnonce"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks This claim is used to ensure the freshness of a token in interactions between the Resource Server, the client, and the Authorization Server, mitigating against replay attacks by validating the uniqueness and timeliness of each token request\. ## IanaClaimTypes\.Dest Field {#Abblix.Jwt.IanaClaimTypes.Dest} Represents the destination identity in telecommunication protocols\. ```csharp public const string Dest = "dest"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks Useful in communication protocols to convey the intended recipient or destination of the communication, supporting routing, billing, and security measures\. ## IanaClaimTypes\.Div Field {#Abblix.Jwt.IanaClaimTypes.Div} Contains information about a call that was diverted from its original destination\. ```csharp public const string Div = "div"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks This claim is used in telecommunications contexts to provide details about call diversions, aiding in the management and tracing of call flows and in the implementation of services that react to call redirection\. ## IanaClaimTypes\.Email Field {#Abblix.Jwt.IanaClaimTypes.Email} Represents the user's preferred email address\. ```csharp public const string Email = "email"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks Used in OpenID Connect\. This claim is for the user's preferred email\. Note that this email address might not be unique\. ## IanaClaimTypes\.EmailVerified Field {#Abblix.Jwt.IanaClaimTypes.EmailVerified} Represents whether the user's email address has been verified\. ```csharp public const string EmailVerified = "email_verified"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks Used in OpenID Connect as a boolean\. True if the user's email address has been verified; otherwise false\. ## IanaClaimTypes\.Entitlements Field {#Abblix.Jwt.IanaClaimTypes.Entitlements} Represents specific entitlements or permissions granted to the subject\. ```csharp public const string Entitlements = "entitlements"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks This claim is used to specify granular permissions or entitlements granted to a subject, allowing for precise control over access rights and enabling fine\-grained authorization policies\. ## IanaClaimTypes\.Events Field {#Abblix.Jwt.IanaClaimTypes.Events} Represents specific security events or state changes\. ```csharp public const string Events = "events"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks Used in Security Event Tokens \(SETs\) to convey information about security\-related events or changes, such as authentication events or configuration changes, aiding in security monitoring and response\. ## IanaClaimTypes\.Exi Field {#Abblix.Jwt.IanaClaimTypes.Exi} Lifetime of the token in seconds from the time the Resource Server first sees it, for devices with unsynchronized clocks\. ```csharp public const string Exi = "exi"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks This claim addresses challenges posed by devices with unsynchronized clocks by providing a relative measure of the token's validity, enhancing interoperability and security in distributed systems\. ## IanaClaimTypes\.Exp Field {#Abblix.Jwt.IanaClaimTypes.Exp} Specifies the expiration time on or after which the JWT must not be accepted for processing\. ```csharp public const string Exp = "exp"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks Defined in RFC 7519, Section 4\.1\.4\. The "exp" claim is a NumericDate value\. Use this claim to define the validity period of the JWT\. ## IanaClaimTypes\.FamilyName Field {#Abblix.Jwt.IanaClaimTypes.FamilyName} Represents the surname\(s\) or last name\(s\) of the user\. ```csharp public const string FamilyName = "family_name"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks Used in OpenID Connect\. This claim focuses on the user's family name or surname\(s\), excluding middle names\. ## IanaClaimTypes\.Gender Field {#Abblix.Jwt.IanaClaimTypes.Gender} Represents the user's gender\. ```csharp public const string Gender = "gender"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks Used in OpenID Connect\. This claim can be used to convey the user's gender\. The value is not strictly defined and can vary based on the user's preference and the application's requirements\. ## IanaClaimTypes\.GivenName Field {#Abblix.Jwt.IanaClaimTypes.GivenName} Represents the first or given name\(s\) of the user\. ```csharp public const string GivenName = "given_name"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks Used in OpenID Connect\. This claim is intended to refer to the user's first name or given name\(s\)\. It allows for middle names if applicable\. ## IanaClaimTypes\.Groups Field {#Abblix.Jwt.IanaClaimTypes.Groups} Represents the groups that the subject belongs to, typically used in identity and access management\. ```csharp public const string Groups = "groups"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks This claim is used to convey group membership information, supporting group\-based access control and enabling systems to make authorization decisions based on the groups a subject is associated with\. ## IanaClaimTypes\.Iat Field {#Abblix.Jwt.IanaClaimTypes.Iat} Indicates the time at which the JWT was issued\. ```csharp public const string Iat = "iat"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks Defined in RFC 7519, Section 4\.1\.6\. The "iat" \(Issued At\) claim is a NumericDate value\. This claim can be used to determine the age of the JWT\. ## IanaClaimTypes\.Iss Field {#Abblix.Jwt.IanaClaimTypes.Iss} Represents the principal \(e\.g\., authorization server\) that issued the JWT\. ```csharp public const string Iss = "iss"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks Defined in RFC 7519, Section 4\.1\.1\. It is a case\-sensitive string containing a StringOrURI value\. Use this claim to identify the issuer of the JWT uniquely\. ## IanaClaimTypes\.Jcard Field {#Abblix.Jwt.IanaClaimTypes.Jcard} Contains jCard data, representing contact information in a JSON format\. ```csharp public const string Jcard = "jcard"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks This claim is used to convey contact information in a structured format that mirrors the vCard specification, facilitating interoperable exchange of personal or organizational contact details\. ## IanaClaimTypes\.Jti Field {#Abblix.Jwt.IanaClaimTypes.Jti} Provides a unique identifier for the JWT\. ```csharp public const string Jti = "jti"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks Defined in RFC 7519, Section 4\.1\.7\. The "jti" \(JWT ID\) claim is a case\-sensitive string\. Use this claim to prevent the JWT from being replayed\. ## IanaClaimTypes\.Locale Field {#Abblix.Jwt.IanaClaimTypes.Locale} Represents the user's locale\. ```csharp public const string Locale = "locale"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks Used in OpenID Connect\. This claim specifies the user's preferred language and optionally, region\. Typically represented as a language tag, e\.g\., en\-US or fr\-CA\. ## IanaClaimTypes\.MayAct Field {#Abblix.Jwt.IanaClaimTypes.MayAct} Indicates the parties that the token bearer is authorized to act on behalf of\. ```csharp public const string MayAct = "may_act"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks This claim is used in scenarios where a token bearer is permitted to act on behalf of other parties, enabling delegation of rights and facilitating advanced authorization scenarios\. ## IanaClaimTypes\.MiddleName Field {#Abblix.Jwt.IanaClaimTypes.MiddleName} Represents the middle name\(s\) of the user\. ```csharp public const string MiddleName = "middle_name"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks Used in OpenID Connect\. This claim is intended for the user's middle name\(s\), which might not be present for all users\. ## IanaClaimTypes\.Mky Field {#Abblix.Jwt.IanaClaimTypes.Mky} Represents a media key fingerprint\. ```csharp public const string Mky = "mky"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks Used in secure communication protocols to provide a fingerprint of the cryptographic key used for encrypting media, enhancing the security of media exchanges by facilitating key verification\. ## IanaClaimTypes\.Name Field {#Abblix.Jwt.IanaClaimTypes.Name} Represents the full name of the user\. ```csharp public const string Name = "name"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks Used in OpenID Connect for representing the user's full name in a single string\. It might include the first, middle, last, and other names\. ## IanaClaimTypes\.Nbf Field {#Abblix.Jwt.IanaClaimTypes.Nbf} Defines a time before which the JWT MUST NOT be accepted for processing\. ```csharp public const string Nbf = "nbf"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks Defined in RFC 7519, Section 4\.1\.5\. The "nbf" \(Not Before\) claim is a NumericDate value\. This claim helps in ensuring that a JWT is not accepted before a certain time\. ## IanaClaimTypes\.Nickname Field {#Abblix.Jwt.IanaClaimTypes.Nickname} Represents the casual name of the user\. ```csharp public const string Nickname = "nickname"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks Used in OpenID Connect\. This claim is for the user's casual or informal name that might differ from their legal name\. ## IanaClaimTypes\.Nonce Field {#Abblix.Jwt.IanaClaimTypes.Nonce} A string value used to associate a client session with an ID Token\. ```csharp public const string Nonce = "nonce"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks Used in OpenID Connect to mitigate replay attacks by binding a session to a token\. ## IanaClaimTypes\.Opt Field {#Abblix.Jwt.IanaClaimTypes.Opt} Contains the original PASSporT in full form, often used in call diversion scenarios\. ```csharp public const string Opt = "opt"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks This claim is utilized in telecommunications to verify the authenticity of redirected calls by providing a cryptographic assertion of the call's origin, enhancing trust and security in voice communications\. ## IanaClaimTypes\.Orig Field {#Abblix.Jwt.IanaClaimTypes.Orig} Represents the originating identity in telecommunication protocols\. ```csharp public const string Orig = "orig"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks It's used to convey the identity of the originator in communication protocols, aiding in the identification and verification of the call origin for security and billing purposes\. ## IanaClaimTypes\.Origid Field {#Abblix.Jwt.IanaClaimTypes.Origid} Represents the originating identifier in the SHAKEN framework\. ```csharp public const string Origid = "origid"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks Used to uniquely identify the originator of a call within the SHAKEN framework, facilitating traceability and verification of the call's origin, and enhancing trust in telecommunication ecosystems\. ## IanaClaimTypes\.PhoneNumber Field {#Abblix.Jwt.IanaClaimTypes.PhoneNumber} Represents the user's phone number\. ```csharp public const string PhoneNumber = "phone_number"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks Used in OpenID Connect\. This claim provides the user's preferred phone number\. The format of the number can vary and it's not guaranteed to be in a standard format\. ## IanaClaimTypes\.PhoneNumberVerified Field {#Abblix.Jwt.IanaClaimTypes.PhoneNumberVerified} Indicates whether the user's phone number has been verified\. ```csharp public const string PhoneNumberVerified = "phone_number_verified"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks Used in OpenID Connect as a boolean\. True if the user's phone number has been verified; otherwise false\. ## IanaClaimTypes\.Picture Field {#Abblix.Jwt.IanaClaimTypes.Picture} Represents the URL of the user's profile picture\. ```csharp public const string Picture = "picture"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks Used in OpenID Connect\. This claim provides a URL pointing to a profile picture or avatar of the user\. ## IanaClaimTypes\.PreferredUsername Field {#Abblix.Jwt.IanaClaimTypes.PreferredUsername} The username preferred by the user, which may be different from their actual or legal name\. ```csharp public const string PreferredUsername = "preferred_username"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks This claim is used to convey the user's preferred username within the system\. It allows the user to specify a nickname or alias that is used within the application for display purposes, providing a more personalized user experience\. ## IanaClaimTypes\.Profile Field {#Abblix.Jwt.IanaClaimTypes.Profile} Represents the URL of the user's profile page\. ```csharp public const string Profile = "profile"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks Used in OpenID Connect\. It is the URL of a web page containing information about the user or a social profile page\. ## IanaClaimTypes\.Public Field {#Abblix.Jwt.IanaClaimTypes.Public} A set of public claims that can be defined by applications as needed\. To ensure global uniqueness and avoid collisions, these claims should either be registered with the IANA JSON Web Token Registry or be defined within a namespace that is resistant to collisions, such as a URI\. ```csharp public static readonly IReadOnlyCollection Public; ``` #### Field Value [System\.Collections\.Generic\.IReadOnlyCollection<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ireadonlycollection-1 'System\.Collections\.Generic\.IReadOnlyCollection\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ireadonlycollection-1 'System\.Collections\.Generic\.IReadOnlyCollection\`1') ## IanaClaimTypes\.Registered Field {#Abblix.Jwt.IanaClaimTypes.Registered} A set of predefined claims recommended for ensuring interoperability among different systems\. These claims are widely recognized and provide basic information necessary for many authentication and authorization processes\. ```csharp public static readonly IReadOnlyCollection Registered; ``` #### Field Value [System\.Collections\.Generic\.IReadOnlyCollection<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ireadonlycollection-1 'System\.Collections\.Generic\.IReadOnlyCollection\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ireadonlycollection-1 'System\.Collections\.Generic\.IReadOnlyCollection\`1') ## IanaClaimTypes\.Roles Field {#Abblix.Jwt.IanaClaimTypes.Roles} Represents the roles associated with the subject, often used in System for Cross\-domain Identity Management \(SCIM\)\. ```csharp public const string Roles = "roles"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks This claim is used to convey the roles attributed to a subject, facilitating role\-based access control \(RBAC\) and other authorization decisions in systems implementing SCIM or similar identity management protocols\. ## IanaClaimTypes\.Rph Field {#Abblix.Jwt.IanaClaimTypes.Rph} Represents a resource priority header\. ```csharp public const string Rph = "rph"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks This claim is used to indicate the priority of a resource or process in network communications, ensuring that critical resources receive appropriate handling and prioritization in congested or limited\-capacity environments\. ## IanaClaimTypes\.Scope Field {#Abblix.Jwt.IanaClaimTypes.Scope} Represents the scope associated with an access token\. ```csharp public const string Scope = "scope"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks Specifies the permissions or access rights granted to an access token, defining what actions the token bearer is authorized to perform\. This claim is fundamental in controlling access to resources\. ## IanaClaimTypes\.Sid Field {#Abblix.Jwt.IanaClaimTypes.Sid} Represents the session ID for front\-channel logout in OpenID Connect sessions\. ```csharp public const string Sid = "sid"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks This claim is critical for implementing front\-channel logout mechanisms, allowing clients and servers to coordinate user sessions and logout processes across multiple applications and services\. ## IanaClaimTypes\.SigValClaims Field {#Abblix.Jwt.IanaClaimTypes.SigValClaims} Contains claims used for validating signatures, often in security contexts\. ```csharp public const string SigValClaims = "sig_val_claims"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks This claim set is essential for scenarios where signature validation is critical, providing necessary information to verify the authenticity and integrity of signed data or tokens in secure communications and transactions\. ## IanaClaimTypes\.SipCallid Field {#Abblix.Jwt.IanaClaimTypes.SipCallid} "sip\_callid" \- Value from the SIP 'Call\-Id' header field, uniquely identifying the SIP call\. ```csharp public const string SipCallid = "sip_callid"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## IanaClaimTypes\.SipCseqNum Field {#Abblix.Jwt.IanaClaimTypes.SipCseqNum} "sip\_cseq\_num" \- Numeric value from the SIP 'CSeq' header field, indicating the command sequence number in SIP protocol\. ```csharp public const string SipCseqNum = "sip_cseq_num"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## IanaClaimTypes\.SipDate Field {#Abblix.Jwt.IanaClaimTypes.SipDate} "sip\_date" \- Value from the SIP 'Date' header field, indicating the time of the SIP message\. ```csharp public const string SipDate = "sip_date"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## IanaClaimTypes\.SipFromTag Field {#Abblix.Jwt.IanaClaimTypes.SipFromTag} "sip\_from\_tag" \- Value from the SIP 'From' tag header field, used in SIP\-based communications\. ```csharp public const string SipFromTag = "sip_from_tag"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## IanaClaimTypes\.SipViaBranch Field {#Abblix.Jwt.IanaClaimTypes.SipViaBranch} "sip\_via\_branch" \- Value from the SIP 'Via' branch parameter, used in routing SIP messages\. ```csharp public const string SipViaBranch = "sip_via_branch"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## IanaClaimTypes\.Sph Field {#Abblix.Jwt.IanaClaimTypes.Sph} Used to indicate the priority of a SIP message\. ```csharp public const string Sph = "sph"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks This claim is relevant in Session Initiation Protocol \(SIP\)\-based communications, where it may influence routing, handling, and processing priorities of SIP messages, ensuring that critical communications are appropriately prioritized\. ## IanaClaimTypes\.Sub Field {#Abblix.Jwt.IanaClaimTypes.Sub} Represents the principal that is the subject of the JWT\. ```csharp public const string Sub = "sub"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks Defined in RFC 7519, Section 4\.1\.2\. The "sub" value is a case\-sensitive string containing a StringOrURI value\. This claim is used to identify the subject of the JWT, which could be an end user or a device\. ## IanaClaimTypes\.SubId Field {#Abblix.Jwt.IanaClaimTypes.SubId} Represents the Subject Identifier of the principal a token is about \(RFC 9493, Section 4\.2\)\. ```csharp public const string SubId = "sub_id"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks The value is a Subject Identifier object naming its Identifier Format, letting a Security Event Token identify its subject by a mechanism richer than the plain "sub" string \- and by an identity the recipient understands, since the identifier's members may differ from the token's own "iss" and "sub" claims\. Kept beside the RFC 8417 SET claims it profiles\. ## IanaClaimTypes\.SubJwk Field {#Abblix.Jwt.IanaClaimTypes.SubJwk} Represents the subject's public key as a JSON Web Key \(JWK\)\. ```csharp public const string SubJwk = "sub_jwk"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks Used in scenarios where public keys are associated with JWT subjects\. This claim allows embedding a public key directly within a JWT, facilitating key discovery and distribution\. ## IanaClaimTypes\.Toe Field {#Abblix.Jwt.IanaClaimTypes.Toe} Represents the time of the security event\. ```csharp public const string Toe = "toe"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks This claim is used in Security Event Tokens \(SETs\) to indicate the precise time at which the described security event occurred, facilitating accurate incident tracking and response\. ## IanaClaimTypes\.TokenIntrospection Field {#Abblix.Jwt.IanaClaimTypes.TokenIntrospection} Contains the response from an OAuth 2\.0 token introspection request\. ```csharp public const string TokenIntrospection = "token_introspection"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks This claim is typically used in scenarios where detailed token information is necessary for validating token status, scopes, and other attributes as part of OAuth 2\.0 introspection processes\. ## IanaClaimTypes\.Txn Field {#Abblix.Jwt.IanaClaimTypes.Txn} Represents a transaction identifier\. ```csharp public const string Txn = "txn"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks Often utilized in financial transactions and other scenarios where tracking the identity and state of individual transactions is critical for security, auditing, and reconciliation processes\. ## IanaClaimTypes\.UpdatedAt Field {#Abblix.Jwt.IanaClaimTypes.UpdatedAt} Indicates when the user's information was last updated\. ```csharp public const string UpdatedAt = "updated_at"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks Used in OpenID Connect\. This claim provides a Unix time stamp indicating when the user's information was last updated\. ## IanaClaimTypes\.Vc Field {#Abblix.Jwt.IanaClaimTypes.Vc} Represents a verifiable credential as specified in the W3C Recommendation\. ```csharp public const string Vc = "vc"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks This claim is used to convey credentials that can be cryptographically verified, supporting a wide range of applications from identity verification to qualification attestation in a secure and interoperable manner\. ## IanaClaimTypes\.Vot Field {#Abblix.Jwt.IanaClaimTypes.Vot} Represents the vector of trust for authentication processes\. ```csharp public const string Vot = "vot"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks Used to convey the level of confidence in the authentication process, detailing the methods used and their security properties\. This claim is particularly useful in contexts requiring a nuanced understanding of authentication assurance\. ## IanaClaimTypes\.Vp Field {#Abblix.Jwt.IanaClaimTypes.Vp} Represents a verifiable presentation as specified in the W3C Recommendation\. ```csharp public const string Vp = "vp"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks This claim is used when a subject presents one or more verifiable credentials, allowing the verifier to check the authenticity and integrity of the credentials presented, facilitating trusted digital interactions\. ## IanaClaimTypes\.Vtm Field {#Abblix.Jwt.IanaClaimTypes.Vtm} Represents the vector of trust trustmark\. ```csharp public const string Vtm = "vtm"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks Provides a URL to a trustmark that further describes the trust vector associated with the authentication process, offering a means to verify the authentication methods and their adherence to certain standards or practices\. ## IanaClaimTypes\.Website Field {#Abblix.Jwt.IanaClaimTypes.Website} Represents the URL of the user's web page or blog\. ```csharp public const string Website = "website"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks Used in OpenID Connect\. This claim indicates the URL of the user's personal or business website\. ## IanaClaimTypes\.Zoneinfo Field {#Abblix.Jwt.IanaClaimTypes.Zoneinfo} Represents the user's time zone\. ```csharp public const string Zoneinfo = "zoneinfo"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks Used in OpenID Connect\. This claim indicates the user's time zone, facilitating localization and personalization\. --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.IanaClaimTypes.ConfirmationMethods.md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt 'Abblix\.Jwt').[IanaClaimTypes](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.IanaClaimTypes 'Abblix\.Jwt\.IanaClaimTypes') ## IanaClaimTypes\.ConfirmationMethods Class Member names of the `cnf` confirmation\-method JSON object \(RFC 7800 §3\.1 / IANA "JWT Confirmation Methods" registry\)\. Each member encodes a different proof\-of\-possession binding scheme; multiple members can coexist when a deployment uses several schemes concurrently \(e\.g\. mTLS for client authentication and DPoP for token binding\)\. ```csharp public static class IanaClaimTypes.ConfirmationMethods ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ConfirmationMethods ### Fields ## IanaClaimTypes\.ConfirmationMethods\.CertificateSha256Thumbprint Field {#Abblix.Jwt.IanaClaimTypes.ConfirmationMethods.CertificateSha256Thumbprint} Base64url\-encoded SHA\-256 thumbprint of the client X\.509 certificate that authenticated the request \(RFC 8705 §3\.1\)\. Locks an access token to the certificate the client presented at the token endpoint via mutual TLS\. ```csharp public const string CertificateSha256Thumbprint = "x5t#S256"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## IanaClaimTypes\.ConfirmationMethods\.JwkThumbprint Field {#Abblix.Jwt.IanaClaimTypes.ConfirmationMethods.JwkThumbprint} Base64url\-encoded RFC 7638 JWK Thumbprint of the DPoP proof key \(RFC 9449 §6\.1\)\. Locks an access token to the specific proof\-of\-possession key the client demonstrated control of when the token was issued\. ```csharp public const string JwkThumbprint = "jkt"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ICriticalHeaderHandler.md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt 'Abblix\.Jwt') ## ICriticalHeaderHandler Interface Recipient\-side handler for one JWS 'crit' header extension spec \(RFC 7515 §4\.1\.11\)\. Covers «understood AND processed»: the handler applies the extension's recipient\-side semantics via [HandleAsync\(CriticalHeaderContext, CancellationToken\)](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ICriticalHeaderHandler#Abblix.Jwt.ICriticalHeaderHandler.HandleAsync(Abblix.Jwt.CriticalHeaderContext,System.Threading.CancellationToken) 'Abblix\.Jwt\.ICriticalHeaderHandler\.HandleAsync\(Abblix\.Jwt\.CriticalHeaderContext, System\.Threading\.CancellationToken\)')\. The JOSE header parameter name the handler implements is the DI key it is registered under \- see [AddCriticalHeaderHandler<THandler>\(this IServiceCollection, string\)](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ServiceCollectionExtensions#Abblix.Jwt.ServiceCollectionExtensions.AddCriticalHeaderHandler_THandler_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,string) 'Abblix\.Jwt\.ServiceCollectionExtensions\.AddCriticalHeaderHandler\\(this Microsoft\.Extensions\.DependencyInjection\.IServiceCollection, string\)') \- so name and behaviour are inseparable: a name cannot be registered without a handler behind it\. ```csharp public interface ICriticalHeaderHandler ``` ### Remarks One method, [HandleAsync\(CriticalHeaderContext, CancellationToken\)](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ICriticalHeaderHandler#Abblix.Jwt.ICriticalHeaderHandler.HandleAsync(Abblix.Jwt.CriticalHeaderContext,System.Threading.CancellationToken) 'Abblix\.Jwt\.ICriticalHeaderHandler\.HandleAsync\(Abblix\.Jwt\.CriticalHeaderContext, System\.Threading\.CancellationToken\)'), intentionally collapses «validate» and «handle». Every realistic crit extension reads the header, optionally performs side effects (consume a replay nonce, emit an audit event), and returns success or a typed error. Splitting into validate+handle methods would tear related code apart - nonce extraction, freshness check, and consumption are one logical step. Two realistic processing modes share this shape: - Validate-only - read the header value, compare against local policy, accept or reject. Pure function over the JWT. Examples: RFC 8225 'ppt' (PASSporT Type), enterprise-policy headers. - Stateful handler - read the header value, mutate external state (replay-cache, audit log, counters), accept or reject. Example: ACME-style 'nonce' (RFC 8555 §6.5.2) consumption with atomic single-use semantics. Signature-affecting crit extensions (RFC 7797 'b64' - Unencoded Payload Option) need a pre-signature hook that transforms the JWS Signing Input bytes, which MUST run before signature verification. That hook is a separate sibling contract on the signing pipeline (out of scope for this interface). A b64 implementation of THIS interface is a thin shim registered under "b64" that short-circuits to success - successful signature verification already proves the directive was honoured. Register with [AddCriticalHeaderHandler<THandler>\(this IServiceCollection, string\)](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ServiceCollectionExtensions#Abblix.Jwt.ServiceCollectionExtensions.AddCriticalHeaderHandler_THandler_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,string) 'Abblix\.Jwt\.ServiceCollectionExtensions\.AddCriticalHeaderHandler\\(this Microsoft\.Extensions\.DependencyInjection\.IServiceCollection, string\)'), passing the JOSE header parameter name as the DI key. One handler owns one name; a handler covering a family of related names registers under each. ### Methods ## ICriticalHeaderHandler\.HandleAsync\(CriticalHeaderContext, CancellationToken\) Method {#Abblix.Jwt.ICriticalHeaderHandler.HandleAsync(Abblix.Jwt.CriticalHeaderContext,System.Threading.CancellationToken)} Apply the extension's recipient\-side semantics\. May read the parsed token \(header and payload\), consult external state via DI\-injected dependencies \(inject [System\.TimeProvider](https://learn.microsoft.com/en-us/dotnet/api/system.timeprovider 'System\.TimeProvider') if the extension needs the clock\), perform side effects, and reject the JWS by returning a non\-null [JwtValidationError](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JwtValidationError 'Abblix\.Jwt\.JwtValidationError')\. Return [null](https://docs.microsoft.com/en-us/dotnet/csharp/language-reference/keywords/null 'https://docs.microsoft.com/en-us/dotnet/csharp/language-reference/keywords/null') on success\. ```csharp System.Threading.Tasks.Task HandleAsync(Abblix.Jwt.CriticalHeaderContext context, System.Threading.CancellationToken cancellationToken); ``` #### Parameters ###### `context` [CriticalHeaderContext](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.CriticalHeaderContext 'Abblix\.Jwt\.CriticalHeaderContext') {#Abblix.Jwt.ICriticalHeaderHandler.HandleAsync(Abblix.Jwt.CriticalHeaderContext,System.Threading.CancellationToken).context} Per\-call inputs: the parsed token and the validation parameters in force\. ###### `cancellationToken` [System\.Threading\.CancellationToken](https://learn.microsoft.com/en-us/dotnet/api/system.threading.cancellationtoken 'System\.Threading\.CancellationToken') {#Abblix.Jwt.ICriticalHeaderHandler.HandleAsync(Abblix.Jwt.CriticalHeaderContext,System.Threading.CancellationToken).cancellationToken} Propagates cancellation to I/O\-bound handlers \(replay\-store lookups, audit emitters\)\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[JwtValidationError](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JwtValidationError 'Abblix\.Jwt\.JwtValidationError')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.IJsonWebTokenCreator.md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt 'Abblix\.Jwt') ## IJsonWebTokenCreator Interface Defines the contract for a service that creates JSON Web Tokens \(JWTs\)\. ```csharp public interface IJsonWebTokenCreator ``` ### Properties ## IJsonWebTokenCreator\.EncryptedResponseAlgorithmsSupported Property {#Abblix.Jwt.IJsonWebTokenCreator.EncryptedResponseAlgorithmsSupported} Lists the JWE key\-management algorithms \(the `alg` values, e\.g\. "RSA\-OAEP\-256"\) supported for encrypting a JWT on creation\. The symmetric counterpart of [SignedResponseAlgorithmsSupported](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.IJsonWebTokenCreator#Abblix.Jwt.IJsonWebTokenCreator.SignedResponseAlgorithmsSupported 'Abblix\.Jwt\.IJsonWebTokenCreator\.SignedResponseAlgorithmsSupported'), projected from the registered encryptors\. ```csharp System.Collections.Generic.IEnumerable EncryptedResponseAlgorithmsSupported { get; } ``` #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ## IJsonWebTokenCreator\.SignedResponseAlgorithmsSupported Property {#Abblix.Jwt.IJsonWebTokenCreator.SignedResponseAlgorithmsSupported} Lists the all supported signing algorithms for JWT creation\. ```csharp System.Collections.Generic.IEnumerable SignedResponseAlgorithmsSupported { get; } ``` #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ### Methods ## IJsonWebTokenCreator\.IssueAsync\(JsonWebToken, JsonWebKey, JsonWebKey, string, string\) Method {#Abblix.Jwt.IJsonWebTokenCreator.IssueAsync(Abblix.Jwt.JsonWebToken,Abblix.Jwt.JsonWebKey,Abblix.Jwt.JsonWebKey,string,string)} Issues a new JWT based on the specified JsonWebToken object, signing key, and optional encrypting key\. ```csharp System.Threading.Tasks.Task IssueAsync(Abblix.Jwt.JsonWebToken token, Abblix.Jwt.JsonWebKey? signingKey, Abblix.Jwt.JsonWebKey? encryptionKey=null, string keyEncryptionAlgorithm="RSA-OAEP-256", string contentEncryptionAlgorithm="A256CBC-HS512"); ``` #### Parameters ###### `token` [JsonWebToken](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebToken 'Abblix\.Jwt\.JsonWebToken') {#Abblix.Jwt.IJsonWebTokenCreator.IssueAsync(Abblix.Jwt.JsonWebToken,Abblix.Jwt.JsonWebKey,Abblix.Jwt.JsonWebKey,string,string).token} The JsonWebToken object containing the payload of the JWT\. ###### `signingKey` [JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey') {#Abblix.Jwt.IJsonWebTokenCreator.IssueAsync(Abblix.Jwt.JsonWebToken,Abblix.Jwt.JsonWebKey,Abblix.Jwt.JsonWebKey,string,string).signingKey} The JsonWebKey used to sign the JWT\. ###### `encryptionKey` [JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey') {#Abblix.Jwt.IJsonWebTokenCreator.IssueAsync(Abblix.Jwt.JsonWebToken,Abblix.Jwt.JsonWebKey,Abblix.Jwt.JsonWebKey,string,string).encryptionKey} Optional JsonWebKey used to encrypt the JWT\. If null, the JWT is not encrypted\. ###### `keyEncryptionAlgorithm` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Jwt.IJsonWebTokenCreator.IssueAsync(Abblix.Jwt.JsonWebToken,Abblix.Jwt.JsonWebKey,Abblix.Jwt.JsonWebKey,string,string).keyEncryptionAlgorithm} JWE key management algorithm \("alg"\) that protects the Content Encryption Key with the recipient's key \(RFC 7518 Section 4\)\. Defaults to `RSA-OAEP-256`\. Supported values are listed on [KeyManagement](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.EncryptionAlgorithms.KeyManagement 'Abblix\.Jwt\.EncryptionAlgorithms\.KeyManagement'); only used when [encryptionKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.IJsonWebTokenCreator#Abblix.Jwt.IJsonWebTokenCreator.IssueAsync(Abblix.Jwt.JsonWebToken,Abblix.Jwt.JsonWebKey,Abblix.Jwt.JsonWebKey,string,string).encryptionKey 'Abblix\.Jwt\.IJsonWebTokenCreator\.IssueAsync\(Abblix\.Jwt\.JsonWebToken, Abblix\.Jwt\.JsonWebKey, Abblix\.Jwt\.JsonWebKey, string, string\)\.encryptionKey') is provided\. ###### `contentEncryptionAlgorithm` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Jwt.IJsonWebTokenCreator.IssueAsync(Abblix.Jwt.JsonWebToken,Abblix.Jwt.JsonWebKey,Abblix.Jwt.JsonWebKey,string,string).contentEncryptionAlgorithm} JWE content encryption algorithm \("enc"\) that encrypts the payload with the CEK \(RFC 7518 Section 5\)\. Defaults to `A256CBC-HS512`\. Supported values are listed on [ContentEncryption](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.EncryptionAlgorithms.ContentEncryption 'Abblix\.Jwt\.EncryptionAlgorithms\.ContentEncryption'); only used when [encryptionKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.IJsonWebTokenCreator#Abblix.Jwt.IJsonWebTokenCreator.IssueAsync(Abblix.Jwt.JsonWebToken,Abblix.Jwt.JsonWebKey,Abblix.Jwt.JsonWebKey,string,string).encryptionKey 'Abblix\.Jwt\.IJsonWebTokenCreator\.IssueAsync\(Abblix\.Jwt\.JsonWebToken, Abblix\.Jwt\.JsonWebKey, Abblix\.Jwt\.JsonWebKey, string, string\)\.encryptionKey') is provided\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A Task representing the asynchronous operation, which upon completion yields the JWT as a string\. --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.IJsonWebTokenEncryptor.md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt 'Abblix\.Jwt') ## IJsonWebTokenEncryptor Interface Defines the contract for JSON Web Encryption \(JWE\) token encryption and decryption services\. ```csharp public interface IJsonWebTokenEncryptor ``` ### Remarks The payload is exchanged as bytes rather than a string: the CEK protects arbitrary octets, and a later feature encrypts a binary \(non\-text\) payload, so a byte contract fits every caller while a JWS\-wrapping caller does the trivial UTF\-8 conversion\. Encryption is asynchronous and cancellable so key management \(unwrap/agree\) can be served by an external key custodian over a network round\-trip; the in\-process path completes synchronously inside the task\. ### Methods ## IJsonWebTokenEncryptor\.DecryptAsync\(string\[\], IAsyncEnumerable\, CancellationToken\) Method {#Abblix.Jwt.IJsonWebTokenEncryptor.DecryptAsync(string[],System.Collections.Generic.IAsyncEnumerable_Abblix.Jwt.JsonWebKey_,System.Threading.CancellationToken)} Validates and decrypts a JWE token\. Implements RFC 7516 \(JWE\) decryption\. ```csharp System.Threading.Tasks.Task> DecryptAsync(string[] jwtParts, System.Collections.Generic.IAsyncEnumerable decryptionKeys, System.Threading.CancellationToken cancellationToken=default(System.Threading.CancellationToken)); ``` #### Parameters ###### `jwtParts` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Jwt.IJsonWebTokenEncryptor.DecryptAsync(string[],System.Collections.Generic.IAsyncEnumerable_Abblix.Jwt.JsonWebKey_,System.Threading.CancellationToken).jwtParts} The base64url\-encoded JWE string parts\. ###### `decryptionKeys` [System\.Collections\.Generic\.IAsyncEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.iasyncenumerable-1 'System\.Collections\.Generic\.IAsyncEnumerable\`1')[JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.iasyncenumerable-1 'System\.Collections\.Generic\.IAsyncEnumerable\`1') {#Abblix.Jwt.IJsonWebTokenEncryptor.DecryptAsync(string[],System.Collections.Generic.IAsyncEnumerable_Abblix.Jwt.JsonWebKey_,System.Threading.CancellationToken).decryptionKeys} The decryption keys to try\. ###### `cancellationToken` [System\.Threading\.CancellationToken](https://learn.microsoft.com/en-us/dotnet/api/system.threading.cancellationtoken 'System\.Threading\.CancellationToken') {#Abblix.Jwt.IJsonWebTokenEncryptor.DecryptAsync(string[],System.Collections.Generic.IAsyncEnumerable_Abblix.Jwt.JsonWebKey_,System.Threading.CancellationToken).cancellationToken} Cancels enumeration of the decryption\-key source and any external unwrap\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[JwtValidationError](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JwtValidationError 'Abblix\.Jwt\.JwtValidationError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A result containing either the decrypted plaintext bytes or a validation error\. ## IJsonWebTokenEncryptor\.EncryptAsync\(byte\[\], JsonWebKey, string, string, string, CancellationToken\) Method {#Abblix.Jwt.IJsonWebTokenEncryptor.EncryptAsync(byte[],Abblix.Jwt.JsonWebKey,string,string,string,System.Threading.CancellationToken)} Encrypts a plaintext payload \(typically an inner JWS\) into a JWE token\. Implements RFC 7516 \(JWE\) encryption\. ```csharp System.Threading.Tasks.Task EncryptAsync(byte[] plaintext, Abblix.Jwt.JsonWebKey encryptionKey, string? tokenType, string keyEncryptionAlgorithm, string contentEncryptionAlgorithm, System.Threading.CancellationToken cancellationToken=default(System.Threading.CancellationToken)); ``` #### Parameters ###### `plaintext` [System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Jwt.IJsonWebTokenEncryptor.EncryptAsync(byte[],Abblix.Jwt.JsonWebKey,string,string,string,System.Threading.CancellationToken).plaintext} The bytes to encrypt; a JWS\-wrapping caller UTF\-8 encodes the inner JWS\. ###### `encryptionKey` [JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey') {#Abblix.Jwt.IJsonWebTokenEncryptor.EncryptAsync(byte[],Abblix.Jwt.JsonWebKey,string,string,string,System.Threading.CancellationToken).encryptionKey} The JSON Web Key to use for encryption\. ###### `tokenType` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Jwt.IJsonWebTokenEncryptor.EncryptAsync(byte[],Abblix.Jwt.JsonWebKey,string,string,string,System.Threading.CancellationToken).tokenType} The token type to set in the JWE header\. ###### `keyEncryptionAlgorithm` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Jwt.IJsonWebTokenEncryptor.EncryptAsync(byte[],Abblix.Jwt.JsonWebKey,string,string,string,System.Threading.CancellationToken).keyEncryptionAlgorithm} The key encryption algorithm \(e\.g\. RSA\-OAEP\-256\)\. ###### `contentEncryptionAlgorithm` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Jwt.IJsonWebTokenEncryptor.EncryptAsync(byte[],Abblix.Jwt.JsonWebKey,string,string,string,System.Threading.CancellationToken).contentEncryptionAlgorithm} The content encryption algorithm \(e\.g\. A256CBC\-HS512\)\. ###### `cancellationToken` [System\.Threading\.CancellationToken](https://learn.microsoft.com/en-us/dotnet/api/system.threading.cancellationtoken 'System\.Threading\.CancellationToken') {#Abblix.Jwt.IJsonWebTokenEncryptor.EncryptAsync(byte[],Abblix.Jwt.JsonWebKey,string,string,string,System.Threading.CancellationToken).cancellationToken} Cancels a network\-backed external key\-management round\-trip\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') The JWE compact serialization string\. --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.IJsonWebTokenSigner.md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt 'Abblix\.Jwt') ## IJsonWebTokenSigner Interface Defines the contract for JSON Web Signature \(JWS\) signing and verification services\. ```csharp public interface IJsonWebTokenSigner ``` ### Remarks Part of the public JWT crypto surface alongside [IJsonWebTokenCreator](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.IJsonWebTokenCreator 'Abblix\.Jwt\.IJsonWebTokenCreator') and [IJsonWebTokenValidator](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.IJsonWebTokenValidator 'Abblix\.Jwt\.IJsonWebTokenValidator')\. Signing is asynchronous and cancellable so the private\-key operation can be served by an external key custodian \(HSM/KMS/vault\) over a network round\-trip; the in\-process path completes synchronously inside the task\. ### Methods ## IJsonWebTokenSigner\.SignAsync\(JsonWebToken, JsonWebKey, CancellationToken\) Method {#Abblix.Jwt.IJsonWebTokenSigner.SignAsync(Abblix.Jwt.JsonWebToken,Abblix.Jwt.JsonWebKey,System.Threading.CancellationToken)} Creates a signed JSON Web Signature \(JWS\) token\. ```csharp System.Threading.Tasks.Task SignAsync(Abblix.Jwt.JsonWebToken token, Abblix.Jwt.JsonWebKey? signingKey, System.Threading.CancellationToken cancellationToken=default(System.Threading.CancellationToken)); ``` #### Parameters ###### `token` [JsonWebToken](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebToken 'Abblix\.Jwt\.JsonWebToken') {#Abblix.Jwt.IJsonWebTokenSigner.SignAsync(Abblix.Jwt.JsonWebToken,Abblix.Jwt.JsonWebKey,System.Threading.CancellationToken).token} The JSON Web Token to sign\. ###### `signingKey` [JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey') {#Abblix.Jwt.IJsonWebTokenSigner.SignAsync(Abblix.Jwt.JsonWebToken,Abblix.Jwt.JsonWebKey,System.Threading.CancellationToken).signingKey} The signing key, or null for an unsigned \("alg": "none"\) token\. ###### `cancellationToken` [System\.Threading\.CancellationToken](https://learn.microsoft.com/en-us/dotnet/api/system.threading.cancellationtoken 'System\.Threading\.CancellationToken') {#Abblix.Jwt.IJsonWebTokenSigner.SignAsync(Abblix.Jwt.JsonWebToken,Abblix.Jwt.JsonWebKey,System.Threading.CancellationToken).cancellationToken} Cancels a network\-backed external signing round\-trip\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') The JWS compact serialization string\. ## IJsonWebTokenSigner\.ValidateAsync\(string\[\], JsonWebTokenHeader, IAsyncEnumerable\, CancellationToken\) Method {#Abblix.Jwt.IJsonWebTokenSigner.ValidateAsync(string[],Abblix.Jwt.JsonWebTokenHeader,System.Collections.Generic.IAsyncEnumerable_Abblix.Jwt.JsonWebKey_,System.Threading.CancellationToken)} Validates the signature of a signed JWT\. ```csharp System.Threading.Tasks.Task ValidateAsync(string[] jwt, Abblix.Jwt.JsonWebTokenHeader header, System.Collections.Generic.IAsyncEnumerable signingKeys, System.Threading.CancellationToken cancellationToken=default(System.Threading.CancellationToken)); ``` #### Parameters ###### `jwt` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Jwt.IJsonWebTokenSigner.ValidateAsync(string[],Abblix.Jwt.JsonWebTokenHeader,System.Collections.Generic.IAsyncEnumerable_Abblix.Jwt.JsonWebKey_,System.Threading.CancellationToken).jwt} The base64url\-encoded JWT string parts \(header, payload, signature\)\. ###### `header` [JsonWebTokenHeader](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenHeader 'Abblix\.Jwt\.JsonWebTokenHeader') {#Abblix.Jwt.IJsonWebTokenSigner.ValidateAsync(string[],Abblix.Jwt.JsonWebTokenHeader,System.Collections.Generic.IAsyncEnumerable_Abblix.Jwt.JsonWebKey_,System.Threading.CancellationToken).header} The JWT header\. ###### `signingKeys` [System\.Collections\.Generic\.IAsyncEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.iasyncenumerable-1 'System\.Collections\.Generic\.IAsyncEnumerable\`1')[JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.iasyncenumerable-1 'System\.Collections\.Generic\.IAsyncEnumerable\`1') {#Abblix.Jwt.IJsonWebTokenSigner.ValidateAsync(string[],Abblix.Jwt.JsonWebTokenHeader,System.Collections.Generic.IAsyncEnumerable_Abblix.Jwt.JsonWebKey_,System.Threading.CancellationToken).signingKeys} The signing keys to try for verification\. ###### `cancellationToken` [System\.Threading\.CancellationToken](https://learn.microsoft.com/en-us/dotnet/api/system.threading.cancellationtoken 'System\.Threading\.CancellationToken') {#Abblix.Jwt.IJsonWebTokenSigner.ValidateAsync(string[],Abblix.Jwt.JsonWebTokenHeader,System.Collections.Generic.IAsyncEnumerable_Abblix.Jwt.JsonWebKey_,System.Threading.CancellationToken).cancellationToken} Cancels enumeration of the signing\-key source\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[JwtValidationError](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JwtValidationError 'Abblix\.Jwt\.JwtValidationError')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A validation error if the signature is invalid; otherwise, null\. --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.IJsonWebTokenValidator.md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt 'Abblix\.Jwt') ## IJsonWebTokenValidator Interface Defines the contract for a service that validates JSON Web Tokens \(JWTs\)\. ```csharp public interface IJsonWebTokenValidator ``` ### Properties ## IJsonWebTokenValidator\.EncryptionAlgorithmsSupported Property {#Abblix.Jwt.IJsonWebTokenValidator.EncryptionAlgorithmsSupported} Indicates which JWE key\-management algorithms \(the `alg` header values, e\.g\. "RSA\-OAEP\-256"\) the validator can use to decrypt incoming encrypted JWTs, such as JWE\-wrapped request objects\. ```csharp System.Collections.Generic.IEnumerable EncryptionAlgorithmsSupported { get; } ``` #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ## IJsonWebTokenValidator\.EncryptionMethodsSupported Property {#Abblix.Jwt.IJsonWebTokenValidator.EncryptionMethodsSupported} Indicates which JWE content\-encryption algorithms \(the `enc` header values, e\.g\. "A256GCM"\) the validator can use to decrypt incoming encrypted JWTs, such as JWE\-wrapped request objects\. ```csharp System.Collections.Generic.IEnumerable EncryptionMethodsSupported { get; } ``` #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ## IJsonWebTokenValidator\.SigningAlgorithmsSupported Property {#Abblix.Jwt.IJsonWebTokenValidator.SigningAlgorithmsSupported} Indicates which algorithms are accepted by the validator for verifying the signatures of incoming JWTs, ensuring that only tokens signed with recognized and secure algorithms are considered valid\. ```csharp System.Collections.Generic.IEnumerable SigningAlgorithmsSupported { get; } ``` #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ### Methods ## IJsonWebTokenValidator\.ValidateAsync\(string, ValidationParameters\) Method {#Abblix.Jwt.IJsonWebTokenValidator.ValidateAsync(string,Abblix.Jwt.ValidationParameters)} Asynchronously validates a JWT against a set of specified parameters\. ```csharp System.Threading.Tasks.Task> ValidateAsync(string jwt, Abblix.Jwt.ValidationParameters parameters); ``` #### Parameters ###### `jwt` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Jwt.IJsonWebTokenValidator.ValidateAsync(string,Abblix.Jwt.ValidationParameters).jwt} The JWT as a string to be validated\. ###### `parameters` [ValidationParameters](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ValidationParameters 'Abblix\.Jwt\.ValidationParameters') {#Abblix.Jwt.IJsonWebTokenValidator.ValidateAsync(string,Abblix.Jwt.ValidationParameters).parameters} The parameters against which the JWT will be validated\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[JsonWebToken](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebToken 'Abblix\.Jwt\.JsonWebToken')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[JwtValidationError](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JwtValidationError 'Abblix\.Jwt\.JwtValidationError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A Task representing the asynchronous validation operation, which yields a Result containing either a validated JsonWebToken or a JwtValidationError\. --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonArrayExtensions.md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt 'Abblix\.Jwt') ## JsonArrayExtensions Class Conversion helpers between a raw [System\.Text\.Json\.Nodes\.JsonArray](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonarray 'System\.Text\.Json\.Nodes\.JsonArray') wire form and a sequence of [AuthorizationDetail](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.AuthorizationDetail 'Abblix\.Jwt\.AuthorizationDetail') wrappers\. Parallels [JsonObjectExtensions](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonObjectExtensions 'Abblix\.Jwt\.JsonObjectExtensions') for object\-shaped claims; here the shape is a JSON array and each element is a wrapper over its underlying [System\.Text\.Json\.Nodes\.JsonNode](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonnode 'System\.Text\.Json\.Nodes\.JsonNode')\. ```csharp public static class JsonArrayExtensions ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → JsonArrayExtensions ### Remarks The raw [System\.Text\.Json\.Nodes\.JsonArray](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonarray 'System\.Text\.Json\.Nodes\.JsonArray') remains the source of truth \- member order and type\-specific payload survive the authorize → code → token round\-trip byte\-exact because no typed deserialise / re\-serialise cycle ever runs over the wrapped nodes\. ### Methods ## JsonArrayExtensions\.ToRawJsonArray\(this IEnumerable\\) Method {#Abblix.Jwt.JsonArrayExtensions.ToRawJsonArray(thisSystem.Collections.Generic.IEnumerable_Abblix.Jwt.AuthorizationDetail_)} Builds a fresh [System\.Text\.Json\.Nodes\.JsonArray](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonarray 'System\.Text\.Json\.Nodes\.JsonArray') from a sequence of [AuthorizationDetail](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.AuthorizationDetail 'Abblix\.Jwt\.AuthorizationDetail') wrappers, deep\-cloning each entry's underlying [Json](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.AuthorizationDetail#Abblix.Jwt.AuthorizationDetail.Json 'Abblix\.Jwt\.AuthorizationDetail\.Json') so the resulting array is independent of the sources and can attach to a different parent \(JSON nodes may have only one parent at a time\)\. ```csharp public static System.Text.Json.Nodes.JsonArray? ToRawJsonArray(this System.Collections.Generic.IEnumerable? details); ``` #### Parameters ###### `details` [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[AuthorizationDetail](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.AuthorizationDetail 'Abblix\.Jwt\.AuthorizationDetail')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') {#Abblix.Jwt.JsonArrayExtensions.ToRawJsonArray(thisSystem.Collections.Generic.IEnumerable_Abblix.Jwt.AuthorizationDetail_).details} The wrapper sequence, or `null`\. #### Returns [System\.Text\.Json\.Nodes\.JsonArray](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonarray 'System\.Text\.Json\.Nodes\.JsonArray') A fresh [System\.Text\.Json\.Nodes\.JsonArray](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonarray 'System\.Text\.Json\.Nodes\.JsonArray'), or `null` when the input is `null`\. ## JsonArrayExtensions\.ToTypedArray\(this JsonArray\) Method {#Abblix.Jwt.JsonArrayExtensions.ToTypedArray(thisSystem.Text.Json.Nodes.JsonArray)} Wraps each non\-null element of a raw [System\.Text\.Json\.Nodes\.JsonArray](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonarray 'System\.Text\.Json\.Nodes\.JsonArray') as an [AuthorizationDetail](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.AuthorizationDetail 'Abblix\.Jwt\.AuthorizationDetail')\. The wrappers share references with the source array's nodes \- read\-through is byte\-exact, and any property\-setter calls mutate the underlying array in place\. ```csharp public static Abblix.Jwt.AuthorizationDetail[]? ToTypedArray(this System.Text.Json.Nodes.JsonArray? jsonArray); ``` #### Parameters ###### `jsonArray` [System\.Text\.Json\.Nodes\.JsonArray](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonarray 'System\.Text\.Json\.Nodes\.JsonArray') {#Abblix.Jwt.JsonArrayExtensions.ToTypedArray(thisSystem.Text.Json.Nodes.JsonArray).jsonArray} The raw array, or `null`\. #### Returns [AuthorizationDetail](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.AuthorizationDetail 'Abblix\.Jwt\.AuthorizationDetail')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') A wrapper array, or `null` when the input is `null`\. ### Remarks The attribute states one half of the sentence above in the type system: never null out for an input that was not\. The other half, null in null out, is not expressible there and is pinned by a test instead\. Without it a caller holding a non\-null array still gets a nullable result, and the way that gets silenced is a null\-forgiving operator \- which keeps compiling after the guard it depends on is moved or deleted, asserting something no longer true\. With it the compiler carries the claim and re\-checks it at every call site\. --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonObjectExtensions.md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt 'Abblix\.Jwt') ## JsonObjectExtensions Class Provides extension methods for the [System\.Text\.Json\.Nodes\.JsonObject](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonobject 'System\.Text\.Json\.Nodes\.JsonObject') class, enhancing its usability by simplifying the process of accessing and manipulating JSON properties\. ```csharp public static class JsonObjectExtensions ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → JsonObjectExtensions ### Remarks The extension methods in this class aim to streamline common tasks associated with JSON objects, such as retrieving and setting properties with type safety and minimal boilerplate code\. These methods abstract away some of the complexities of working directly with [System\.Text\.Json\.Nodes\.JsonObject](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonobject 'System\.Text\.Json\.Nodes\.JsonObject') and [System\.Text\.Json\.Nodes\.JsonNode](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonnode 'System\.Text\.Json\.Nodes\.JsonNode'), offering a more fluent and intuitive interface for developers\. ### Methods ## JsonObjectExtensions\.GetProperty\\(this JsonObject, string\) Method {#Abblix.Jwt.JsonObjectExtensions.GetProperty_T_(thisSystem.Text.Json.Nodes.JsonObject,string)} Retrieves the value of the specified property from a [System\.Text\.Json\.Nodes\.JsonObject](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonobject 'System\.Text\.Json\.Nodes\.JsonObject')\. ```csharp public static T? GetProperty(this System.Text.Json.Nodes.JsonObject json, string name); ``` #### Type parameters ###### `T` {#Abblix.Jwt.JsonObjectExtensions.GetProperty_T_(thisSystem.Text.Json.Nodes.JsonObject,string).T} The expected type of the property value\. #### Parameters ###### `json` [System\.Text\.Json\.Nodes\.JsonObject](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonobject 'System\.Text\.Json\.Nodes\.JsonObject') {#Abblix.Jwt.JsonObjectExtensions.GetProperty_T_(thisSystem.Text.Json.Nodes.JsonObject,string).json} The [System\.Text\.Json\.Nodes\.JsonObject](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonobject 'System\.Text\.Json\.Nodes\.JsonObject') instance to extract the property value from\. ###### `name` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Jwt.JsonObjectExtensions.GetProperty_T_(thisSystem.Text.Json.Nodes.JsonObject,string).name} The name of the property whose value is to be retrieved\. #### Returns [T](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonObjectExtensions#Abblix.Jwt.JsonObjectExtensions.GetProperty_T_(thisSystem.Text.Json.Nodes.JsonObject,string).T 'Abblix\.Jwt\.JsonObjectExtensions\.GetProperty\\(this System\.Text\.Json\.Nodes\.JsonObject, string\)\.T') The value of the specified property if it exists and can be successfully converted to the specified type; otherwise, the default value for the type [T](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonObjectExtensions#Abblix.Jwt.JsonObjectExtensions.GetProperty_T_(thisSystem.Text.Json.Nodes.JsonObject,string).T 'Abblix\.Jwt\.JsonObjectExtensions\.GetProperty\\(this System\.Text\.Json\.Nodes\.JsonObject, string\)\.T')\. ### Remarks This method facilitates the retrieval of typed values from a JSON object, abstracting away the need for manual type checking and conversion\. ## JsonObjectExtensions\.SetProperty\(this JsonObject, string, JsonNode\) Method {#Abblix.Jwt.JsonObjectExtensions.SetProperty(thisSystem.Text.Json.Nodes.JsonObject,string,System.Text.Json.Nodes.JsonNode)} Sets or updates the value of a specified property in a [System\.Text\.Json\.Nodes\.JsonObject](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonobject 'System\.Text\.Json\.Nodes\.JsonObject')\. ```csharp public static System.Text.Json.Nodes.JsonObject SetProperty(this System.Text.Json.Nodes.JsonObject json, string name, System.Text.Json.Nodes.JsonNode? value); ``` #### Parameters ###### `json` [System\.Text\.Json\.Nodes\.JsonObject](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonobject 'System\.Text\.Json\.Nodes\.JsonObject') {#Abblix.Jwt.JsonObjectExtensions.SetProperty(thisSystem.Text.Json.Nodes.JsonObject,string,System.Text.Json.Nodes.JsonNode).json} The [System\.Text\.Json\.Nodes\.JsonObject](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonobject 'System\.Text\.Json\.Nodes\.JsonObject') instance to modify\. ###### `name` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Jwt.JsonObjectExtensions.SetProperty(thisSystem.Text.Json.Nodes.JsonObject,string,System.Text.Json.Nodes.JsonNode).name} The name of the property to set or update\. ###### `value` [System\.Text\.Json\.Nodes\.JsonNode](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonnode 'System\.Text\.Json\.Nodes\.JsonNode') {#Abblix.Jwt.JsonObjectExtensions.SetProperty(thisSystem.Text.Json.Nodes.JsonObject,string,System.Text.Json.Nodes.JsonNode).value} The new value for the property\. If `null`, the property is removed from the [System\.Text\.Json\.Nodes\.JsonObject](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonobject 'System\.Text\.Json\.Nodes\.JsonObject')\. #### Returns [System\.Text\.Json\.Nodes\.JsonObject](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonobject 'System\.Text\.Json\.Nodes\.JsonObject') ### Remarks This method provides a convenient way to update the properties of a JSON object, allowing for the addition of new properties or the removal of existing ones by providing a `null` value\. It ensures that the JSON object remains in a consistent state by avoiding the presence of null property values\. --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey.md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt 'Abblix\.Jwt') ## JsonWebKey Class Base class representing a JSON Web Key \(JWK\), a versatile structure for representing cryptographic keys using JSON\. JWKs are crucial for digital signatures, encryption, and ensuring secure communication in web\-based protocols\. ```csharp public abstract record JsonWebKey : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → JsonWebKey Derived ↳ [EllipticCurveJsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.EllipticCurveJsonWebKey 'Abblix\.Jwt\.EllipticCurveJsonWebKey') ↳ [OctetJsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.OctetJsonWebKey 'Abblix\.Jwt\.OctetJsonWebKey') ↳ [RsaJsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.RsaJsonWebKey 'Abblix\.Jwt\.RsaJsonWebKey') Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Remarks This is an abstract base class\. Use specific subclasses for different key types: - [RsaJsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.RsaJsonWebKey 'Abblix\.Jwt\.RsaJsonWebKey') for RSA keys - [EllipticCurveJsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.EllipticCurveJsonWebKey 'Abblix\.Jwt\.EllipticCurveJsonWebKey') for Elliptic Curve keys - [OctetJsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.OctetJsonWebKey 'Abblix\.Jwt\.OctetJsonWebKey') for symmetric keys (oct) ### Properties ## JsonWebKey\.Algorithm Property {#Abblix.Jwt.JsonWebKey.Algorithm} Specifies the algorithm intended for use with the key, aligning with JWT and JWA specifications to ensure interoperability and secure key management\. ```csharp public string? Algorithm { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JsonWebKey\.Certificates Property {#Abblix.Jwt.JsonWebKey.Certificates} Contains a chain of one or more PKIX certificates \(RFC 5280\), offering a method to associate X\.509 certificates with the key for validation and trust chain establishment in secure communications\. ```csharp public byte[][]? Certificates { get; set; } ``` #### Property Value [System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') ## JsonWebKey\.HasPrivateKey Property {#Abblix.Jwt.JsonWebKey.HasPrivateKey} Checks if the key contains private key material\. ```csharp public abstract bool HasPrivateKey { get; } ``` #### Property Value [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') ## JsonWebKey\.HasPublicKey Property {#Abblix.Jwt.JsonWebKey.HasPublicKey} Checks if the key contains public key material\. ```csharp public abstract bool HasPublicKey { get; } ``` #### Property Value [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') ## JsonWebKey\.KeyId Property {#Abblix.Jwt.JsonWebKey.KeyId} A unique identifier for the key, facilitating key selection and management in multi\-key environments, enabling clients and servers to reference and utilize the correct key for cryptographic operations\. ```csharp public string? KeyId { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JsonWebKey\.KeyType Property {#Abblix.Jwt.JsonWebKey.KeyType} Identifies the cryptographic algorithm family used with the key, such as RSA, EC \(Elliptic Curve\), or oct \(Octet Sequence\), specifying the key's type and its intended cryptographic use\. ```csharp public abstract string KeyType { get; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks This property is marked with [System\.Text\.Json\.Serialization\.JsonIgnoreAttribute](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.serialization.jsonignoreattribute 'System\.Text\.Json\.Serialization\.JsonIgnoreAttribute') on the base class to prevent conflicts with the custom [JsonWebKeyConverter](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKeyConverter 'Abblix\.Jwt\.JsonWebKeyConverter')\. Derived types override this property with `[JsonPropertyName("kty")]` and `[JsonInclude]` attributes\. The custom converter ensures "kty" is always serialized by serializing the concrete type's properties, maintaining RFC 7517 compliance\. ## JsonWebKey\.Thumbprint Property {#Abblix.Jwt.JsonWebKey.Thumbprint} A base64url\-encoded SHA\-1 thumbprint of the DER encoding of an X\.509 certificate, providing a compact means to associate a certificate with the JWK for verification purposes without transmitting the full certificate\. ```csharp public byte[]? Thumbprint { get; set; } ``` #### Property Value [System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') ## JsonWebKey\.Usage Property {#Abblix.Jwt.JsonWebKey.Usage} Indicates the intended use of the key, for example, "sig" \(signature\) for signing operations or "enc" \(encryption\) for encryption operations, guiding clients on how to use the key appropriately\. ```csharp public string? Usage { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Methods ## JsonWebKey\.ComputeJwkThumbprint\(\) Method {#Abblix.Jwt.JsonWebKey.ComputeJwkThumbprint()} Computes the JWK Thumbprint of this key per RFC 7638 §3 as the raw 32\-byte SHA\-256 digest of the canonical\-JSON form built by [Abblix\.Jwt\.JsonWebKey\.CanonicalJson](https://learn.microsoft.com/en-us/dotnet/api/abblix.jwt.jsonwebkey.canonicaljson 'Abblix\.Jwt\.JsonWebKey\.CanonicalJson')\. ```csharp public byte[] ComputeJwkThumbprint(); ``` #### Returns [System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') The 32\-byte SHA\-256 digest\. #### Exceptions [System\.InvalidOperationException](https://learn.microsoft.com/en-us/dotnet/api/system.invalidoperationexception 'System\.InvalidOperationException') A required member \(per RFC 7638 §3\.2\) is missing on this key\. ### Remarks The thumbprint is computed at runtime from the public\-key material; it is not a stored member on the JWK and is distinct from the X\.509 certificate thumbprints `x5t` \(RFC 7517 §4\.8\) and `x5t#S256` \(RFC 7517 §4\.9\), which hash the certificate, not the key\. OAuth 2\.0 DPoP \(RFC 9449\) uses this value for `cnf.jkt` and the `dpop_jkt` request parameter\. ## JsonWebKey\.ComputeJwkThumbprintBase64Url\(\) Method {#Abblix.Jwt.JsonWebKey.ComputeJwkThumbprintBase64Url()} Computes the JWK Thumbprint of this key per RFC 7638 §3 and returns the base64url\-encoded form, which is the wire shape used by DPoP `cnf.jkt` and the `dpop_jkt` authorization\-request parameter\. ```csharp public string ComputeJwkThumbprintBase64Url(); ``` #### Returns [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') The base64url\-encoded SHA\-256 digest of the canonical\-JSON form\. #### Exceptions [System\.InvalidOperationException](https://learn.microsoft.com/en-us/dotnet/api/system.invalidoperationexception 'System\.InvalidOperationException') A required member \(per RFC 7638 §3\.2\) is missing on this key\. ## JsonWebKey\.Sanitize\(bool\) Method {#Abblix.Jwt.JsonWebKey.Sanitize(bool)} Prepares a sanitized version of the JWK that excludes private key information unless explicitly included, suitable for public sharing while preserving the integrity of sensitive data\. ```csharp public abstract Abblix.Jwt.JsonWebKey Sanitize(bool includePrivateKeys); ``` #### Parameters ###### `includePrivateKeys` [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') {#Abblix.Jwt.JsonWebKey.Sanitize(bool).includePrivateKeys} Whether to include private key data in the sanitized output\. #### Returns [JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey') A new instance of [JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey') with or without private key data based on the input parameter\. --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKeyConverter.md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt 'Abblix\.Jwt') ## JsonWebKeyConverter Class Custom JSON converter for JsonWebKey that handles polymorphic serialization/deserialization based on the "kty" \(key type\) discriminator while ensuring the KeyType property is serialized in both polymorphic and direct serialization scenarios\. ```csharp public class JsonWebKeyConverter : System.Text.Json.Serialization.JsonConverter ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [System\.Text\.Json\.Serialization\.JsonConverter](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.serialization.jsonconverter 'System\.Text\.Json\.Serialization\.JsonConverter') → [System\.Text\.Json\.Serialization\.JsonConverter<](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.serialization.jsonconverter-1 'System\.Text\.Json\.Serialization\.JsonConverter\`1')[JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey')[>](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.serialization.jsonconverter-1 'System\.Text\.Json\.Serialization\.JsonConverter\`1') → JsonWebKeyConverter ### Remarks Looks superficially replaceable by `[JsonPolymorphic(TypeDiscriminatorPropertyName = "kty")]` + `[JsonDerivedType]`. It is not, because of how this hierarchy emits "kty" today: each concrete subtype overrides [KeyType](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey#Abblix.Jwt.JsonWebKey.KeyType 'Abblix\.Jwt\.JsonWebKey\.KeyType') with `[JsonPropertyName("kty")]` and `[JsonInclude]`, which guarantees "kty" appears both in polymorphic writes (`JsonSerializer.Serialize(rsaKey)`) and in direct concrete-type writes (`JsonSerializer.Serialize(rsaKey)` where the compile-time type is `RsaJsonWebKey`). Switching to `[JsonPolymorphic]` alone breaks one of those two scenarios: - Keep the derived `[JsonInclude]` override AND add `[JsonPolymorphic]` → "kty" gets written twice in polymorphic context (once by STJ as the discriminator, once by the derived property), producing invalid JSON. - Drop the derived `[JsonInclude]` override → "kty" disappears whenever a concrete subtype is serialized directly, because `[JsonPolymorphic]` only writes the discriminator when STJ sees the abstract base type. This converter bridges both write modes by always serializing through the concrete subtype's own attribute set, so "kty" lands once regardless of the call site. A future replacement is possible but must also touch every `KeyType` override and ship with a round-trip regression test that covers polymorphic AND direct serialization paths. ### Methods ## JsonWebKeyConverter\.Read\(Utf8JsonReader, Type, JsonSerializerOptions\) Method {#Abblix.Jwt.JsonWebKeyConverter.Read(System.Text.Json.Utf8JsonReader,System.Type,System.Text.Json.JsonSerializerOptions)} Reads a [JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey') from the JSON payload, dispatching to the matching concrete subtype \([RsaJsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.RsaJsonWebKey 'Abblix\.Jwt\.RsaJsonWebKey'), [EllipticCurveJsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.EllipticCurveJsonWebKey 'Abblix\.Jwt\.EllipticCurveJsonWebKey'), or [OctetJsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.OctetJsonWebKey 'Abblix\.Jwt\.OctetJsonWebKey')\) based on the `kty` property\. ```csharp public override Abblix.Jwt.JsonWebKey? Read(ref System.Text.Json.Utf8JsonReader reader, System.Type typeToConvert, System.Text.Json.JsonSerializerOptions options); ``` #### Parameters ###### `reader` [System\.Text\.Json\.Utf8JsonReader](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.utf8jsonreader 'System\.Text\.Json\.Utf8JsonReader') {#Abblix.Jwt.JsonWebKeyConverter.Read(System.Text.Json.Utf8JsonReader,System.Type,System.Text.Json.JsonSerializerOptions).reader} ###### `typeToConvert` [System\.Type](https://learn.microsoft.com/en-us/dotnet/api/system.type 'System\.Type') {#Abblix.Jwt.JsonWebKeyConverter.Read(System.Text.Json.Utf8JsonReader,System.Type,System.Text.Json.JsonSerializerOptions).typeToConvert} ###### `options` [System\.Text\.Json\.JsonSerializerOptions](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.jsonserializeroptions 'System\.Text\.Json\.JsonSerializerOptions') {#Abblix.Jwt.JsonWebKeyConverter.Read(System.Text.Json.Utf8JsonReader,System.Type,System.Text.Json.JsonSerializerOptions).options} #### Returns [JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey') ## JsonWebKeyConverter\.Write\(Utf8JsonWriter, JsonWebKey, JsonSerializerOptions\) Method {#Abblix.Jwt.JsonWebKeyConverter.Write(System.Text.Json.Utf8JsonWriter,Abblix.Jwt.JsonWebKey,System.Text.Json.JsonSerializerOptions)} Writes a [JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey') to JSON in its concrete\-subtype shape, so the resulting object includes the `kty` discriminator and every key\-type\-specific member\. ```csharp public override void Write(System.Text.Json.Utf8JsonWriter writer, Abblix.Jwt.JsonWebKey value, System.Text.Json.JsonSerializerOptions options); ``` #### Parameters ###### `writer` [System\.Text\.Json\.Utf8JsonWriter](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.utf8jsonwriter 'System\.Text\.Json\.Utf8JsonWriter') {#Abblix.Jwt.JsonWebKeyConverter.Write(System.Text.Json.Utf8JsonWriter,Abblix.Jwt.JsonWebKey,System.Text.Json.JsonSerializerOptions).writer} ###### `value` [JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey') {#Abblix.Jwt.JsonWebKeyConverter.Write(System.Text.Json.Utf8JsonWriter,Abblix.Jwt.JsonWebKey,System.Text.Json.JsonSerializerOptions).value} `options` [System\.Text\.Json\.JsonSerializerOptions](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.jsonserializeroptions 'System\.Text\.Json\.JsonSerializerOptions') --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKeyExtensions.md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt 'Abblix\.Jwt') ## JsonWebKeyExtensions Class Provides extension methods for the JsonWebKey model to simplify the process of populating its properties from different sources\. These methods enable easy conversion between JsonWebKey and various cryptographic representations\. ```csharp public static class JsonWebKeyExtensions ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → JsonWebKeyExtensions ### Fields ## JsonWebKeyExtensions\.MinimumRsaKeyBits Field {#Abblix.Jwt.JsonWebKeyExtensions.MinimumRsaKeyBits} The smallest RSA modulus RFC 7518 permits\. Four sections state it, one per family: Section 3\.3 and Section 3\.5 for signing, Section 4\.2 and Section 4\.3 for key encryption\. Almost the same words \- 3\.3 and 4\.3 govern several algorithms and say "these", 3\.5 and 4\.2 govern one and say "this"\. One number here, so the sites that enforce it cannot drift apart\. ```csharp public const int MinimumRsaKeyBits = 2048; ``` #### Field Value [System\.Int32](https://learn.microsoft.com/en-us/dotnet/api/system.int32 'System\.Int32') ### Methods ## JsonWebKeyExtensions\.Apply\(this EllipticCurveJsonWebKey, ECParameters\) Method {#Abblix.Jwt.JsonWebKeyExtensions.Apply(thisAbblix.Jwt.EllipticCurveJsonWebKey,System.Security.Cryptography.ECParameters)} Applies Elliptic Curve parameters to an EllipticCurveJsonWebKey\. ```csharp public static Abblix.Jwt.EllipticCurveJsonWebKey Apply(this Abblix.Jwt.EllipticCurveJsonWebKey jwk, System.Security.Cryptography.ECParameters parameters); ``` #### Parameters ###### `jwk` [EllipticCurveJsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.EllipticCurveJsonWebKey 'Abblix\.Jwt\.EllipticCurveJsonWebKey') {#Abblix.Jwt.JsonWebKeyExtensions.Apply(thisAbblix.Jwt.EllipticCurveJsonWebKey,System.Security.Cryptography.ECParameters).jwk} The EllipticCurveJsonWebKey to which the EC parameters are to be applied\. ###### `parameters` [System\.Security\.Cryptography\.ECParameters](https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.ecparameters 'System\.Security\.Cryptography\.ECParameters') {#Abblix.Jwt.JsonWebKeyExtensions.Apply(thisAbblix.Jwt.EllipticCurveJsonWebKey,System.Security.Cryptography.ECParameters).parameters} The ECParameters providing the Elliptic Curve key information\. #### Returns [EllipticCurveJsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.EllipticCurveJsonWebKey 'Abblix\.Jwt\.EllipticCurveJsonWebKey') The updated EllipticCurveJsonWebKey with applied Elliptic Curve parameters\. ## JsonWebKeyExtensions\.Apply\(this RsaJsonWebKey, RSAParameters\) Method {#Abblix.Jwt.JsonWebKeyExtensions.Apply(thisAbblix.Jwt.RsaJsonWebKey,System.Security.Cryptography.RSAParameters)} Applies RSA parameters to an RsaJsonWebKey\. ```csharp public static Abblix.Jwt.RsaJsonWebKey Apply(this Abblix.Jwt.RsaJsonWebKey jwk, System.Security.Cryptography.RSAParameters parameters); ``` #### Parameters ###### `jwk` [RsaJsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.RsaJsonWebKey 'Abblix\.Jwt\.RsaJsonWebKey') {#Abblix.Jwt.JsonWebKeyExtensions.Apply(thisAbblix.Jwt.RsaJsonWebKey,System.Security.Cryptography.RSAParameters).jwk} The RsaJsonWebKey to which the RSA parameters are to be applied\. ###### `parameters` [System\.Security\.Cryptography\.RSAParameters](https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.rsaparameters 'System\.Security\.Cryptography\.RSAParameters') {#Abblix.Jwt.JsonWebKeyExtensions.Apply(thisAbblix.Jwt.RsaJsonWebKey,System.Security.Cryptography.RSAParameters).parameters} The RSAParameters providing the RSA key information\. #### Returns [RsaJsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.RsaJsonWebKey 'Abblix\.Jwt\.RsaJsonWebKey') The updated RsaJsonWebKey with applied RSA parameters\. ## JsonWebKeyExtensions\.Apply\\(this T, X509Certificate2\) Method {#Abblix.Jwt.JsonWebKeyExtensions.Apply_T_(thisT,System.Security.Cryptography.X509Certificates.X509Certificate2)} Applies X509Certificate2 properties to a JsonWebKey\. ```csharp public static T Apply(this T jwk, System.Security.Cryptography.X509Certificates.X509Certificate2 certificate) where T : Abblix.Jwt.JsonWebKey; ``` #### Type parameters ###### `T` {#Abblix.Jwt.JsonWebKeyExtensions.Apply_T_(thisT,System.Security.Cryptography.X509Certificates.X509Certificate2).T} The type of JsonWebKey \(must be a subclass\)\. #### Parameters ###### `jwk` [T](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKeyExtensions#Abblix.Jwt.JsonWebKeyExtensions.Apply_T_(thisT,System.Security.Cryptography.X509Certificates.X509Certificate2).T 'Abblix\.Jwt\.JsonWebKeyExtensions\.Apply\\(this T, System\.Security\.Cryptography\.X509Certificates\.X509Certificate2\)\.T') {#Abblix.Jwt.JsonWebKeyExtensions.Apply_T_(thisT,System.Security.Cryptography.X509Certificates.X509Certificate2).jwk} The JsonWebKey to which the certificate properties are to be applied\. ###### `certificate` [System\.Security\.Cryptography\.X509Certificates\.X509Certificate2](https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.x509certificates.x509certificate2 'System\.Security\.Cryptography\.X509Certificates\.X509Certificate2') {#Abblix.Jwt.JsonWebKeyExtensions.Apply_T_(thisT,System.Security.Cryptography.X509Certificates.X509Certificate2).certificate} The X509Certificate2 providing the properties\. #### Returns [T](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKeyExtensions#Abblix.Jwt.JsonWebKeyExtensions.Apply_T_(thisT,System.Security.Cryptography.X509Certificates.X509Certificate2).T 'Abblix\.Jwt\.JsonWebKeyExtensions\.Apply\\(this T, System\.Security\.Cryptography\.X509Certificates\.X509Certificate2\)\.T') The updated JsonWebKey with applied certificate properties\. ## JsonWebKeyExtensions\.ModulusBitLength\(this RsaJsonWebKey\) Method {#Abblix.Jwt.JsonWebKeyExtensions.ModulusBitLength(thisAbblix.Jwt.RsaJsonWebKey)} The real bit length of the key's modulus, ignoring any leading zero octets\. ```csharp public static int ModulusBitLength(this Abblix.Jwt.RsaJsonWebKey key); ``` #### Parameters ###### `key` [RsaJsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.RsaJsonWebKey 'Abblix\.Jwt\.RsaJsonWebKey') {#Abblix.Jwt.JsonWebKeyExtensions.ModulusBitLength(thisAbblix.Jwt.RsaJsonWebKey).key} #### Returns [System\.Int32](https://learn.microsoft.com/en-us/dotnet/api/system.int32 'System\.Int32') ### Remarks `RSA.KeySize` is not this number, and how far it differs depends on the platform\. It reports the key as the importer built it: Windows CNG keeps a left\-padded modulus at its padded length and reports twice the real strength, while Linux \(OpenSSL\) strips the leading zeros and reports the true one\. So a size check written against that property refuses a downgraded key on one operating system and admits it on another \- which is a worse failure than either, because the deployment that admits it looks identical to the one that does not, and the forgery arrives later from whoever factored the real modulus\. Measuring the modulus itself removes the platform from the question. It is also never larger than `RSA.KeySize`, so switching to it can only add refusals, never remove one. RFC 7518 Section 2 requires the minimal encoding - "The octet sequence MUST utilize the minimum number of octets needed to represent the value" - which is what this measurement follows. Padding far enough to matter is NOT something a library does by accident: the one benign quirk the specification records is a single extra zero octet (Section 6.3.1.1, "returning 257 octets for a 2048-bit key"), and one octet moves neither check in either direction. Sixty-four of them is a malformed or hostile JWKS entry. The leading octet contributes only the bits from its own highest set bit down, which is what makes this the modulus's true length rather than a rounded-up octet count. ## JsonWebKeyExtensions\.RsaSectionFor\(string\) Method {#Abblix.Jwt.JsonWebKeyExtensions.RsaSectionFor(string)} The RFC 7518 section that carries the key\-size requirement for [algorithm](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKeyExtensions#Abblix.Jwt.JsonWebKeyExtensions.RsaSectionFor(string).algorithm 'Abblix\.Jwt\.JsonWebKeyExtensions\.RsaSectionFor\(string\)\.algorithm')\. ```csharp public static string RsaSectionFor(string algorithm); ``` #### Parameters ###### `algorithm` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Jwt.JsonWebKeyExtensions.RsaSectionFor(string).algorithm} #### Returns [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') #### Exceptions [System\.ArgumentException](https://learn.microsoft.com/en-us/dotnet/api/system.argumentexception 'System\.ArgumentException') The algorithm is not one this library enforces a floor for\. ### Remarks A refusal has to send the operator to the paragraph that refused them\. Sections 3 and 4 are container headings and state no size requirement at all, so citing either leaves the reader looking at a table of algorithm names and no MUST \- which reads as the library inventing the rule\. ## JsonWebKeyExtensions\.RsaSectionForOrNothing\(string\) Method {#Abblix.Jwt.JsonWebKeyExtensions.RsaSectionForOrNothing(string)} The WHOLE citation phrase, ready to drop into a refusal message \- "per RFC 7518 Section 3\.3", or "for RSA signatures" when the algorithm has no section of its own\. ```csharp public static string RsaSectionForOrNothing(string algorithm); ``` #### Parameters ###### `algorithm` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Jwt.JsonWebKeyExtensions.RsaSectionForOrNothing(string).algorithm} #### Returns [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks Two differences from [RsaSectionFor\(string\)](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKeyExtensions#Abblix.Jwt.JsonWebKeyExtensions.RsaSectionFor(string) 'Abblix\.Jwt\.JsonWebKeyExtensions\.RsaSectionFor\(string\)'), and both matter at a call site\. This one never throws, because an unknown algorithm must not replace the refusal the operator was about to read with a complaint about the citation \- and it is reachable, since an RSA key carrying no `alg` resolves to `SigningAlgorithms.None`\. And this one carries the words "per RFC 7518" itself, where [RsaSectionFor\(string\)](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKeyExtensions#Abblix.Jwt.JsonWebKeyExtensions.RsaSectionFor(string) 'Abblix\.Jwt\.JsonWebKeyExtensions\.RsaSectionFor\(string\)') returns the bare section and leaves them to the caller\. Interpolate this one into a sentence that writes them too and the message says them twice\. ## JsonWebKeyExtensions\.SupportsAlgorithm\(this JsonWebKey, string\) Method {#Abblix.Jwt.JsonWebKeyExtensions.SupportsAlgorithm(thisAbblix.Jwt.JsonWebKey,string)} Whether this key can carry out the given algorithm \- JWS signing or JWE key management \- judged by the key's own material rather than by what it declares\. ```csharp public static bool SupportsAlgorithm(this Abblix.Jwt.JsonWebKey key, string algorithm); ``` #### Parameters ###### `key` [JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey') {#Abblix.Jwt.JsonWebKeyExtensions.SupportsAlgorithm(thisAbblix.Jwt.JsonWebKey,string).key} The key to test\. ###### `algorithm` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Jwt.JsonWebKeyExtensions.SupportsAlgorithm(thisAbblix.Jwt.JsonWebKey,string).algorithm} The JWS algorithm the caller needs\. #### Returns [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') True when the key's type, and for ECDSA its curve, match what the algorithm requires\. ### Remarks RFC 7517 section 4\.4 makes `alg` OPTIONAL, so a key may simply not say what it is for \- and a key imported from a certificate never does\. Such a key is not "unknown", it is answerable: RFC 7518 section 3\.1 binds each algorithm to a key type, and section 3\.4 binds each ECDSA algorithm to one curve\. Asking the material is therefore exact, and it is the only question that matters at the point of use, since a declaration is a claim while the material is the fact\. ## JsonWebKeyExtensions\.ToEcdh\(this EllipticCurveJsonWebKey\) Method {#Abblix.Jwt.JsonWebKeyExtensions.ToEcdh(thisAbblix.Jwt.EllipticCurveJsonWebKey)} Converts an EllipticCurveJsonWebKey to an ECDiffieHellman object for ECDH key agreement operations \(e\.g\. the ECDH\-ES family of JWE key management algorithms\)\. ```csharp public static System.Security.Cryptography.ECDiffieHellman ToEcdh(this Abblix.Jwt.EllipticCurveJsonWebKey key); ``` #### Parameters ###### `key` [EllipticCurveJsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.EllipticCurveJsonWebKey 'Abblix\.Jwt\.EllipticCurveJsonWebKey') {#Abblix.Jwt.JsonWebKeyExtensions.ToEcdh(thisAbblix.Jwt.EllipticCurveJsonWebKey).key} The EllipticCurveJsonWebKey to be converted\. #### Returns [System\.Security\.Cryptography\.ECDiffieHellman](https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.ecdiffiehellman 'System\.Security\.Cryptography\.ECDiffieHellman') An ECDiffieHellman object based on the provided EllipticCurveJsonWebKey\. ## JsonWebKeyExtensions\.ToEcdsa\(this EllipticCurveJsonWebKey\) Method {#Abblix.Jwt.JsonWebKeyExtensions.ToEcdsa(thisAbblix.Jwt.EllipticCurveJsonWebKey)} Converts an EllipticCurveJsonWebKey to an ECDsa object, which represents an ECDSA public and private key pair or just a public key\. ```csharp public static System.Security.Cryptography.ECDsa ToEcdsa(this Abblix.Jwt.EllipticCurveJsonWebKey key); ``` #### Parameters ###### `key` [EllipticCurveJsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.EllipticCurveJsonWebKey 'Abblix\.Jwt\.EllipticCurveJsonWebKey') {#Abblix.Jwt.JsonWebKeyExtensions.ToEcdsa(thisAbblix.Jwt.EllipticCurveJsonWebKey).key} The EllipticCurveJsonWebKey to be converted\. #### Returns [System\.Security\.Cryptography\.ECDsa](https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.ecdsa 'System\.Security\.Cryptography\.ECDsa') An ECDsa object based on the provided EllipticCurveJsonWebKey\. ## JsonWebKeyExtensions\.ToEcParameters\(this EllipticCurveJsonWebKey\) Method {#Abblix.Jwt.JsonWebKeyExtensions.ToEcParameters(thisAbblix.Jwt.EllipticCurveJsonWebKey)} Converts an EllipticCurveJsonWebKey to ECParameters, which represent the key parameters used in ECDSA cryptographic operations\. Supports P\-256, P\-384, and P\-521 curves as defined in NIST standards\. ```csharp public static System.Security.Cryptography.ECParameters ToEcParameters(this Abblix.Jwt.EllipticCurveJsonWebKey key); ``` #### Parameters ###### `key` [EllipticCurveJsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.EllipticCurveJsonWebKey 'Abblix\.Jwt\.EllipticCurveJsonWebKey') {#Abblix.Jwt.JsonWebKeyExtensions.ToEcParameters(thisAbblix.Jwt.EllipticCurveJsonWebKey).key} The EllipticCurveJsonWebKey to be converted\. #### Returns [System\.Security\.Cryptography\.ECParameters](https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.ecparameters 'System\.Security\.Cryptography\.ECParameters') An ECParameters object based on the provided EllipticCurveJsonWebKey\. #### Exceptions [System\.InvalidOperationException](https://learn.microsoft.com/en-us/dotnet/api/system.invalidoperationexception 'System\.InvalidOperationException') Thrown when the curve type is not supported\. ## JsonWebKeyExtensions\.ToJsonWebKey\(this X509Certificate2, bool\) Method {#Abblix.Jwt.JsonWebKeyExtensions.ToJsonWebKey(thisSystem.Security.Cryptography.X509Certificates.X509Certificate2,bool)} Converts an X509Certificate2 to a JsonWebKey\. The private keys can be optionally included in the conversion\. ```csharp public static Abblix.Jwt.JsonWebKey ToJsonWebKey(this System.Security.Cryptography.X509Certificates.X509Certificate2 certificate, bool includePrivateKeys=false); ``` #### Parameters ###### `certificate` [System\.Security\.Cryptography\.X509Certificates\.X509Certificate2](https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.x509certificates.x509certificate2 'System\.Security\.Cryptography\.X509Certificates\.X509Certificate2') {#Abblix.Jwt.JsonWebKeyExtensions.ToJsonWebKey(thisSystem.Security.Cryptography.X509Certificates.X509Certificate2,bool).certificate} The X509Certificate2 to convert\. ###### `includePrivateKeys` [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') {#Abblix.Jwt.JsonWebKeyExtensions.ToJsonWebKey(thisSystem.Security.Cryptography.X509Certificates.X509Certificate2,bool).includePrivateKeys} Indicates whether to include private keys in the conversion\. #### Returns [JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey') A JsonWebKey representing the certificate\. ## JsonWebKeyExtensions\.ToRsa\(this RsaJsonWebKey\) Method {#Abblix.Jwt.JsonWebKeyExtensions.ToRsa(thisAbblix.Jwt.RsaJsonWebKey)} Converts an RsaJsonWebKey to an RSA object, which represents an RSA public and private key pair or just a public key\. ```csharp public static System.Security.Cryptography.RSA ToRsa(this Abblix.Jwt.RsaJsonWebKey key); ``` #### Parameters ###### `key` [RsaJsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.RsaJsonWebKey 'Abblix\.Jwt\.RsaJsonWebKey') {#Abblix.Jwt.JsonWebKeyExtensions.ToRsa(thisAbblix.Jwt.RsaJsonWebKey).key} The RsaJsonWebKey to be converted\. #### Returns [System\.Security\.Cryptography\.RSA](https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.rsa 'System\.Security\.Cryptography\.RSA') An RSA object based on the provided RsaJsonWebKey\. ## JsonWebKeyExtensions\.ToRsaParameters\(this RsaJsonWebKey\) Method {#Abblix.Jwt.JsonWebKeyExtensions.ToRsaParameters(thisAbblix.Jwt.RsaJsonWebKey)} Converts an RsaJsonWebKey to RSAParameters, which represent the key parameters used in RSA cryptographic operations\. ```csharp public static System.Security.Cryptography.RSAParameters ToRsaParameters(this Abblix.Jwt.RsaJsonWebKey key); ``` #### Parameters ###### `key` [RsaJsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.RsaJsonWebKey 'Abblix\.Jwt\.RsaJsonWebKey') {#Abblix.Jwt.JsonWebKeyExtensions.ToRsaParameters(thisAbblix.Jwt.RsaJsonWebKey).key} The RsaJsonWebKey to be converted\. #### Returns [System\.Security\.Cryptography\.RSAParameters](https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.rsaparameters 'System\.Security\.Cryptography\.RSAParameters') An RSAParameters object based on the provided RsaJsonWebKey\. --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKeyFactory.md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt 'Abblix\.Jwt') ## JsonWebKeyFactory Class A factory for creating JsonWebKey objects for various cryptographic key types\. Supports RSA, Elliptic Curve, and symmetric \(HMAC\) keys for JWT operations\. ```csharp public static class JsonWebKeyFactory ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → JsonWebKeyFactory ### Methods ## JsonWebKeyFactory\.CreateEllipticCurve\(string, string\) Method {#Abblix.Jwt.JsonWebKeyFactory.CreateEllipticCurve(string,string)} Creates an Elliptic Curve JsonWebKey with a specified curve\. ```csharp public static Abblix.Jwt.EllipticCurveJsonWebKey CreateEllipticCurve(string curve, string algorithm); ``` #### Parameters ###### `curve` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Jwt.JsonWebKeyFactory.CreateEllipticCurve(string,string).curve} The elliptic curve to use\. Common values: P\-256, P\-384, P\-521\. ###### `algorithm` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Jwt.JsonWebKeyFactory.CreateEllipticCurve(string,string).algorithm} The signing algorithm\. Common values: ES256, ES384, ES512\. #### Returns [EllipticCurveJsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.EllipticCurveJsonWebKey 'Abblix\.Jwt\.EllipticCurveJsonWebKey') A [EllipticCurveJsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.EllipticCurveJsonWebKey 'Abblix\.Jwt\.EllipticCurveJsonWebKey') suitable for ECDSA signing operations\. ## JsonWebKeyFactory\.CreateHmac\(string, Nullable\\) Method {#Abblix.Jwt.JsonWebKeyFactory.CreateHmac(string,System.Nullable_int_)} Creates a symmetric \(Octet\) JsonWebKey for HMAC signing\. ```csharp public static Abblix.Jwt.OctetJsonWebKey CreateHmac(string algorithm, System.Nullable keySize=null); ``` #### Parameters ###### `algorithm` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Jwt.JsonWebKeyFactory.CreateHmac(string,System.Nullable_int_).algorithm} The HMAC algorithm\. Common values: HS256, HS384, HS512\. ###### `keySize` [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.Int32](https://learn.microsoft.com/en-us/dotnet/api/system.int32 'System\.Int32')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') {#Abblix.Jwt.JsonWebKeyFactory.CreateHmac(string,System.Nullable_int_).keySize} The key size in bytes\. Defaults based on algorithm: HS256=32, HS384=48, HS512=64\. #### Returns [OctetJsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.OctetJsonWebKey 'Abblix\.Jwt\.OctetJsonWebKey') A [OctetJsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.OctetJsonWebKey 'Abblix\.Jwt\.OctetJsonWebKey') suitable for HMAC signing operations\. ## JsonWebKeyFactory\.CreateRsa\(string, string, int\) Method {#Abblix.Jwt.JsonWebKeyFactory.CreateRsa(string,string,int)} Creates an RSA JsonWebKey with a specified algorithm\. ```csharp public static Abblix.Jwt.RsaJsonWebKey CreateRsa(string usage, string? algorithm=null, int keySize=2048); ``` #### Parameters ###### `usage` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Jwt.JsonWebKeyFactory.CreateRsa(string,string,int).usage} The intended usage of the key, typically 'sig' for signing or 'enc' for encryption\. ###### `algorithm` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Jwt.JsonWebKeyFactory.CreateRsa(string,string,int).algorithm} The signing or encryption algorithm the key declares\. It does not affect the key size\. ###### `keySize` [System\.Int32](https://learn.microsoft.com/en-us/dotnet/api/system.int32 'System\.Int32') {#Abblix.Jwt.JsonWebKeyFactory.CreateRsa(string,string,int).keySize} The size of the RSA key in bits, 2048 by default, which is also the smallest this library will mint\. #### Returns [RsaJsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.RsaJsonWebKey 'Abblix\.Jwt\.RsaJsonWebKey') A [RsaJsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.RsaJsonWebKey 'Abblix\.Jwt\.RsaJsonWebKey') configured for the specified algorithm\. #### Exceptions [System\.ArgumentException](https://learn.microsoft.com/en-us/dotnet/api/system.argumentexception 'System\.ArgumentException') The usage is neither signing nor encryption, or [keySize](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKeyFactory#Abblix.Jwt.JsonWebKeyFactory.CreateRsa(string,string,int).keySize 'Abblix\.Jwt\.JsonWebKeyFactory\.CreateRsa\(string, string, int\)\.keySize') is below [MinimumRsaKeyBits](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKeyExtensions#Abblix.Jwt.JsonWebKeyExtensions.MinimumRsaKeyBits 'Abblix\.Jwt\.JsonWebKeyExtensions\.MinimumRsaKeyBits') \- a size this library would refuse to sign or encrypt with, so it does not produce one either\. --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKeyPropertyNames.md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt 'Abblix\.Jwt') ## JsonWebKeyPropertyNames Class JSON property names used in the JSON serialization of a JWK as defined in RFC 7517 Section 4 and RFC 7518 Section 6\. These are the wire\-level names; consumers normally interact with the strongly\-typed properties on [JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey') and its subclasses\. ```csharp public static class JsonWebKeyPropertyNames ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → JsonWebKeyPropertyNames ### Fields ## JsonWebKeyPropertyNames\.Algorithm Field {#Abblix.Jwt.JsonWebKeyPropertyNames.Algorithm} "alg" \- Algorithm\. Identifies the JWA algorithm intended for use with the key\. Optional per RFC 7517 Section 4\.4; when present it constrains how the key may be used\. ```csharp public const string Algorithm = "alg"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JsonWebKeyPropertyNames\.Certificates Field {#Abblix.Jwt.JsonWebKeyPropertyNames.Certificates} "x5c" \- X\.509 Certificate Chain\. Contains a chain of one or more base64\-encoded PKIX certificates \(RFC 5280\) associating the key with an X\.509 identity\. ```csharp public const string Certificates = "x5c"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JsonWebKeyPropertyNames\.Curve Field {#Abblix.Jwt.JsonWebKeyPropertyNames.Curve} ECC Curve parameter \(crv\)\. ```csharp public const string Curve = "crv"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JsonWebKeyPropertyNames\.EllipticCurveX Field {#Abblix.Jwt.JsonWebKeyPropertyNames.EllipticCurveX} ECC X Coordinate parameter \(x\)\. ```csharp public const string EllipticCurveX = "x"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JsonWebKeyPropertyNames\.EllipticCurveY Field {#Abblix.Jwt.JsonWebKeyPropertyNames.EllipticCurveY} ECC Y Coordinate parameter \(y\)\. ```csharp public const string EllipticCurveY = "y"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JsonWebKeyPropertyNames\.Exponent Field {#Abblix.Jwt.JsonWebKeyPropertyNames.Exponent} RSA Public Exponent parameter \(e\)\. ```csharp public const string Exponent = "e"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JsonWebKeyPropertyNames\.FirstCrtCoefficient Field {#Abblix.Jwt.JsonWebKeyPropertyNames.FirstCrtCoefficient} RSA First CRT Coefficient parameter \(qi\)\. ```csharp public const string FirstCrtCoefficient = "qi"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JsonWebKeyPropertyNames\.FirstFactorCrtExponent Field {#Abblix.Jwt.JsonWebKeyPropertyNames.FirstFactorCrtExponent} RSA First Factor CRT Exponent parameter \(dp\)\. ```csharp public const string FirstFactorCrtExponent = "dp"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JsonWebKeyPropertyNames\.FirstPrimeFactor Field {#Abblix.Jwt.JsonWebKeyPropertyNames.FirstPrimeFactor} RSA First Prime Factor parameter \(p\)\. ```csharp public const string FirstPrimeFactor = "p"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JsonWebKeyPropertyNames\.KeyId Field {#Abblix.Jwt.JsonWebKeyPropertyNames.KeyId} "kid" \- Key ID\. Lets producers and consumers pick a specific key from a JWK Set when several keys share the same algorithm\. ```csharp public const string KeyId = "kid"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JsonWebKeyPropertyNames\.KeyType Field {#Abblix.Jwt.JsonWebKeyPropertyNames.KeyType} "kty" \- Key Type\. Identifies the cryptographic family \(e\.g\., "RSA", "EC", "oct"\)\. REQUIRED on every JWK \(RFC 7517 Section 4\.1\)\. ```csharp public const string KeyType = "kty"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JsonWebKeyPropertyNames\.KeyValue Field {#Abblix.Jwt.JsonWebKeyPropertyNames.KeyValue} Symmetric Key Value parameter \(k\) \- Used for oct \(Octet Sequence\) keys\. ```csharp public const string KeyValue = "k"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JsonWebKeyPropertyNames\.Modulus Field {#Abblix.Jwt.JsonWebKeyPropertyNames.Modulus} RSA Modulus parameter \(n\)\. ```csharp public const string Modulus = "n"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JsonWebKeyPropertyNames\.PrivateExponent Field {#Abblix.Jwt.JsonWebKeyPropertyNames.PrivateExponent} RSA or ECC Private Exponent parameter \(d\)\. For RSA: Private Exponent\. For ECC: ECC Private Key\. ```csharp public const string PrivateExponent = "d"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JsonWebKeyPropertyNames\.SecondFactorCrtExponent Field {#Abblix.Jwt.JsonWebKeyPropertyNames.SecondFactorCrtExponent} RSA Second Factor CRT Exponent parameter \(dq\)\. ```csharp public const string SecondFactorCrtExponent = "dq"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JsonWebKeyPropertyNames\.SecondPrimeFactor Field {#Abblix.Jwt.JsonWebKeyPropertyNames.SecondPrimeFactor} RSA Second Prime Factor parameter \(q\)\. ```csharp public const string SecondPrimeFactor = "q"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JsonWebKeyPropertyNames\.Thumbprint Field {#Abblix.Jwt.JsonWebKeyPropertyNames.Thumbprint} "x5t" \- X\.509 Certificate SHA\-1 Thumbprint\. A base64url\-encoded SHA\-1 digest of the DER encoding of an X\.509 certificate \(RFC 7517 Section 4\.8\)\. ```csharp public const string Thumbprint = "x5t"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JsonWebKeyPropertyNames\.Usage Field {#Abblix.Jwt.JsonWebKeyPropertyNames.Usage} "use" \- Public Key Use\. Declares whether the key is meant for signing \("sig"\) or encryption \("enc"\)\. See [PublicKeyUsages](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.PublicKeyUsages 'Abblix\.Jwt\.PublicKeyUsages')\. ```csharp public const string Usage = "use"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKeySet.md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt 'Abblix\.Jwt') ## JsonWebKeySet Class A JSON Web Key Set \(JWK Set\) per RFC 7517 Section 5: a JSON document containing an array of JSON Web Keys\. Authorization servers publish their JWK Set at the `jwks_uri` endpoint so that relying parties can discover the keys used to validate or encrypt tokens\. ```csharp public record JsonWebKeySet : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → JsonWebKeySet Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[JsonWebKeySet](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKeySet 'Abblix\.Jwt\.JsonWebKeySet')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Constructors ## JsonWebKeySet\(JsonWebKey\[\]\) Constructor {#Abblix.Jwt.JsonWebKeySet.JsonWebKeySet(Abblix.Jwt.JsonWebKey[])} A JSON Web Key Set \(JWK Set\) per RFC 7517 Section 5: a JSON document containing an array of JSON Web Keys\. Authorization servers publish their JWK Set at the `jwks_uri` endpoint so that relying parties can discover the keys used to validate or encrypt tokens\. ```csharp public JsonWebKeySet(Abblix.Jwt.JsonWebKey[] Keys); ``` #### Parameters ###### `Keys` [JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Jwt.JsonWebKeySet.JsonWebKeySet(Abblix.Jwt.JsonWebKey[]).Keys} ### Properties ## JsonWebKeySet\.Keys Property {#Abblix.Jwt.JsonWebKeySet.Keys} The keys belonging to this JWK Set\. Serialized to the JSON "keys" member\. Each entry is a polymorphic [JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey') resolved by its "kty" parameter\. ```csharp public Abblix.Jwt.JsonWebKey[] Keys { get; init; } ``` #### Property Value [JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKeyTypes.md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt 'Abblix\.Jwt') ## JsonWebKeyTypes Class Values for the JWK "kty" parameter \(RFC 7517 Section 4\.1, RFC 7518 Section 6\.1\) identifying the cryptographic family a key belongs to\. Used as the discriminator when deserializing a [JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey') into the correct concrete subtype\. ```csharp public static class JsonWebKeyTypes ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → JsonWebKeyTypes ### Fields ## JsonWebKeyTypes\.EllipticCurve Field {#Abblix.Jwt.JsonWebKeyTypes.EllipticCurve} Elliptic Curve key \(RFC 7518 Section 6\.2\)\. Maps to [EllipticCurveJsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.EllipticCurveJsonWebKey 'Abblix\.Jwt\.EllipticCurveJsonWebKey'); usable with the ES256/ES384/ES512 signing algorithms\. ```csharp public const string EllipticCurve = "EC"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JsonWebKeyTypes\.Octet Field {#Abblix.Jwt.JsonWebKeyTypes.Octet} Symmetric \(Octet Sequence\) key \(RFC 7518 Section 6\.4\)\. Maps to [OctetJsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.OctetJsonWebKey 'Abblix\.Jwt\.OctetJsonWebKey'); usable with HS\* signing, AES\-GCM key wrap, and direct key agreement\. ```csharp public const string Octet = "oct"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JsonWebKeyTypes\.Rsa Field {#Abblix.Jwt.JsonWebKeyTypes.Rsa} RSA key \(RFC 7518 Section 6\.3\)\. Maps to [RsaJsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.RsaJsonWebKey 'Abblix\.Jwt\.RsaJsonWebKey'); usable with the RS\*/PS\* signing algorithms and RSA\-OAEP/RSA1\_5 key encryption\. ```csharp public const string Rsa = "RSA"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebToken.md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt 'Abblix\.Jwt') ## JsonWebToken Class Represents a JSON Web Token \(JWT\), a compact, URL\-safe means of representing claims to be transferred between two parties\. This record encapsulates the standard JWT structure, offering properties to access and manipulate the header, payload, and claims\. ```csharp public record JsonWebToken : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → JsonWebToken Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[JsonWebToken](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebToken 'Abblix\.Jwt\.JsonWebToken')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Properties ## JsonWebToken\.Header Property {#Abblix.Jwt.JsonWebToken.Header} Represents the JWT header, containing metadata about the type of token and the algorithms used to secure it\. ```csharp public Abblix.Jwt.JsonWebTokenHeader Header { get; init; } ``` #### Property Value [JsonWebTokenHeader](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenHeader 'Abblix\.Jwt\.JsonWebTokenHeader') ### Remarks The header typically includes information such as the type of token \(JWT\) and the signing algorithm \(e\.g\., HS256, RS256\)\. This property allows direct access and manipulation of these values\. ## JsonWebToken\.Payload Property {#Abblix.Jwt.JsonWebToken.Payload} Represents the JWT payload, containing the claims about the entity \(typically, the user\) and additional metadata\. ```csharp public Abblix.Jwt.JsonWebTokenPayload Payload { get; init; } ``` #### Property Value [JsonWebTokenPayload](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenPayload 'Abblix\.Jwt\.JsonWebTokenPayload') ### Remarks The payload is where the claims of the JWT are stored\. This includes standard claims such as issuer, subject, and expiration time, as well as custom claims as required by the application\. ### Methods ## JsonWebToken\.Deconstruct\(JsonWebTokenHeader, JsonWebTokenPayload\) Method {#Abblix.Jwt.JsonWebToken.Deconstruct(Abblix.Jwt.JsonWebTokenHeader,Abblix.Jwt.JsonWebTokenPayload)} Splits the token into its header and payload components, enabling pattern\-style destructuring at the call site\. ```csharp public void Deconstruct(out Abblix.Jwt.JsonWebTokenHeader header, out Abblix.Jwt.JsonWebTokenPayload payload); ``` #### Parameters ###### `header` [JsonWebTokenHeader](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenHeader 'Abblix\.Jwt\.JsonWebTokenHeader') {#Abblix.Jwt.JsonWebToken.Deconstruct(Abblix.Jwt.JsonWebTokenHeader,Abblix.Jwt.JsonWebTokenPayload).header} Receives the JWS/JWT header section\. ###### `payload` [JsonWebTokenPayload](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenPayload 'Abblix\.Jwt\.JsonWebTokenPayload') {#Abblix.Jwt.JsonWebToken.Deconstruct(Abblix.Jwt.JsonWebTokenHeader,Abblix.Jwt.JsonWebTokenPayload).payload} Receives the claim\-bearing payload section\. --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenConfirmation.md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt 'Abblix\.Jwt') ## JsonWebTokenConfirmation Class Typed wrapper over the `cnf` confirmation\-method JSON object \(RFC 7800 §3\.1\)\. Exposes the proof\-of\-possession binding members an issued JWT can carry: the mutual\-TLS client certificate thumbprint \(`x5t#S256`, RFC 8705 §3\.1\) and the DPoP proof\-key JWK thumbprint \(`jkt`, RFC 9449 §6\.1\)\. Symmetric with [JsonWebTokenPayload](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenPayload 'Abblix\.Jwt\.JsonWebTokenPayload'): each member is a typed accessor over the underlying [System\.Text\.Json\.Nodes\.JsonObject](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonobject 'System\.Text\.Json\.Nodes\.JsonObject'); constants live in [ConfirmationMethods](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.IanaClaimTypes.ConfirmationMethods 'Abblix\.Jwt\.IanaClaimTypes\.ConfirmationMethods') so adding a new member is a single\-file edit\. ```csharp public class JsonWebTokenConfirmation ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → JsonWebTokenConfirmation ### Constructors ## JsonWebTokenConfirmation\(\) Constructor {#Abblix.Jwt.JsonWebTokenConfirmation.JsonWebTokenConfirmation()} Initialises a fresh, detached confirmation object backed by an empty [System\.Text\.Json\.Nodes\.JsonObject](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonobject 'System\.Text\.Json\.Nodes\.JsonObject')\. Use this overload when constructing a new `cnf` for assignment to [Confirmation](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenPayload#Abblix.Jwt.JsonWebTokenPayload.Confirmation 'Abblix\.Jwt\.JsonWebTokenPayload\.Confirmation'); for read or read\-modify\-write paths obtain the wrapper from the payload instead\. ```csharp public JsonWebTokenConfirmation(); ``` ## JsonWebTokenConfirmation\(JsonObject\) Constructor {#Abblix.Jwt.JsonWebTokenConfirmation.JsonWebTokenConfirmation(System.Text.Json.Nodes.JsonObject)} Typed wrapper over the `cnf` confirmation\-method JSON object \(RFC 7800 §3\.1\)\. Exposes the proof\-of\-possession binding members an issued JWT can carry: the mutual\-TLS client certificate thumbprint \(`x5t#S256`, RFC 8705 §3\.1\) and the DPoP proof\-key JWK thumbprint \(`jkt`, RFC 9449 §6\.1\)\. Symmetric with [JsonWebTokenPayload](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenPayload 'Abblix\.Jwt\.JsonWebTokenPayload'): each member is a typed accessor over the underlying [System\.Text\.Json\.Nodes\.JsonObject](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonobject 'System\.Text\.Json\.Nodes\.JsonObject'); constants live in [ConfirmationMethods](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.IanaClaimTypes.ConfirmationMethods 'Abblix\.Jwt\.IanaClaimTypes\.ConfirmationMethods') so adding a new member is a single\-file edit\. ```csharp public JsonWebTokenConfirmation(System.Text.Json.Nodes.JsonObject json); ``` #### Parameters ###### `json` [System\.Text\.Json\.Nodes\.JsonObject](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonobject 'System\.Text\.Json\.Nodes\.JsonObject') {#Abblix.Jwt.JsonWebTokenConfirmation.JsonWebTokenConfirmation(System.Text.Json.Nodes.JsonObject).json} ### Properties ## JsonWebTokenConfirmation\.CertificateSha256Thumbprint Property {#Abblix.Jwt.JsonWebTokenConfirmation.CertificateSha256Thumbprint} Base64url\-encoded SHA\-256 thumbprint of the client X\.509 certificate that authenticated the request \(RFC 8705 §3\.1\)\. Locks an access token to the certificate the client presented at the token endpoint via mutual TLS\. ```csharp public string? CertificateSha256Thumbprint { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JsonWebTokenConfirmation\.Json Property {#Abblix.Jwt.JsonWebTokenConfirmation.Json} The underlying mutable JSON object backing the strongly\-typed accessors\. Exposed so the payload setter can attach this object as the `cnf` claim and so callers can read or write `cnf` members the wrapper does not yet expose as named properties\. ```csharp public System.Text.Json.Nodes.JsonObject Json { get; } ``` #### Property Value [System\.Text\.Json\.Nodes\.JsonObject](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonobject 'System\.Text\.Json\.Nodes\.JsonObject') ## JsonWebTokenConfirmation\.JwkThumbprint Property {#Abblix.Jwt.JsonWebTokenConfirmation.JwkThumbprint} Base64url\-encoded RFC 7638 JWK Thumbprint of the DPoP proof key \(RFC 9449 §6\.1\)\. Locks an access token to the specific proof\-of\-possession key the client demonstrated control of when the token was issued\. ```csharp public string? JwkThumbprint { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenExtensions.md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt 'Abblix\.Jwt') ## JsonWebTokenExtensions Class Provides extension methods for handling JSON data within JWTs\. ```csharp public static class JsonWebTokenExtensions ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → JsonWebTokenExtensions ### Methods ## JsonWebTokenExtensions\.GetArrayOfStrings\(this JsonObject, string\) Method {#Abblix.Jwt.JsonWebTokenExtensions.GetArrayOfStrings(thisSystem.Text.Json.Nodes.JsonObject,string)} Retrieves an array of strings from a [System\.Text\.Json\.Nodes\.JsonObject](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonobject 'System\.Text\.Json\.Nodes\.JsonObject') based on a specified property name\. This method supports both single string values and arrays of strings\. ```csharp public static System.Collections.Generic.IEnumerable GetArrayOfStrings(this System.Text.Json.Nodes.JsonObject json, string name); ``` #### Parameters ###### `json` [System\.Text\.Json\.Nodes\.JsonObject](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonobject 'System\.Text\.Json\.Nodes\.JsonObject') {#Abblix.Jwt.JsonWebTokenExtensions.GetArrayOfStrings(thisSystem.Text.Json.Nodes.JsonObject,string).json} The [System\.Text\.Json\.Nodes\.JsonObject](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonobject 'System\.Text\.Json\.Nodes\.JsonObject') from which to retrieve the array of strings\. ###### `name` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Jwt.JsonWebTokenExtensions.GetArrayOfStrings(thisSystem.Text.Json.Nodes.JsonObject,string).name} The property name to retrieve the values from\. #### Returns [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') An enumerable of strings if the property exists; otherwise, an empty enumerable\. ### Remarks This method is useful for JWT claims or other JSON structures where a property may contain either a single string value or an array of strings\. ## JsonWebTokenExtensions\.GetArrayOfStringsOrNull\(this JsonObject, string\) Method {#Abblix.Jwt.JsonWebTokenExtensions.GetArrayOfStringsOrNull(thisSystem.Text.Json.Nodes.JsonObject,string)} Retrieves an array of strings from a [System\.Text\.Json\.Nodes\.JsonObject](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonobject 'System\.Text\.Json\.Nodes\.JsonObject') based on a specified property name, or returns `null` if the property does not exist\. ```csharp public static System.Collections.Generic.IEnumerable? GetArrayOfStringsOrNull(this System.Text.Json.Nodes.JsonObject json, string name); ``` #### Parameters ###### `json` [System\.Text\.Json\.Nodes\.JsonObject](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonobject 'System\.Text\.Json\.Nodes\.JsonObject') {#Abblix.Jwt.JsonWebTokenExtensions.GetArrayOfStringsOrNull(thisSystem.Text.Json.Nodes.JsonObject,string).json} The [System\.Text\.Json\.Nodes\.JsonObject](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonobject 'System\.Text\.Json\.Nodes\.JsonObject') from which to retrieve the array of strings\. ###### `name` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Jwt.JsonWebTokenExtensions.GetArrayOfStringsOrNull(thisSystem.Text.Json.Nodes.JsonObject,string).name} The property name to retrieve the values from\. #### Returns [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') An enumerable of strings if the property exists; otherwise, `null`\. ### Remarks This method is useful when distinguishing between a missing property \(`null`\) and a property that is present but empty\. It supports both single string values and arrays of strings\. ## JsonWebTokenExtensions\.GetSpaceSeparatedStrings\(this JsonObject, string\) Method {#Abblix.Jwt.JsonWebTokenExtensions.GetSpaceSeparatedStrings(thisSystem.Text.Json.Nodes.JsonObject,string)} Retrieves a collection of strings from a space\-separated string stored in a specified property of a [System\.Text\.Json\.Nodes\.JsonObject](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonobject 'System\.Text\.Json\.Nodes\.JsonObject')\. ```csharp public static System.Collections.Generic.IEnumerable GetSpaceSeparatedStrings(this System.Text.Json.Nodes.JsonObject json, string name); ``` #### Parameters ###### `json` [System\.Text\.Json\.Nodes\.JsonObject](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonobject 'System\.Text\.Json\.Nodes\.JsonObject') {#Abblix.Jwt.JsonWebTokenExtensions.GetSpaceSeparatedStrings(thisSystem.Text.Json.Nodes.JsonObject,string).json} The [System\.Text\.Json\.Nodes\.JsonObject](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonobject 'System\.Text\.Json\.Nodes\.JsonObject') from which to retrieve the space\-separated strings\. ###### `name` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Jwt.JsonWebTokenExtensions.GetSpaceSeparatedStrings(thisSystem.Text.Json.Nodes.JsonObject,string).name} The name of the property containing the space\-separated string\. #### Returns [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') An enumerable of strings if the property exists and contains values; otherwise, an empty enumerable\. ### Remarks This method simplifies extracting multiple values from a single string property, common in JWT and OAuth scenarios\. ## JsonWebTokenExtensions\.GetUnixTimeSeconds\(this JsonObject, string\) Method {#Abblix.Jwt.JsonWebTokenExtensions.GetUnixTimeSeconds(thisSystem.Text.Json.Nodes.JsonObject,string)} Retrieves a [System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset') value from a [System\.Text\.Json\.Nodes\.JsonObject](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonobject 'System\.Text\.Json\.Nodes\.JsonObject') based on a property stored as Unix time seconds\. ```csharp public static System.Nullable GetUnixTimeSeconds(this System.Text.Json.Nodes.JsonObject json, string name); ``` #### Parameters ###### `json` [System\.Text\.Json\.Nodes\.JsonObject](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonobject 'System\.Text\.Json\.Nodes\.JsonObject') {#Abblix.Jwt.JsonWebTokenExtensions.GetUnixTimeSeconds(thisSystem.Text.Json.Nodes.JsonObject,string).json} The [System\.Text\.Json\.Nodes\.JsonObject](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonobject 'System\.Text\.Json\.Nodes\.JsonObject') from which to retrieve the date/time value\. ###### `name` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Jwt.JsonWebTokenExtensions.GetUnixTimeSeconds(thisSystem.Text.Json.Nodes.JsonObject,string).name} The property name containing the Unix time seconds\. #### Returns [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') A nullable [System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset') representing the date and time of the specified property, or `null` if the property is not present\. #### Exceptions [System\.InvalidOperationException](https://learn.microsoft.com/en-us/dotnet/api/system.invalidoperationexception 'System\.InvalidOperationException') The value is not a number\. [System\.Text\.Json\.JsonException](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.jsonexception 'System\.Text\.Json\.JsonException') The value is a JSON kind no number can be read from\. [System\.ArgumentOutOfRangeException](https://learn.microsoft.com/en-us/dotnet/api/system.argumentoutofrangeexception 'System\.ArgumentOutOfRangeException') The number is outside the range a date can hold\. ### Remarks Unix time seconds are widely used for representing date and time in JSON objects, especially in JWTs\. This method simplifies retrieving such values by converting them directly to [System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset')\. A value that is present and cannot be read THROWS rather than answering null: a caller judging a token somebody else wrote reads through [TryReadTimestamp\(string, Nullable<DateTimeOffset>, string\)](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenPayload#Abblix.Jwt.JsonWebTokenPayload.TryReadTimestamp(string,System.Nullable_System.DateTimeOffset_,string) 'Abblix\.Jwt\.JsonWebTokenPayload\.TryReadTimestamp\(string, System\.Nullable\, string\)') instead, which names the claim in a refusal\. ## JsonWebTokenExtensions\.SetArrayOrNull\(this JsonObject, string, IEnumerable\\) Method {#Abblix.Jwt.JsonWebTokenExtensions.SetArrayOrNull(thisSystem.Text.Json.Nodes.JsonObject,string,System.Collections.Generic.IEnumerable_string_)} Assigns a collection of strings to a property as a JSON array whatever its length, or removes the property when the collection is `null` or empty\. ```csharp public static void SetArrayOrNull(this System.Text.Json.Nodes.JsonObject json, string name, System.Collections.Generic.IEnumerable? values); ``` #### Parameters ###### `json` [System\.Text\.Json\.Nodes\.JsonObject](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonobject 'System\.Text\.Json\.Nodes\.JsonObject') {#Abblix.Jwt.JsonWebTokenExtensions.SetArrayOrNull(thisSystem.Text.Json.Nodes.JsonObject,string,System.Collections.Generic.IEnumerable_string_).json} The object to write to\. ###### `name` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Jwt.JsonWebTokenExtensions.SetArrayOrNull(thisSystem.Text.Json.Nodes.JsonObject,string,System.Collections.Generic.IEnumerable_string_).name} The name of the property\. ###### `values` [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') {#Abblix.Jwt.JsonWebTokenExtensions.SetArrayOrNull(thisSystem.Text.Json.Nodes.JsonObject,string,System.Collections.Generic.IEnumerable_string_).values} The values to assign, or `null` to remove the property\. ### Remarks The single\-element case is the whole difference from [SetArrayOrStringOrNull\(this JsonObject, string, IEnumerable<string>\)](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenExtensions#Abblix.Jwt.JsonWebTokenExtensions.SetArrayOrStringOrNull(thisSystem.Text.Json.Nodes.JsonObject,string,System.Collections.Generic.IEnumerable_string_) 'Abblix\.Jwt\.JsonWebTokenExtensions\.SetArrayOrStringOrNull\(this System\.Text\.Json\.Nodes\.JsonObject, string, System\.Collections\.Generic\.IEnumerable\\)'), and it is why both exist\. A JWT claim a specification defines as "a string or an array of strings" \- aud, per RFC 7519 Section 4\.1\.3 \- may collapse; a member defined as "an array of strings" may not, and writing a bare string there produces a document that parses and does not conform\. Neither reader complains, so the divergence is only ever noticed by the party that rejects the token\. ## JsonWebTokenExtensions\.SetArrayOrString\(this JsonObject, string, IEnumerable\\) Method {#Abblix.Jwt.JsonWebTokenExtensions.SetArrayOrString(thisSystem.Text.Json.Nodes.JsonObject,string,System.Collections.Generic.IEnumerable_string_)} Sets a property in a [System\.Text\.Json\.Nodes\.JsonObject](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonobject 'System\.Text\.Json\.Nodes\.JsonObject') with a value that can be either a single string or an array of strings, depending on the number of items in the provided enumerable\. ```csharp public static void SetArrayOrString(this System.Text.Json.Nodes.JsonObject json, string name, System.Collections.Generic.IEnumerable values); ``` #### Parameters ###### `json` [System\.Text\.Json\.Nodes\.JsonObject](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonobject 'System\.Text\.Json\.Nodes\.JsonObject') {#Abblix.Jwt.JsonWebTokenExtensions.SetArrayOrString(thisSystem.Text.Json.Nodes.JsonObject,string,System.Collections.Generic.IEnumerable_string_).json} The [System\.Text\.Json\.Nodes\.JsonObject](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonobject 'System\.Text\.Json\.Nodes\.JsonObject') to modify\. ###### `name` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Jwt.JsonWebTokenExtensions.SetArrayOrString(thisSystem.Text.Json.Nodes.JsonObject,string,System.Collections.Generic.IEnumerable_string_).name} The name of the property to set\. ###### `values` [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') {#Abblix.Jwt.JsonWebTokenExtensions.SetArrayOrString(thisSystem.Text.Json.Nodes.JsonObject,string,System.Collections.Generic.IEnumerable_string_).values} The enumerable of string values to set as the property's value\. ### Remarks This method is versatile for JWT or JSON handling where a property may accept both single and multiple values\. ## JsonWebTokenExtensions\.SetArrayOrStringOrNull\(this JsonObject, string, IEnumerable\\) Method {#Abblix.Jwt.JsonWebTokenExtensions.SetArrayOrStringOrNull(thisSystem.Text.Json.Nodes.JsonObject,string,System.Collections.Generic.IEnumerable_string_)} Sets a property on a [System\.Text\.Json\.Nodes\.JsonObject](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonobject 'System\.Text\.Json\.Nodes\.JsonObject') to either a single string, a JSON array of strings, or `null`, depending on the contents of the provided [values](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenExtensions#Abblix.Jwt.JsonWebTokenExtensions.SetArrayOrStringOrNull(thisSystem.Text.Json.Nodes.JsonObject,string,System.Collections.Generic.IEnumerable_string_).values 'Abblix\.Jwt\.JsonWebTokenExtensions\.SetArrayOrStringOrNull\(this System\.Text\.Json\.Nodes\.JsonObject, string, System\.Collections\.Generic\.IEnumerable\\)\.values') collection\. ```csharp public static void SetArrayOrStringOrNull(this System.Text.Json.Nodes.JsonObject json, string name, System.Collections.Generic.IEnumerable? values); ``` #### Parameters ###### `json` [System\.Text\.Json\.Nodes\.JsonObject](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonobject 'System\.Text\.Json\.Nodes\.JsonObject') {#Abblix.Jwt.JsonWebTokenExtensions.SetArrayOrStringOrNull(thisSystem.Text.Json.Nodes.JsonObject,string,System.Collections.Generic.IEnumerable_string_).json} The [System\.Text\.Json\.Nodes\.JsonObject](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonobject 'System\.Text\.Json\.Nodes\.JsonObject') to update\. ###### `name` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Jwt.JsonWebTokenExtensions.SetArrayOrStringOrNull(thisSystem.Text.Json.Nodes.JsonObject,string,System.Collections.Generic.IEnumerable_string_).name} The name of the property to set\. ###### `values` [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') {#Abblix.Jwt.JsonWebTokenExtensions.SetArrayOrStringOrNull(thisSystem.Text.Json.Nodes.JsonObject,string,System.Collections.Generic.IEnumerable_string_).values} The collection of string values to assign\. If `null`, the property is set to `null`\. If the collection contains a single value, it is stored as a string; if multiple values, as a JSON array\. ### Remarks This method is useful for serializing claims or properties where the value can be a single string, an array of strings, or omitted entirely \(null\), such as in JWT payloads or OpenID Connect claims\. ## JsonWebTokenExtensions\.SetSpaceSeparatedStrings\(this JsonObject, string, IEnumerable\\) Method {#Abblix.Jwt.JsonWebTokenExtensions.SetSpaceSeparatedStrings(thisSystem.Text.Json.Nodes.JsonObject,string,System.Collections.Generic.IEnumerable_string_)} Sets a property in a [System\.Text\.Json\.Nodes\.JsonObject](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonobject 'System\.Text\.Json\.Nodes\.JsonObject') with a value represented as a space\-separated string from an enumerable of strings\. ```csharp public static void SetSpaceSeparatedStrings(this System.Text.Json.Nodes.JsonObject json, string name, System.Collections.Generic.IEnumerable value); ``` #### Parameters ###### `json` [System\.Text\.Json\.Nodes\.JsonObject](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonobject 'System\.Text\.Json\.Nodes\.JsonObject') {#Abblix.Jwt.JsonWebTokenExtensions.SetSpaceSeparatedStrings(thisSystem.Text.Json.Nodes.JsonObject,string,System.Collections.Generic.IEnumerable_string_).json} The [System\.Text\.Json\.Nodes\.JsonObject](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonobject 'System\.Text\.Json\.Nodes\.JsonObject') to modify\. ###### `name` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Jwt.JsonWebTokenExtensions.SetSpaceSeparatedStrings(thisSystem.Text.Json.Nodes.JsonObject,string,System.Collections.Generic.IEnumerable_string_).name} The name of the property to set\. ###### `value` [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') {#Abblix.Jwt.JsonWebTokenExtensions.SetSpaceSeparatedStrings(thisSystem.Text.Json.Nodes.JsonObject,string,System.Collections.Generic.IEnumerable_string_).value} The enumerable of string values to join into a space\-separated string\. ### Remarks This method is useful for setting JWT claims or other JSON properties that accept a list of values as a single space\-separated string\. ## JsonWebTokenExtensions\.SetUnixTimeSeconds\(this JsonObject, string, Nullable\\) Method {#Abblix.Jwt.JsonWebTokenExtensions.SetUnixTimeSeconds(thisSystem.Text.Json.Nodes.JsonObject,string,System.Nullable_System.DateTimeOffset_)} Sets a [System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset') value in a [System\.Text\.Json\.Nodes\.JsonObject](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonobject 'System\.Text\.Json\.Nodes\.JsonObject'), stored as Unix time seconds\. ```csharp public static void SetUnixTimeSeconds(this System.Text.Json.Nodes.JsonObject json, string name, System.Nullable value); ``` #### Parameters ###### `json` [System\.Text\.Json\.Nodes\.JsonObject](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonobject 'System\.Text\.Json\.Nodes\.JsonObject') {#Abblix.Jwt.JsonWebTokenExtensions.SetUnixTimeSeconds(thisSystem.Text.Json.Nodes.JsonObject,string,System.Nullable_System.DateTimeOffset_).json} The [System\.Text\.Json\.Nodes\.JsonObject](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonobject 'System\.Text\.Json\.Nodes\.JsonObject') to modify\. ###### `name` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Jwt.JsonWebTokenExtensions.SetUnixTimeSeconds(thisSystem.Text.Json.Nodes.JsonObject,string,System.Nullable_System.DateTimeOffset_).name} The property name under which to store the Unix time seconds\. ###### `value` [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') {#Abblix.Jwt.JsonWebTokenExtensions.SetUnixTimeSeconds(thisSystem.Text.Json.Nodes.JsonObject,string,System.Nullable_System.DateTimeOffset_).value} The [System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset') value to set\. If `null`, the property will be removed from the JSON object\. ### Remarks Storing dates as Unix time seconds is a common practice in JWTs and other JSON structures\. This method facilitates setting such values by converting [System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset') to Unix time seconds\. ## JsonWebTokenExtensions\.ToJsonElement\(this JsonNode\) Method {#Abblix.Jwt.JsonWebTokenExtensions.ToJsonElement(thisSystem.Text.Json.Nodes.JsonNode)} Converts a JsonNode to a JsonElement\. ```csharp public static System.Text.Json.JsonElement ToJsonElement(this System.Text.Json.Nodes.JsonNode? jsonNode); ``` #### Parameters ###### `jsonNode` [System\.Text\.Json\.Nodes\.JsonNode](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonnode 'System\.Text\.Json\.Nodes\.JsonNode') {#Abblix.Jwt.JsonWebTokenExtensions.ToJsonElement(thisSystem.Text.Json.Nodes.JsonNode).jsonNode} The JsonNode to convert\. #### Returns [System\.Text\.Json\.JsonElement](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.jsonelement 'System\.Text\.Json\.JsonElement') The converted JsonElement\. ## JsonWebTokenExtensions\.ToJsonNode\(this JsonElement\) Method {#Abblix.Jwt.JsonWebTokenExtensions.ToJsonNode(thisSystem.Text.Json.JsonElement)} Converts a JsonElement to a JsonNode, allowing for more dynamic manipulation of the JSON structure\. ```csharp public static System.Text.Json.Nodes.JsonNode? ToJsonNode(this System.Text.Json.JsonElement jsonElement); ``` #### Parameters ###### `jsonElement` [System\.Text\.Json\.JsonElement](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.jsonelement 'System\.Text\.Json\.JsonElement') {#Abblix.Jwt.JsonWebTokenExtensions.ToJsonNode(thisSystem.Text.Json.JsonElement).jsonElement} The JsonElement to convert\. #### Returns [System\.Text\.Json\.Nodes\.JsonNode](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonnode 'System\.Text\.Json\.Nodes\.JsonNode') The converted JsonNode\. ### Remarks This method is useful when you need to convert from a structured JsonElement to a more flexible JsonNode\. --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenHeader.md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt 'Abblix\.Jwt') ## JsonWebTokenHeader Class Represents the header part of a JSON Web Token \(JWT\), containing metadata about the token such as the type and the algorithm used for signing\. ```csharp public class JsonWebTokenHeader ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → JsonWebTokenHeader ### Remarks The JWT header typically specifies the cryptographic operations applied to the JWT and can also include additional properties defined or required by the application\. ### Constructors ## JsonWebTokenHeader\(JsonObject\) Constructor {#Abblix.Jwt.JsonWebTokenHeader.JsonWebTokenHeader(System.Text.Json.Nodes.JsonObject)} Represents the header part of a JSON Web Token \(JWT\), containing metadata about the token such as the type and the algorithm used for signing\. ```csharp public JsonWebTokenHeader(System.Text.Json.Nodes.JsonObject json); ``` #### Parameters ###### `json` [System\.Text\.Json\.Nodes\.JsonObject](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonobject 'System\.Text\.Json\.Nodes\.JsonObject') {#Abblix.Jwt.JsonWebTokenHeader.JsonWebTokenHeader(System.Text.Json.Nodes.JsonObject).json} ### Remarks The JWT header typically specifies the cryptographic operations applied to the JWT and can also include additional properties defined or required by the application\. ### Properties ## JsonWebTokenHeader\.AgreementPartyUInfo Property {#Abblix.Jwt.JsonWebTokenHeader.AgreementPartyUInfo} The 'apu' header parameter \(RFC 7518 §4\.6\.1\.2\): base64url\-encoded Agreement PartyUInfo \(producer information\) fed into the Concat KDF during ECDH\-ES key agreement\. ```csharp public string? AgreementPartyUInfo { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JsonWebTokenHeader\.AgreementPartyVInfo Property {#Abblix.Jwt.JsonWebTokenHeader.AgreementPartyVInfo} The 'apv' header parameter \(RFC 7518 §4\.6\.1\.3\): base64url\-encoded Agreement PartyVInfo \(recipient information\) fed into the Concat KDF during ECDH\-ES key agreement\. ```csharp public string? AgreementPartyVInfo { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JsonWebTokenHeader\.Algorithm Property {#Abblix.Jwt.JsonWebTokenHeader.Algorithm} The algorithm used to sign the JWT, indicating how the token is secured\. ```csharp public string? Algorithm { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks The 'alg' parameter identifies the cryptographic algorithm used to secure the JWT\. Common algorithms include HS256, RS256, and ES256\. It is crucial for verifying the JWT integrity\. Per RFC 7515 Section 4\.1\.1, this parameter is REQUIRED\. ## JsonWebTokenHeader\.Certificates Property {#Abblix.Jwt.JsonWebTokenHeader.Certificates} The 'x5c' \(X\.509 Certificate Chain\) header parameter \(RFC 7515 §4\.1\.6\): an X\.509 certificate chain as a JSON array of base64\-encoded DER certificates, the first being the leaf\. Returns the raw base64 strings; consumers are responsible for decoding to `X509Certificate2` and validating the chain per RFC 5280\. ```csharp public System.Collections.Generic.IReadOnlyList? Certificates { get; set; } ``` #### Property Value [System\.Collections\.Generic\.IReadOnlyList<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ireadonlylist-1 'System\.Collections\.Generic\.IReadOnlyList\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ireadonlylist-1 'System\.Collections\.Generic\.IReadOnlyList\`1') #### Exceptions [System\.Text\.Json\.JsonException](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.jsonexception 'System\.Text\.Json\.JsonException') Thrown when 'x5c' is present but is not a JSON array of strings\. ## JsonWebTokenHeader\.CertificateSha1Thumbprint Property {#Abblix.Jwt.JsonWebTokenHeader.CertificateSha1Thumbprint} The 'x5t' \(X\.509 SHA\-1 Thumbprint\) header parameter \(RFC 7515 §4\.1\.7\): base64url\-encoded SHA\-1 digest of the DER\-encoded leaf certificate\. Per RFC 7515 §10\.11, SHA\-1 is discouraged because of cryptographic weaknesses \- prefer [CertificateSha256Thumbprint](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenHeader#Abblix.Jwt.JsonWebTokenHeader.CertificateSha256Thumbprint 'Abblix\.Jwt\.JsonWebTokenHeader\.CertificateSha256Thumbprint') for new deployments\. The library exposes 'x5t' for inspection of legacy producers\. ```csharp public string? CertificateSha1Thumbprint { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JsonWebTokenHeader\.CertificateSha256Thumbprint Property {#Abblix.Jwt.JsonWebTokenHeader.CertificateSha256Thumbprint} The 'x5t\#S256' \(X\.509 SHA\-256 Thumbprint\) header parameter \(RFC 7515 §4\.1\.8\): base64url\-encoded SHA\-256 digest of the DER\-encoded leaf certificate\. The C\# member name strips the '\#' character \(illegal in identifiers\); the JSON literal stays 'x5t\#S256' as defined by the spec\. ```csharp public string? CertificateSha256Thumbprint { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JsonWebTokenHeader\.CertificatesUrl Property {#Abblix.Jwt.JsonWebTokenHeader.CertificatesUrl} The 'x5u' \(X\.509 URL\) header parameter \(RFC 7515 §4\.1\.5\): a URI referring to an X\.509 public\-key certificate or certificate chain corresponding to the key used for the JWS signature\. Same caveat as [JwkSetUrl](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenHeader#Abblix.Jwt.JsonWebTokenHeader.JwkSetUrl 'Abblix\.Jwt\.JsonWebTokenHeader\.JwkSetUrl') \- the library does not fetch\. ```csharp public System.Uri? CertificatesUrl { get; set; } ``` #### Property Value [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri') ## JsonWebTokenHeader\.Critical Property {#Abblix.Jwt.JsonWebTokenHeader.Critical} The 'crit' \(Critical\) header parameter \(RFC 7515 §4\.1\.11\): names of JOSE header parameters that the recipient MUST understand and process\. Returns null when 'crit' is absent\. ```csharp public System.Collections.Generic.IReadOnlyList? Critical { get; set; } ``` #### Property Value [System\.Collections\.Generic\.IReadOnlyList<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ireadonlylist-1 'System\.Collections\.Generic\.IReadOnlyList\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ireadonlylist-1 'System\.Collections\.Generic\.IReadOnlyList\`1') #### Exceptions [System\.Text\.Json\.JsonException](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.jsonexception 'System\.Text\.Json\.JsonException') Thrown when 'crit' is present but is not a JSON array of strings\. ## JsonWebTokenHeader\.EncryptionAlgorithm Property {#Abblix.Jwt.JsonWebTokenHeader.EncryptionAlgorithm} The content encryption algorithm used for JWE \(JSON Web Encryption\)\. ```csharp public string? EncryptionAlgorithm { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks The 'enc' parameter identifies the content encryption algorithm used to encrypt the plaintext to produce the JWE ciphertext and authentication tag\. Common algorithms include A128CBC\-HS256, A192CBC\-HS384, A256CBC\-HS512, A128GCM, A192GCM, and A256GCM\. ## JsonWebTokenHeader\.EphemeralPublicKey Property {#Abblix.Jwt.JsonWebTokenHeader.EphemeralPublicKey} The 'epk' header parameter \(RFC 7518 §4\.6\.1\.1\): the originator's ephemeral public key for ECDH\-ES key agreement, carried as a JWK with public members only\. Returns null when absent\. ```csharp public Abblix.Jwt.JsonWebKey? EphemeralPublicKey { get; set; } ``` #### Property Value [JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey') #### Exceptions [System\.Text\.Json\.JsonException](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.jsonexception 'System\.Text\.Json\.JsonException') Thrown when 'epk' is present but is not a valid JWK \(e\.g\. unknown 'kty'\)\. ## JsonWebTokenHeader\.Json Property {#Abblix.Jwt.JsonWebTokenHeader.Json} The underlying mutable JSON object backing the strongly\-typed accessors on this header\. Use this when reading or writing custom header parameters that are not modeled as properties\. ```csharp public System.Text.Json.Nodes.JsonObject Json { get; } ``` #### Property Value [System\.Text\.Json\.Nodes\.JsonObject](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonobject 'System\.Text\.Json\.Nodes\.JsonObject') ## JsonWebTokenHeader\.JwkSetUrl Property {#Abblix.Jwt.JsonWebTokenHeader.JwkSetUrl} The 'jku' \(JWK Set URL\) header parameter \(RFC 7515 §4\.1\.2\): a URI referring to a JSON Web Key Set whose keys the issuer claims are candidates for verifying the JWS\. The library only exposes the URI; it does not fetch the URL \- the host is responsible for trust and transport per RFC 7515 §8 \(TLS with server identity validation per RFC 6125\)\. ```csharp public System.Uri? JwkSetUrl { get; set; } ``` #### Property Value [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri') ## JsonWebTokenHeader\.KeyId Property {#Abblix.Jwt.JsonWebTokenHeader.KeyId} The key ID that indicates which key was used to secure the JWT\. ```csharp public string? KeyId { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks The 'kid' parameter is a hint indicating which specific key from a JWKS was used to sign the JWT\. This is particularly useful when the issuer has multiple keys and the verifier needs to identify the correct key for signature verification\. ## JsonWebTokenHeader\.KeyWrapAuthenticationTag Property {#Abblix.Jwt.JsonWebTokenHeader.KeyWrapAuthenticationTag} The 'tag' header parameter \(RFC 7518 §4\.7\.1\.2\): base64url\-encoded 128\-bit GCM authentication tag produced when the CEK is wrapped with AES\-GCM key wrapping \(A128GCMKW/A192GCMKW/A256GCMKW\)\. ```csharp public string? KeyWrapAuthenticationTag { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JsonWebTokenHeader\.KeyWrapInitializationVector Property {#Abblix.Jwt.JsonWebTokenHeader.KeyWrapInitializationVector} The 'iv' header parameter \(RFC 7518 §4\.7\.1\.1\): base64url\-encoded 96\-bit Initialization Vector used when the CEK is wrapped with AES\-GCM key wrapping \(A128GCMKW/A192GCMKW/A256GCMKW\)\. ```csharp public string? KeyWrapInitializationVector { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JsonWebTokenHeader\.Pbes2IterationCount Property {#Abblix.Jwt.JsonWebTokenHeader.Pbes2IterationCount} The 'p2c' header parameter \(RFC 7518 §4\.8\.1\.2\): the PBKDF2 iteration count for PBES2\. Returns null when absent or when the value is not representable as a positive 32\-bit integer \- a count beyond int\.MaxValue could never pass the decryptor's denial\-of\-service cap anyway\. ```csharp public System.Nullable Pbes2IterationCount { get; set; } ``` #### Property Value [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.Int32](https://learn.microsoft.com/en-us/dotnet/api/system.int32 'System\.Int32')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') ## JsonWebTokenHeader\.Pbes2SaltInput Property {#Abblix.Jwt.JsonWebTokenHeader.Pbes2SaltInput} The 'p2s' header parameter \(RFC 7518 §4\.8\.1\.1\): the base64url\-encoded PBES2 salt input\. Per the spec it must decode to at least 8 octets; the PBES2 decryptor enforces that bound\. ```csharp public string? Pbes2SaltInput { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JsonWebTokenHeader\.Type Property {#Abblix.Jwt.JsonWebTokenHeader.Type} The type of the JWT, typically "JWT" or a similar identifier\. This field is optional and used to declare the media type of the JWT\. ```csharp public string? Type { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks The 'typ' parameter is recommended when the JWT is embedded in places not inherently carrying this information, helping recipients process the JWT type accordingly\. ## JsonWebTokenHeader\.VerificationKey Property {#Abblix.Jwt.JsonWebTokenHeader.VerificationKey} The 'jwk' \(JSON Web Key\) header parameter \(RFC 7515 §4\.1\.3\): the public key used to verify the JWS, embedded directly in the JOSE header as a JWK\. Returns null when 'jwk' is absent\. Trust is the consumer's responsibility \- for example, DPoP \(RFC 9449\) binds this key to the request via a separate confirmation claim\. ```csharp public Abblix.Jwt.JsonWebKey? VerificationKey { get; set; } ``` #### Property Value [JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey') #### Exceptions [System\.Text\.Json\.JsonException](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.jsonexception 'System\.Text\.Json\.JsonException') Thrown when 'jwk' is present but is not a valid JWK \(e\.g\. unknown 'kty'\)\. --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenPayload.md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt 'Abblix\.Jwt') ## JsonWebTokenPayload Class Represents the payload part of a JSON Web Token \(JWT\), containing the claims or statements about the subject\. ```csharp public class JsonWebTokenPayload ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → JsonWebTokenPayload ### Remarks The JWT payload is a JSON object that contains the claims transmitted by the token\. Standard claims such as issuer, subject, expiration time, and more can be included, as well as additional claims as needed\. This class provides a convenient way to work with the payload, allowing for easy access and modification of claims\. ### Constructors ## JsonWebTokenPayload\(JsonObject\) Constructor {#Abblix.Jwt.JsonWebTokenPayload.JsonWebTokenPayload(System.Text.Json.Nodes.JsonObject)} Represents the payload part of a JSON Web Token \(JWT\), containing the claims or statements about the subject\. ```csharp public JsonWebTokenPayload(System.Text.Json.Nodes.JsonObject json); ``` #### Parameters ###### `json` [System\.Text\.Json\.Nodes\.JsonObject](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonobject 'System\.Text\.Json\.Nodes\.JsonObject') {#Abblix.Jwt.JsonWebTokenPayload.JsonWebTokenPayload(System.Text.Json.Nodes.JsonObject).json} ### Remarks The JWT payload is a JSON object that contains the claims transmitted by the token\. Standard claims such as issuer, subject, expiration time, and more can be included, as well as additional claims as needed\. This class provides a convenient way to work with the payload, allowing for easy access and modification of claims\. ### Properties ## JsonWebTokenPayload\.AccessTokenHash Property {#Abblix.Jwt.JsonWebTokenPayload.AccessTokenHash} A digest binding this ID token to the access token issued alongside it, per OpenID Connect Core section 3\.1\.3\.6\. ```csharp public string? AccessTokenHash { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks Read by a relying party to confirm that the access token it holds is the one this ID token was issued with\. Without that binding an attacker who can substitute an access token gets an identity assertion about one user paired with authority belonging to another\. ## JsonWebTokenPayload\.Audiences Property {#Abblix.Jwt.JsonWebTokenPayload.Audiences} The intended audiences for the JWT\. ```csharp public System.Collections.Generic.IEnumerable Audiences { get; set; } ``` #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ## JsonWebTokenPayload\.AuthContextClassRef Property {#Abblix.Jwt.JsonWebTokenPayload.AuthContextClassRef} Represents the Authentication Context Class Reference \(ACR\) indicating the authentication context achieved during authentication\. ```csharp public string? AuthContextClassRef { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks In federated and multi\-tenant environments, the `acr` claim helps assert that the user was authenticated under a specific assurance level \(e\.g\., `"urn:openbanking:psd2:sca"` or `"loa3"`\)\. This is particularly important for applications that integrate with external identity providers, regulatory domains \(such as finance or healthcare\), or environments where different tenants require varying levels of authentication rigor\. The ACR value enables relying parties to make access decisions based on agreed\-upon trust frameworks and security profiles\. ## JsonWebTokenPayload\.AuthenticationMethodReferences Property {#Abblix.Jwt.JsonWebTokenPayload.AuthenticationMethodReferences} A list of authentication methods used to authenticate the subject, represented as Authentication Method Reference \(AMR\) values\. ```csharp public System.Collections.Generic.IEnumerable? AuthenticationMethodReferences { get; set; } ``` #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ### Remarks In multi\-tenant and federated identity systems, this claim helps relying parties understand the authentication strength applied to a user session\. Each value in the list corresponds to a specific method used during authentication, such as `"pwd"` \(password\), `"mfa"` \(multi\-factor authentication\), `"otp"` \(one\-time password\), or `"fido"` \(FIDO\-based authentication\)\. These values support policy enforcement at the tenant level, allowing services to require particular authentication methods \(e\.g\., tenants enforcing MFA\) or to provide differentiated access based on authentication robustness\. ## JsonWebTokenPayload\.AuthenticationTime Property {#Abblix.Jwt.JsonWebTokenPayload.AuthenticationTime} Represents the time when the authentication occurred, facilitating checks against token freshness and replay attacks\. ```csharp public System.Nullable AuthenticationTime { get; set; } ``` #### Property Value [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') ### Remarks Storing the authentication time is critical for applications requiring a high level of assurance regarding the moment a user was authenticated, allowing for precise control over session validity and user authentication status\. ## JsonWebTokenPayload\.AuthorizationDetails Property {#Abblix.Jwt.JsonWebTokenPayload.AuthorizationDetails} The RFC 9396 `authorization_details` claim as a sequence of typed wrappers over the underlying [System\.Text\.Json\.Nodes\.JsonArray](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonarray 'System\.Text\.Json\.Nodes\.JsonArray') stored at [Json](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenPayload#Abblix.Jwt.JsonWebTokenPayload.Json 'Abblix\.Jwt\.JsonWebTokenPayload\.Json')\[`authorization_details`\]\. Each wrapper shares its [System\.Text\.Json\.Nodes\.JsonNode](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonnode 'System\.Text\.Json\.Nodes\.JsonNode') reference with the corresponding array element \- read\-through is byte\-exact, and property setters on a wrapper mutate the underlying claim in place\. Assigning a new sequence rebuilds the raw array via [ToRawJsonArray\(this IEnumerable<AuthorizationDetail>\)](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonArrayExtensions#Abblix.Jwt.JsonArrayExtensions.ToRawJsonArray(thisSystem.Collections.Generic.IEnumerable_Abblix.Jwt.AuthorizationDetail_) 'Abblix\.Jwt\.JsonArrayExtensions\.ToRawJsonArray\(this System\.Collections\.Generic\.IEnumerable\\)'), deep\-cloning each entry's [Json](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.AuthorizationDetail#Abblix.Jwt.AuthorizationDetail.Json 'Abblix\.Jwt\.AuthorizationDetail\.Json') to detach parent ownership; assigning `null` removes the claim\. For direct raw access bypass this accessor and use the [Json](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenPayload#Abblix.Jwt.JsonWebTokenPayload.Json 'Abblix\.Jwt\.JsonWebTokenPayload\.Json') indexer at `IanaClaimTypes.AuthorizationDetails`\. ```csharp public System.Collections.Generic.IEnumerable? AuthorizationDetails { get; set; } ``` #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[AuthorizationDetail](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.AuthorizationDetail 'Abblix\.Jwt\.AuthorizationDetail')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ## JsonWebTokenPayload\.AuthorizedParty Property {#Abblix.Jwt.JsonWebTokenPayload.AuthorizedParty} The authorized party \(azp\): the party the token was issued to\. OpenID Connect Core 1\.0 section 2 defines it in one sentence \- "OPTIONAL\. Authorized party \- the party to which the ID Token was issued\. If present, it MUST contain the OAuth 2\.0 Client ID of this party\." So the claim is optional, and the only obligation attaches to its value\. ```csharp public string? AuthorizedParty { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks This described the claim as mandated, and as keyed to the issuer, until 2026\-07\-20\. Both were wrong, and the second inverts what the claim is for: azp names the recipient, not the sender\. The conditions the old text carried \- a single audience differing from something, or more than one audience \- come from wording that errata set 2 replaced\. A recipient's duty is correspondingly weak: section 3\.1\.3\.7 step 4 says a client using extensions that produce azp "SHOULD validate the azp value as specified by those extensions", and step 5 that this "MAY include that when an azp Claim is present, the Client SHOULD verify that its client\_id is the Claim Value"\. Nothing here is a MUST, and a validator that rejects on a missing azp will refuse conformant issuers\. ## JsonWebTokenPayload\.ClientId Property {#Abblix.Jwt.JsonWebTokenPayload.ClientId} The client ID for which the JWT was issued, identifying the client application in OAuth 2\.0 and OpenID Connect flows\. ```csharp public string? ClientId { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks This property is crucial in scenarios where the JWT is used to convey or assert the identity of a client application to the authorization server or resource server\. ## JsonWebTokenPayload\.CodeHash Property {#Abblix.Jwt.JsonWebTokenPayload.CodeHash} A digest binding this ID token to the authorization code issued alongside it, per OpenID Connect Core section 3\.3\.2\.11\. ```csharp public string? CodeHash { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks Present in the hybrid flow, where the ID token arrives through the front channel before the code is redeemed\. It is what lets the relying party detect a code swapped in transit, since the swapped code would not match the digest in a token it cannot forge\. ## JsonWebTokenPayload\.Confirmation Property {#Abblix.Jwt.JsonWebTokenPayload.Confirmation} The proof\-of\-possession confirmation object \(RFC 7800 §3\.1 `cnf`\) bound to this JWT\. Carries each binding the token holds \- `cnf.x5t#S256` for mTLS\-bound tokens \(RFC 8705 §3\.1\) and `cnf.jkt` for DPoP\-bound tokens \(RFC 9449 §6\.1\) \- behind typed accessors\. Assignment writes the wrapped [System\.Text\.Json\.Nodes\.JsonObject](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonobject 'System\.Text\.Json\.Nodes\.JsonObject') as the `cnf` claim; assigning `null` removes the claim\. ```csharp public Abblix.Jwt.JsonWebTokenConfirmation? Confirmation { get; set; } ``` #### Property Value [JsonWebTokenConfirmation](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenConfirmation 'Abblix\.Jwt\.JsonWebTokenConfirmation') ## JsonWebTokenPayload\.DPoPAccessTokenHash Property {#Abblix.Jwt.JsonWebTokenPayload.DPoPAccessTokenHash} The access\-token hash bound by a DPoP proof when one accompanies an access token \(RFC 9449 §4\.2 `ath`\): `Base64Url(SHA-256(access_token))`\. ```csharp public string? DPoPAccessTokenHash { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JsonWebTokenPayload\.DPoPHttpMethod Property {#Abblix.Jwt.JsonWebTokenPayload.DPoPHttpMethod} The HTTP method bound by a DPoP proof \(RFC 9449 §4\.2 `htm`\)\. Compared byte\-exact against the current request method on the server side\. ```csharp public string? DPoPHttpMethod { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JsonWebTokenPayload\.DPoPHttpUri Property {#Abblix.Jwt.JsonWebTokenPayload.DPoPHttpUri} The HTTP URI bound by a DPoP proof \(RFC 9449 §4\.2 `htu`\)\. Returned as the raw claim string so callers keep the three\-way "missing / unparseable / mismatched" distinction; parsing into a [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri') belongs to the comparison step\. ```csharp public string? DPoPHttpUri { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JsonWebTokenPayload\.Email Property {#Abblix.Jwt.JsonWebTokenPayload.Email} The email address of the subject\. ```csharp public string? Email { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks When the subject uses external authentication \(Google, Microsoft, etc\.\) or authenticates via email verification, this property contains the exact email used during authentication, ensuring the email claim in ID tokens reflects the authentication method rather than the primary email from the user's profile\. ## JsonWebTokenPayload\.EmailVerified Property {#Abblix.Jwt.JsonWebTokenPayload.EmailVerified} Indicates whether the email address has been verified\. ```csharp public System.Nullable EmailVerified { get; set; } ``` #### Property Value [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') ### Remarks For external providers that verify emails or when email verification has been completed through challenge flows, this value is set to true\. This is used in the email\_verified claim in ID tokens\. ## JsonWebTokenPayload\.ExpiresAt Property {#Abblix.Jwt.JsonWebTokenPayload.ExpiresAt} The expiration time on or after which the JWT must not be accepted for processing, represented as a Unix timestamp\. ```csharp public System.Nullable ExpiresAt { get; set; } ``` #### Property Value [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') ## JsonWebTokenPayload\.GrantId Property {#Abblix.Jwt.JsonWebTokenPayload.GrantId} Identifies the authorization grant this refresh token belongs to, binding it to the lineage of every refresh token derived from the same grant\. A first\-issued token starts a new grant; each rotation carries the value forward, so a detected replay can revoke the whole family in one registry write \(RFC 9700 Section 4\.14\.2\)\. ```csharp public string? GrantId { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks Present only on refresh tokens \(`rt+jwt`\); absent \(null\) on all other token types, which leaves the family cascade in the token\-status validator inert for them\. ## JsonWebTokenPayload\.IdentityProvider Property {#Abblix.Jwt.JsonWebTokenPayload.IdentityProvider} Identifies the identity provider that authenticated the end user, useful in federated identity scenarios\. ```csharp public string? IdentityProvider { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks This claim is particularly relevant in systems that support multiple identity providers, helping to trace the origin of the authentication and ensuring that the JWT can be validated appropriately\. ## JsonWebTokenPayload\.IssuedAt Property {#Abblix.Jwt.JsonWebTokenPayload.IssuedAt} The time at which the JWT was issued, represented as a Unix timestamp\. ```csharp public System.Nullable IssuedAt { get; set; } ``` #### Property Value [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') ## JsonWebTokenPayload\.Issuer Property {#Abblix.Jwt.JsonWebTokenPayload.Issuer} The issuer of the JWT\. ```csharp public string? Issuer { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JsonWebTokenPayload\.Json Property {#Abblix.Jwt.JsonWebTokenPayload.Json} The underlying mutable JSON object backing the strongly\-typed accessors on this payload\. Use this for custom claims that are not exposed as named properties on this class\. ```csharp public System.Text.Json.Nodes.JsonObject Json { get; } ``` #### Property Value [System\.Text\.Json\.Nodes\.JsonObject](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonobject 'System\.Text\.Json\.Nodes\.JsonObject') ## JsonWebTokenPayload\.JwtId Property {#Abblix.Jwt.JsonWebTokenPayload.JwtId} The unique identifier of the JWT\. ```csharp public string? JwtId { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JsonWebTokenPayload\.Nonce Property {#Abblix.Jwt.JsonWebTokenPayload.Nonce} A value used to associate a client session with an ID token, mitigating replay attacks\. ```csharp public string? Nonce { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JsonWebTokenPayload\.NotBefore Property {#Abblix.Jwt.JsonWebTokenPayload.NotBefore} The time before which the JWT must not be accepted for processing, represented as a Unix timestamp\. ```csharp public System.Nullable NotBefore { get; set; } ``` #### Property Value [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') ## JsonWebTokenPayload\.Scope Property {#Abblix.Jwt.JsonWebTokenPayload.Scope} The scope of access granted by the JWT\. Scope is typically a space\-separated list of permissions or access levels and is not part of the standard JWT claims\. ```csharp public System.Collections.Generic.IEnumerable Scope { get; set; } ``` #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ### Remarks The 'scope' claim is often used in OAuth 2\.0 and OpenID Connect contexts to specify the extent of access granted by the token\. Each value in the list represents a specific permission or access level granted to the token bearer\. This property ensures that the scope is represented appropriately as either a single value or an array of values\. ## JsonWebTokenPayload\.SessionId Property {#Abblix.Jwt.JsonWebTokenPayload.SessionId} The session ID associated with the JWT, typically used to manage session state across applications\. ```csharp public string? SessionId { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks The session ID can link the JWT to a specific session for the user, allowing for effective session management and security controls\. ## JsonWebTokenPayload\.Subject Property {#Abblix.Jwt.JsonWebTokenPayload.Subject} The subject of the JWT\. The subject typically represents the principal that is the focus of the JWT, often a user identifier\. ```csharp public string? Subject { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks The 'sub' \(subject\) claim is a standard claim in JWTs used to uniquely identify the principal, usually in the context of authentication or user identity\. It is commonly a user ID or username\. ## JsonWebTokenPayload\.this\[string\] Property {#Abblix.Jwt.JsonWebTokenPayload.this[string]} Indexer to get or set claim values in the payload using the claim name\. ```csharp public System.Text.Json.Nodes.JsonNode? this[string name] { get; set; } ``` #### Parameters ###### `name` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Jwt.JsonWebTokenPayload.this[string].name} The name of the claim\. #### Property Value [System\.Text\.Json\.Nodes\.JsonNode](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonnode 'System\.Text\.Json\.Nodes\.JsonNode') ### Methods ## JsonWebTokenPayload\.TryReadTimestamp\(string, Nullable\, string\) Method {#Abblix.Jwt.JsonWebTokenPayload.TryReadTimestamp(string,System.Nullable_System.DateTimeOffset_,string)} Reads one timestamp claim by name, answering false with the reason instead of throwing where it cannot be read\. ```csharp public bool TryReadTimestamp(string claim, out System.Nullable value, out string? whyUnreadable); ``` #### Parameters ###### `claim` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Jwt.JsonWebTokenPayload.TryReadTimestamp(string,System.Nullable_System.DateTimeOffset_,string).claim} The claim name, one of the registered timestamp claims or any other claim holding a NumericDate\. ###### `value` [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') {#Abblix.Jwt.JsonWebTokenPayload.TryReadTimestamp(string,System.Nullable_System.DateTimeOffset_,string).value} The claim's value, or null where the token carries none\. ###### `whyUnreadable` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Jwt.JsonWebTokenPayload.TryReadTimestamp(string,System.Nullable_System.DateTimeOffset_,string).whyUnreadable} Which claim could not be read and what it held, or null where it was read\. #### Returns [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') True where the claim was read, or is absent\. ### Remarks For a caller that judges one claim and must say nothing about the others: a DPoP proof is refused on its `iat` alone, and a refusal naming a claim it never looked at would be wrong twice over\. ## JsonWebTokenPayload\.TryReadTimestamps\(Nullable\, Nullable\, Nullable\, string\) Method {#Abblix.Jwt.JsonWebTokenPayload.TryReadTimestamps(System.Nullable_System.DateTimeOffset_,System.Nullable_System.DateTimeOffset_,System.Nullable_System.DateTimeOffset_,string)} Reads the three timestamp claims at once, answering false with the reason instead of throwing where one of them cannot be read\. ```csharp public bool TryReadTimestamps(out System.Nullable notBefore, out System.Nullable expiresAt, out System.Nullable issuedAt, out string? whyUnreadable); ``` #### Parameters ###### `notBefore` [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') {#Abblix.Jwt.JsonWebTokenPayload.TryReadTimestamps(System.Nullable_System.DateTimeOffset_,System.Nullable_System.DateTimeOffset_,System.Nullable_System.DateTimeOffset_,string).notBefore} The `nbf` claim, or null where the token carries none\. ###### `expiresAt` [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') {#Abblix.Jwt.JsonWebTokenPayload.TryReadTimestamps(System.Nullable_System.DateTimeOffset_,System.Nullable_System.DateTimeOffset_,System.Nullable_System.DateTimeOffset_,string).expiresAt} The `exp` claim, or null where the token carries none\. ###### `issuedAt` [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') {#Abblix.Jwt.JsonWebTokenPayload.TryReadTimestamps(System.Nullable_System.DateTimeOffset_,System.Nullable_System.DateTimeOffset_,System.Nullable_System.DateTimeOffset_,string).issuedAt} The `iat` claim, or null where the token carries none\. ###### `whyUnreadable` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Jwt.JsonWebTokenPayload.TryReadTimestamps(System.Nullable_System.DateTimeOffset_,System.Nullable_System.DateTimeOffset_,System.Nullable_System.DateTimeOffset_,string).whyUnreadable} Which claim could not be read and what it held, or null where all three were read\. #### Returns [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') True where every timestamp the token carries was read\. ### Remarks The typed accessors throw on a value that is not a NumericDate \- a string, an object, a number outside the range [System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset') can hold \- because a caller asking for a timestamp has nowhere to put "the token lied"\. A validator does: a claim it cannot read is a refusal of the token, never an exception out of the request\. This is the read a validator makes, and it names the claim, since the sender can fix only the one it is told about\. --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenTypes.md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt 'Abblix\.Jwt') ## JsonWebTokenTypes Class The registry of `typ` header values that specifications fix: each is registered with IANA \(or by the body that owns the profile\) and required verbatim by its counterparties, so none may be changed\. The registry sits in the JWT core the way [JsonWebKeyTypes](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKeyTypes 'Abblix\.Jwt\.JsonWebKeyTypes') does for `kty` values: every package building on the core shares one copy of the vocabulary instead of drifting its own\. ```csharp public static class JsonWebTokenTypes ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → JsonWebTokenTypes ### Remarks A product's own invented values do not belong here\. RFC 6838 Section 3\.2 gives them the vendor tree \("vnd\." names for "media types associated with publicly available products"\), and they live beside the product that mints them \- combined with this registry through the [IsPermitted\(string, IReadOnlyList<string>, string\[\]\)](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenTypes#Abblix.Jwt.JsonWebTokenTypes.IsPermitted(string,System.Collections.Generic.IReadOnlyList_string_,string[]) 'Abblix\.Jwt\.JsonWebTokenTypes\.IsPermitted\(string, System\.Collections\.Generic\.IReadOnlyList\, string\[\]\)') overload, so refusal decisions still see both vocabularies\. ### Fields ## JsonWebTokenTypes\.AccessToken Field {#Abblix.Jwt.JsonWebTokenTypes.AccessToken} The "AccessToken" JWT type is used to represent access tokens, typically used for authenticating and authorizing users in APIs\. ```csharp public const string AccessToken = "at+jwt"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks FIXED BY SPECIFICATION \- MUST NOT be changed\. Registered with IANA as `application/at+jwt` by RFC 9068, which requires it verbatim: "JWT access tokens MUST include this media type in the typ header parameter to explicitly declare that the JWT represents an access token complying with this profile" \(Section 2\.1\)\. Every resource server that validates our access tokens rejects any other value, so a change here is not a rename but a withdrawal from the profile\. ## JsonWebTokenTypes\.ClientAuthentication Field {#Abblix.Jwt.JsonWebTokenTypes.ClientAuthentication} A JWT used to authenticate a client, per RFC 7523bis \(approved, awaiting its number\)\. ```csharp public const string ClientAuthentication = "client-authentication+jwt"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JsonWebTokenTypes\.DPoPProof Field {#Abblix.Jwt.JsonWebTokenTypes.DPoPProof} The "DPoP proof" JWT type per RFC 9449 §4\.2\. The `typ` header MUST equal this value so a relying party that trusts the same client across multiple JWT types \(id\_token, request\_object, DPoP proof\) cannot have one type replayed as another per the RFC 8725 §3\.11 token\-type confusion guidance\. ```csharp public const string DPoPProof = "dpop+jwt"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JsonWebTokenTypes\.EntityAttestation Field {#Abblix.Jwt.JsonWebTokenTypes.EntityAttestation} An Entity Attestation Token, per RFC 9782\. ```csharp public const string EntityAttestation = "eat+jwt"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JsonWebTokenTypes\.EntityStatement Field {#Abblix.Jwt.JsonWebTokenTypes.EntityStatement} An OpenID Federation entity statement, registered by the OpenID Foundation\. ```csharp public const string EntityStatement = "entity-statement+jwt"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JsonWebTokenTypes\.ExplicitRegistrationResponse Field {#Abblix.Jwt.JsonWebTokenTypes.ExplicitRegistrationResponse} An OpenID Federation explicit registration response, registered by the OpenID Foundation\. ```csharp public const string ExplicitRegistrationResponse = "explicit-registration-response+jwt"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JsonWebTokenTypes\.JwkSet Field {#Abblix.Jwt.JsonWebTokenTypes.JwkSet} A signed JSON Web Key Set, registered by the OpenID Foundation\. ```csharp public const string JwkSet = "jwk-set+jwt"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JsonWebTokenTypes\.Jwt Field {#Abblix.Jwt.JsonWebTokenTypes.Jwt} Standard JSON Web Token type\. Per RFC 7519 Section 5\.1, this is the recommended value for the 'typ' header parameter\. ```csharp public const string Jwt = "JWT"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JsonWebTokenTypes\.KeyBinding Field {#Abblix.Jwt.JsonWebTokenTypes.KeyBinding} An SD\-JWT key binding token, per RFC 9901\. ```csharp public const string KeyBinding = "kb+jwt"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JsonWebTokenTypes\.Known Field {#Abblix.Jwt.JsonWebTokenTypes.Known} Every `typ` named in this class except [Jwt](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenTypes#Abblix.Jwt.JsonWebTokenTypes.Jwt 'Abblix\.Jwt\.JsonWebTokenTypes\.Jwt'), which says only that a thing is a JWT and so cannot tell one kind from another\. ```csharp public static readonly IReadOnlyList Known; ``` #### Field Value [System\.Collections\.Generic\.IReadOnlyList<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ireadonlylist-1 'System\.Collections\.Generic\.IReadOnlyList\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ireadonlylist-1 'System\.Collections\.Generic\.IReadOnlyList\`1') ### Remarks A value belongs here once this class names it, whoever issues it\. What decides whether a given one is refused is not membership but the position it turns up in, and that is stated at each call site rather than here \- see [IsPermitted\(string, string\[\]\)](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenTypes#Abblix.Jwt.JsonWebTokenTypes.IsPermitted(string,string[]) 'Abblix\.Jwt\.JsonWebTokenTypes\.IsPermitted\(string, string\[\]\)')\. Add a value when this class gains one. Leaving it out is the failure that matters: an omission is a refusal that silently does not happen, and nothing anywhere reports it. Public rather than private, because a product combines this list with its own vendor values and hands the union back through the list-taking [IsPermitted\(string, IReadOnlyList<string>, string\[\]\)](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenTypes#Abblix.Jwt.JsonWebTokenTypes.IsPermitted(string,System.Collections.Generic.IReadOnlyList_string_,string[]) 'Abblix\.Jwt\.JsonWebTokenTypes\.IsPermitted\(string, System\.Collections\.Generic\.IReadOnlyList\, string\[\]\)') overload. ## JsonWebTokenTypes\.LogoutToken Field {#Abblix.Jwt.JsonWebTokenTypes.LogoutToken} The "LogoutToken" JWT type is used in the context of OpenID Connect for single logout functionality\. ```csharp public const string LogoutToken = "logout+jwt"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks FIXED BY SPECIFICATION \- MUST NOT be changed\. Registered with IANA as `application/logout+jwt` by the OpenID Foundation and required by OpenID Connect Back\-Channel Logout, which the relying parties we notify implement\. A different value would leave every one of them unable to recognise the token\. ## JsonWebTokenTypes\.ProvidedClaims Field {#Abblix.Jwt.JsonWebTokenTypes.ProvidedClaims} Claims provided to an identity assurance verifier, registered by the OpenID Foundation\. ```csharp public const string ProvidedClaims = "provided-claims+jwt"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JsonWebTokenTypes\.RequestObject Field {#Abblix.Jwt.JsonWebTokenTypes.RequestObject} An OAuth 2\.0 request object, per RFC 9101\. ```csharp public const string RequestObject = "oauth-authz-req+jwt"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JsonWebTokenTypes\.ResolveResponse Field {#Abblix.Jwt.JsonWebTokenTypes.ResolveResponse} An OpenID Federation resolve response, registered by the OpenID Foundation\. ```csharp public const string ResolveResponse = "resolve-response+jwt"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JsonWebTokenTypes\.SecurityEvent Field {#Abblix.Jwt.JsonWebTokenTypes.SecurityEvent} A Security Event Token, per RFC 8417\. ```csharp public const string SecurityEvent = "secevent+jwt"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JsonWebTokenTypes\.StatusList Field {#Abblix.Jwt.JsonWebTokenTypes.StatusList} A token status list, per the OAuth status list specification \(approved, awaiting its number\)\. ```csharp public const string StatusList = "statuslist+jwt"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JsonWebTokenTypes\.TokenIntrospection Field {#Abblix.Jwt.JsonWebTokenTypes.TokenIntrospection} The "token introspection response" JWT type per RFC 9701 §5\. The `typ` header equals this value so a signed introspection response cannot be replayed as a different JWT type \(RFC 8725 §3\.11\)\. ```csharp public const string TokenIntrospection = "token-introspection+jwt"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JsonWebTokenTypes\.TrustMark Field {#Abblix.Jwt.JsonWebTokenTypes.TrustMark} An OpenID Federation trust mark, registered by the OpenID Foundation\. ```csharp public const string TrustMark = "trust-mark+jwt"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JsonWebTokenTypes\.TrustMarkDelegation Field {#Abblix.Jwt.JsonWebTokenTypes.TrustMarkDelegation} An OpenID Federation trust mark delegation, registered by the OpenID Foundation\. ```csharp public const string TrustMarkDelegation = "trust-mark-delegation+jwt"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JsonWebTokenTypes\.TrustMarkStatusResponse Field {#Abblix.Jwt.JsonWebTokenTypes.TrustMarkStatusResponse} An OpenID Federation trust mark status response, registered by the OpenID Foundation\. ```csharp public const string TrustMarkStatusResponse = "trust-mark-status-response+jwt"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JsonWebTokenTypes\.VerifiableCredential Field {#Abblix.Jwt.JsonWebTokenTypes.VerifiableCredential} A W3C Verifiable Credential secured as a JWT\. ```csharp public const string VerifiableCredential = "vc+jwt"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JsonWebTokenTypes\.VerifiablePresentation Field {#Abblix.Jwt.JsonWebTokenTypes.VerifiablePresentation} A W3C Verifiable Presentation secured as a JWT\. ```csharp public const string VerifiablePresentation = "vp+jwt"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Methods ## JsonWebTokenTypes\.IsPermitted\(string, string\[\]\) Method {#Abblix.Jwt.JsonWebTokenTypes.IsPermitted(string,string[])} Reports whether a `typ` is one this position permits, so that a JWT meant for a different purpose can be refused where it has no business being\. ```csharp public static bool IsPermitted(string? tokenType, params string[] permittedTypes); ``` #### Parameters ###### `tokenType` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Jwt.JsonWebTokenTypes.IsPermitted(string,string[]).tokenType} The `typ` header parameter of the incoming JWT, which may be absent\. ###### `permittedTypes` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Jwt.JsonWebTokenTypes.IsPermitted(string,string[]).permittedTypes} The types this position permits\. Pass none where the JWT that belongs there carries no `typ` at all, as an ID token does \- then every type this class names is out of place\. #### Returns [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') `true` for an absent, generic or unfamiliar value and for any of [permittedTypes](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenTypes#Abblix.Jwt.JsonWebTokenTypes.IsPermitted(string,string[]).permittedTypes 'Abblix\.Jwt\.JsonWebTokenTypes\.IsPermitted\(string, string\[\]\)\.permittedTypes'); `false` only for a type this class names that is not among them\. ### Remarks This enumerates what to refuse rather than what to accept, which is the opposite of the usual preference, and the reason is that the accepting side cannot be enumerated\. RFC 7523bis allows a client authentication JWT to be typed "client\-authentication\+jwt or another more specific explicit type value defined by a specification profiling this specification", and RFC 9101 Section 4 observes of the request object that "some existing deployments may alternatively be using the type application/jwt"\. An allow list would refuse conformant senders on both counts, so an absent, generic or unfamiliar value passes untouched and a sender that never heard of explicit typing is unaffected\. What is refused therefore depends on where the question is asked, which is why what belongs is named by the caller. The alternative - one list of everything a server issues - was too narrow at half the call sites: a client assertion and a request object are verified with the CLIENT's key, so the client chooses the `typ` and can present a JWT it signed for some entirely different purpose. Refusing by kind is the mutually exclusive validation RFC 8725 Section 3.12 asks for. ## JsonWebTokenTypes\.IsPermitted\(string, IReadOnlyList\, string\[\]\) Method {#Abblix.Jwt.JsonWebTokenTypes.IsPermitted(string,System.Collections.Generic.IReadOnlyList_string_,string[])} The same refusal\-by\-kind decision over a caller\-supplied vocabulary: a product whose known set is this registry PLUS its own vendor values passes the union here, so its refusals see both\. ```csharp public static bool IsPermitted(string? tokenType, System.Collections.Generic.IReadOnlyList knownTypes, params string[] permittedTypes); ``` #### Parameters ###### `tokenType` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Jwt.JsonWebTokenTypes.IsPermitted(string,System.Collections.Generic.IReadOnlyList_string_,string[]).tokenType} The `typ` header parameter of the incoming JWT, which may be absent\. ###### `knownTypes` [System\.Collections\.Generic\.IReadOnlyList<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ireadonlylist-1 'System\.Collections\.Generic\.IReadOnlyList\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ireadonlylist-1 'System\.Collections\.Generic\.IReadOnlyList\`1') {#Abblix.Jwt.JsonWebTokenTypes.IsPermitted(string,System.Collections.Generic.IReadOnlyList_string_,string[]).knownTypes} Every type the caller can name, this registry's and its own alike\. ###### `permittedTypes` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Jwt.JsonWebTokenTypes.IsPermitted(string,System.Collections.Generic.IReadOnlyList_string_,string[]).permittedTypes} The types this position permits\. #### Returns [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') `true` for an absent, generic or unfamiliar value and for any of [permittedTypes](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenTypes#Abblix.Jwt.JsonWebTokenTypes.IsPermitted(string,System.Collections.Generic.IReadOnlyList_string_,string[]).permittedTypes 'Abblix\.Jwt\.JsonWebTokenTypes\.IsPermitted\(string, System\.Collections\.Generic\.IReadOnlyList\, string\[\]\)\.permittedTypes'); `false` only for a known type that is not among them\. --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JwtClaimTypes.md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt 'Abblix\.Jwt') ## JwtClaimTypes Class Names of the JWT claims and JOSE header parameters used by this library, including the registered claims from RFC 7519 Section 4\.1, common OpenID Connect claims, and several extensions \(token exchange, security event tokens, etc\.\)\. Use these constants whenever reading from or writing to a [JsonWebTokenHeader](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenHeader 'Abblix\.Jwt\.JsonWebTokenHeader') or [JsonWebTokenPayload](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenPayload 'Abblix\.Jwt\.JsonWebTokenPayload') by raw name\. ```csharp public static class JwtClaimTypes ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → JwtClaimTypes ### Fields ## JwtClaimTypes\.AccessTokenHash Field {#Abblix.Jwt.JwtClaimTypes.AccessTokenHash} The 'at\_hash' claim is used for the access token hash value in OpenID Connect\. It provides validation that the access token is tied to the identity token\. ```csharp public const string AccessTokenHash = "at_hash"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JwtClaimTypes\.AgreementPartyUInfo Field {#Abblix.Jwt.JwtClaimTypes.AgreementPartyUInfo} "apu" header parameter \(RFC 7518 Section 4\.6\.1\.2\): base64url\-encoded Agreement PartyUInfo \(information about the producer\) fed into the Concat KDF during ECDH\-ES key agreement\. ```csharp public const string AgreementPartyUInfo = "apu"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JwtClaimTypes\.AgreementPartyVInfo Field {#Abblix.Jwt.JwtClaimTypes.AgreementPartyVInfo} "apv" header parameter \(RFC 7518 Section 4\.6\.1\.3\): base64url\-encoded Agreement PartyVInfo \(information about the recipient\) fed into the Concat KDF during ECDH\-ES key agreement\. ```csharp public const string AgreementPartyVInfo = "apv"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JwtClaimTypes\.Algorithm Field {#Abblix.Jwt.JwtClaimTypes.Algorithm} "alg" header parameter \(RFC 7515 Section 4\.1\.1, RFC 7516 Section 4\.1\.1\): identifies the signing or key management algorithm\. REQUIRED in both JWS and JWE headers\. ```csharp public const string Algorithm = "alg"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JwtClaimTypes\.Audience Field {#Abblix.Jwt.JwtClaimTypes.Audience} The 'aud' \(audience\) claim identifies the recipients that the JWT is intended for\. ```csharp public const string Audience = "aud"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JwtClaimTypes\.AuthContextClassRef Field {#Abblix.Jwt.JwtClaimTypes.AuthContextClassRef} The 'acr' \(Authentication Context Class Reference\) claim provides the reference values for the authentication context class\. ```csharp public const string AuthContextClassRef = "acr"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JwtClaimTypes\.AuthenticationMethodReferences Field {#Abblix.Jwt.JwtClaimTypes.AuthenticationMethodReferences} The 'amr' \(Authentication Methods References\) claim lists the authentication methods used during authentication\. It typically includes values like 'pwd' \(password\), 'mfa' \(multi\-factor authentication\), or other method identifiers, and can help relying parties understand the strength and nature of the authentication\. ```csharp public const string AuthenticationMethodReferences = "amr"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JwtClaimTypes\.AuthenticationRequestId Field {#Abblix.Jwt.JwtClaimTypes.AuthenticationRequestId} The identifier of the backchannel authentication request this ID Token answers, carried so a push notification cannot be replayed against a different request\. ```csharp public const string AuthenticationRequestId = "urn:openid:params:jwt:claim:auth_req_id"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks CIBA Core 1\.0 Section 10\.3\.1 phrases this alongside the hashes \- "the OP MUST include the hash value of the Access Token and the auth\_req\_id \.\.\. using the at\_hash and urn:openid:params:jwt:claim:auth\_req\_id claims respectively" \- but its own worked example beside that sentence carries the identifier VERBATIM, matching the `auth_req_id` field of the same notification body\. The example is what a client compares against, and its own requirement is to check that this claim MATCHES the identifier it asked about, which a hash would not let it do\. Required in push mode only, which the same paragraph says outright. Poll and ping clients redeem at the token endpoint holding the identifier already. ## JwtClaimTypes\.AuthenticationTime Field {#Abblix.Jwt.JwtClaimTypes.AuthenticationTime} The 'auth\_time' claim represents the time when the authentication occurred\. It is expressed as the number of seconds since Unix epoch\. ```csharp public const string AuthenticationTime = "auth_time"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JwtClaimTypes\.ClientId Field {#Abblix.Jwt.JwtClaimTypes.ClientId} The 'client\_id' claim represents the identifier for the client that requested the authentication\. Often used in OAuth 2\.0 and OpenID Connect flows\. ```csharp public const string ClientId = "client_id"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JwtClaimTypes\.CodeHash Field {#Abblix.Jwt.JwtClaimTypes.CodeHash} The 'c\_hash' claim is used for the code hash value in OpenID Connect\. It is a hash of the authorization code issued by the authorization server\. ```csharp public const string CodeHash = "c_hash"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JwtClaimTypes\.CompressionAlgorithm Field {#Abblix.Jwt.JwtClaimTypes.CompressionAlgorithm} "zip" header parameter \(RFC 7516 Section 4\.1\.3\): the compression algorithm applied to the plaintext before encryption\. Registered as a JWE header parameter, so a producer must not list it in "crit" \- it is not an extension\. ```csharp public const string CompressionAlgorithm = "zip"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JwtClaimTypes\.ContentType Field {#Abblix.Jwt.JwtClaimTypes.ContentType} "cty" header parameter \(RFC 7515 Section 4\.1\.10\): the media type of the JWS payload, used when the payload itself is a nested JWT or another well\-defined media type\. ```csharp public const string ContentType = "cty"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JwtClaimTypes\.Critical Field {#Abblix.Jwt.JwtClaimTypes.Critical} "crit" header parameter \(RFC 7515 Section 4\.1\.11\): a JSON array of JOSE header parameter names that the recipient MUST understand and process\. The parameter itself MUST be understood by JWS implementations, even when no extensions are in use\. ```csharp public const string Critical = "crit"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JwtClaimTypes\.DPoPAccessTokenHash Field {#Abblix.Jwt.JwtClaimTypes.DPoPAccessTokenHash} The 'ath' \(Access Token Hash\) claim binds a DPoP proof to the access token it accompanies at a protected resource \(RFC 9449 §4\.2\)\. Base64url\-encoded SHA\-256 of the access\-token ASCII bytes; present only when an access token is presented\. Distinct from [AccessTokenHash](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JwtClaimTypes#Abblix.Jwt.JwtClaimTypes.AccessTokenHash 'Abblix\.Jwt\.JwtClaimTypes\.AccessTokenHash') \(OIDC `at_hash` in id\_tokens\)\. ```csharp public const string DPoPAccessTokenHash = "ath"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JwtClaimTypes\.DPoPHttpMethod Field {#Abblix.Jwt.JwtClaimTypes.DPoPHttpMethod} The 'htm' \(HTTP Method\) claim binds a DPoP proof to the HTTP method of the request \(RFC 9449 §4\.2\)\. Compared byte\-exact against the request method\. ```csharp public const string DPoPHttpMethod = "htm"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JwtClaimTypes\.DPoPHttpUri Field {#Abblix.Jwt.JwtClaimTypes.DPoPHttpUri} The 'htu' \(HTTP URI\) claim binds a DPoP proof to the request target URI \(RFC 9449 §4\.2\)\. Compared after RFC 3986 §6\.2 canonicalisation\. ```csharp public const string DPoPHttpUri = "htu"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JwtClaimTypes\.Email Field {#Abblix.Jwt.JwtClaimTypes.Email} The 'email' claim represents the user's email address\. ```csharp public const string Email = "email"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JwtClaimTypes\.EmailVerified Field {#Abblix.Jwt.JwtClaimTypes.EmailVerified} The 'email\_verified' claim is a boolean that is true if the user's email address has been verified; otherwise, it is false\. ```csharp public const string EmailVerified = "email_verified"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JwtClaimTypes\.EncryptionAlgorithm Field {#Abblix.Jwt.JwtClaimTypes.EncryptionAlgorithm} "enc" header parameter \(RFC 7516 Section 4\.1\.2\): identifies the JWE content encryption algorithm applied to the payload\. ```csharp public const string EncryptionAlgorithm = "enc"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JwtClaimTypes\.EphemeralPublicKey Field {#Abblix.Jwt.JwtClaimTypes.EphemeralPublicKey} "epk" header parameter \(RFC 7518 Section 4\.6\.1\.1\): the ephemeral public key created by the originator for ECDH\-ES key agreement, represented as a JWK containing only public members\. ```csharp public const string EphemeralPublicKey = "epk"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JwtClaimTypes\.Events Field {#Abblix.Jwt.JwtClaimTypes.Events} The 'events' claim represents the events associated with the authentication\. ```csharp public const string Events = "events"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JwtClaimTypes\.ExpiresAt Field {#Abblix.Jwt.JwtClaimTypes.ExpiresAt} The 'exp' \(expiration time\) claim identifies the expiration time on or after which the JWT must not be accepted for processing\. It is expressed as the number of seconds since the Unix epoch\. This claim is used to define the maximum lifespan of the JWT\. ```csharp public const string ExpiresAt = "exp"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JwtClaimTypes\.GrantId Field {#Abblix.Jwt.JwtClaimTypes.GrantId} "grant\_id" \- Abblix private claim \(RFC 7519 Section 4\.3\) identifying the authorization grant a refresh token belongs to\. It binds every refresh token derived from one grant into a single lineage \(a "token family" in RFC 9700 terms\): a first\-issued token starts a new grant, and each rotation carries the same value forward\. It lets a detected replay revoke the whole family in one registry write\. No IANA\-registered claim captures per\-grant refresh\-token lineage, and this token is self\-issued and self\-validated, never shown to third parties\. See RFC 9700 Section 4\.14\.2\. ```csharp public const string GrantId = "grant_id"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JwtClaimTypes\.IdentityProvider Field {#Abblix.Jwt.JwtClaimTypes.IdentityProvider} The 'idp' claim represents the identity provider that authenticated the end user\. ```csharp public const string IdentityProvider = "idp"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JwtClaimTypes\.IssuedAt Field {#Abblix.Jwt.JwtClaimTypes.IssuedAt} The 'iat' \(issued at\) claim identifies the time at which the JWT was issued\. It is expressed as the number of seconds since the Unix epoch\. This claim can be used to determine the age of the JWT\. ```csharp public const string IssuedAt = "iat"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JwtClaimTypes\.Issuer Field {#Abblix.Jwt.JwtClaimTypes.Issuer} The 'iss' \(issuer\) claim identifies the principal that issued the JWT\. It is typically a URI identifying the issuer\. ```csharp public const string Issuer = "iss"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JwtClaimTypes\.JsonWebKeyHeader Field {#Abblix.Jwt.JwtClaimTypes.JsonWebKeyHeader} "jwk" header parameter \(RFC 7515 Section 4\.1\.3\): the public key embedded directly in the JOSE header as a JWK\. ```csharp public const string JsonWebKeyHeader = "jwk"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JwtClaimTypes\.JwkSetUrl Field {#Abblix.Jwt.JwtClaimTypes.JwkSetUrl} "jku" header parameter \(RFC 7515 Section 4\.1\.2\): URL referring to a JWK Set whose keys the issuer claims as candidates for verifying the JWS\. ```csharp public const string JwkSetUrl = "jku"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JwtClaimTypes\.JwtId Field {#Abblix.Jwt.JwtClaimTypes.JwtId} The 'jti' \(JWT ID\) claim provides a unique identifier for the JWT\. ```csharp public const string JwtId = "jti"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JwtClaimTypes\.KeyId Field {#Abblix.Jwt.JwtClaimTypes.KeyId} "kid" header parameter \(RFC 7515 Section 4\.1\.4, RFC 7516 Section 4\.1\.6\): selects which key from a JWK Set produced the JWT, allowing key rotation without ambiguity\. ```csharp public const string KeyId = "kid"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JwtClaimTypes\.KeyWrapAuthenticationTag Field {#Abblix.Jwt.JwtClaimTypes.KeyWrapAuthenticationTag} "tag" header parameter \(RFC 7518 Section 4\.7\.1\.2\): the base64url\-encoded 128\-bit Authentication Tag produced when the CEK is wrapped with AES\-GCM key wrapping \(A128GCMKW/A192GCMKW/A256GCMKW\)\. ```csharp public const string KeyWrapAuthenticationTag = "tag"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JwtClaimTypes\.KeyWrapInitializationVector Field {#Abblix.Jwt.JwtClaimTypes.KeyWrapInitializationVector} "iv" header parameter \(RFC 7518 Section 4\.7\.1\.1\): the base64url\-encoded 96\-bit Initialization Vector used when the CEK is wrapped with AES\-GCM key wrapping \(A128GCMKW/A192GCMKW/A256GCMKW\)\. ```csharp public const string KeyWrapInitializationVector = "iv"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JwtClaimTypes\.Nonce Field {#Abblix.Jwt.JwtClaimTypes.Nonce} The 'nonce' claim provides a string value used to associate a client session with an ID token\. ```csharp public const string Nonce = "nonce"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JwtClaimTypes\.NotBefore Field {#Abblix.Jwt.JwtClaimTypes.NotBefore} The 'nbf' \(not before\) claim identifies the time before which the JWT must not be accepted for processing\. It is expressed as the number of seconds since the Unix epoch\. This claim is used to define the earliest time at which the JWT is considered valid\. ```csharp public const string NotBefore = "nbf"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JwtClaimTypes\.Pbes2IterationCount Field {#Abblix.Jwt.JwtClaimTypes.Pbes2IterationCount} "p2c" header parameter \(RFC 7518 Section 4\.8\.1\.2\): the PBKDF2 iteration count for PBES2 key derivation, a positive JSON integer\. ```csharp public const string Pbes2IterationCount = "p2c"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JwtClaimTypes\.Pbes2SaltInput Field {#Abblix.Jwt.JwtClaimTypes.Pbes2SaltInput} "p2s" header parameter \(RFC 7518 Section 4\.8\.1\.1\): the base64url\-encoded PBES2 salt input, at least 8 octets, combined with the algorithm name into the PBKDF2 salt\. ```csharp public const string Pbes2SaltInput = "p2s"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JwtClaimTypes\.PhoneNumber Field {#Abblix.Jwt.JwtClaimTypes.PhoneNumber} The 'phone\_number' claim represents the user's phone number\. ```csharp public const string PhoneNumber = "phone_number"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JwtClaimTypes\.PhoneNumberVerified Field {#Abblix.Jwt.JwtClaimTypes.PhoneNumberVerified} The 'phone\_number\_verified' claim is a boolean that is true if the user's phone number has been verified; otherwise, it is false\. ```csharp public const string PhoneNumberVerified = "phone_number_verified"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JwtClaimTypes\.RefreshTokenHash Field {#Abblix.Jwt.JwtClaimTypes.RefreshTokenHash} The hash of the refresh token delivered beside this ID Token, computed the same way [AccessTokenHash](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JwtClaimTypes#Abblix.Jwt.JwtClaimTypes.AccessTokenHash 'Abblix\.Jwt\.JwtClaimTypes\.AccessTokenHash') is\. ```csharp public const string RefreshTokenHash = "urn:openid:params:jwt:claim:rt_hash"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks CIBA Core 1\.0 Section 10\.3\.1: "In case a Refresh Token is sent to the Client, the hash value of it MUST also be added to the ID token using the urn:openid:params:jwt:claim:rt\_hash claim", and the same sentence points at OpenID Connect Core 1\.0 Section 3\.1\.3\.6 for the calculation \- the one `at_hash` uses\. Required in push mode only, which is what the paragraph says \- it does not forbid the claim elsewhere \- and only when a refresh token is actually sent\. ## JwtClaimTypes\.RequestedClaims Field {#Abblix.Jwt.JwtClaimTypes.RequestedClaims} The 'requested\_claims' claim represents the specific claims requested by the client\. ```csharp public const string RequestedClaims = "requested_claims"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JwtClaimTypes\.Scope Field {#Abblix.Jwt.JwtClaimTypes.Scope} The 'scope' claim represents the scope of access requested\. ```csharp public const string Scope = "scope"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JwtClaimTypes\.SessionId Field {#Abblix.Jwt.JwtClaimTypes.SessionId} The 'sid' \(session ID\) claim identifies the session to which the JWT is linked\. Useful for maintaining state between the client and the issuer\. ```csharp public const string SessionId = "sid"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JwtClaimTypes\.Subject Field {#Abblix.Jwt.JwtClaimTypes.Subject} The 'sub' \(subject\) claim identifies the principal that is the subject of the JWT\. Typically used to represent the user or entity the token is about\. ```csharp public const string Subject = "sub"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JwtClaimTypes\.Type Field {#Abblix.Jwt.JwtClaimTypes.Type} "typ" header parameter \(RFC 7515 Section 4\.1\.9\): the media type of the JWT, for example "JWT" or "at\+jwt" for OAuth 2\.0 access tokens \(RFC 9068\)\. ```csharp public const string Type = "typ"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JwtClaimTypes\.X509CertificateChain Field {#Abblix.Jwt.JwtClaimTypes.X509CertificateChain} "x5c" header parameter \(RFC 7515 Section 4\.1\.6\): an X\.509 certificate chain embedded in the JOSE header as a JSON array of base64\-encoded DER certificates\. ```csharp public const string X509CertificateChain = "x5c"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JwtClaimTypes\.X509Sha1Thumbprint Field {#Abblix.Jwt.JwtClaimTypes.X509Sha1Thumbprint} "x5t" header parameter \(RFC 7515 Section 4\.1\.7\): base64url\-encoded SHA\-1 thumbprint of the DER encoding of the corresponding X\.509 certificate\. Discouraged in favour of [X509Sha256Thumbprint](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JwtClaimTypes#Abblix.Jwt.JwtClaimTypes.X509Sha256Thumbprint 'Abblix\.Jwt\.JwtClaimTypes\.X509Sha256Thumbprint') per RFC 7515 §10\.11\. ```csharp public const string X509Sha1Thumbprint = "x5t"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JwtClaimTypes\.X509Sha256Thumbprint Field {#Abblix.Jwt.JwtClaimTypes.X509Sha256Thumbprint} "x5t\#S256" header parameter \(RFC 7515 Section 4\.1\.8\): base64url\-encoded SHA\-256 thumbprint of the DER encoding of the corresponding X\.509 certificate\. ```csharp public const string X509Sha256Thumbprint = "x5t#S256"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JwtClaimTypes\.X509Url Field {#Abblix.Jwt.JwtClaimTypes.X509Url} "x5u" header parameter \(RFC 7515 Section 4\.1\.5\): URL referring to an X\.509 public\-key certificate or certificate chain corresponding to the key used for the JWS signature\. ```csharp public const string X509Url = "x5u"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JwtError.md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt 'Abblix\.Jwt') ## JwtError Enum High\-level categories of JWT processing failures returned by the validator and by callers that consume validated tokens\. Pair with [ErrorDescription](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JwtValidationError#Abblix.Jwt.JwtValidationError.ErrorDescription 'Abblix\.Jwt\.JwtValidationError\.ErrorDescription') for a human\-readable explanation\. Categories let callers branch on the failure cause without parsing the description string\. ```csharp public enum JwtError ``` ### Fields ###### `InvalidToken` 0 {#Abblix.Jwt.JwtError.InvalidToken} The token cannot be accepted but does not fall into a more specific category below \(for example, a missing or invalid issuer/audience/lifetime claim\)\. ###### `TokenAlreadyUsed` 1 {#Abblix.Jwt.JwtError.TokenAlreadyUsed} The token is well\-formed and otherwise valid, but it has already been redeemed in a context that allows only single use \(for example, an authorization code or a one\-time login link\)\. ###### `TokenRevoked` 2 {#Abblix.Jwt.JwtError.TokenRevoked} The token has been explicitly revoked by the issuer \(for example, after sign\-out, password change, or administrative action\) and must no longer be honored\. ###### `MalformedToken` 3 {#Abblix.Jwt.JwtError.MalformedToken} The compact JWS / JWE serialisation failed to parse: wrong dot\-separated\-segment count, base64url decode failure, or the header/payload is not a JSON object\. ###### `InvalidAlgorithm` 4 {#Abblix.Jwt.JwtError.InvalidAlgorithm} The `alg` header parameter is missing, names the unsecured `none` algorithm where signed tokens are required, or falls outside the caller's configured [AllowedSigningAlgorithms](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ValidationParameters#Abblix.Jwt.ValidationParameters.AllowedSigningAlgorithms 'Abblix\.Jwt\.ValidationParameters\.AllowedSigningAlgorithms') whitelist\. ###### `InvalidTokenType` 5 {#Abblix.Jwt.JwtError.InvalidTokenType} The `typ` header parameter is missing or does not match the caller's [ExpectedTokenTypes](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ValidationParameters#Abblix.Jwt.ValidationParameters.ExpectedTokenTypes 'Abblix\.Jwt\.ValidationParameters\.ExpectedTokenTypes') \(RFC 8725 §3\.11 token\-type confusion guard\)\. ###### `InvalidHeader` 6 {#Abblix.Jwt.JwtError.InvalidHeader} A JOSE header parameter is malformed or violates a structural rule: the embedded `jwk` is not a valid JWK, the `crit` array is malformed or names an unknown extension, or a required header is missing for the chosen trust model\. ###### `InvalidSignature` 7 {#Abblix.Jwt.JwtError.InvalidSignature} The JWS signature does not verify under the resolved signing key\. --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JwtTypeName.md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt 'Abblix\.Jwt') ## JwtTypeName Class Compares JWT `typ` header values, which name a media type and therefore have more than one spelling for the same value\. ```csharp public static class JwtTypeName ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → JwtTypeName ### Remarks Two rules make the spellings equivalent\. RFC 7515 Section 4\.1\.9: "A recipient using the media type value MUST treat it as if 'application/' were prepended to any 'typ' value not containing a '/'", so `at+jwt` and `application/at+jwt` are one name\. RFC 2045 Section 5\.1: "Matching of media type and subtype is ALWAYS case\-insensitive", so casing carries no meaning either\. Note that RFC 7515 Section 5\.3, which defines this library's general string\-comparison rules, does not apply: it ends by exempting exactly this parameter, "Only the 'typ' and 'cty' member values defined in this specification do not use these comparison rules"\. This lives here rather than beside each comparison so the rule has one implementation: a second copy would be a second, quietly different answer to "is this an access token"\. ### Methods ## JwtTypeName\.Matches\(string, string\) Method {#Abblix.Jwt.JwtTypeName.Matches(string,string)} Determines whether two `typ` values name the same token type, in any spelling of either\. ```csharp public static bool Matches(string? actual, string expected); ``` #### Parameters ###### `actual` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Jwt.JwtTypeName.Matches(string,string).actual} The value read from the token's header, or `null` when it carries none\. ###### `expected` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Jwt.JwtTypeName.Matches(string,string).expected} The value the caller expects, written in whichever spelling it prefers\. #### Returns [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') `true` when both name the same media type\. ## JwtTypeName\.StripApplicationPrefix\(string\) Method {#Abblix.Jwt.JwtTypeName.StripApplicationPrefix(string)} Removes the `application/` prefix when present, reaching RFC 7515 Section 4\.1\.9's equivalence from either form rather than only from the short one\. ```csharp public static string StripApplicationPrefix(string typ); ``` #### Parameters ###### `typ` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Jwt.JwtTypeName.StripApplicationPrefix(string).typ} The `typ` value to normalise\. #### Returns [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') The value without its media\-type prefix\. ### Remarks The prefix match ignores case because it is the media type portion, which RFC 2045 Section 5\.1 declares case\-insensitive; matching it ordinally would leave `Application/at+jwt` unstripped and therefore unmatchable\. --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JwtValidationError.md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt 'Abblix\.Jwt') ## JwtValidationError Class Represents an error encountered during the validation of a JSON Web Token \(JWT\)\. ```csharp public record JwtValidationError : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → JwtValidationError Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[JwtValidationError](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JwtValidationError 'Abblix\.Jwt\.JwtValidationError')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Constructors ## JwtValidationError\(JwtError, string\) Constructor {#Abblix.Jwt.JwtValidationError.JwtValidationError(Abblix.Jwt.JwtError,string)} Represents an error encountered during the validation of a JSON Web Token \(JWT\)\. ```csharp public JwtValidationError(Abblix.Jwt.JwtError Error, string ErrorDescription); ``` #### Parameters ###### `Error` [JwtError](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JwtError 'Abblix\.Jwt\.JwtError') {#Abblix.Jwt.JwtValidationError.JwtValidationError(Abblix.Jwt.JwtError,string).Error} The specific type of JWT error encountered\. ###### `ErrorDescription` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Jwt.JwtValidationError.JwtValidationError(Abblix.Jwt.JwtError,string).ErrorDescription} A description of the error providing details about the validation failure\. ### Properties ## JwtValidationError\.Error Property {#Abblix.Jwt.JwtValidationError.Error} The specific type of JWT error encountered\. ```csharp public Abblix.Jwt.JwtError Error { get; init; } ``` #### Property Value [JwtError](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JwtError 'Abblix\.Jwt\.JwtError') ## JwtValidationError\.ErrorDescription Property {#Abblix.Jwt.JwtValidationError.ErrorDescription} A description of the error providing details about the validation failure\. ```csharp public string ErrorDescription { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Methods ## JwtValidationError\.ToString\(\) Method {#Abblix.Jwt.JwtValidationError.ToString()} Returns the error description as the textual representation of this validation error, preserving the original capitalization of [ErrorDescription](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JwtValidationError#Abblix.Jwt.JwtValidationError.ErrorDescription 'Abblix\.Jwt\.JwtValidationError\.ErrorDescription')\. ```csharp public override string ToString(); ``` #### Returns [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JwtValidationError\.ToString\(bool\) Method {#Abblix.Jwt.JwtValidationError.ToString(bool)} Formats a user\-friendly description of the JWT validation error with proper sentence capitalization\. ```csharp public string ToString(bool forceLowercaseFirst); ``` #### Parameters ###### `forceLowercaseFirst` [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') {#Abblix.Jwt.JwtValidationError.ToString(bool).forceLowercaseFirst} If true, converts the first letter to lowercase for embedding in larger sentences\. If false, preserves the original capitalization\. Default is true\. #### Returns [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') The error description, optionally with the first letter in lowercase if a description is available, otherwise returns the error code as a string\. ### Remarks This method is useful for embedding error descriptions in the middle of sentences, where starting with a lowercase letter maintains proper grammar\. Example with forceLowercaseFirst=true: "The id token hint contains invalid token: token has expired" Example with forceLowercaseFirst=false: "Token has expired" --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.KeyVersion.md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt 'Abblix\.Jwt') ## KeyVersion Struct One version of a custodian\-held key: its public half and when the custodian created that version\. The public key carries the version\-specific `kid` that routes a private operation back to this exact version, so publishing a key's versions lets a client verify a signature made by any of them and lets the server unwrap a JWE encrypted to any of them\. The creation time is what a rotation policy reads to hold a freshly minted version as announced\-but\-not\-yet\-signing until client JWKS caches catch up \(the propagation window\), and to keep a superseded version published until its tokens expire\. ```csharp public readonly record struct KeyVersion : System.IEquatable ``` Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[KeyVersion](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.KeyVersion 'Abblix\.Jwt\.KeyVersion')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Constructors ## KeyVersion\(JsonWebKey, DateTimeOffset\) Constructor {#Abblix.Jwt.KeyVersion.KeyVersion(Abblix.Jwt.JsonWebKey,System.DateTimeOffset)} One version of a custodian\-held key: its public half and when the custodian created that version\. The public key carries the version\-specific `kid` that routes a private operation back to this exact version, so publishing a key's versions lets a client verify a signature made by any of them and lets the server unwrap a JWE encrypted to any of them\. The creation time is what a rotation policy reads to hold a freshly minted version as announced\-but\-not\-yet\-signing until client JWKS caches catch up \(the propagation window\), and to keep a superseded version published until its tokens expire\. ```csharp public KeyVersion(Abblix.Jwt.JsonWebKey PublicKey, System.DateTimeOffset CreatedAt); ``` #### Parameters ###### `PublicKey` [JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey') {#Abblix.Jwt.KeyVersion.KeyVersion(Abblix.Jwt.JsonWebKey,System.DateTimeOffset).PublicKey} The public\-only key material for this version, with its version\-specific `kid`\. ###### `CreatedAt` [System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset') {#Abblix.Jwt.KeyVersion.KeyVersion(Abblix.Jwt.JsonWebKey,System.DateTimeOffset).CreatedAt} When the custodian created this version\. A custodian that does not track a creation time reports [System\.DateTimeOffset\.MinValue](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset.minvalue 'System\.DateTimeOffset\.MinValue'), which a rotation policy treats as "always past the propagation window", so a single non\-rotating key is always eligible to sign\. ### Properties ## KeyVersion\.CreatedAt Property {#Abblix.Jwt.KeyVersion.CreatedAt} When the custodian created this version\. A custodian that does not track a creation time reports [System\.DateTimeOffset\.MinValue](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset.minvalue 'System\.DateTimeOffset\.MinValue'), which a rotation policy treats as "always past the propagation window", so a single non\-rotating key is always eligible to sign\. ```csharp public System.DateTimeOffset CreatedAt { get; init; } ``` #### Property Value [System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset') ## KeyVersion\.PublicKey Property {#Abblix.Jwt.KeyVersion.PublicKey} The public\-only key material for this version, with its version\-specific `kid`\. ```csharp public Abblix.Jwt.JsonWebKey PublicKey { get; init; } ``` #### Property Value [JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey') --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.OctetJsonWebKey.md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt 'Abblix\.Jwt') ## OctetJsonWebKey Class Represents a Symmetric JSON Web Key \(JWK\) containing symmetric key material for algorithms like HMAC\. Supports symmetric keys per RFC 7518 Section 6\.4\. ```csharp public sealed record OctetJsonWebKey : Abblix.Jwt.JsonWebKey, System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey') → OctetJsonWebKey Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[OctetJsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.OctetJsonWebKey 'Abblix\.Jwt\.OctetJsonWebKey')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Properties ## OctetJsonWebKey\.HasPrivateKey Property {#Abblix.Jwt.OctetJsonWebKey.HasPrivateKey} Checks if the key contains private key material\. ```csharp public override bool HasPrivateKey { get; } ``` #### Property Value [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') ## OctetJsonWebKey\.HasPublicKey Property {#Abblix.Jwt.OctetJsonWebKey.HasPublicKey} Checks if the key contains public key material\. ```csharp public override bool HasPublicKey { get; } ``` #### Property Value [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') ## OctetJsonWebKey\.KeyType Property {#Abblix.Jwt.OctetJsonWebKey.KeyType} The key type identifier for symmetric \(Octet Sequence\) keys\. Always returns "oct"\. ```csharp public override string KeyType { get; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## OctetJsonWebKey\.KeyValue Property {#Abblix.Jwt.OctetJsonWebKey.KeyValue} Symmetric Key Value \(k\)\. Used for oct \(Octet Sequence\) keys, which are symmetric keys used in algorithms like HMAC\-SHA256, HMAC\-SHA384, and HMAC\-SHA512\. This is a required parameter for symmetric keys and must be kept confidential\. ```csharp public byte[]? KeyValue { get; set; } ``` #### Property Value [System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') ### Methods ## OctetJsonWebKey\.Sanitize\(bool\) Method {#Abblix.Jwt.OctetJsonWebKey.Sanitize(bool)} Prepares a sanitized version of the symmetric JWK that excludes the key value unless explicitly included\. ```csharp public override Abblix.Jwt.JsonWebKey Sanitize(bool includePrivateKeys); ``` #### Parameters ###### `includePrivateKeys` [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') {#Abblix.Jwt.OctetJsonWebKey.Sanitize(bool).includePrivateKeys} Whether to include the symmetric key value in the sanitized output\. #### Returns [JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey') A new instance of [OctetJsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.OctetJsonWebKey 'Abblix\.Jwt\.OctetJsonWebKey') with or without the key value based on the input parameter\. #### Exceptions [System\.InvalidOperationException](https://learn.microsoft.com/en-us/dotnet/api/system.invalidoperationexception 'System\.InvalidOperationException') Thrown when includePrivateKeys is true but the key contains no key value\. ### Remarks For symmetric keys, the key value is always considered sensitive and should be treated as private key material\. --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.PublicKeyUsages.md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt 'Abblix\.Jwt') ## PublicKeyUsages Class Values for the JWK "use" parameter \(RFC 7517 Section 4\.2\), declaring whether a key is intended for signing or encryption\. Lets clients pick the right key from a JWK Set when a JWKS contains keys for both purposes\. ```csharp public static class PublicKeyUsages ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → PublicKeyUsages ### Fields ## PublicKeyUsages\.Encryption Field {#Abblix.Jwt.PublicKeyUsages.Encryption} Key is intended for encryption operations \(JWE\), either as a key\-encryption key or, for symmetric keys, as the content\-encryption key in direct mode\. ```csharp public const string Encryption = "enc"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## PublicKeyUsages\.Signature Field {#Abblix.Jwt.PublicKeyUsages.Signature} Key is intended for digital signature or MAC operations \(JWS\)\. ```csharp public const string Signature = "sig"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.RsaJsonWebKey.md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt 'Abblix\.Jwt') ## RsaJsonWebKey Class Represents an RSA JSON Web Key \(JWK\) containing RSA\-specific cryptographic parameters\. Supports both public and private RSA keys per RFC 7518 Section 6\.3\. ```csharp public sealed record RsaJsonWebKey : Abblix.Jwt.JsonWebKey, System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey') → RsaJsonWebKey Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[RsaJsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.RsaJsonWebKey 'Abblix\.Jwt\.RsaJsonWebKey')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Properties ## RsaJsonWebKey\.Exponent Property {#Abblix.Jwt.RsaJsonWebKey.Exponent} RSA Public Key Exponent \(e\)\. Part of the RSA public key\. This is a required parameter for RSA public keys\. ```csharp public byte[]? Exponent { get; set; } ``` #### Property Value [System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') ## RsaJsonWebKey\.FirstCrtCoefficient Property {#Abblix.Jwt.RsaJsonWebKey.FirstCrtCoefficient} RSA First CRT Coefficient \(qi\)\. Part of the RSA private key in CRT format\. Computed as q^\(\-1\) mod p, the modular multiplicative inverse of q modulo p\. ```csharp public byte[]? FirstCrtCoefficient { get; set; } ``` #### Property Value [System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') ## RsaJsonWebKey\.FirstFactorCrtExponent Property {#Abblix.Jwt.RsaJsonWebKey.FirstFactorCrtExponent} RSA First Factor CRT Exponent \(dp\)\. Part of the RSA private key in Chinese Remainder Theorem \(CRT\) format\. Computed as d mod \(p\-1\), where d is the private exponent and p is the first prime factor\. ```csharp public byte[]? FirstFactorCrtExponent { get; set; } ``` #### Property Value [System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') ## RsaJsonWebKey\.FirstPrimeFactor Property {#Abblix.Jwt.RsaJsonWebKey.FirstPrimeFactor} RSA First Prime Factor \(p\)\. Part of the RSA private key\. Used in Chinese Remainder Theorem \(CRT\) optimization for RSA operations\. ```csharp public byte[]? FirstPrimeFactor { get; set; } ``` #### Property Value [System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') ## RsaJsonWebKey\.HasPrivateKey Property {#Abblix.Jwt.RsaJsonWebKey.HasPrivateKey} Checks if the key contains private key material\. ```csharp public override bool HasPrivateKey { get; } ``` #### Property Value [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') ## RsaJsonWebKey\.HasPublicKey Property {#Abblix.Jwt.RsaJsonWebKey.HasPublicKey} Checks if the key contains public key material\. ```csharp public override bool HasPublicKey { get; } ``` #### Property Value [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') ## RsaJsonWebKey\.KeyType Property {#Abblix.Jwt.RsaJsonWebKey.KeyType} The key type identifier for RSA keys\. Always returns "RSA"\. ```csharp public override string KeyType { get; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## RsaJsonWebKey\.Modulus Property {#Abblix.Jwt.RsaJsonWebKey.Modulus} RSA Public Key Modulus \(n\)\. Part of the RSA public key\. This is a required parameter for RSA public keys\. ```csharp public byte[]? Modulus { get; set; } ``` #### Property Value [System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') ## RsaJsonWebKey\.PrivateExponent Property {#Abblix.Jwt.RsaJsonWebKey.PrivateExponent} RSA Private Exponent \(d\)\. Part of the RSA private key\. This parameter must be kept confidential and should only be present in private keys\. ```csharp public byte[]? PrivateExponent { get; set; } ``` #### Property Value [System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') ## RsaJsonWebKey\.SecondFactorCrtExponent Property {#Abblix.Jwt.RsaJsonWebKey.SecondFactorCrtExponent} RSA Second Factor CRT Exponent \(dq\)\. Part of the RSA private key in CRT format\. Computed as d mod \(q\-1\), where d is the private exponent and q is the second prime factor\. ```csharp public byte[]? SecondFactorCrtExponent { get; set; } ``` #### Property Value [System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') ## RsaJsonWebKey\.SecondPrimeFactor Property {#Abblix.Jwt.RsaJsonWebKey.SecondPrimeFactor} RSA Second Prime Factor \(q\)\. Part of the RSA private key\. Used in Chinese Remainder Theorem \(CRT\) optimization for RSA operations\. ```csharp public byte[]? SecondPrimeFactor { get; set; } ``` #### Property Value [System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') ### Methods ## RsaJsonWebKey\.Sanitize\(bool\) Method {#Abblix.Jwt.RsaJsonWebKey.Sanitize(bool)} Prepares a sanitized version of the RSA JWK that excludes private key information unless explicitly included\. ```csharp public override Abblix.Jwt.JsonWebKey Sanitize(bool includePrivateKeys); ``` #### Parameters ###### `includePrivateKeys` [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') {#Abblix.Jwt.RsaJsonWebKey.Sanitize(bool).includePrivateKeys} Whether to include private key data in the sanitized output\. #### Returns [JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey') A new instance of [RsaJsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.RsaJsonWebKey 'Abblix\.Jwt\.RsaJsonWebKey') with or without private key data based on the input parameter\. #### Exceptions [System\.InvalidOperationException](https://learn.microsoft.com/en-us/dotnet/api/system.invalidoperationexception 'System\.InvalidOperationException') Thrown when includePrivateKeys is true but the key contains no private key data\. --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ServiceCollectionExtensions.md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt 'Abblix\.Jwt') ## ServiceCollectionExtensions Class Provides extension methods for [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') to register JwT\-related services within the application\. ```csharp public static class ServiceCollectionExtensions ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ServiceCollectionExtensions ### Methods ## ServiceCollectionExtensions\.AddCriticalHeaderHandler\\(this IServiceCollection, string\) Method {#Abblix.Jwt.ServiceCollectionExtensions.AddCriticalHeaderHandler_THandler_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,string)} Registers an [ICriticalHeaderHandler](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ICriticalHeaderHandler 'Abblix\.Jwt\.ICriticalHeaderHandler') for a single JOSE header extension parameter listed in a JWS 'crit' array \(RFC 7515 §4\.1\.11\)\. The parameter name is the DI key, so the registration cannot claim a name without a handler behind it \- name and behaviour are inseparable\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection AddCriticalHeaderHandler(this Microsoft.Extensions.DependencyInjection.IServiceCollection services, string headerName) where THandler : class, Abblix.Jwt.ICriticalHeaderHandler; ``` #### Type parameters ###### `THandler` {#Abblix.Jwt.ServiceCollectionExtensions.AddCriticalHeaderHandler_THandler_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,string).THandler} Concrete handler type\. #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.Jwt.ServiceCollectionExtensions.AddCriticalHeaderHandler_THandler_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,string).services} The service collection to register the handler in\. ###### `headerName` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Jwt.ServiceCollectionExtensions.AddCriticalHeaderHandler_THandler_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,string).headerName} The JOSE header parameter name the handler implements \(byte\-exact per RFC 7515 §5\.3\); used as the DI key the validator routes a 'crit' name to\. A handler covering a family of related names registers under each\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') The service collection for method chaining\. ### Remarks Keyed\-name DI mirrors the signer/encryptor registrations in this assembly \([Abblix\.Jwt\.ServiceCollectionExtensions\.AddSignatureAlgorithm<>\.Extensions\.DependencyInjection\.IServiceCollection,System\.String\)](https://learn.microsoft.com/en-us/dotnet/api/abblix.jwt.servicecollectionextensions.addsignaturealgorithm--2#abblix-jwt-servicecollectionextensions-addsignaturealgorithm--2(microsoft-extensions-dependencyinjection-iservicecollection-system-string) 'Abblix\.Jwt\.ServiceCollectionExtensions\.AddSignatureAlgorithm\`\`2\(Microsoft\.Extensions\.DependencyInjection\.IServiceCollection,System\.String\)') by 'alg'\): one keyed registration serves O\(1\) request\-time dispatch \(`GetKeyedService(name)`\)\. [Microsoft\.Extensions\.DependencyInjection\.Extensions\.ServiceCollectionDescriptorExtensions\.TryAddKeyedSingleton<>\.Extensions\.DependencyInjection\.IServiceCollection,System\.Object\)](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.extensions.servicecollectiondescriptorextensions.tryaddkeyedsingleton--2#microsoft-extensions-dependencyinjection-extensions-servicecollectiondescriptorextensions-tryaddkeyedsingleton--2(microsoft-extensions-dependencyinjection-iservicecollection-system-object) 'Microsoft\.Extensions\.DependencyInjection\.Extensions\.ServiceCollectionDescriptorExtensions\.TryAddKeyedSingleton\`\`2\(Microsoft\.Extensions\.DependencyInjection\.IServiceCollection,System\.Object\)') dedups by \(service, key\) first\-wins, so a host pre\-registration for a name wins over a later default\. ## ServiceCollectionExtensions\.AddJsonWebTokens\(this IServiceCollection\) Method {#Abblix.Jwt.ServiceCollectionExtensions.AddJsonWebTokens(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection)} Registers services for creating and validating JSON Web Tokens \(JWTs\) within the application\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection AddJsonWebTokens(this Microsoft.Extensions.DependencyInjection.IServiceCollection services); ``` #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.Jwt.ServiceCollectionExtensions.AddJsonWebTokens(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).services} The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') to configure with JWT services\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') The configured [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection'), enabling further chaining of service registrations\. ### Remarks This method adds services for JWT handling, enabling the application to generate and validate JWTs efficiently\. JWTs are an essential part of modern web application security, used for representing claims securely between two parties\. By registering these services, the application can: \- Create JWTs with [IJsonWebTokenCreator](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.IJsonWebTokenCreator 'Abblix\.Jwt\.IJsonWebTokenCreator'), allowing for the generation of tokens that can securely transmit information between parties\. \- Validate JWTs with [IJsonWebTokenValidator](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.IJsonWebTokenValidator 'Abblix\.Jwt\.IJsonWebTokenValidator'), ensuring that incoming tokens are valid and have not been tampered with\. This setup is crucial for implementing authentication and authorization mechanisms that rely on JWTs, such as OAuth 2\.0 and OpenID Connect\. ## ServiceCollectionExtensions\.AddPbes2KeyManagement\(this IServiceCollection\) Method {#Abblix.Jwt.ServiceCollectionExtensions.AddPbes2KeyManagement(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection)} Enables the PBES2 password\-based key management algorithms \(PBES2\-HS256\+A128KW, PBES2\-HS384\+A192KW, PBES2\-HS512\+A256KW; RFC 7518 Section 4\.8\) for both producing and consuming JWE tokens\. They are deliberately not part of [AddJsonWebTokens\(this IServiceCollection\)](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ServiceCollectionExtensions#Abblix.Jwt.ServiceCollectionExtensions.AddJsonWebTokens(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection) 'Abblix\.Jwt\.ServiceCollectionExtensions\.AddJsonWebTokens\(this Microsoft\.Extensions\.DependencyInjection\.IServiceCollection\)'): the 'p2c' header of an inbound token dictates PBKDF2 work performed before any authentication of the token \(the CVE\-2022\-36083 class of denial of service\), and because JWE decryption keys are matched by key identifier, an octet key configured for another key\-management algorithm could otherwise be driven into the PBKDF2 path by an attacker\-chosen 'alg' header\. Accepting password\-based key management is therefore an explicit hosting decision\. The iteration count of an inbound token is bounded to \[1000, 10,000\] even when enabled\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection AddPbes2KeyManagement(this Microsoft.Extensions.DependencyInjection.IServiceCollection services); ``` #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.Jwt.ServiceCollectionExtensions.AddPbes2KeyManagement(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).services} The service collection to register the PBES2 encryptors in\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') The service collection for method chaining\. ## ServiceCollectionExtensions\.AddRsaPkcs1KeyManagement\(this IServiceCollection\) Method {#Abblix.Jwt.ServiceCollectionExtensions.AddRsaPkcs1KeyManagement(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection)} Enables the RSA1\_5 \(RSAES\-PKCS1\-v1\_5\) key management algorithm \(RFC 7518 Section 4\.2\) for both producing and consuming JWE tokens\. It is deliberately not part of [AddJsonWebTokens\(this IServiceCollection\)](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ServiceCollectionExtensions#Abblix.Jwt.ServiceCollectionExtensions.AddJsonWebTokens(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection) 'Abblix\.Jwt\.ServiceCollectionExtensions\.AddJsonWebTokens\(this Microsoft\.Extensions\.DependencyInjection\.IServiceCollection\)'): NIST SP 800\-131A Rev\. 2 disallows RSA key transport with PKCS\#1 v1\.5 padding after 2023, and RFC 8725 §3\.2 prescribes preferring RSAES\-OAEP \- interoperating with a legacy peer that still requires it is an explicit hosting decision\. The padding's Bleichenbacher decryption oracle stays closed for opted\-in hosts by the RFC 7516 §11\.5 mitigation in [Abblix\.Jwt\.JsonWebTokenEncryptor](https://learn.microsoft.com/en-us/dotnet/api/abblix.jwt.jsonwebtokenencryptor 'Abblix\.Jwt\.JsonWebTokenEncryptor'): a CEK that fails to decrypt is replaced with a random CEK and the AEAD step still runs, so a decryption failure is processed identically regardless of padding validity\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection AddRsaPkcs1KeyManagement(this Microsoft.Extensions.DependencyInjection.IServiceCollection services); ``` #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.Jwt.ServiceCollectionExtensions.AddRsaPkcs1KeyManagement(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).services} The service collection to register the encryptor in\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') The service collection for method chaining\. ## ServiceCollectionExtensions\.ComposeExternalKeyBackends\(this IServiceCollection\) Method {#Abblix.Jwt.ServiceCollectionExtensions.ComposeExternalKeyBackends(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection)} Registers the external backends for the wired [IKeyCustodian](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.IKeyCustodian 'Abblix\.Jwt\.ExternalKeys\.IKeyCustodian') \- [Abblix\.Jwt\.ExternalKeys\.ExternalKeySigner](https://learn.microsoft.com/en-us/dotnet/api/abblix.jwt.externalkeys.externalkeysigner 'Abblix\.Jwt\.ExternalKeys\.ExternalKeySigner') on the signing seam and [Abblix\.Jwt\.ExternalKeys\.ExternalKeyDecryptor](https://learn.microsoft.com/en-us/dotnet/api/abblix.jwt.externalkeys.externalkeydecryptor 'Abblix\.Jwt\.ExternalKeys\.ExternalKeyDecryptor') on the key\-recovery seam \- and composes each with its in\-process peer, so a key routes to the backend that owns it: a public\-only signing key routes its signing to the custodian, a public\-only decryption key routes its unwrap or ECDH\-ES agreement there, and keys carrying their private material keep working in process\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection ComposeExternalKeyBackends(this Microsoft.Extensions.DependencyInjection.IServiceCollection services); ``` #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.Jwt.ServiceCollectionExtensions.ComposeExternalKeyBackends(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).services} #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') ### Remarks The raw seam, for a host that manages key material entirely on its own terms\. It records no key placement, which makes it the wrong call inside an OpenID Provider: that server refuses to serve keys once a custodian is registered and no placement was named, so `/jwks` and every token issuance would fail\. Such a host calls [AddCustodian<TCustodian>\(this IServiceCollection\)](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.ExternalKeysServiceCollectionExtensions#Abblix.Jwt.ExternalKeys.ExternalKeysServiceCollectionExtensions.AddCustodian_TCustodian_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection) 'Abblix\.Jwt\.ExternalKeys\.ExternalKeysServiceCollectionExtensions\.AddCustodian\\(this Microsoft\.Extensions\.DependencyInjection\.IServiceCollection\)') and a placement, which perform this too\. Never both: `Compose` refuses the second composition on the spot\. Call after [AddJsonWebTokens\(this IServiceCollection\)](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ServiceCollectionExtensions#Abblix.Jwt.ServiceCollectionExtensions.AddJsonWebTokens(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection) 'Abblix\.Jwt\.ServiceCollectionExtensions\.AddJsonWebTokens\(this Microsoft\.Extensions\.DependencyInjection\.IServiceCollection\)'), whose in-process backends this composes with. Register the custodian first, by any means the container accepts - it is resolved, not passed in here. --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.SigningAlgorithms.md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt 'Abblix\.Jwt') ## SigningAlgorithms Class JWS signing algorithm identifiers \("alg" header values\) defined in RFC 7518 Section 3\. Used to indicate how a JWT was signed and to look up the matching signer or verifier\. ```csharp public static class SigningAlgorithms ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → SigningAlgorithms ### Fields ## SigningAlgorithms\.ES256 Field {#Abblix.Jwt.SigningAlgorithms.ES256} ECDSA on curve P\-256 with SHA\-256 \(RFC 7518 Section 3\.4\)\. Backed by \.NET `ECDsa` using `DSASignatureFormat.IeeeP1363FixedFieldConcatenation`\. Produces 64\-byte signatures and is significantly smaller than RSA equivalents\. ```csharp public const string ES256 = "ES256"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## SigningAlgorithms\.ES384 Field {#Abblix.Jwt.SigningAlgorithms.ES384} ECDSA on curve P\-384 with SHA\-384 \(RFC 7518 Section 3\.4\)\. Backed by \.NET `ECDsa` in IEEE P1363 format; produces 96\-byte signatures\. ```csharp public const string ES384 = "ES384"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## SigningAlgorithms\.ES512 Field {#Abblix.Jwt.SigningAlgorithms.ES512} ECDSA on curve P\-521 with SHA\-512 \(RFC 7518 Section 3\.4\)\. Backed by \.NET `ECDsa` in IEEE P1363 format; produces 132\-byte signatures\. Note that the curve is P\-521 \(521 bits\) although the algorithm name is "ES512"\. ```csharp public const string ES512 = "ES512"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## SigningAlgorithms\.HS256 Field {#Abblix.Jwt.SigningAlgorithms.HS256} HMAC with SHA\-256 \(RFC 7518 Section 3\.2\)\. Backed by \.NET `HMACSHA256` with constant\-time signature comparison\. Requires a shared symmetric key of at least 256 bits\. Suitable only when issuer and verifier can both be trusted with the secret\. ```csharp public const string HS256 = "HS256"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## SigningAlgorithms\.HS384 Field {#Abblix.Jwt.SigningAlgorithms.HS384} HMAC with SHA\-384 \(RFC 7518 Section 3\.2\)\. Backed by \.NET `HMACSHA384`; requires a shared symmetric key of at least 384 bits\. ```csharp public const string HS384 = "HS384"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## SigningAlgorithms\.HS512 Field {#Abblix.Jwt.SigningAlgorithms.HS512} HMAC with SHA\-512 \(RFC 7518 Section 3\.2\)\. Backed by \.NET `HMACSHA512`; requires a shared symmetric key of at least 512 bits\. ```csharp public const string HS512 = "HS512"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## SigningAlgorithms\.Known Field {#Abblix.Jwt.SigningAlgorithms.Known} The set of every `alg` identifier this library recognises\. Per RFC 7515 §5\.3 and §10\.13 the comparison is byte\-exact, so case\-variants like `None`/`NONE` are not members of this set and must be rejected as unknown algorithms \- not silently stream into the signature\-verification path where they would surface as the \(semantically incorrect\) "invalid signature" failure\. ```csharp public static readonly IReadOnlySet Known; ``` #### Field Value [System\.Collections\.Generic\.IReadOnlySet<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ireadonlyset-1 'System\.Collections\.Generic\.IReadOnlySet\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ireadonlyset-1 'System\.Collections\.Generic\.IReadOnlySet\`1') ## SigningAlgorithms\.None Field {#Abblix.Jwt.SigningAlgorithms.None} Unsecured JWS \("none"\) per RFC 7515 Section 6: no digital signature or MAC is applied\. The token's integrity is therefore not protected; callers must reject unsigned tokens unless integrity is guaranteed by another channel\. ```csharp public const string None = "none"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## SigningAlgorithms\.PS256 Field {#Abblix.Jwt.SigningAlgorithms.PS256} RSASSA\-PSS with SHA\-256 and MGF1 \(RFC 7518 Section 3\.5\)\. Backed by \.NET `RSA` with `RSASignaturePadding.Pss`\. Preferred over RS256 when both sides support PSS, because PSS has a tighter security reduction\. ```csharp public const string PS256 = "PS256"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## SigningAlgorithms\.PS384 Field {#Abblix.Jwt.SigningAlgorithms.PS384} RSASSA\-PSS with SHA\-384 and MGF1 \(RFC 7518 Section 3\.5\)\. Backed by \.NET `RSA` with `RSASignaturePadding.Pss`\. ```csharp public const string PS384 = "PS384"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## SigningAlgorithms\.PS512 Field {#Abblix.Jwt.SigningAlgorithms.PS512} RSASSA\-PSS with SHA\-512 and MGF1 \(RFC 7518 Section 3\.5\)\. Backed by \.NET `RSA` with `RSASignaturePadding.Pss`\. ```csharp public const string PS512 = "PS512"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## SigningAlgorithms\.RS256 Field {#Abblix.Jwt.SigningAlgorithms.RS256} RSASSA\-PKCS1\-v1\_5 with SHA\-256 \(RFC 7518 Section 3\.3\)\. Backed by \.NET `RSA` with `RSASignaturePadding.Pkcs1`\. Widely deployed default for OIDC ID tokens\. ```csharp public const string RS256 = "RS256"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## SigningAlgorithms\.RS384 Field {#Abblix.Jwt.SigningAlgorithms.RS384} RSASSA\-PKCS1\-v1\_5 with SHA\-384 \(RFC 7518 Section 3\.3\)\. Same construction as RS256 with a stronger hash; backed by \.NET `RSA` with `RSASignaturePadding.Pkcs1`\. ```csharp public const string RS384 = "RS384"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## SigningAlgorithms\.RS512 Field {#Abblix.Jwt.SigningAlgorithms.RS512} RSASSA\-PKCS1\-v1\_5 with SHA\-512 \(RFC 7518 Section 3\.3\)\. Same construction as RS256 with SHA\-512; backed by \.NET `RSA` with `RSASignaturePadding.Pkcs1`\. ```csharp public const string RS512 = "RS512"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ValidationOptions.md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt 'Abblix\.Jwt') ## ValidationOptions Enum Set of flags for specifying various validation options for JWT tokens\. These options can be combined using bitwise operations to create a customized set of validation rules\. ```csharp public enum ValidationOptions ``` ### Fields ###### `RequireIssuer` 1 {#Abblix.Jwt.ValidationOptions.RequireIssuer} Requires the issuer claim \(iss\) to be present in the JWT\. ###### `ValidateIssuer` 2 {#Abblix.Jwt.ValidationOptions.ValidateIssuer} Validates the issuer of the JWT if present\. Ensures that the issuer claim \(iss\) matches a specified value, typically configured in the token validation parameters\. ###### `RequireAudience` 4 {#Abblix.Jwt.ValidationOptions.RequireAudience} Requires the audience claim \(aud\) to be present in the JWT\. ###### `ValidateAudience` 8 {#Abblix.Jwt.ValidationOptions.ValidateAudience} Validates the audience of the JWT if present\. Ensures that the audience claim \(aud\) matches one of the specified values, typically configured in the token validation parameters\. ###### `RequireSignedTokens` 16 {#Abblix.Jwt.ValidationOptions.RequireSignedTokens} Rejects tokens issued with the unsecured "none" algorithm, ensuring that every accepted token carries a signature or MAC\. ###### `ValidateIssuerSigningKey` 32 {#Abblix.Jwt.ValidationOptions.ValidateIssuerSigningKey} Validates the signing key of the issuer\. Ensures that the key used to sign the JWT is valid and is authorized by the issuer\. ###### `ValidateLifetime` 64 {#Abblix.Jwt.ValidationOptions.ValidateLifetime} Validates the lifetime of the JWT\. Ensures that the token is within its valid time frame of use \(not expired and not yet valid if the 'nbf' claim is specified\)\. ###### `UseEmbeddedVerificationKey` 128 {#Abblix.Jwt.ValidationOptions.UseEmbeddedVerificationKey} Switches signature validation to the embedded\-key trust model: the signing key is taken from the JOSE header's `jwk` parameter \([VerificationKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenHeader#Abblix.Jwt.JsonWebTokenHeader.VerificationKey 'Abblix\.Jwt\.JsonWebTokenHeader\.VerificationKey')\) and the issuer\-resolved\-keys delegate is bypassed entirely\. Set this flag only on validation paths whose protocol design explicitly trusts the proof to carry its own key \(DPoP per RFC 9449 §4\.2 is the canonical example\)\. ### Remarks Auto\-trusting an embedded JWK without an opt\-in is a known JWT antipattern: an attacker who controls the token header could substitute their own key\. The flag is the explicit caller\-side declaration "I am validating a proof whose trust model is embedded\-key, not issuer\-resolved\-key\." When the flag is set the JOSE header MUST carry a valid `jwk` parameter; absence is an error\. ###### `RequireExpirationTime` 256 {#Abblix.Jwt.ValidationOptions.RequireExpirationTime} Requires the token to carry an expiration time\. Pairs with [ValidateLifetime](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ValidationOptions#Abblix.Jwt.ValidationOptions.ValidateLifetime 'Abblix\.Jwt\.ValidationOptions\.ValidateLifetime') the way [RequireIssuer](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ValidationOptions#Abblix.Jwt.ValidationOptions.RequireIssuer 'Abblix\.Jwt\.ValidationOptions\.RequireIssuer') pairs with [ValidateIssuer](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ValidationOptions#Abblix.Jwt.ValidationOptions.ValidateIssuer 'Abblix\.Jwt\.ValidationOptions\.ValidateIssuer'): the Validate flag checks a claim that is there, the Require flag says it has to be there\. ### Remarks Without this, [ValidateLifetime](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ValidationOptions#Abblix.Jwt.ValidationOptions.ValidateLifetime 'Abblix\.Jwt\.ValidationOptions\.ValidateLifetime') alone accepts a token carrying neither `nbf` nor `exp` \- there is no instant at which such a token is expired, so checking its lifetime finds nothing wrong\. That is right for the token types whose specifications leave expiry out, and wrong for the ones that make it REQUIRED, which is why the two are separate flags rather than one stricter check\. Set it wherever the governing specification demands `exp`: an ID Token \(OpenID Connect Core 1\.0 section 2, "REQUIRED"\), a JWT access token \(RFC 9068 section 2\.2, "exp REQUIRED"\), a client assertion or JWT bearer grant \(RFC 7523 section 3, "The JWT MUST contain an 'exp' claim"\)\. Leave it clear where the specification is silent, and note that silence is not an oversight in at least one case: RFC 7592 section 5 says a registration access token "SHOULD NOT expire while a client is still actively registered", and this library issues those without an expiry accordingly\. Deliberately absent from [Default](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ValidationOptions#Abblix.Jwt.ValidationOptions.Default 'Abblix\.Jwt\.ValidationOptions\.Default'), because several call sites derive their options from Default by subtraction and would inherit a requirement their tokens do not meet \- including tokens this library itself mints\. ###### `RequireValidIssuer` 3 {#Abblix.Jwt.ValidationOptions.RequireValidIssuer} Requires and validates the issuer claim \(iss\)\. Combines RequireIssuer and ValidateIssuer flags\. ###### `RequireValidAudience` 12 {#Abblix.Jwt.ValidationOptions.RequireValidAudience} Requires and validates the audience claim \(aud\)\. Combines RequireAudience and ValidateAudience flags\. ###### `RequireValidSignedTokens` 48 {#Abblix.Jwt.ValidationOptions.RequireValidSignedTokens} Requires and validates signed tokens\. Combines RequireSignedTokens and ValidateIssuerSigningKey flags\. ###### `Default` 127 {#Abblix.Jwt.ValidationOptions.Default} Default validation options that include validating the issuer, audience, presence of a signature, validation of the issuer's signing key, and the token's lifetime\. This is a common set of validations providing a standard level of security\. --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ValidationParameters.md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt 'Abblix\.Jwt') ## ValidationParameters Class Defines parameters used during the validation of a JSON Web Token \(JWT\)\. ```csharp public record ValidationParameters : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ValidationParameters Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[ValidationParameters](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ValidationParameters 'Abblix\.Jwt\.ValidationParameters')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Properties ## ValidationParameters\.AllowedSigningAlgorithms Property {#Abblix.Jwt.ValidationParameters.AllowedSigningAlgorithms} JWS signing algorithms \(per RFC 7518\) that the validator MUST accept; any other `alg` in the JOSE header causes rejection\. When `null` or empty the check is skipped \- the validator only enforces the basic [RequireSignedTokens](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ValidationOptions#Abblix.Jwt.ValidationOptions.RequireSignedTokens 'Abblix\.Jwt\.ValidationOptions\.RequireSignedTokens') rule \(which forbids `none`\) and lets any registered signer match\. ```csharp public System.Collections.Generic.IReadOnlySet? AllowedSigningAlgorithms { get; init; } ``` #### Property Value [System\.Collections\.Generic\.IReadOnlySet<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ireadonlyset-1 'System\.Collections\.Generic\.IReadOnlySet\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ireadonlyset-1 'System\.Collections\.Generic\.IReadOnlySet\`1') ### Remarks Use this to express policy beyond "signed\-or\-not" without writing per\-algorithm matchers in callers: pass the asymmetric\-only set to enforce DPoP RFC 9449 section 4\.2, pass \{RS256, ES256\} to require small\-footprint algorithms only, and so on\. Comparison is byte\-exact per RFC 7515 section 5\.3\. ## ValidationParameters\.ClockSkew Property {#Abblix.Jwt.ValidationParameters.ClockSkew} How far this token's timestamps may sit either side of this clock and still be honoured\. None unless the caller says otherwise\. ```csharp public Abblix.Jwt.ClockSkew ClockSkew { get; set; } ``` #### Property Value [ClockSkew](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ClockSkew 'Abblix\.Jwt\.ClockSkew') ## ValidationParameters\.ExpectedTokenTypes Property {#Abblix.Jwt.ValidationParameters.ExpectedTokenTypes} Token\-type values \(per RFC 7515 section 4\.1\.9 `typ` header\) that the JWT MUST match\. When non\-null and non\-empty the validator pins `typ` per RFC 8725 section 3\.11 to prevent token\-type confusion: a JWS signed for one type \(id\_token, logout\_token, request\_object, DPoP proof, JARM response, OAuth access\_token\) cannot be replayed as another by relying parties that trust the same issuer for several classes\. ```csharp public System.Collections.Generic.IReadOnlySet? ExpectedTokenTypes { get; init; } ``` #### Property Value [System\.Collections\.Generic\.IReadOnlySet<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ireadonlyset-1 'System\.Collections\.Generic\.IReadOnlySet\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ireadonlyset-1 'System\.Collections\.Generic\.IReadOnlySet\`1') ### Remarks Matching is case\-insensitive and accepts either spelling of the `application/` prefix on either side, so `at+jwt` and `application/AT+JWT` name the same class\. A `typ` is a media type, and RFC 7515 section 4\.1\.9 adopts RFC 2045 section 5\.1 for it: "Matching of media type and subtype is ALWAYS case\-insensitive"\. The general string\-comparison rules of RFC 7515 section 5\.3 do not govern this parameter; that section ends by exempting it by name\. The comparer carried by the set is NOT what produces this behaviour and is not consulted for matching \- the validator compares explicitly, so that its rules cannot be widened or narrowed by how a host happened to construct the collection\. Supply any comparer, or none\. When this property is null or empty the validator skips the check, preserving historical behaviour for callers that have not opted in\. ## ValidationParameters\.Options Property {#Abblix.Jwt.ValidationParameters.Options} Options that control various aspects of JWT validation\. ```csharp public Abblix.Jwt.ValidationOptions Options { get; init; } ``` #### Property Value [ValidationOptions](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ValidationOptions 'Abblix\.Jwt\.ValidationOptions') ## ValidationParameters\.ResolveIssuerSigningKeys Property {#Abblix.Jwt.ValidationParameters.ResolveIssuerSigningKeys} Delegate that resolves the signing keys for a given issuer, used during token signature validation\. ```csharp public Abblix.Jwt.ValidationParameters.ResolveIssuerSigningKeysDelegate? ResolveIssuerSigningKeys { get; set; } ``` #### Property Value [ResolveIssuerSigningKeysDelegate\(string\)](Abblix.Jwt.ValidationParameters.ResolveIssuerSigningKeysDelegate(string).md 'Abblix\.Jwt\.ValidationParameters\.ResolveIssuerSigningKeysDelegate\(string\)') ## ValidationParameters\.ResolveTokenDecryptionKeys Property {#Abblix.Jwt.ValidationParameters.ResolveTokenDecryptionKeys} Delegate that resolves decryption keys for a given issuer, used during token decryption\. ```csharp public Abblix.Jwt.ValidationParameters.ResolveTokenDecryptionKeysDelegate? ResolveTokenDecryptionKeys { get; set; } ``` #### Property Value [ResolveTokenDecryptionKeysDelegate\(string\)](Abblix.Jwt.ValidationParameters.ResolveTokenDecryptionKeysDelegate(string).md 'Abblix\.Jwt\.ValidationParameters\.ResolveTokenDecryptionKeysDelegate\(string\)') ## ValidationParameters\.ValidateAudience Property {#Abblix.Jwt.ValidationParameters.ValidateAudience} Delegate used to validate one or more token audiences\. ```csharp public Abblix.Jwt.ValidationParameters.ValidateAudienceDelegate? ValidateAudience { get; set; } ``` #### Property Value [ValidateAudienceDelegate\(IEnumerable<string>\)](Abblix.Jwt.ValidationParameters.ValidateAudienceDelegate(System.Collections.Generic.IEnumerable_string_).md 'Abblix\.Jwt\.ValidationParameters\.ValidateAudienceDelegate\(System\.Collections\.Generic\.IEnumerable\\)') ## ValidationParameters\.ValidateIssuer Property {#Abblix.Jwt.ValidationParameters.ValidateIssuer} Delegate used to verify the validity of a token issuer\. ```csharp public Abblix.Jwt.ValidationParameters.ValidateIssuersDelegate? ValidateIssuer { get; set; } ``` #### Property Value [ValidateIssuersDelegate\(string\)](Abblix.Jwt.ValidationParameters.ValidateIssuersDelegate(string).md 'Abblix\.Jwt\.ValidationParameters\.ValidateIssuersDelegate\(string\)') --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ValidationParameters.ResolveIssuerSigningKeysDelegate(string).md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt 'Abblix\.Jwt').[ValidationParameters](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ValidationParameters 'Abblix\.Jwt\.ValidationParameters') ## ValidationParameters\.ResolveIssuerSigningKeysDelegate\(string\) Delegate Resolves signing keys \(JWKs\) asynchronously for a specified issuer\. ```csharp public delegate System.Collections.Generic.IAsyncEnumerable ValidationParameters.ResolveIssuerSigningKeysDelegate(string issuer); ``` #### Parameters ###### `issuer` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Jwt.ValidationParameters.ResolveIssuerSigningKeysDelegate(string).issuer} Issuer whose signing keys are to be resolved\. #### Returns [System\.Collections\.Generic\.IAsyncEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.iasyncenumerable-1 'System\.Collections\.Generic\.IAsyncEnumerable\`1')[JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.iasyncenumerable-1 'System\.Collections\.Generic\.IAsyncEnumerable\`1') An asynchronous stream of JSON Web Keys\. --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ValidationParameters.ResolveTokenDecryptionKeysDelegate(string).md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt 'Abblix\.Jwt').[ValidationParameters](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ValidationParameters 'Abblix\.Jwt\.ValidationParameters') ## ValidationParameters\.ResolveTokenDecryptionKeysDelegate\(string\) Delegate Resolves decryption keys \(JWKs\) asynchronously for a specified issuer\. ```csharp public delegate System.Collections.Generic.IAsyncEnumerable ValidationParameters.ResolveTokenDecryptionKeysDelegate(string issuer); ``` #### Parameters ###### `issuer` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Jwt.ValidationParameters.ResolveTokenDecryptionKeysDelegate(string).issuer} Issuer whose decryption keys are to be resolved\. #### Returns [System\.Collections\.Generic\.IAsyncEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.iasyncenumerable-1 'System\.Collections\.Generic\.IAsyncEnumerable\`1')[JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.iasyncenumerable-1 'System\.Collections\.Generic\.IAsyncEnumerable\`1') An asynchronous stream of JSON Web Keys\. --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ValidationParameters.ValidateAudienceDelegate(System.Collections.Generic.IEnumerable_string_).md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt 'Abblix\.Jwt').[ValidationParameters](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ValidationParameters 'Abblix\.Jwt\.ValidationParameters') ## ValidationParameters\.ValidateAudienceDelegate\(IEnumerable\\) Delegate Validates a collection of audiences against expected values\. ```csharp public delegate System.Threading.Tasks.Task ValidationParameters.ValidateAudienceDelegate(System.Collections.Generic.IEnumerable audiences); ``` #### Parameters ###### `audiences` [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') {#Abblix.Jwt.ValidationParameters.ValidateAudienceDelegate(System.Collections.Generic.IEnumerable_string_).audiences} Audiences to be validated\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task that returns true if validation succeeds\. --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ValidationParameters.ValidateIssuersDelegate(string).md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt 'Abblix\.Jwt').[ValidationParameters](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ValidationParameters 'Abblix\.Jwt\.ValidationParameters') ## ValidationParameters\.ValidateIssuersDelegate\(string\) Delegate Validates a token issuer against expected values\. ```csharp public delegate System.Threading.Tasks.Task ValidationParameters.ValidateIssuersDelegate(string issuer); ``` #### Parameters ###### `issuer` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Jwt.ValidationParameters.ValidateIssuersDelegate(string).issuer} Issuer to be validated\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task that returns true if validation succeeds\. --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Encryption.md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ## Abblix\.Jwt\.Encryption Namespace | Classes | | | :--- | :--- | | [DeterministicAeadEncryptor](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Encryption.DeterministicAeadEncryptor 'Abblix\.Jwt\.Encryption\.DeterministicAeadEncryptor') | Deterministic authenticated encryption bound to associated data: the same plaintext and associated data always seal to the same bytes, different inputs seal to unrelated bytes, and tampering or a wrong associated data is rejected on opening\. This is the property a reversible, stable pseudonym needs \- a value that is opaque and unlinkable to outsiders yet recoverable by the holder of the key, and identical across sessions and hosts for the same input\. | | [EncryptedData](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Encryption.EncryptedData 'Abblix\.Jwt\.Encryption\.EncryptedData') | Represents the result of JWE content encryption operation\. Contains the components required for JWE Compact Serialization per RFC 7516\. | | Interfaces | | | :--- | :--- | | [IContentKeyDecryptor](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Encryption.IContentKeyDecryptor 'Abblix\.Jwt\.Encryption\.IContentKeyDecryptor') | The JWE key\-recovery seam: recovers the Content Encryption Key for a recipient key, routed per key to the backend that owns it\. This is the encryption counterpart of [IDataSigner](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Signing.IDataSigner 'Abblix\.Jwt\.Signing\.IDataSigner') and, like it, carries ONLY the private operation: recovering the CEK needs the recipient's private/secret half, so a public\-only key routes to an external custodian\. Producing a JWE \(wrapping the CEK\) uses the recipient's PUBLIC half for asymmetric algorithms, or a locally held shared secret for symmetric ones, so it never needs a custodian and never passes through this seam \- it stays in [IJsonWebTokenEncryptor](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.IJsonWebTokenEncryptor 'Abblix\.Jwt\.IJsonWebTokenEncryptor'), exactly as signature verification stays out of [IDataSigner](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Signing.IDataSigner 'Abblix\.Jwt\.Signing\.IDataSigner')\. Backends compose as peers behind [Abblix\.Jwt\.Encryption\.CompositeDecryptor](https://learn.microsoft.com/en-us/dotnet/api/abblix.jwt.encryption.compositedecryptor 'Abblix\.Jwt\.Encryption\.CompositeDecryptor'): [Abblix\.Jwt\.Encryption\.LocalKeyDecryptor](https://learn.microsoft.com/en-us/dotnet/api/abblix.jwt.encryption.localkeydecryptor 'Abblix\.Jwt\.Encryption\.LocalKeyDecryptor') unwraps in process, an external custodian backend \([Abblix\.Jwt\.ExternalKeys\.ExternalKeyDecryptor](https://learn.microsoft.com/en-us/dotnet/api/abblix.jwt.externalkeys.externalkeydecryptor 'Abblix\.Jwt\.ExternalKeys\.ExternalKeyDecryptor')\) unwraps against an HSM/KMS/vault\. | | [IKeyManagementAlgorithm<TJsonWebKey>](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Encryption.IKeyManagementAlgorithm_TJsonWebKey_ 'Abblix\.Jwt\.Encryption\.IKeyManagementAlgorithm\') | Interface for JWE \(JSON Web Encryption\) key encryption and decryption operations\. Encrypts and decrypts the Content Encryption Key \(CEK\) using a specific key management algorithm\. Implements RFC 7516 Section 5 \(Key Encryption\) and RFC 7518 Section 4 \(Key Management Algorithms\)\. | --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Encryption.DeterministicAeadEncryptor.md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ### [Abblix\.Jwt\.Encryption](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Encryption 'Abblix\.Jwt\.Encryption') ## DeterministicAeadEncryptor Class Deterministic authenticated encryption bound to associated data: the same plaintext and associated data always seal to the same bytes, different inputs seal to unrelated bytes, and tampering or a wrong associated data is rejected on opening\. This is the property a reversible, stable pseudonym needs \- a value that is opaque and unlinkable to outsiders yet recoverable by the holder of the key, and identical across sessions and hosts for the same input\. ```csharp public sealed class DeterministicAeadEncryptor ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → DeterministicAeadEncryptor ### Remarks The encryption is AES Key Wrap with Padding \(RFC 5649 / NIST SP 800\-38F KWP\) via [Abblix\.Jwt\.Encryption\.AesKeyWrapPadded](https://learn.microsoft.com/en-us/dotnet/api/abblix.jwt.encryption.aeskeywrappadded 'Abblix\.Jwt\.Encryption\.AesKeyWrapPadded'), a standardised deterministic authenticated encryption whose integrity check rejects any tampered value on unwrap\. RFC 5649 has no associated\-data input, so the associated data is bound into the key instead: a distinct key encryption key is derived per associated\-data value by HKDF, so a value sealed for one context cannot be opened under another \- its integrity check fails\. The supplied key is the sole secret; HKDF expands it, mixing the associated data into the context label, into a 256\-bit key encryption key\. ### Constructors ## DeterministicAeadEncryptor\(HashAlgorithmName, byte\[\]\) Constructor {#Abblix.Jwt.Encryption.DeterministicAeadEncryptor.DeterministicAeadEncryptor(System.Security.Cryptography.HashAlgorithmName,byte[])} Creates an encryptor whose per\-context key encryption keys are derived from [key](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Encryption.DeterministicAeadEncryptor#Abblix.Jwt.Encryption.DeterministicAeadEncryptor.DeterministicAeadEncryptor(System.Security.Cryptography.HashAlgorithmName,byte[]).key 'Abblix\.Jwt\.Encryption\.DeterministicAeadEncryptor\.DeterministicAeadEncryptor\(System\.Security\.Cryptography\.HashAlgorithmName, byte\[\]\)\.key') by HKDF\. ```csharp public DeterministicAeadEncryptor(System.Security.Cryptography.HashAlgorithmName hashAlgorithm, byte[] key); ``` #### Parameters ###### `hashAlgorithm` [System\.Security\.Cryptography\.HashAlgorithmName](https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.hashalgorithmname 'System\.Security\.Cryptography\.HashAlgorithmName') {#Abblix.Jwt.Encryption.DeterministicAeadEncryptor.DeterministicAeadEncryptor(System.Security.Cryptography.HashAlgorithmName,byte[]).hashAlgorithm} The hash used for the HKDF key derivation\. Defaults to SHA\-256 at the call sites; a caller honouring host\-configured pairwise settings passes their chosen algorithm\. ###### `key` [System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Jwt.Encryption.DeterministicAeadEncryptor.DeterministicAeadEncryptor(System.Security.Cryptography.HashAlgorithmName,byte[]).key} The key material\. Its secrecy is the whole security of the seal\. ### Methods ## DeterministicAeadEncryptor\.Open\(ReadOnlySpan\, ReadOnlySpan\\) Method {#Abblix.Jwt.Encryption.DeterministicAeadEncryptor.Open(System.ReadOnlySpan_byte_,System.ReadOnlySpan_byte_)} Opens a value produced by [Seal\(ReadOnlySpan<byte>, ReadOnlySpan<byte>\)](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Encryption.DeterministicAeadEncryptor#Abblix.Jwt.Encryption.DeterministicAeadEncryptor.Seal(System.ReadOnlySpan_byte_,System.ReadOnlySpan_byte_) 'Abblix\.Jwt\.Encryption\.DeterministicAeadEncryptor\.Seal\(System\.ReadOnlySpan\, System\.ReadOnlySpan\\)') under the same [associatedData](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Encryption.DeterministicAeadEncryptor#Abblix.Jwt.Encryption.DeterministicAeadEncryptor.Open(System.ReadOnlySpan_byte_,System.ReadOnlySpan_byte_).associatedData 'Abblix\.Jwt\.Encryption\.DeterministicAeadEncryptor\.Open\(System\.ReadOnlySpan\, System\.ReadOnlySpan\\)\.associatedData')\. ```csharp public byte[]? Open(System.ReadOnlySpan sealedData, System.ReadOnlySpan associatedData); ``` #### Parameters ###### `sealedData` [System\.ReadOnlySpan<](https://learn.microsoft.com/en-us/dotnet/api/system.readonlyspan-1 'System\.ReadOnlySpan\`1')[System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[>](https://learn.microsoft.com/en-us/dotnet/api/system.readonlyspan-1 'System\.ReadOnlySpan\`1') {#Abblix.Jwt.Encryption.DeterministicAeadEncryptor.Open(System.ReadOnlySpan_byte_,System.ReadOnlySpan_byte_).sealedData} ###### `associatedData` [System\.ReadOnlySpan<](https://learn.microsoft.com/en-us/dotnet/api/system.readonlyspan-1 'System\.ReadOnlySpan\`1')[System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[>](https://learn.microsoft.com/en-us/dotnet/api/system.readonlyspan-1 'System\.ReadOnlySpan\`1') {#Abblix.Jwt.Encryption.DeterministicAeadEncryptor.Open(System.ReadOnlySpan_byte_,System.ReadOnlySpan_byte_).associatedData} #### Returns [System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') The recovered plaintext, or `null` when the value is malformed, tampered, or bound to different associated data\. ## DeterministicAeadEncryptor\.Seal\(ReadOnlySpan\, ReadOnlySpan\\) Method {#Abblix.Jwt.Encryption.DeterministicAeadEncryptor.Seal(System.ReadOnlySpan_byte_,System.ReadOnlySpan_byte_)} Seals [plaintext](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Encryption.DeterministicAeadEncryptor#Abblix.Jwt.Encryption.DeterministicAeadEncryptor.Seal(System.ReadOnlySpan_byte_,System.ReadOnlySpan_byte_).plaintext 'Abblix\.Jwt\.Encryption\.DeterministicAeadEncryptor\.Seal\(System\.ReadOnlySpan\, System\.ReadOnlySpan\\)\.plaintext') bound to [associatedData](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Encryption.DeterministicAeadEncryptor#Abblix.Jwt.Encryption.DeterministicAeadEncryptor.Seal(System.ReadOnlySpan_byte_,System.ReadOnlySpan_byte_).associatedData 'Abblix\.Jwt\.Encryption\.DeterministicAeadEncryptor\.Seal\(System\.ReadOnlySpan\, System\.ReadOnlySpan\\)\.associatedData')\. Deterministic: the same inputs always return the same bytes\. ```csharp public byte[] Seal(System.ReadOnlySpan plaintext, System.ReadOnlySpan associatedData); ``` #### Parameters ###### `plaintext` [System\.ReadOnlySpan<](https://learn.microsoft.com/en-us/dotnet/api/system.readonlyspan-1 'System\.ReadOnlySpan\`1')[System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[>](https://learn.microsoft.com/en-us/dotnet/api/system.readonlyspan-1 'System\.ReadOnlySpan\`1') {#Abblix.Jwt.Encryption.DeterministicAeadEncryptor.Seal(System.ReadOnlySpan_byte_,System.ReadOnlySpan_byte_).plaintext} ###### `associatedData` [System\.ReadOnlySpan<](https://learn.microsoft.com/en-us/dotnet/api/system.readonlyspan-1 'System\.ReadOnlySpan\`1')[System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[>](https://learn.microsoft.com/en-us/dotnet/api/system.readonlyspan-1 'System\.ReadOnlySpan\`1') {#Abblix.Jwt.Encryption.DeterministicAeadEncryptor.Seal(System.ReadOnlySpan_byte_,System.ReadOnlySpan_byte_).associatedData} #### Returns [System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Encryption.EncryptedData.md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ### [Abblix\.Jwt\.Encryption](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Encryption 'Abblix\.Jwt\.Encryption') ## EncryptedData Class Represents the result of JWE content encryption operation\. Contains the components required for JWE Compact Serialization per RFC 7516\. ```csharp public record EncryptedData : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → EncryptedData Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[EncryptedData](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Encryption.EncryptedData 'Abblix\.Jwt\.Encryption\.EncryptedData')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Constructors ## EncryptedData\(byte\[\], byte\[\], byte\[\]\) Constructor {#Abblix.Jwt.Encryption.EncryptedData.EncryptedData(byte[],byte[],byte[])} Represents the result of JWE content encryption operation\. Contains the components required for JWE Compact Serialization per RFC 7516\. ```csharp public EncryptedData(byte[] InitializationVector, byte[] Ciphertext, byte[] AuthenticationTag); ``` #### Parameters ###### `InitializationVector` [System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Jwt.Encryption.EncryptedData.EncryptedData(byte[],byte[],byte[]).InitializationVector} The random initialization vector \(IV\) used for content encryption\. ###### `Ciphertext` [System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Jwt.Encryption.EncryptedData.EncryptedData(byte[],byte[],byte[]).Ciphertext} The encrypted content \(plaintext encrypted with CEK\)\. ###### `AuthenticationTag` [System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Jwt.Encryption.EncryptedData.EncryptedData(byte[],byte[],byte[]).AuthenticationTag} The authentication tag for verifying ciphertext integrity\. ### Properties ## EncryptedData\.AuthenticationTag Property {#Abblix.Jwt.Encryption.EncryptedData.AuthenticationTag} The authentication tag for verifying ciphertext integrity\. ```csharp public byte[] AuthenticationTag { get; init; } ``` #### Property Value [System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') ## EncryptedData\.Ciphertext Property {#Abblix.Jwt.Encryption.EncryptedData.Ciphertext} The encrypted content \(plaintext encrypted with CEK\)\. ```csharp public byte[] Ciphertext { get; init; } ``` #### Property Value [System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') ## EncryptedData\.InitializationVector Property {#Abblix.Jwt.Encryption.EncryptedData.InitializationVector} The random initialization vector \(IV\) used for content encryption\. ```csharp public byte[] InitializationVector { get; init; } ``` #### Property Value [System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Encryption.IContentKeyDecryptor.md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ### [Abblix\.Jwt\.Encryption](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Encryption 'Abblix\.Jwt\.Encryption') ## IContentKeyDecryptor Interface The JWE key\-recovery seam: recovers the Content Encryption Key for a recipient key, routed per key to the backend that owns it\. This is the encryption counterpart of [IDataSigner](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Signing.IDataSigner 'Abblix\.Jwt\.Signing\.IDataSigner') and, like it, carries ONLY the private operation: recovering the CEK needs the recipient's private/secret half, so a public\-only key routes to an external custodian\. Producing a JWE \(wrapping the CEK\) uses the recipient's PUBLIC half for asymmetric algorithms, or a locally held shared secret for symmetric ones, so it never needs a custodian and never passes through this seam \- it stays in [IJsonWebTokenEncryptor](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.IJsonWebTokenEncryptor 'Abblix\.Jwt\.IJsonWebTokenEncryptor'), exactly as signature verification stays out of [IDataSigner](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Signing.IDataSigner 'Abblix\.Jwt\.Signing\.IDataSigner')\. Backends compose as peers behind [Abblix\.Jwt\.Encryption\.CompositeDecryptor](https://learn.microsoft.com/en-us/dotnet/api/abblix.jwt.encryption.compositedecryptor 'Abblix\.Jwt\.Encryption\.CompositeDecryptor'): [Abblix\.Jwt\.Encryption\.LocalKeyDecryptor](https://learn.microsoft.com/en-us/dotnet/api/abblix.jwt.encryption.localkeydecryptor 'Abblix\.Jwt\.Encryption\.LocalKeyDecryptor') unwraps in process, an external custodian backend \([Abblix\.Jwt\.ExternalKeys\.ExternalKeyDecryptor](https://learn.microsoft.com/en-us/dotnet/api/abblix.jwt.externalkeys.externalkeydecryptor 'Abblix\.Jwt\.ExternalKeys\.ExternalKeyDecryptor')\) unwraps against an HSM/KMS/vault\. ```csharp public interface IContentKeyDecryptor ``` ### Methods ## IContentKeyDecryptor\.CanDecrypt\(JsonWebKey\) Method {#Abblix.Jwt.Encryption.IContentKeyDecryptor.CanDecrypt(Abblix.Jwt.JsonWebKey)} Reports whether this backend owns recovering the CEK for [key](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Encryption.IContentKeyDecryptor#Abblix.Jwt.Encryption.IContentKeyDecryptor.CanDecrypt(Abblix.Jwt.JsonWebKey).key 'Abblix\.Jwt\.Encryption\.IContentKeyDecryptor\.CanDecrypt\(Abblix\.Jwt\.JsonWebKey\)\.key')\. The in\-process backend owns any key that carries its private/secret material; an external custodian backend owns any key published public\-only, whose private half lives with the custodian\. ```csharp bool CanDecrypt(Abblix.Jwt.JsonWebKey key); ``` #### Parameters ###### `key` [JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey') {#Abblix.Jwt.Encryption.IContentKeyDecryptor.CanDecrypt(Abblix.Jwt.JsonWebKey).key} The recipient decryption key the seam is about to route\. #### Returns [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') `true` if this backend can recover the CEK for [key](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Encryption.IContentKeyDecryptor#Abblix.Jwt.Encryption.IContentKeyDecryptor.CanDecrypt(Abblix.Jwt.JsonWebKey).key 'Abblix\.Jwt\.Encryption\.IContentKeyDecryptor\.CanDecrypt\(Abblix\.Jwt\.JsonWebKey\)\.key')\. ## IContentKeyDecryptor\.DecryptKeyAsync\(JsonWebTokenHeader, JsonWebKey, string, byte\[\], CancellationToken\) Method {#Abblix.Jwt.Encryption.IContentKeyDecryptor.DecryptKeyAsync(Abblix.Jwt.JsonWebTokenHeader,Abblix.Jwt.JsonWebKey,string,byte[],System.Threading.CancellationToken)} Recovers the Content Encryption Key from [encryptedKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Encryption.IContentKeyDecryptor#Abblix.Jwt.Encryption.IContentKeyDecryptor.DecryptKeyAsync(Abblix.Jwt.JsonWebTokenHeader,Abblix.Jwt.JsonWebKey,string,byte[],System.Threading.CancellationToken).encryptedKey 'Abblix\.Jwt\.Encryption\.IContentKeyDecryptor\.DecryptKeyAsync\(Abblix\.Jwt\.JsonWebTokenHeader, Abblix\.Jwt\.JsonWebKey, string, byte\[\], System\.Threading\.CancellationToken\)\.encryptedKey'): an RSA decryption, a symmetric unwrap, or an ECDH\-ES agreement, selected by [algorithm](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Encryption.IContentKeyDecryptor#Abblix.Jwt.Encryption.IContentKeyDecryptor.DecryptKeyAsync(Abblix.Jwt.JsonWebTokenHeader,Abblix.Jwt.JsonWebKey,string,byte[],System.Threading.CancellationToken).algorithm 'Abblix\.Jwt\.Encryption\.IContentKeyDecryptor\.DecryptKeyAsync\(Abblix\.Jwt\.JsonWebTokenHeader, Abblix\.Jwt\.JsonWebKey, string, byte\[\], System\.Threading\.CancellationToken\)\.algorithm')\. Returns null on a decryption failure \- wrong key, bad ciphertext, unsupported algorithm, or a malformed header parameter \- so a wrong key is indistinguishable from a bad ciphertext \(the RFC 7516 §11\.5 mitigation upstream relies on this\)\. A key with no decryption path at all \(a public\-only key with no custodian, which a correct configuration never presents\) fails loud instead\. ```csharp System.Threading.Tasks.Task DecryptKeyAsync(Abblix.Jwt.JsonWebTokenHeader header, Abblix.Jwt.JsonWebKey key, string algorithm, byte[] encryptedKey, System.Threading.CancellationToken cancellationToken); ``` #### Parameters ###### `header` [JsonWebTokenHeader](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenHeader 'Abblix\.Jwt\.JsonWebTokenHeader') {#Abblix.Jwt.Encryption.IContentKeyDecryptor.DecryptKeyAsync(Abblix.Jwt.JsonWebTokenHeader,Abblix.Jwt.JsonWebKey,string,byte[],System.Threading.CancellationToken).header} The JWE header; ECDH\-ES and AES\-GCM key wrap read parameters from it\. ###### `key` [JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey') {#Abblix.Jwt.Encryption.IContentKeyDecryptor.DecryptKeyAsync(Abblix.Jwt.JsonWebTokenHeader,Abblix.Jwt.JsonWebKey,string,byte[],System.Threading.CancellationToken).key} The recipient decryption key\. Its `kid` is the custodian's handle when external\. ###### `algorithm` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Jwt.Encryption.IContentKeyDecryptor.DecryptKeyAsync(Abblix.Jwt.JsonWebTokenHeader,Abblix.Jwt.JsonWebKey,string,byte[],System.Threading.CancellationToken).algorithm} The JWE `alg` value identifying the key\-management operation\. ###### `encryptedKey` [System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Jwt.Encryption.IContentKeyDecryptor.DecryptKeyAsync(Abblix.Jwt.JsonWebTokenHeader,Abblix.Jwt.JsonWebKey,string,byte[],System.Threading.CancellationToken).encryptedKey} The wrapped or RSA\-encrypted CEK from the JWE Encrypted Key\. ###### `cancellationToken` [System\.Threading\.CancellationToken](https://learn.microsoft.com/en-us/dotnet/api/system.threading.cancellationtoken 'System\.Threading\.CancellationToken') {#Abblix.Jwt.Encryption.IContentKeyDecryptor.DecryptKeyAsync(Abblix.Jwt.JsonWebTokenHeader,Abblix.Jwt.JsonWebKey,string,byte[],System.Threading.CancellationToken).cancellationToken} Cancels the operation, including a custodian round\-trip\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') The recovered CEK, or null on a decryption failure\. --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Encryption.IKeyManagementAlgorithm_TJsonWebKey_.md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ### [Abblix\.Jwt\.Encryption](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Encryption 'Abblix\.Jwt\.Encryption') ## IKeyManagementAlgorithm\ Interface Interface for JWE \(JSON Web Encryption\) key encryption and decryption operations\. Encrypts and decrypts the Content Encryption Key \(CEK\) using a specific key management algorithm\. Implements RFC 7516 Section 5 \(Key Encryption\) and RFC 7518 Section 4 \(Key Management Algorithms\)\. ```csharp public interface IKeyManagementAlgorithm where TJsonWebKey : Abblix.Jwt.JsonWebKey ``` #### Type parameters ###### `TJsonWebKey` {#Abblix.Jwt.Encryption.IKeyManagementAlgorithm_TJsonWebKey_.TJsonWebKey} The specific type of JSON Web Key required by this encryptor implementation\. ### Remarks The key encryptor handles the "alg" \(algorithm\) parameter in the JWE header, which specifies how the CEK is encrypted using the recipient's key\. This is separate from the "enc" parameter, which specifies how the actual content is encrypted using the CEK\. Common key encryption algorithms include RSA\-OAEP, RSA\-OAEP\-256, RSA1\_5, ECDH\-ES, and AES key wrap\. ### Properties ## IKeyManagementAlgorithm\\.Algorithm Property {#Abblix.Jwt.Encryption.IKeyManagementAlgorithm_TJsonWebKey_.Algorithm} The JWE key\-management algorithm identifier this encryptor implements \(e\.g\. "RSA\-OAEP\-256"\)\. Must equal the DI key the encryptor is registered under: discovery enumerates the keyed registrations and projects this value into the `*_encryption_alg_values_supported` lists, so a mismatch would advertise an algorithm name the dispatch cannot resolve\. ```csharp string Algorithm { get; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Methods ## IKeyManagementAlgorithm\\.EncryptKey\(JsonWebTokenHeader, TJsonWebKey, byte\[\]\) Method {#Abblix.Jwt.Encryption.IKeyManagementAlgorithm_TJsonWebKey_.EncryptKey(Abblix.Jwt.JsonWebTokenHeader,TJsonWebKey,byte[])} Encrypts a Content Encryption Key \(CEK\) using the configured key management algorithm\. Used when creating JWE tokens to protect the CEK with the recipient's public key\. ```csharp byte[] EncryptKey(Abblix.Jwt.JsonWebTokenHeader header, TJsonWebKey encryptionKey, byte[] keyToEncrypt); ``` #### Parameters ###### `header` [JsonWebTokenHeader](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenHeader 'Abblix\.Jwt\.JsonWebTokenHeader') {#Abblix.Jwt.Encryption.IKeyManagementAlgorithm_TJsonWebKey_.EncryptKey(Abblix.Jwt.JsonWebTokenHeader,TJsonWebKey,byte[]).header} The JWE header that can be modified to add algorithm\-specific parameters \(e\.g\., "epk" for ECDH\-ES\)\. ###### `encryptionKey` [TJsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Encryption.IKeyManagementAlgorithm_TJsonWebKey_#Abblix.Jwt.Encryption.IKeyManagementAlgorithm_TJsonWebKey_.TJsonWebKey 'Abblix\.Jwt\.Encryption\.IKeyManagementAlgorithm\\.TJsonWebKey') {#Abblix.Jwt.Encryption.IKeyManagementAlgorithm_TJsonWebKey_.EncryptKey(Abblix.Jwt.JsonWebTokenHeader,TJsonWebKey,byte[]).encryptionKey} The JSON Web Key containing the public key material for encryption\. ###### `keyToEncrypt` [System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Jwt.Encryption.IKeyManagementAlgorithm_TJsonWebKey_.EncryptKey(Abblix.Jwt.JsonWebTokenHeader,TJsonWebKey,byte[]).keyToEncrypt} The randomly generated Content Encryption Key bytes to protect\. #### Returns [System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') The encrypted CEK bytes that will be placed in the JWE "encrypted\_key" field\. For RSA algorithms, output size equals the RSA key size in bytes\. For direct key agreement \(ECDH\-ES\), returns empty array per RFC 7518\. #### Exceptions [System\.InvalidOperationException](https://learn.microsoft.com/en-us/dotnet/api/system.invalidoperationexception 'System\.InvalidOperationException') Thrown when the key type is not supported for the configured algorithm\. [System\.Security\.Cryptography\.CryptographicException](https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.cryptographicexception 'System\.Security\.Cryptography\.CryptographicException') Thrown when encryption fails \(e\.g\., CEK too large for RSA key size\)\. ## IKeyManagementAlgorithm\\.GenerateContentEncryptionKey\(JsonWebTokenHeader, TJsonWebKey, int\) Method {#Abblix.Jwt.Encryption.IKeyManagementAlgorithm_TJsonWebKey_.GenerateContentEncryptionKey(Abblix.Jwt.JsonWebTokenHeader,TJsonWebKey,int)} Produces the Content Encryption Key the content encryption step will use, before it is protected by [EncryptKey\(JsonWebTokenHeader, TJsonWebKey, byte\[\]\)](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Encryption.IKeyManagementAlgorithm_TJsonWebKey_#Abblix.Jwt.Encryption.IKeyManagementAlgorithm_TJsonWebKey_.EncryptKey(Abblix.Jwt.JsonWebTokenHeader,TJsonWebKey,byte[]) 'Abblix\.Jwt\.Encryption\.IKeyManagementAlgorithm\\.EncryptKey\(Abblix\.Jwt\.JsonWebTokenHeader, TJsonWebKey, byte\[\]\)')\. Key\-wrapping and key\-transport algorithms use the default implementation \- a fresh random CEK\. Algorithms where the CEK is determined by the key material itself override it: direct encryption \("dir"\) returns the shared symmetric key, and direct key agreement \(ECDH\-ES\) derives the CEK from the ephemeral\-static agreement, recording the agreement parameters \(e\.g\. "epk"\) in the header\. ```csharp byte[] GenerateContentEncryptionKey(Abblix.Jwt.JsonWebTokenHeader header, TJsonWebKey encryptionKey, int keySizeInBytes); ``` #### Parameters ###### `header` [JsonWebTokenHeader](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenHeader 'Abblix\.Jwt\.JsonWebTokenHeader') {#Abblix.Jwt.Encryption.IKeyManagementAlgorithm_TJsonWebKey_.GenerateContentEncryptionKey(Abblix.Jwt.JsonWebTokenHeader,TJsonWebKey,int).header} The JWE header; agreement\-based algorithms add their parameters to it\. ###### `encryptionKey` [TJsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Encryption.IKeyManagementAlgorithm_TJsonWebKey_#Abblix.Jwt.Encryption.IKeyManagementAlgorithm_TJsonWebKey_.TJsonWebKey 'Abblix\.Jwt\.Encryption\.IKeyManagementAlgorithm\\.TJsonWebKey') {#Abblix.Jwt.Encryption.IKeyManagementAlgorithm_TJsonWebKey_.GenerateContentEncryptionKey(Abblix.Jwt.JsonWebTokenHeader,TJsonWebKey,int).encryptionKey} The JSON Web Key the JWE is being encrypted with\. ###### `keySizeInBytes` [System\.Int32](https://learn.microsoft.com/en-us/dotnet/api/system.int32 'System\.Int32') {#Abblix.Jwt.Encryption.IKeyManagementAlgorithm_TJsonWebKey_.GenerateContentEncryptionKey(Abblix.Jwt.JsonWebTokenHeader,TJsonWebKey,int).keySizeInBytes} The CEK size required by the content encryption algorithm\. #### Returns [System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') The CEK to encrypt the JWE payload with\. ## IKeyManagementAlgorithm\\.TryDecryptKey\(JsonWebTokenHeader, TJsonWebKey, byte\[\], byte\[\]\) Method {#Abblix.Jwt.Encryption.IKeyManagementAlgorithm_TJsonWebKey_.TryDecryptKey(Abblix.Jwt.JsonWebTokenHeader,TJsonWebKey,byte[],byte[])} Attempts to decrypt an encrypted Content Encryption Key \(CEK\) using the configured key management algorithm\. Used when validating JWE tokens where multiple decryption keys may be tried sequentially\. ```csharp bool TryDecryptKey(Abblix.Jwt.JsonWebTokenHeader header, TJsonWebKey decryptingKey, byte[] encryptedKey, out byte[]? decryptedKey); ``` #### Parameters ###### `header` [JsonWebTokenHeader](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenHeader 'Abblix\.Jwt\.JsonWebTokenHeader') {#Abblix.Jwt.Encryption.IKeyManagementAlgorithm_TJsonWebKey_.TryDecryptKey(Abblix.Jwt.JsonWebTokenHeader,TJsonWebKey,byte[],byte[]).header} The JWE header containing algorithm\-specific parameters \(e\.g\., "epk" for ECDH\-ES\)\. ###### `decryptingKey` [TJsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Encryption.IKeyManagementAlgorithm_TJsonWebKey_#Abblix.Jwt.Encryption.IKeyManagementAlgorithm_TJsonWebKey_.TJsonWebKey 'Abblix\.Jwt\.Encryption\.IKeyManagementAlgorithm\\.TJsonWebKey') {#Abblix.Jwt.Encryption.IKeyManagementAlgorithm_TJsonWebKey_.TryDecryptKey(Abblix.Jwt.JsonWebTokenHeader,TJsonWebKey,byte[],byte[]).decryptingKey} The JSON Web Key containing the private key material for decryption\. ###### `encryptedKey` [System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Jwt.Encryption.IKeyManagementAlgorithm_TJsonWebKey_.TryDecryptKey(Abblix.Jwt.JsonWebTokenHeader,TJsonWebKey,byte[],byte[]).encryptedKey} The encrypted CEK bytes from the JWE "encrypted\_key" field\. ###### `decryptedKey` [System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Jwt.Encryption.IKeyManagementAlgorithm_TJsonWebKey_.TryDecryptKey(Abblix.Jwt.JsonWebTokenHeader,TJsonWebKey,byte[],byte[]).decryptedKey} When this method returns true, contains the decrypted Content Encryption Key\. When this method returns false, this parameter is null\. #### Returns [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') True if decryption succeeded with the provided key; otherwise, false\. False typically indicates the wrong private key was used or the data is corrupted\. ### Remarks This method does not throw exceptions for decryption failures to support trying multiple keys\. Only cryptographic operation errors \(not authentication failures\) should throw exceptions\. --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ## Abblix\.Jwt\.ExternalKeys Namespace | Classes | | | :--- | :--- | | [CustodianHeldKeys](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.CustodianHeldKeys 'Abblix\.Jwt\.ExternalKeys\.CustodianHeldKeys') | Selects which of the custodian's keys the host produces with, for a host that chose to keep the private halves where they never leave the custodian \(`UseKeysInCustodian`\)\. The keys belong to the operator: they are already provisioned in the custodian, so this only names them\. Each algorithm is advertised on the published key and forwarded to the custodian on every operation, so it must be one the custodian provisions for that key\. | | [ExternalKeysServiceCollectionExtensions](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.ExternalKeysServiceCollectionExtensions 'Abblix\.Jwt\.ExternalKeys\.ExternalKeysServiceCollectionExtensions') | Wires an [IKeyCustodian](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.IKeyCustodian 'Abblix\.Jwt\.ExternalKeys\.IKeyCustodian') \(an HSM, a cloud KMS, or a vault transit engine\) in two steps: WHICH custodian holds the keys, and HOW the library uses it\. The backend packages supply the first; the placement calls here supply the second, so a custodian and a placement compose freely instead of multiplying into one method per pair\. | | [InMemoryKeyRing](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.InMemoryKeyRing 'Abblix\.Jwt\.ExternalKeys\.InMemoryKeyRing') | A key ring whose keys are minted in this process and never leave it\. | | [KeyCustodianBuilder](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.KeyCustodianBuilder 'Abblix\.Jwt\.ExternalKeys\.KeyCustodianBuilder') | The continuation of a custodian registration: the host has said WHICH custodian holds its keys and must now say HOW the library uses it\. These are two independent choices, and the second one is the security posture \- where the private half of a key lives \- so it is named at the call site and never defaulted\. The choices are `UseKeysInCustodian`, where the private half never enters this process and every signature and every CEK unwrap is a round\-trip to the custodian, and `UseKeysInProcess`, where the library mints its own keys and the custodian only seals them\. | | [KeyPlacementChoice](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.KeyPlacementChoice 'Abblix\.Jwt\.ExternalKeys\.KeyPlacementChoice') | Records where the host chose to keep its private keys for its registered custodian, so the choice can be checked at startup rather than at the first key operation\. | | [KeyRingOptions](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.KeyRingOptions 'Abblix\.Jwt\.ExternalKeys\.KeyRingOptions') | Configuration of the key ring\. | | [LocalKeys](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.LocalKeys 'Abblix\.Jwt\.ExternalKeys\.LocalKeys') | What an in\-process key ring mints, and how often\. | | [MintedKeys](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.MintedKeys 'Abblix\.Jwt\.ExternalKeys\.MintedKeys') | The policy for the placement where the server mints its own keys and the custodian only protects them \(`UseKeysInProcess`\): it generates them, encrypts them to the custodian's key\-encryption key, keeps the ciphertext in a shared ring, and rotates on schedule\. No key names here \- the server names what it creates\. | | [ProduceFirstOrdering](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.ProduceFirstOrdering 'Abblix\.Jwt\.ExternalKeys\.ProduceFirstOrdering') | Orders a set of key versions so the one to produce with leads: whoever signs or encrypts takes the first key for an algorithm, while every version stays published so consumers can still verify or decrypt\. | | [StoredKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.StoredKey 'Abblix\.Jwt\.ExternalKeys\.StoredKey') | One entry of the key ring: a private key the server minted, encrypted to the custodian's key\-encryption key, plus the two facts needed to place it without opening it\. | | Interfaces | | | :--- | :--- | | [IKeyCustodian](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.IKeyCustodian 'Abblix\.Jwt\.ExternalKeys\.IKeyCustodian') | Host\-implemented custodian for the external private keys the library never holds in process: they live in an HSM, a cloud KMS, or a vault transit engine, and only the private operations cross the boundary\. A key published public\-only routes its private operation here by `kid`: SIGNING for a signing key, and for a decryption key an RSA/symmetric UNWRAP or an ECDH\-ES AGREEMENT\. The public operations \- signature verification, and wrapping a CEK with the recipient's public half \- stay in process and never reach the custodian\. Wire it with `AddCustodian` and a placement call; a host with no external keys leaves it unregistered\. | | [IKeyCustodianBuilder](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.IKeyCustodianBuilder 'Abblix\.Jwt\.ExternalKeys\.IKeyCustodianBuilder') | The continuation of a custodian registration: the host has said WHICH custodian holds its keys and must now say HOW the library uses it\. These are two independent choices, and the second one is the security posture \- where the private half of a key lives \- so it is named at the call site and never defaulted\. The choices are `UseKeysInCustodian`, where the private half never enters this process and every signature and every CEK unwrap is a round\-trip to the custodian, and `UseKeysInProcess`, where the library mints its own keys and the custodian only seals them\. | | [IKeyRing](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.IKeyRing 'Abblix\.Jwt\.ExternalKeys\.IKeyRing') | Hands out the keys it holds to whoever asks for them\. | | [IKeyRingStore](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.IKeyRingStore 'Abblix\.Jwt\.ExternalKeys\.IKeyRingStore') | The shared place the server's minted keys live, so every pod serves one key set rather than its own\. Entries are encrypted to the custodian's key\-encryption key before they get here, so this store holds ciphertext and never a secret\. | | [IMintedKeysBuilder](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.IMintedKeysBuilder 'Abblix\.Jwt\.ExternalKeys\.IMintedKeysBuilder') | The continuation of `UseKeysInProcess`: the placement that mints its own keys must say where the ring lives, and the packages hang their `PersistRingTo...` calls off this\. | | Enums | | | :--- | :--- | | [KeyPlacement](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.KeyPlacement 'Abblix\.Jwt\.ExternalKeys\.KeyPlacement') | Where the private half of a key lives once a custodian is wired\. This is the security posture, so a host names it at the call site and the library never picks one\. | --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.CustodianHeldKeys.md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ### [Abblix\.Jwt\.ExternalKeys](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys 'Abblix\.Jwt\.ExternalKeys') ## CustodianHeldKeys Class Selects which of the custodian's keys the host produces with, for a host that chose to keep the private halves where they never leave the custodian \(`UseKeysInCustodian`\)\. The keys belong to the operator: they are already provisioned in the custodian, so this only names them\. Each algorithm is advertised on the published key and forwarded to the custodian on every operation, so it must be one the custodian provisions for that key\. ```csharp public sealed record CustodianHeldKeys : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → CustodianHeldKeys Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[CustodianHeldKeys](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.CustodianHeldKeys 'Abblix\.Jwt\.ExternalKeys\.CustodianHeldKeys')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Remarks A name here is the custodian's name for the LOGICAL key, not a published `kid`\. Every version of that key is published under its own version\-qualified `kid` minted by the custodian \(Vault Transit `:`, Azure Key Vault `/`\), which is what lets a rotation overlap and routes each private operation back to the exact version that signed\. The bare name is the published `kid` only for a custodian that does not version its keys and leaves the `kid` unset\. ### Properties ## CustodianHeldKeys\.EncryptionAlgorithm Property {#Abblix.Jwt.ExternalKeys.CustodianHeldKeys.EncryptionAlgorithm} The JWE key\-management algorithm the encryption key uses\. Has no effect unless [EncryptionKeyName](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.CustodianHeldKeys#Abblix.Jwt.ExternalKeys.CustodianHeldKeys.EncryptionKeyName 'Abblix\.Jwt\.ExternalKeys\.CustodianHeldKeys\.EncryptionKeyName') names a key\. ```csharp public string EncryptionAlgorithm { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## CustodianHeldKeys\.EncryptionKeyName Property {#Abblix.Jwt.ExternalKeys.CustodianHeldKeys.EncryptionKeyName} The custodian's name for the encryption key, whose versions are published and unwrapped with\. Name it when anything encrypts to this provider: it both encrypts the provider's own tokens \(a service token configured to be encrypted\) and decrypts inbound JWE a client sent, such as an encrypted request object or client assertion, and its published half is what tells a client where to encrypt\. ```csharp public string? EncryptionKeyName { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks Optional, and unset means no encryption key is published at all, rather than a guessed name the custodian may not hold: a signing\-only deployment is the common high\-assurance case\. ## CustodianHeldKeys\.SigningAlgorithm Property {#Abblix.Jwt.ExternalKeys.CustodianHeldKeys.SigningAlgorithm} The JWS algorithm the signing key uses, for example `RS256`, `PS384` or `ES256` \(an EC one needs a custodian key on the matching curve\)\. ```csharp public string SigningAlgorithm { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## CustodianHeldKeys\.SigningKeyName Property {#Abblix.Jwt.ExternalKeys.CustodianHeldKeys.SigningKeyName} The custodian's name for the signing key, whose versions are published and signed with\. Required: a host with no signing key cannot issue a token at all, so the compiler asks for it instead of a startup failure\. ```csharp public string SigningKeyName { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.ExternalKeysServiceCollectionExtensions.md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ### [Abblix\.Jwt\.ExternalKeys](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys 'Abblix\.Jwt\.ExternalKeys') ## ExternalKeysServiceCollectionExtensions Class Wires an [IKeyCustodian](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.IKeyCustodian 'Abblix\.Jwt\.ExternalKeys\.IKeyCustodian') \(an HSM, a cloud KMS, or a vault transit engine\) in two steps: WHICH custodian holds the keys, and HOW the library uses it\. The backend packages supply the first; the placement calls here supply the second, so a custodian and a placement compose freely instead of multiplying into one method per pair\. ```csharp public static class ExternalKeysServiceCollectionExtensions ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ExternalKeysServiceCollectionExtensions ### Remarks Both halves live in this package because both are about key material and neither is about any particular consumer of it\. Whoever consumes the keys \- an OpenID Provider publishing them at its JWKS endpoint, a transmitter signing security event tokens, a client protecting its own state \- reads the recorded [KeyPlacement](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.KeyPlacement 'Abblix\.Jwt\.ExternalKeys\.KeyPlacement') and needs no registration call of its own\. ### Methods ## ExternalKeysServiceCollectionExtensions\.AddCustodian\\(this IServiceCollection\) Method {#Abblix.Jwt.ExternalKeys.ExternalKeysServiceCollectionExtensions.AddCustodian_TCustodian_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection)} Registers [TCustodian](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.ExternalKeysServiceCollectionExtensions#Abblix.Jwt.ExternalKeys.ExternalKeysServiceCollectionExtensions.AddCustodian_TCustodian_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).TCustodian 'Abblix\.Jwt\.ExternalKeys\.ExternalKeysServiceCollectionExtensions\.AddCustodian\\(this Microsoft\.Extensions\.DependencyInjection\.IServiceCollection\)\.TCustodian') as the custodian and opens the placement choice\. The custodian is DI\-constructed, so it may depend on the host's own services\. A host whose custodian is already registered \- a typed `HttpClient`, or an instance it built itself \- calls [RequireKeyPlacement\(this IServiceCollection\)](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.ExternalKeysServiceCollectionExtensions#Abblix.Jwt.ExternalKeys.ExternalKeysServiceCollectionExtensions.RequireKeyPlacement(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection) 'Abblix\.Jwt\.ExternalKeys\.ExternalKeysServiceCollectionExtensions\.RequireKeyPlacement\(this Microsoft\.Extensions\.DependencyInjection\.IServiceCollection\)') instead\. ```csharp public static Abblix.Jwt.ExternalKeys.IKeyCustodianBuilder AddCustodian(this Microsoft.Extensions.DependencyInjection.IServiceCollection services) where TCustodian : class, Abblix.Jwt.ExternalKeys.IKeyCustodian; ``` #### Type parameters ###### `TCustodian` {#Abblix.Jwt.ExternalKeys.ExternalKeysServiceCollectionExtensions.AddCustodian_TCustodian_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).TCustodian} The custodian implementation holding the private keys\. #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.Jwt.ExternalKeys.ExternalKeysServiceCollectionExtensions.AddCustodian_TCustodian_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).services} The service collection to configure\. #### Returns [IKeyCustodianBuilder](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.IKeyCustodianBuilder 'Abblix\.Jwt\.ExternalKeys\.IKeyCustodianBuilder') The builder whose placement call completes the wiring\. ### Remarks Do not combine this with `ComposeExternalKeyBackends`: the placement call performs that itself, and `Compose` refuses the second composition on the spot, at the registration call rather than at startup\. Use this path, or that one, never both\. ## ExternalKeysServiceCollectionExtensions\.AddInMemoryKeyRing\(this IServiceCollection, LocalKeys\) Method {#Abblix.Jwt.ExternalKeys.ExternalKeysServiceCollectionExtensions.AddInMemoryKeyRing(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,Abblix.Jwt.ExternalKeys.LocalKeys)} Registers a key ring that mints its keys in this process and keeps them there: no custodian, no shared store, nothing to provision\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection AddInMemoryKeyRing(this Microsoft.Extensions.DependencyInjection.IServiceCollection services, Abblix.Jwt.ExternalKeys.LocalKeys policy); ``` #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.Jwt.ExternalKeys.ExternalKeysServiceCollectionExtensions.AddInMemoryKeyRing(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,Abblix.Jwt.ExternalKeys.LocalKeys).services} The service collection to add to\. ###### `policy` [LocalKeys](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.LocalKeys 'Abblix\.Jwt\.ExternalKeys\.LocalKeys') {#Abblix.Jwt.ExternalKeys.ExternalKeysServiceCollectionExtensions.AddInMemoryKeyRing(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,Abblix.Jwt.ExternalKeys.LocalKeys).policy} What to mint, how often, and how long to keep a retired key\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') The same collection, so calls chain\. ### Remarks The answer for a host with no HSM or KMS, which is most of them\. It rotates, and it keeps retired keys long enough that what they produced stays readable \- the two things a ring is for\. What it does NOT do is share those keys with another process\. Every replica mints its own, so anything one replica produced is unreadable by the others, and everything is gone when the process restarts\. For a single instance that is exactly right and costs nothing\. For more than one it is wrong, and wrong in the quiet way: nothing fails at startup, sign\-ins simply break for whoever lands on the wrong replica\. So a host that has registered an [IKeyRingStore](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.IKeyRingStore 'Abblix\.Jwt\.ExternalKeys\.IKeyRingStore') \- which is how keys are shared \- is refused here rather than served: having registered one, it plainly expects sharing, and a ring that silently ignored it would be the worst of both\. Use [AddKeyRing\(this IServiceCollection, MintedKeys\)](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.ExternalKeysServiceCollectionExtensions#Abblix.Jwt.ExternalKeys.ExternalKeysServiceCollectionExtensions.AddKeyRing(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,Abblix.Jwt.ExternalKeys.MintedKeys) 'Abblix\.Jwt\.ExternalKeys\.ExternalKeysServiceCollectionExtensions\.AddKeyRing\(this Microsoft\.Extensions\.DependencyInjection\.IServiceCollection, Abblix\.Jwt\.ExternalKeys\.MintedKeys\)') with a custodian instead\. ## ExternalKeysServiceCollectionExtensions\.AddKeyRing\(this IServiceCollection, MintedKeys\) Method {#Abblix.Jwt.ExternalKeys.ExternalKeysServiceCollectionExtensions.AddKeyRing(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,Abblix.Jwt.ExternalKeys.MintedKeys)} Registers a key ring that mints its own keys, seals each to the custodian's key\-encryption key, shares them through the registered [IKeyRingStore](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.IKeyRingStore 'Abblix\.Jwt\.ExternalKeys\.IKeyRingStore'), and rotates them on the policy's schedule\. ```csharp public static Abblix.Jwt.ExternalKeys.IMintedKeysBuilder AddKeyRing(this Microsoft.Extensions.DependencyInjection.IServiceCollection services, Abblix.Jwt.ExternalKeys.MintedKeys policy); ``` #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.Jwt.ExternalKeys.ExternalKeysServiceCollectionExtensions.AddKeyRing(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,Abblix.Jwt.ExternalKeys.MintedKeys).services} The service collection to add to\. ###### `policy` [MintedKeys](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.MintedKeys 'Abblix\.Jwt\.ExternalKeys\.MintedKeys') {#Abblix.Jwt.ExternalKeys.ExternalKeysServiceCollectionExtensions.AddKeyRing(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,Abblix.Jwt.ExternalKeys.MintedKeys).policy} What to mint, how often, and which key\-encryption key seals it\. #### Returns [IMintedKeysBuilder](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.IMintedKeysBuilder 'Abblix\.Jwt\.ExternalKeys\.IMintedKeysBuilder') A builder for the call that supplies the store\. ### Remarks This registers the ring and nothing else\. What the ring's keys are then USED for is the caller's concern: an OpenID Provider publishes them at its JWKS endpoint, a client protects stored sessions with them\. Neither of those belongs here, which is why this lives beside the key material rather than beside either consumer\. ## ExternalKeysServiceCollectionExtensions\.RequireKeyPlacement\(this IServiceCollection\) Method {#Abblix.Jwt.ExternalKeys.ExternalKeysServiceCollectionExtensions.RequireKeyPlacement(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection)} Requires the host to say where the private half of its keys lives, and hands it the builder to say it with\. ```csharp public static Abblix.Jwt.ExternalKeys.IKeyCustodianBuilder RequireKeyPlacement(this Microsoft.Extensions.DependencyInjection.IServiceCollection services); ``` #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.Jwt.ExternalKeys.ExternalKeysServiceCollectionExtensions.RequireKeyPlacement(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).services} The service collection holding the custodian registration\. #### Returns [IKeyCustodianBuilder](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.IKeyCustodianBuilder 'Abblix\.Jwt\.ExternalKeys\.IKeyCustodianBuilder') The builder whose placement call completes the wiring\. ### Remarks Which custodian holds the keys and how the library uses it are two independent choices, so they are two calls: this one opens the second\. Nothing is decided here, and that is the point \- a custodian with no placement chosen is a half\-wired host, and it fails at startup rather than picking a posture on the host's behalf\. Registered by the backend packages, which know their custodian and nothing about what it will be used for\. What the placement calls then do with it belongs to whoever consumes the keys\. ## ExternalKeysServiceCollectionExtensions\.UseKeysInCustodian\(this IKeyCustodianBuilder, CustodianHeldKeys\) Method {#Abblix.Jwt.ExternalKeys.ExternalKeysServiceCollectionExtensions.UseKeysInCustodian(thisAbblix.Jwt.ExternalKeys.IKeyCustodianBuilder,Abblix.Jwt.ExternalKeys.CustodianHeldKeys)} Keeps the private halves OUT of this process entirely: the custodian signs and unwraps, and only public halves are published and used for local signature verification\. Every token signed and every encrypted token consumed is a round\-trip to the custodian, so throughput is bounded by it \- the price of the guarantee that a compromised process yields no key\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection UseKeysInCustodian(this Abblix.Jwt.ExternalKeys.IKeyCustodianBuilder builder, Abblix.Jwt.ExternalKeys.CustodianHeldKeys keys); ``` #### Parameters ###### `builder` [IKeyCustodianBuilder](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.IKeyCustodianBuilder 'Abblix\.Jwt\.ExternalKeys\.IKeyCustodianBuilder') {#Abblix.Jwt.ExternalKeys.ExternalKeysServiceCollectionExtensions.UseKeysInCustodian(thisAbblix.Jwt.ExternalKeys.IKeyCustodianBuilder,Abblix.Jwt.ExternalKeys.CustodianHeldKeys).builder} The builder returned by the custodian registration\. ###### `keys` [CustodianHeldKeys](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.CustodianHeldKeys 'Abblix\.Jwt\.ExternalKeys\.CustodianHeldKeys') {#Abblix.Jwt.ExternalKeys.ExternalKeysServiceCollectionExtensions.UseKeysInCustodian(thisAbblix.Jwt.ExternalKeys.IKeyCustodianBuilder,Abblix.Jwt.ExternalKeys.CustodianHeldKeys).keys} Names the custodian's keys to produce with, and their algorithms\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') The service collection, for chaining\. ### Remarks Call this AFTER [AddJsonWebTokens\(this IServiceCollection\)](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ServiceCollectionExtensions#Abblix.Jwt.ServiceCollectionExtensions.AddJsonWebTokens(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection) 'Abblix\.Jwt\.ServiceCollectionExtensions\.AddJsonWebTokens\(this Microsoft\.Extensions\.DependencyInjection\.IServiceCollection\)')\. It composes the external signing and decryption backends with their in\-process peers, and a composition needs those peers already registered: run first, it would find a one\-member family, skip the composite, and leave the external backend to lose the singular resolve to the local one that arrives later\. ## ExternalKeysServiceCollectionExtensions\.UseKeysInCustodian\(this IKeyCustodianBuilder, Func\\) Method {#Abblix.Jwt.ExternalKeys.ExternalKeysServiceCollectionExtensions.UseKeysInCustodian(thisAbblix.Jwt.ExternalKeys.IKeyCustodianBuilder,System.Func_System.IServiceProvider,Abblix.Jwt.ExternalKeys.CustodianHeldKeys_)} Keeps the private halves out of this process, reading the key selection from a service instead of a literal\. Suits a host whose key names come from its configuration; a host with literal names uses [UseKeysInCustodian\(this IKeyCustodianBuilder, CustodianHeldKeys\)](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.ExternalKeysServiceCollectionExtensions#Abblix.Jwt.ExternalKeys.ExternalKeysServiceCollectionExtensions.UseKeysInCustodian(thisAbblix.Jwt.ExternalKeys.IKeyCustodianBuilder,Abblix.Jwt.ExternalKeys.CustodianHeldKeys) 'Abblix\.Jwt\.ExternalKeys\.ExternalKeysServiceCollectionExtensions\.UseKeysInCustodian\(this Abblix\.Jwt\.ExternalKeys\.IKeyCustodianBuilder, Abblix\.Jwt\.ExternalKeys\.CustodianHeldKeys\)')\. See that overload for what this placement means and when to call it\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection UseKeysInCustodian(this Abblix.Jwt.ExternalKeys.IKeyCustodianBuilder builder, System.Func keys); ``` #### Parameters ###### `builder` [IKeyCustodianBuilder](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.IKeyCustodianBuilder 'Abblix\.Jwt\.ExternalKeys\.IKeyCustodianBuilder') {#Abblix.Jwt.ExternalKeys.ExternalKeysServiceCollectionExtensions.UseKeysInCustodian(thisAbblix.Jwt.ExternalKeys.IKeyCustodianBuilder,System.Func_System.IServiceProvider,Abblix.Jwt.ExternalKeys.CustodianHeldKeys_).builder} The builder returned by the custodian registration\. ###### `keys` [System\.Func<](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2')[System\.IServiceProvider](https://learn.microsoft.com/en-us/dotnet/api/system.iserviceprovider 'System\.IServiceProvider')[,](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2')[CustodianHeldKeys](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.CustodianHeldKeys 'Abblix\.Jwt\.ExternalKeys\.CustodianHeldKeys')[>](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2') {#Abblix.Jwt.ExternalKeys.ExternalKeysServiceCollectionExtensions.UseKeysInCustodian(thisAbblix.Jwt.ExternalKeys.IKeyCustodianBuilder,System.Func_System.IServiceProvider,Abblix.Jwt.ExternalKeys.CustodianHeldKeys_).keys} Resolves the key selection from the service provider, once\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') The service collection, for chaining\. ### Remarks The selection is a singleton, so the factory runs once per container and the answer is fixed for the life of the process\. That rules out anything varying per request or per tenant: a host needing that registers its own key provider rather than varying this\. ## ExternalKeysServiceCollectionExtensions\.UseKeysInProcess\(this IKeyCustodianBuilder, MintedKeys\) Method {#Abblix.Jwt.ExternalKeys.ExternalKeysServiceCollectionExtensions.UseKeysInProcess(thisAbblix.Jwt.ExternalKeys.IKeyCustodianBuilder,Abblix.Jwt.ExternalKeys.MintedKeys)} Chooses the placement where the library MINTS its own keys and the custodian only protects them: each key is generated in process, encrypted to the custodian's key\-encryption key, shared as ciphertext through [IKeyRingStore](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.IKeyRingStore 'Abblix\.Jwt\.ExternalKeys\.IKeyRingStore'), and rotated on the policy's schedule\. Signing then runs in process, so the custodian is touched once per key rather than once per token\. ```csharp public static Abblix.Jwt.ExternalKeys.IMintedKeysBuilder UseKeysInProcess(this Abblix.Jwt.ExternalKeys.IKeyCustodianBuilder builder, Abblix.Jwt.ExternalKeys.MintedKeys policy); ``` #### Parameters ###### `builder` [IKeyCustodianBuilder](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.IKeyCustodianBuilder 'Abblix\.Jwt\.ExternalKeys\.IKeyCustodianBuilder') {#Abblix.Jwt.ExternalKeys.ExternalKeysServiceCollectionExtensions.UseKeysInProcess(thisAbblix.Jwt.ExternalKeys.IKeyCustodianBuilder,Abblix.Jwt.ExternalKeys.MintedKeys).builder} The builder returned by the custodian registration\. ###### `policy` [MintedKeys](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.MintedKeys 'Abblix\.Jwt\.ExternalKeys\.MintedKeys') {#Abblix.Jwt.ExternalKeys.ExternalKeysServiceCollectionExtensions.UseKeysInProcess(thisAbblix.Jwt.ExternalKeys.IKeyCustodianBuilder,Abblix.Jwt.ExternalKeys.MintedKeys).policy} What to mint, how often, and which key seals it\. #### Returns [IMintedKeysBuilder](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.IMintedKeysBuilder 'Abblix\.Jwt\.ExternalKeys\.IMintedKeysBuilder') The builder whose `PersistRingTo...` call says where the ring lives\. ### Remarks This is the weaker posture of the two, which is why it is named rather than defaulted: the private half is unwrapped into process memory and stays there, so a compromised process yields the key itself, not merely the ability to ask the custodian to sign while its credential lives\. Use [UseKeysInCustodian\(this IKeyCustodianBuilder, CustodianHeldKeys\)](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.ExternalKeysServiceCollectionExtensions#Abblix.Jwt.ExternalKeys.ExternalKeysServiceCollectionExtensions.UseKeysInCustodian(thisAbblix.Jwt.ExternalKeys.IKeyCustodianBuilder,Abblix.Jwt.ExternalKeys.CustodianHeldKeys) 'Abblix\.Jwt\.ExternalKeys\.ExternalKeysServiceCollectionExtensions\.UseKeysInCustodian\(this Abblix\.Jwt\.ExternalKeys\.IKeyCustodianBuilder, Abblix\.Jwt\.ExternalKeys\.CustodianHeldKeys\)') when the key must never be in memory at all\. Call this AFTER [AddJsonWebTokens\(this IServiceCollection\)](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ServiceCollectionExtensions#Abblix.Jwt.ServiceCollectionExtensions.AddJsonWebTokens(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection) 'Abblix\.Jwt\.ServiceCollectionExtensions\.AddJsonWebTokens\(this Microsoft\.Extensions\.DependencyInjection\.IServiceCollection\)'), for the same reason the custodian-held placement does: opening an envelope IS a custodian unwrap, so the external decryption backend has to be composed with its in-process peer, and a composition needs that peer registered first. A store must also be registered for the ring; the backend packages supply one. --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.IKeyCustodian.md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ### [Abblix\.Jwt\.ExternalKeys](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys 'Abblix\.Jwt\.ExternalKeys') ## IKeyCustodian Interface Host\-implemented custodian for the external private keys the library never holds in process: they live in an HSM, a cloud KMS, or a vault transit engine, and only the private operations cross the boundary\. A key published public\-only routes its private operation here by `kid`: SIGNING for a signing key, and for a decryption key an RSA/symmetric UNWRAP or an ECDH\-ES AGREEMENT\. The public operations \- signature verification, and wrapping a CEK with the recipient's public half \- stay in process and never reach the custodian\. Wire it with `AddCustodian` and a placement call; a host with no external keys leaves it unregistered\. ```csharp public interface IKeyCustodian ``` ### Remarks Every private operation is addressed by `kid`, the custodian's handle for that exact key version, identical to the published key's `kid` \- there is no separate identifier and no mapping\. The public halves the library publishes come from [GetKeyVersionsAsync\(string, CancellationToken\)](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.IKeyCustodian#Abblix.Jwt.ExternalKeys.IKeyCustodian.GetKeyVersionsAsync(string,System.Threading.CancellationToken) 'Abblix\.Jwt\.ExternalKeys\.IKeyCustodian\.GetKeyVersionsAsync\(string, System\.Threading\.CancellationToken\)'), which enumerates a named key's versions so a rotation can overlap\. The implementation never receives or returns private key material, and only needs to implement the private operations its own keys require: a signing\-only custodian leaves unwrap and agree unreachable, and a decryption\-only custodian leaves sign unreachable\. Direct encryption \(`dir`\) and password\-based key management \(PBES2\) have no external form \- the CEK is the secret itself, or is derived from it by a password KDF \- so they are never routed here and fail closed\. Every operation is a round\-trip to the custodian, so the contract returns [System\.Threading\.Tasks\.Task<>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') throughout\. ### Methods ## IKeyCustodian\.AgreeKeyAsync\(string, string, JsonWebKey, CancellationToken\) Method {#Abblix.Jwt.ExternalKeys.IKeyCustodian.AgreeKeyAsync(string,string,Abblix.Jwt.JsonWebKey,System.Threading.CancellationToken)} Performs the ECDH\-ES key agreement between the recipient's static private key \(held by the custodian\) and the originator's ephemeral public key, returning the raw shared secret Z\. The library runs the Concat KDF over Z and any AES key unwrap, so those steps never leave it\. ```csharp System.Threading.Tasks.Task AgreeKeyAsync(string keyId, string algorithm, Abblix.Jwt.JsonWebKey ephemeralPublicKey, System.Threading.CancellationToken cancellationToken); ``` #### Parameters ###### `keyId` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Jwt.ExternalKeys.IKeyCustodian.AgreeKeyAsync(string,string,Abblix.Jwt.JsonWebKey,System.Threading.CancellationToken).keyId} The custodian's handle for the recipient key version\. ###### `algorithm` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Jwt.ExternalKeys.IKeyCustodian.AgreeKeyAsync(string,string,Abblix.Jwt.JsonWebKey,System.Threading.CancellationToken).algorithm} The JWE `alg` value \(ECDH\-ES or an ECDH\-ES\+A\*KW variant\)\. ###### `ephemeralPublicKey` [JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey') {#Abblix.Jwt.ExternalKeys.IKeyCustodian.AgreeKeyAsync(string,string,Abblix.Jwt.JsonWebKey,System.Threading.CancellationToken).ephemeralPublicKey} The originator's ephemeral public key from the `epk` header\. ###### `cancellationToken` [System\.Threading\.CancellationToken](https://learn.microsoft.com/en-us/dotnet/api/system.threading.cancellationtoken 'System\.Threading\.CancellationToken') {#Abblix.Jwt.ExternalKeys.IKeyCustodian.AgreeKeyAsync(string,string,Abblix.Jwt.JsonWebKey,System.Threading.CancellationToken).cancellationToken} Cancels the round\-trip to the custodian\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') The raw ECDH shared secret Z \(the agreement's field\-sized X\-coordinate\)\. ## IKeyCustodian\.GetKeyVersionsAsync\(string, CancellationToken\) Method {#Abblix.Jwt.ExternalKeys.IKeyCustodian.GetKeyVersionsAsync(string,System.Threading.CancellationToken)} Enumerates every current version of the key named [keyName](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.IKeyCustodian#Abblix.Jwt.ExternalKeys.IKeyCustodian.GetKeyVersionsAsync(string,System.Threading.CancellationToken).keyName 'Abblix\.Jwt\.ExternalKeys\.IKeyCustodian\.GetKeyVersionsAsync\(string, System\.Threading\.CancellationToken\)\.keyName') as its public half, each carrying the version\-specific `kid` that routes a private operation back to that exact version, plus the custodian's creation time for that version\. A custodian that does not version its keys yields a single element; a version\-aware custodian \(Vault Transit, Azure Key Vault\) yields every version, which a rotation policy overlaps for zero\-downtime key rollover\. Called at publication time, so JWKS publishing and local signature verification run against the returned public halves and never touch the custodian on the hot path\. ```csharp System.Collections.Generic.IAsyncEnumerable GetKeyVersionsAsync(string keyName, System.Threading.CancellationToken cancellationToken); ``` #### Parameters ###### `keyName` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Jwt.ExternalKeys.IKeyCustodian.GetKeyVersionsAsync(string,System.Threading.CancellationToken).keyName} The custodian's name for the logical key whose versions to enumerate\. ###### `cancellationToken` [System\.Threading\.CancellationToken](https://learn.microsoft.com/en-us/dotnet/api/system.threading.cancellationtoken 'System\.Threading\.CancellationToken') {#Abblix.Jwt.ExternalKeys.IKeyCustodian.GetKeyVersionsAsync(string,System.Threading.CancellationToken).cancellationToken} Cancels the round\-trip to the custodian\. #### Returns [System\.Collections\.Generic\.IAsyncEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.iasyncenumerable-1 'System\.Collections\.Generic\.IAsyncEnumerable\`1')[KeyVersion](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.KeyVersion 'Abblix\.Jwt\.KeyVersion')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.iasyncenumerable-1 'System\.Collections\.Generic\.IAsyncEnumerable\`1') The key's versions, each a public\-only [KeyVersion](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.KeyVersion 'Abblix\.Jwt\.KeyVersion')\. ## IKeyCustodian\.SignAsync\(string, string, byte\[\], CancellationToken\) Method {#Abblix.Jwt.ExternalKeys.IKeyCustodian.SignAsync(string,string,byte[],System.Threading.CancellationToken)} Signs [data](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.IKeyCustodian#Abblix.Jwt.ExternalKeys.IKeyCustodian.SignAsync(string,string,byte[],System.Threading.CancellationToken).data 'Abblix\.Jwt\.ExternalKeys\.IKeyCustodian\.SignAsync\(string, string, byte\[\], System\.Threading\.CancellationToken\)\.data') with a signing key held by the custodian, returning the signature in the JWS wire format for [algorithm](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.IKeyCustodian#Abblix.Jwt.ExternalKeys.IKeyCustodian.SignAsync(string,string,byte[],System.Threading.CancellationToken).algorithm 'Abblix\.Jwt\.ExternalKeys\.IKeyCustodian\.SignAsync\(string, string, byte\[\], System\.Threading\.CancellationToken\)\.algorithm')\. Called for a signing key the library holds public\-only\. ```csharp System.Threading.Tasks.Task SignAsync(string keyId, string algorithm, byte[] data, System.Threading.CancellationToken cancellationToken); ``` #### Parameters ###### `keyId` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Jwt.ExternalKeys.IKeyCustodian.SignAsync(string,string,byte[],System.Threading.CancellationToken).keyId} The custodian's handle for the signing key version\. ###### `algorithm` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Jwt.ExternalKeys.IKeyCustodian.SignAsync(string,string,byte[],System.Threading.CancellationToken).algorithm} The JWS algorithm identifier \(e\.g\. RS256, ES256\) the signature must use\. ###### `data` [System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Jwt.ExternalKeys.IKeyCustodian.SignAsync(string,string,byte[],System.Threading.CancellationToken).data} The signing input bytes, BASE64URL\(header\) \+ '\.' \+ BASE64URL\(payload\)\. ###### `cancellationToken` [System\.Threading\.CancellationToken](https://learn.microsoft.com/en-us/dotnet/api/system.threading.cancellationtoken 'System\.Threading\.CancellationToken') {#Abblix.Jwt.ExternalKeys.IKeyCustodian.SignAsync(string,string,byte[],System.Threading.CancellationToken).cancellationToken} Cancels the round\-trip to the custodian\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') The raw signature bytes in JWS wire format for the algorithm\. ## IKeyCustodian\.UnwrapKeyAsync\(string, string, JsonWebTokenHeader, byte\[\], CancellationToken\) Method {#Abblix.Jwt.ExternalKeys.IKeyCustodian.UnwrapKeyAsync(string,string,Abblix.Jwt.JsonWebTokenHeader,byte[],System.Threading.CancellationToken)} Recovers a Content Encryption Key: an RSA decryption \(RSA\-OAEP / RSA\-OAEP\-256 / RSA1\_5\) or a symmetric unwrap \(AES\-KW / AES\-GCM\-KW\), selected by [algorithm](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.IKeyCustodian#Abblix.Jwt.ExternalKeys.IKeyCustodian.UnwrapKeyAsync(string,string,Abblix.Jwt.JsonWebTokenHeader,byte[],System.Threading.CancellationToken).algorithm 'Abblix\.Jwt\.ExternalKeys\.IKeyCustodian\.UnwrapKeyAsync\(string, string, Abblix\.Jwt\.JsonWebTokenHeader, byte\[\], System\.Threading\.CancellationToken\)\.algorithm')\. ```csharp System.Threading.Tasks.Task UnwrapKeyAsync(string keyId, string algorithm, Abblix.Jwt.JsonWebTokenHeader header, byte[] encryptedKey, System.Threading.CancellationToken cancellationToken); ``` #### Parameters ###### `keyId` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Jwt.ExternalKeys.IKeyCustodian.UnwrapKeyAsync(string,string,Abblix.Jwt.JsonWebTokenHeader,byte[],System.Threading.CancellationToken).keyId} The custodian's handle for the recipient key version\. ###### `algorithm` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Jwt.ExternalKeys.IKeyCustodian.UnwrapKeyAsync(string,string,Abblix.Jwt.JsonWebTokenHeader,byte[],System.Threading.CancellationToken).algorithm} The JWE `alg` value identifying the key\-management operation\. ###### `header` [JsonWebTokenHeader](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenHeader 'Abblix\.Jwt\.JsonWebTokenHeader') {#Abblix.Jwt.ExternalKeys.IKeyCustodian.UnwrapKeyAsync(string,string,Abblix.Jwt.JsonWebTokenHeader,byte[],System.Threading.CancellationToken).header} The JWE header; AES\-GCM\-KW reads its `iv` / `tag` parameters from it\. ###### `encryptedKey` [System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Jwt.ExternalKeys.IKeyCustodian.UnwrapKeyAsync(string,string,Abblix.Jwt.JsonWebTokenHeader,byte[],System.Threading.CancellationToken).encryptedKey} The wrapped or RSA\-encrypted CEK from the JWE Encrypted Key\. ###### `cancellationToken` [System\.Threading\.CancellationToken](https://learn.microsoft.com/en-us/dotnet/api/system.threading.cancellationtoken 'System\.Threading\.CancellationToken') {#Abblix.Jwt.ExternalKeys.IKeyCustodian.UnwrapKeyAsync(string,string,Abblix.Jwt.JsonWebTokenHeader,byte[],System.Threading.CancellationToken).cancellationToken} Cancels the round\-trip to the custodian\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') The recovered CEK, or null on any failure\. Returning null rather than throwing keeps a decryption failure indistinguishable from a wrong key, which the RFC 7516 §11\.5 mitigation upstream relies on to close the Bleichenbacher / padding\-oracle side channel\. --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.IKeyCustodianBuilder.md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ### [Abblix\.Jwt\.ExternalKeys](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys 'Abblix\.Jwt\.ExternalKeys') ## IKeyCustodianBuilder Interface The continuation of a custodian registration: the host has said WHICH custodian holds its keys and must now say HOW the library uses it\. These are two independent choices, and the second one is the security posture \- where the private half of a key lives \- so it is named at the call site and never defaulted\. The choices are `UseKeysInCustodian`, where the private half never enters this process and every signature and every CEK unwrap is a round\-trip to the custodian, and `UseKeysInProcess`, where the library mints its own keys and the custodian only seals them\. ```csharp public interface IKeyCustodianBuilder ``` Derived ↳ [KeyCustodianBuilder](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.KeyCustodianBuilder 'Abblix\.Jwt\.ExternalKeys\.KeyCustodianBuilder') ### Remarks A host that drops this builder without naming a placement fails at startup, rather than falling back silently to whatever keys its configuration happens to carry \- which would leave a configured custodian, a clean log, and local keys\. ### Properties ## IKeyCustodianBuilder\.Services Property {#Abblix.Jwt.ExternalKeys.IKeyCustodianBuilder.Services} The collection the placement call records its choice into\. ```csharp Microsoft.Extensions.DependencyInjection.IServiceCollection Services { get; } ``` #### Property Value [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.IKeyRing.md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ### [Abblix\.Jwt\.ExternalKeys](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys 'Abblix\.Jwt\.ExternalKeys') ## IKeyRing Interface Hands out the keys it holds to whoever asks for them\. ```csharp public interface IKeyRing ``` Derived ↳ [InMemoryKeyRing](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.InMemoryKeyRing 'Abblix\.Jwt\.ExternalKeys\.InMemoryKeyRing') ### Remarks The ring knows how keys are minted, sealed, shared and rotated, and nothing about what they are then used for\. An OpenID Provider asks it for the keys it signs with and publishes; a client asks it for the keys it protects stored sessions with\. Both get the same answer from the same ring, which is why this contract names neither of them\. ### Methods ## IKeyRing\.Get\(string, bool\) Method {#Abblix.Jwt.ExternalKeys.IKeyRing.Get(string,bool)} Returns the keys for a role, the one to produce with leading\. ```csharp System.Collections.Generic.IEnumerable Get(string usage, bool includePrivateKeys); ``` #### Parameters ###### `usage` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Jwt.ExternalKeys.IKeyRing.Get(string,bool).usage} Which role to serve, signature or encryption\. ###### `includePrivateKeys` [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') {#Abblix.Jwt.ExternalKeys.IKeyRing.Get(string,bool).includePrivateKeys} Whether the caller needs the private half, which only signing and decryption do\. Publication must not\. #### Returns [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ### Remarks The ordering carries meaning: whoever produces takes the first key for an algorithm, while every key stays in the result so consumers can still verify or decrypt across a rotation\. ## IKeyRing\.RefreshAsync\(CancellationToken\) Method {#Abblix.Jwt.ExternalKeys.IKeyRing.RefreshAsync(System.Threading.CancellationToken)} Brings the ring up to date: mints what the current period lacks, retires what has expired, and reloads what other instances have minted\. ```csharp System.Threading.Tasks.Task RefreshAsync(System.Threading.CancellationToken cancellationToken); ``` #### Parameters ###### `cancellationToken` [System\.Threading\.CancellationToken](https://learn.microsoft.com/en-us/dotnet/api/system.threading.cancellationtoken 'System\.Threading\.CancellationToken') {#Abblix.Jwt.ExternalKeys.IKeyRing.RefreshAsync(System.Threading.CancellationToken).cancellationToken} Cancels the refresh\. #### Returns [System\.Threading\.Tasks\.Task](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task 'System\.Threading\.Tasks\.Task') --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.IKeyRingStore.md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ### [Abblix\.Jwt\.ExternalKeys](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys 'Abblix\.Jwt\.ExternalKeys') ## IKeyRingStore Interface The shared place the server's minted keys live, so every pod serves one key set rather than its own\. Entries are encrypted to the custodian's key\-encryption key before they get here, so this store holds ciphertext and never a secret\. ```csharp public interface IKeyRingStore ``` ### Remarks The port is three methods because the design needs no more\. Key state is not stored, it is computed: given the entries and their creation times, every pod derives the same announced / active / retired projection by arithmetic, so there is nothing to update and no state machine to synchronise\. The single operation that does need synchronising is creating the next key, since two pods would otherwise generate different material, and [TryAddAsync\(StoredKey, CancellationToken\)](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.IKeyRingStore#Abblix.Jwt.ExternalKeys.IKeyRingStore.TryAddAsync(Abblix.Jwt.ExternalKeys.StoredKey,System.Threading.CancellationToken) 'Abblix\.Jwt\.ExternalKeys\.IKeyRingStore\.TryAddAsync\(Abblix\.Jwt\.ExternalKeys\.StoredKey, System\.Threading\.CancellationToken\)') carries that alone\. Because the entry is ciphertext we produced, the store's own protection is not what keeps the key safe: an implementation may be a database, a blob, a config map, or the custodian's own key-value engine, and the threat model does not change with the choice. ### Methods ## IKeyRingStore\.LoadAsync\(CancellationToken\) Method {#Abblix.Jwt.ExternalKeys.IKeyRingStore.LoadAsync(System.Threading.CancellationToken)} Reads every entry\. The caller projects the key states from their creation times, so the store neither filters nor orders\. ```csharp System.Threading.Tasks.Task> LoadAsync(System.Threading.CancellationToken cancellationToken); ``` #### Parameters ###### `cancellationToken` [System\.Threading\.CancellationToken](https://learn.microsoft.com/en-us/dotnet/api/system.threading.cancellationtoken 'System\.Threading\.CancellationToken') {#Abblix.Jwt.ExternalKeys.IKeyRingStore.LoadAsync(System.Threading.CancellationToken).cancellationToken} Cancels the read\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[System\.Collections\.Generic\.IReadOnlyList<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ireadonlylist-1 'System\.Collections\.Generic\.IReadOnlyList\`1')[StoredKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.StoredKey 'Abblix\.Jwt\.ExternalKeys\.StoredKey')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ireadonlylist-1 'System\.Collections\.Generic\.IReadOnlyList\`1')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') All entries currently in the ring\. ## IKeyRingStore\.RemoveAsync\(string, CancellationToken\) Method {#Abblix.Jwt.ExternalKeys.IKeyRingStore.RemoveAsync(string,System.Threading.CancellationToken)} Removes an entry, idempotently: removing an absent id is not an error\. ```csharp System.Threading.Tasks.Task RemoveAsync(string id, System.Threading.CancellationToken cancellationToken); ``` #### Parameters ###### `id` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Jwt.ExternalKeys.IKeyRingStore.RemoveAsync(string,System.Threading.CancellationToken).id} The [Id](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.StoredKey#Abblix.Jwt.ExternalKeys.StoredKey.Id 'Abblix\.Jwt\.ExternalKeys\.StoredKey\.Id') to remove\. ###### `cancellationToken` [System\.Threading\.CancellationToken](https://learn.microsoft.com/en-us/dotnet/api/system.threading.cancellationtoken 'System\.Threading\.CancellationToken') {#Abblix.Jwt.ExternalKeys.IKeyRingStore.RemoveAsync(string,System.Threading.CancellationToken).cancellationToken} Cancels the write\. #### Returns [System\.Threading\.Tasks\.Task](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task 'System\.Threading\.Tasks\.Task') ### Remarks Only ever called for a key already past every token it signed, so removal races are harmless: two pods removing the same expired entry is the same outcome as one\. ## IKeyRingStore\.TryAddAsync\(StoredKey, CancellationToken\) Method {#Abblix.Jwt.ExternalKeys.IKeyRingStore.TryAddAsync(Abblix.Jwt.ExternalKeys.StoredKey,System.Threading.CancellationToken)} Inserts an entry if its [Id](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.StoredKey#Abblix.Jwt.ExternalKeys.StoredKey.Id 'Abblix\.Jwt\.ExternalKeys\.StoredKey\.Id') is not taken, and reports whether this caller was the one that took it\. ```csharp System.Threading.Tasks.Task TryAddAsync(Abblix.Jwt.ExternalKeys.StoredKey key, System.Threading.CancellationToken cancellationToken); ``` #### Parameters ###### `key` [StoredKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.StoredKey 'Abblix\.Jwt\.ExternalKeys\.StoredKey') {#Abblix.Jwt.ExternalKeys.IKeyRingStore.TryAddAsync(Abblix.Jwt.ExternalKeys.StoredKey,System.Threading.CancellationToken).key} The entry to insert\. ###### `cancellationToken` [System\.Threading\.CancellationToken](https://learn.microsoft.com/en-us/dotnet/api/system.threading.cancellationtoken 'System\.Threading\.CancellationToken') {#Abblix.Jwt.ExternalKeys.IKeyRingStore.TryAddAsync(Abblix.Jwt.ExternalKeys.StoredKey,System.Threading.CancellationToken).cancellationToken} Cancels the write\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') True when this caller inserted the entry; false when another pod had already claimed the id, in which case the caller re\-reads the ring and uses the winner's key\. ### Remarks This is the whole of the coordination, and it must be atomic in the backing store: a unique index, a conditional create, a compare\-and\-set on absence\. Two pods minting the same period both attempt the same id, exactly one gets true, and the loser discards the key it generated\. An implementation that cannot insert atomically cannot back this port\. --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.IMintedKeysBuilder.md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ### [Abblix\.Jwt\.ExternalKeys](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys 'Abblix\.Jwt\.ExternalKeys') ## IMintedKeysBuilder Interface The continuation of `UseKeysInProcess`: the placement that mints its own keys must say where the ring lives, and the packages hang their `PersistRingTo...` calls off this\. ```csharp public interface IMintedKeysBuilder ``` ### Remarks A ring store belongs to this placement and to no other, so it attaches here rather than to the service collection: there is nothing to register a store onto unless the placement that needs one was chosen\. The placement where the custodian holds every key has no ring at all\. ### Properties ## IMintedKeysBuilder\.Services Property {#Abblix.Jwt.ExternalKeys.IMintedKeysBuilder.Services} The collection a `PersistRingTo...` call registers the store into\. ```csharp Microsoft.Extensions.DependencyInjection.IServiceCollection Services { get; } ``` #### Property Value [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') ### Methods ## IMintedKeysBuilder\.AdoptExistingKeys\(JsonWebKey\[\]\) Method {#Abblix.Jwt.ExternalKeys.IMintedKeysBuilder.AdoptExistingKeys(Abblix.Jwt.JsonWebKey[])} Takes keys the server already signs with into the ring, so that switching to minted keys does not change which key produces on the day it happens\. ```csharp Abblix.Jwt.ExternalKeys.IMintedKeysBuilder AdoptExistingKeys(params Abblix.Jwt.JsonWebKey[] keys); ``` #### Parameters ###### `keys` [JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Jwt.ExternalKeys.IMintedKeysBuilder.AdoptExistingKeys(Abblix.Jwt.JsonWebKey[]).keys} The keys to take, private halves included \- the ring seals what it is given, and a key without its private half can be published but cannot sign\. #### Returns [IMintedKeysBuilder](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.IMintedKeysBuilder 'Abblix\.Jwt\.ExternalKeys\.IMintedKeysBuilder') The same builder, so the `PersistRingTo...` call follows\. ### Remarks This is a migration call and is meant to be deleted once the ring has rotated past the keys it names, but nothing breaks if it is not: keys are taken only into an EMPTY ring, so from the first entry onward the call does nothing\. See [AdoptedKeys](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.MintedKeys#Abblix.Jwt.ExternalKeys.MintedKeys.AdoptedKeys 'Abblix\.Jwt\.ExternalKeys\.MintedKeys\.AdoptedKeys') for what adoption does to the ordering\. --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.InMemoryKeyRing.md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ### [Abblix\.Jwt\.ExternalKeys](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys 'Abblix\.Jwt\.ExternalKeys') ## InMemoryKeyRing Class A key ring whose keys are minted in this process and never leave it\. ```csharp public sealed class InMemoryKeyRing : Abblix.Jwt.ExternalKeys.IKeyRing ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → InMemoryKeyRing Implements [IKeyRing](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.IKeyRing 'Abblix\.Jwt\.ExternalKeys\.IKeyRing') ### Remarks The default for a host that has no HSM or KMS, which is most of them\. It gives what a ring is for \- rotation without breaking what the retired key produced \- and nothing more: the keys live in memory, so they are gone when the process is, and no other process shares them\. That last property is the whole of the difference from [Abblix\.Jwt\.ExternalKeys\.KeyRing](https://learn.microsoft.com/en-us/dotnet/api/abblix.jwt.externalkeys.keyring 'Abblix\.Jwt\.ExternalKeys\.KeyRing'), and it is a difference in guarantee, not in strength\. A custodian\-backed ring puts the private half somewhere this process cannot reach and every replica can; this one puts it somewhere only this process can reach\. Which is right depends on how the host is deployed, so the host chooses rather than inheriting a default\. ### Constructors ## InMemoryKeyRing\(LocalKeys, IOptions\, TimeProvider\) Constructor {#Abblix.Jwt.ExternalKeys.InMemoryKeyRing.InMemoryKeyRing(Abblix.Jwt.ExternalKeys.LocalKeys,Microsoft.Extensions.Options.IOptions_Abblix.Jwt.ExternalKeys.KeyRingOptions_,System.TimeProvider)} Creates the ring\. ```csharp public InMemoryKeyRing(Abblix.Jwt.ExternalKeys.LocalKeys policy, Microsoft.Extensions.Options.IOptions options, System.TimeProvider timeProvider); ``` #### Parameters ###### `policy` [LocalKeys](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.LocalKeys 'Abblix\.Jwt\.ExternalKeys\.LocalKeys') {#Abblix.Jwt.ExternalKeys.InMemoryKeyRing.InMemoryKeyRing(Abblix.Jwt.ExternalKeys.LocalKeys,Microsoft.Extensions.Options.IOptions_Abblix.Jwt.ExternalKeys.KeyRingOptions_,System.TimeProvider).policy} ###### `options` [Microsoft\.Extensions\.Options\.IOptions<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptions-1 'Microsoft\.Extensions\.Options\.IOptions\`1')[KeyRingOptions](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.KeyRingOptions 'Abblix\.Jwt\.ExternalKeys\.KeyRingOptions')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptions-1 'Microsoft\.Extensions\.Options\.IOptions\`1') {#Abblix.Jwt.ExternalKeys.InMemoryKeyRing.InMemoryKeyRing(Abblix.Jwt.ExternalKeys.LocalKeys,Microsoft.Extensions.Options.IOptions_Abblix.Jwt.ExternalKeys.KeyRingOptions_,System.TimeProvider).options} ###### `timeProvider` [System\.TimeProvider](https://learn.microsoft.com/en-us/dotnet/api/system.timeprovider 'System\.TimeProvider') {#Abblix.Jwt.ExternalKeys.InMemoryKeyRing.InMemoryKeyRing(Abblix.Jwt.ExternalKeys.LocalKeys,Microsoft.Extensions.Options.IOptions_Abblix.Jwt.ExternalKeys.KeyRingOptions_,System.TimeProvider).timeProvider} ### Methods ## InMemoryKeyRing\.Get\(string, bool\) Method {#Abblix.Jwt.ExternalKeys.InMemoryKeyRing.Get(string,bool)} Returns the keys for a role, the one to produce with leading\. ```csharp public System.Collections.Generic.IEnumerable Get(string usage, bool includePrivateKeys); ``` #### Parameters ###### `usage` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Jwt.ExternalKeys.InMemoryKeyRing.Get(string,bool).usage} Which role to serve, signature or encryption\. ###### `includePrivateKeys` [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') {#Abblix.Jwt.ExternalKeys.InMemoryKeyRing.Get(string,bool).includePrivateKeys} Whether the caller needs the private half, which only signing and decryption do\. Publication must not\. Implements [Get\(string, bool\)](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.IKeyRing#Abblix.Jwt.ExternalKeys.IKeyRing.Get(string,bool) 'Abblix\.Jwt\.ExternalKeys\.IKeyRing\.Get\(string, bool\)') #### Returns [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ### Remarks The ordering carries meaning: whoever produces takes the first key for an algorithm, while every key stays in the result so consumers can still verify or decrypt across a rotation\. ## InMemoryKeyRing\.RefreshAsync\(CancellationToken\) Method {#Abblix.Jwt.ExternalKeys.InMemoryKeyRing.RefreshAsync(System.Threading.CancellationToken)} Brings the ring up to date: mints what the current period lacks, retires what has expired, and reloads what other instances have minted\. ```csharp public System.Threading.Tasks.Task RefreshAsync(System.Threading.CancellationToken cancellationToken); ``` #### Parameters ###### `cancellationToken` [System\.Threading\.CancellationToken](https://learn.microsoft.com/en-us/dotnet/api/system.threading.cancellationtoken 'System\.Threading\.CancellationToken') {#Abblix.Jwt.ExternalKeys.InMemoryKeyRing.RefreshAsync(System.Threading.CancellationToken).cancellationToken} Cancels the refresh\. Implements [RefreshAsync\(CancellationToken\)](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.IKeyRing#Abblix.Jwt.ExternalKeys.IKeyRing.RefreshAsync(System.Threading.CancellationToken) 'Abblix\.Jwt\.ExternalKeys\.IKeyRing\.RefreshAsync\(System\.Threading\.CancellationToken\)') #### Returns [System\.Threading\.Tasks\.Task](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task 'System\.Threading\.Tasks\.Task') --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.KeyCustodianBuilder.md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ### [Abblix\.Jwt\.ExternalKeys](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys 'Abblix\.Jwt\.ExternalKeys') ## KeyCustodianBuilder Class The continuation of a custodian registration: the host has said WHICH custodian holds its keys and must now say HOW the library uses it\. These are two independent choices, and the second one is the security posture \- where the private half of a key lives \- so it is named at the call site and never defaulted\. The choices are `UseKeysInCustodian`, where the private half never enters this process and every signature and every CEK unwrap is a round\-trip to the custodian, and `UseKeysInProcess`, where the library mints its own keys and the custodian only seals them\. ```csharp public sealed class KeyCustodianBuilder : Abblix.Jwt.ExternalKeys.IKeyCustodianBuilder ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → KeyCustodianBuilder Implements [IKeyCustodianBuilder](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.IKeyCustodianBuilder 'Abblix\.Jwt\.ExternalKeys\.IKeyCustodianBuilder') ### Remarks A host that drops this builder without naming a placement fails at startup, rather than falling back silently to whatever keys its configuration happens to carry \- which would leave a configured custodian, a clean log, and local keys\. ### Properties ## KeyCustodianBuilder\.Services Property {#Abblix.Jwt.ExternalKeys.KeyCustodianBuilder.Services} The collection the placement call records its choice into\. ```csharp public Microsoft.Extensions.DependencyInjection.IServiceCollection Services { get; } ``` Implements [Services](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.IKeyCustodianBuilder#Abblix.Jwt.ExternalKeys.IKeyCustodianBuilder.Services 'Abblix\.Jwt\.ExternalKeys\.IKeyCustodianBuilder\.Services') #### Property Value [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.KeyPlacement.md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ### [Abblix\.Jwt\.ExternalKeys](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys 'Abblix\.Jwt\.ExternalKeys') ## KeyPlacement Enum Where the private half of a key lives once a custodian is wired\. This is the security posture, so a host names it at the call site and the library never picks one\. ```csharp public enum KeyPlacement ``` ### Fields ###### `Custodian` 0 {#Abblix.Jwt.ExternalKeys.KeyPlacement.Custodian} The private halves stay in the custodian\. Every signature and every Content Encryption Key unwrap is a round\-trip to it, and a compromised process holds no key to leak\. ###### `InProcess` 1 {#Abblix.Jwt.ExternalKeys.KeyPlacement.InProcess} The keys are minted in this process, sealed to the custodian's key\-encryption key and shared as ciphertext through an [IKeyRingStore](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.IKeyRingStore 'Abblix\.Jwt\.ExternalKeys\.IKeyRingStore')\. Signing then runs locally, so the custodian is touched once per key rather than once per token\. ### Remarks Recorded rather than inferred from the registrations, so a host that layers its own key provider over the placement's does not change the answer\. An enum rather than the name of the call that chose it: consumers dispatch on this, and a dispatch on a method name is a magic string that survives the method being renamed\. --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.KeyPlacementChoice.md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ### [Abblix\.Jwt\.ExternalKeys](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys 'Abblix\.Jwt\.ExternalKeys') ## KeyPlacementChoice Class Records where the host chose to keep its private keys for its registered custodian, so the choice can be checked at startup rather than at the first key operation\. ```csharp public sealed class KeyPlacementChoice ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → KeyPlacementChoice ### Remarks Riding the options\-validation pipeline is what buys the timing: `ValidateOnStart` registers an `IStartupValidator`, and the host runs it BEFORE it starts any hosted service, including the one that opens the HTTP port\. A hosted service of our own would only run once that port is already open\. The state lives here rather than on `OidcOptions` because validating those would resolve the key provider, which itself depends on those same options\. ### Fields ## KeyPlacementChoice\.PlacementNotChosenMessage Field {#Abblix.Jwt.ExternalKeys.KeyPlacementChoice.PlacementNotChosenMessage} What a host is told when it registered a custodian and never said how its keys are used\. ```csharp public const string PlacementNotChosenMessage = "A key custodian is registered, but where its private keys live was never chosen. Follow the custodian registration with UseKeysInCustodian() to keep the private half inside the custodian, or UseKeysInProcess() to mint keys locally and seal them to it."; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks Held here rather than on whichever guard reports it, because more than one does: the startup validation says it when the host has a lifetime to run validators, and the key provider says it when something asks for keys without one\. Two guards saying different things about the same omission would read as two different problems\. ### Properties ## KeyPlacementChoice\.ChosenPlacement Property {#Abblix.Jwt.ExternalKeys.KeyPlacementChoice.ChosenPlacement} Where the placement call put the private halves, or null when no placement call ran\. Recording the choice rather than inspecting the registered provider keeps the check independent of a host that layers its own provider over the placement's\. ```csharp public System.Nullable ChosenPlacement { get; set; } ``` #### Property Value [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[KeyPlacement](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.KeyPlacement 'Abblix\.Jwt\.ExternalKeys\.KeyPlacement')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.KeyRingOptions.md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ### [Abblix\.Jwt\.ExternalKeys](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys 'Abblix\.Jwt\.ExternalKeys') ## KeyRingOptions Class Configuration of the key ring\. ```csharp public sealed class KeyRingOptions ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → KeyRingOptions ### Properties ## KeyRingOptions\.KeyRolloverPropagation Property {#Abblix.Jwt.ExternalKeys.KeyRingOptions.KeyRolloverPropagation} How long a newly minted key is published before the ring starts producing with it\. ```csharp public System.TimeSpan KeyRolloverPropagation { get; set; } ``` #### Property Value [System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan') ### Remarks A consumer caches the published key set, so a key that starts signing the moment it appears will sign tokens that consumers with a warm cache cannot yet verify\. Publishing first and producing later closes that window: by the time a key leads its algorithm, every consumer refreshing on the usual schedule has already seen it\. The value is therefore a property of how long consumers cache, not of how often keys rotate\. An hour covers the caching most providers and clients default to\. --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.LocalKeys.md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ### [Abblix\.Jwt\.ExternalKeys](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys 'Abblix\.Jwt\.ExternalKeys') ## LocalKeys Class What an in\-process key ring mints, and how often\. ```csharp public sealed record LocalKeys : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → LocalKeys Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[LocalKeys](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.LocalKeys 'Abblix\.Jwt\.ExternalKeys\.LocalKeys')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Remarks The counterpart of [MintedKeys](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.MintedKeys 'Abblix\.Jwt\.ExternalKeys\.MintedKeys') for a ring with no custodian behind it\. It names no key\-encryption key because there is nothing to seal to and nothing to seal for: the keys never leave the process that made them\. ### Properties ## LocalKeys\.EncryptionAlgorithm Property {#Abblix.Jwt.ExternalKeys.LocalKeys.EncryptionAlgorithm} The JWE key\-management algorithm the minted encryption key uses, or null to mint no encryption key\. ```csharp public string? EncryptionAlgorithm { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## LocalKeys\.KeepRetiredFor Property {#Abblix.Jwt.ExternalKeys.LocalKeys.KeepRetiredFor} How long a key that has stopped producing is still offered, so what it produced stays verifiable\. ```csharp public System.TimeSpan KeepRetiredFor { get; init; } ``` #### Property Value [System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan') ### Remarks Must outlast the longest thing the key signed or encrypted\. Retire a key sooner than the tokens it signed, and those tokens fail verification while their holders still believe them valid\. ## LocalKeys\.RotateEvery Property {#Abblix.Jwt.ExternalKeys.LocalKeys.RotateEvery} How often a fresh key is minted and the previous one steps back from producing\. ```csharp public System.TimeSpan RotateEvery { get; init; } ``` #### Property Value [System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan') ## LocalKeys\.RsaKeySize Property {#Abblix.Jwt.ExternalKeys.LocalKeys.RsaKeySize} The modulus size of a minted RSA key\. ```csharp public int RsaKeySize { get; init; } ``` #### Property Value [System\.Int32](https://learn.microsoft.com/en-us/dotnet/api/system.int32 'System\.Int32') ## LocalKeys\.SigningAlgorithm Property {#Abblix.Jwt.ExternalKeys.LocalKeys.SigningAlgorithm} The JWS algorithm the minted signing keys use, which also decides what is generated\. ```csharp public string SigningAlgorithm { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.MintedKeys.md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ### [Abblix\.Jwt\.ExternalKeys](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys 'Abblix\.Jwt\.ExternalKeys') ## MintedKeys Class The policy for the placement where the server mints its own keys and the custodian only protects them \(`UseKeysInProcess`\): it generates them, encrypts them to the custodian's key\-encryption key, keeps the ciphertext in a shared ring, and rotates on schedule\. No key names here \- the server names what it creates\. ```csharp public sealed record MintedKeys : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → MintedKeys Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[MintedKeys](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.MintedKeys 'Abblix\.Jwt\.ExternalKeys\.MintedKeys')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Remarks This is the weaker of the two postures, and naming it at the call site is the point: the private half is unwrapped into process memory and stays there, so a compromised process yields the key itself rather than the ability to ask the custodian to sign while its credential lives\. In exchange, signing runs in process, and the custodian is touched once per key rather than once per token\. Choose [CustodianHeldKeys](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.CustodianHeldKeys 'Abblix\.Jwt\.ExternalKeys\.CustodianHeldKeys') when the key must never be in memory at all\. ### Properties ## MintedKeys\.AdoptedKeys Property {#Abblix.Jwt.ExternalKeys.MintedKeys.AdoptedKeys} Keys the server already signs with, taken into an EMPTY ring so the move to minted keys does not change which key is producing on the day it happens\. Normally set through [AdoptExistingKeys\(JsonWebKey\[\]\)](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.IMintedKeysBuilder#Abblix.Jwt.ExternalKeys.IMintedKeysBuilder.AdoptExistingKeys(Abblix.Jwt.JsonWebKey[]) 'Abblix\.Jwt\.ExternalKeys\.IMintedKeysBuilder\.AdoptExistingKeys\(Abblix\.Jwt\.JsonWebKey\[\]\)') rather than written here\. ```csharp public System.Collections.Generic.IReadOnlyList AdoptedKeys { get; init; } ``` #### Property Value [System\.Collections\.Generic\.IReadOnlyList<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ireadonlylist-1 'System\.Collections\.Generic\.IReadOnlyList\`1')[JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ireadonlylist-1 'System\.Collections\.Generic\.IReadOnlyList\`1') ### Remarks Without this the ring starts empty, and a ring of one key has nothing to trail behind: the freshly minted key produces from its first second, so every client whose JWKS copy predates that second meets a token it cannot verify\. An adopted key is dated one rotation period back, which is what makes it the active one while the minted key serves out its propagation window \- the old key keeps signing, the new one is published, and the changeover happens once clients have had the window to fetch it\. Adoption happens only into an empty ring. That is what makes leaving the call in place harmless: once the ring holds anything the keys are never taken again, so a key that has since retired is not resurrected, and pods racing to adopt settle it the same way they settle minting - one insert wins and the rest drop what they built. ## MintedKeys\.ContentEncryptionAlgorithm Property {#Abblix.Jwt.ExternalKeys.MintedKeys.ContentEncryptionAlgorithm} The JWE `enc` sealing an entry: how the key itself is encrypted\. ```csharp public string ContentEncryptionAlgorithm { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## MintedKeys\.EncryptionAlgorithm Property {#Abblix.Jwt.ExternalKeys.MintedKeys.EncryptionAlgorithm} The JWE key\-management algorithm the minted encryption key uses, or null to mint no encryption key at all\. ```csharp public string? EncryptionAlgorithm { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks Name it when anything encrypts to this provider: it covers both the provider's own encrypted tokens and inbound JWE a client sent, such as an encrypted request object\. ## MintedKeys\.KeepRetiredFor Property {#Abblix.Jwt.ExternalKeys.MintedKeys.KeepRetiredFor} How long a key is kept after it stops signing, before it leaves the ring\. Null keeps it for one full rotation period, which is the safe reading of [RotateEvery](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.MintedKeys#Abblix.Jwt.ExternalKeys.MintedKeys.RotateEvery 'Abblix\.Jwt\.ExternalKeys\.MintedKeys\.RotateEvery')\. ```csharp public System.Nullable KeepRetiredFor { get; init; } ``` #### Property Value [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') ### Remarks This must outlast every token the key signed\. Removing it early does not degrade anything gracefully: the key vanishes from `/jwks` and every unexpired token it signed stops verifying, which is why the default errs long rather than short\. Set it explicitly only to say "no token of mine lives longer than this", and remember refresh tokens are signed too, not just access tokens\. ## MintedKeys\.KeyEncryptionKeyName Property {#Abblix.Jwt.ExternalKeys.MintedKeys.KeyEncryptionKeyName} The custodian's name for the key\-encryption key\. Its versions seal and open the ring's entries, and it is the only key the custodian holds for this placement\. ```csharp public string KeyEncryptionKeyName { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks It must be an ASYMMETRIC key\. Sealing uses its public half in process, which is what keeps the wrap local and needs no custodian round\-trip; a symmetric KEK has no public half and would require one\. Both Vault Transit and Azure Key Vault provision RSA keys, so this costs nothing in practice\. ## MintedKeys\.KeyWrapAlgorithm Property {#Abblix.Jwt.ExternalKeys.MintedKeys.KeyWrapAlgorithm} The JWE `alg` sealing an entry: how its data\-encryption key is wrapped under the KEK\. ```csharp public string KeyWrapAlgorithm { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## MintedKeys\.RotateEvery Property {#Abblix.Jwt.ExternalKeys.MintedKeys.RotateEvery} How often a fresh key is minted\. It sets the rotation grid: every pod derives the same period, and exactly one of them wins the insert for it\. ```csharp public System.TimeSpan RotateEvery { get; init; } ``` #### Property Value [System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan') ### Remarks A new key does not sign the moment it appears\. It is published and verifiable for `KeyRingOptions.KeyRolloverPropagation` first, so a client whose JWKS cache is stale never meets a token signed by a key it lacks\. Keep this comfortably larger than that window\. ## MintedKeys\.RsaKeySize Property {#Abblix.Jwt.ExternalKeys.MintedKeys.RsaKeySize} The modulus size for a minted RSA key\. Ignored when the algorithm asks for an elliptic curve\. ```csharp public int RsaKeySize { get; init; } ``` #### Property Value [System\.Int32](https://learn.microsoft.com/en-us/dotnet/api/system.int32 'System\.Int32') ## MintedKeys\.SigningAlgorithm Property {#Abblix.Jwt.ExternalKeys.MintedKeys.SigningAlgorithm} The JWS algorithm the minted signing keys use, which also decides what is generated\. ```csharp public string SigningAlgorithm { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.ProduceFirstOrdering.md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ### [Abblix\.Jwt\.ExternalKeys](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys 'Abblix\.Jwt\.ExternalKeys') ## ProduceFirstOrdering Class Orders a set of key versions so the one to produce with leads: whoever signs or encrypts takes the first key for an algorithm, while every version stays published so consumers can still verify or decrypt\. ```csharp public static class ProduceFirstOrdering ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ProduceFirstOrdering ### Remarks This is the whole of what makes a rollover cause no verification failure, and it is the same arithmetic wherever the versions come from: a custodian enumerating them, or a key ring the library owns\. It is a pure function of the creation times and the propagation window, so every pod derives the identical answer with no coordination\. ### Methods ## ProduceFirstOrdering\.ProduceFirst\\(this IReadOnlyList\, Func\, DateTimeOffset, TimeSpan\) Method {#Abblix.Jwt.ExternalKeys.ProduceFirstOrdering.ProduceFirst_T_(thisSystem.Collections.Generic.IReadOnlyList_T_,System.Func_T,System.DateTimeOffset_,System.DateTimeOffset,System.TimeSpan)} Returns the versions with the active one first and the rest trailing newest\-first\. ```csharp public static System.Collections.Generic.IEnumerable ProduceFirst(this System.Collections.Generic.IReadOnlyList versions, System.Func createdAt, System.DateTimeOffset now, System.TimeSpan propagation); ``` #### Type parameters ###### `T` {#Abblix.Jwt.ExternalKeys.ProduceFirstOrdering.ProduceFirst_T_(thisSystem.Collections.Generic.IReadOnlyList_T_,System.Func_T,System.DateTimeOffset_,System.DateTimeOffset,System.TimeSpan).T} The version type, whatever carries a creation time\. #### Parameters ###### `versions` [System\.Collections\.Generic\.IReadOnlyList<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ireadonlylist-1 'System\.Collections\.Generic\.IReadOnlyList\`1')[T](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.ProduceFirstOrdering#Abblix.Jwt.ExternalKeys.ProduceFirstOrdering.ProduceFirst_T_(thisSystem.Collections.Generic.IReadOnlyList_T_,System.Func_T,System.DateTimeOffset_,System.DateTimeOffset,System.TimeSpan).T 'Abblix\.Jwt\.ExternalKeys\.ProduceFirstOrdering\.ProduceFirst\\(this System\.Collections\.Generic\.IReadOnlyList\, System\.Func\, System\.DateTimeOffset, System\.TimeSpan\)\.T')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ireadonlylist-1 'System\.Collections\.Generic\.IReadOnlyList\`1') {#Abblix.Jwt.ExternalKeys.ProduceFirstOrdering.ProduceFirst_T_(thisSystem.Collections.Generic.IReadOnlyList_T_,System.Func_T,System.DateTimeOffset_,System.DateTimeOffset,System.TimeSpan).versions} The versions to order\. ###### `createdAt` [System\.Func<](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2')[T](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.ProduceFirstOrdering#Abblix.Jwt.ExternalKeys.ProduceFirstOrdering.ProduceFirst_T_(thisSystem.Collections.Generic.IReadOnlyList_T_,System.Func_T,System.DateTimeOffset_,System.DateTimeOffset,System.TimeSpan).T 'Abblix\.Jwt\.ExternalKeys\.ProduceFirstOrdering\.ProduceFirst\\(this System\.Collections\.Generic\.IReadOnlyList\, System\.Func\, System\.DateTimeOffset, System\.TimeSpan\)\.T')[,](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2')[System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset')[>](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2') {#Abblix.Jwt.ExternalKeys.ProduceFirstOrdering.ProduceFirst_T_(thisSystem.Collections.Generic.IReadOnlyList_T_,System.Func_T,System.DateTimeOffset_,System.DateTimeOffset,System.TimeSpan).createdAt} Reads a version's creation time\. ###### `now` [System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset') {#Abblix.Jwt.ExternalKeys.ProduceFirstOrdering.ProduceFirst_T_(thisSystem.Collections.Generic.IReadOnlyList_T_,System.Func_T,System.DateTimeOffset_,System.DateTimeOffset,System.TimeSpan).now} The current time\. ###### `propagation` [System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan') {#Abblix.Jwt.ExternalKeys.ProduceFirstOrdering.ProduceFirst_T_(thisSystem.Collections.Generic.IReadOnlyList_T_,System.Func_T,System.DateTimeOffset_,System.DateTimeOffset,System.TimeSpan).propagation} How long a version stays announced before it starts producing, which is also the max\-age the server puts on its JWKS response, so a client that honours it holds the key before it meets a token signed with it\. #### Returns [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[T](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.ProduceFirstOrdering#Abblix.Jwt.ExternalKeys.ProduceFirstOrdering.ProduceFirst_T_(thisSystem.Collections.Generic.IReadOnlyList_T_,System.Func_T,System.DateTimeOffset_,System.DateTimeOffset,System.TimeSpan).T 'Abblix\.Jwt\.ExternalKeys\.ProduceFirstOrdering\.ProduceFirst\\(this System\.Collections\.Generic\.IReadOnlyList\, System\.Func\, System\.DateTimeOffset, System\.TimeSpan\)\.T')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') The versions, produce\-first\. ### Remarks The active version is the newest one already past [propagation](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.ProduceFirstOrdering#Abblix.Jwt.ExternalKeys.ProduceFirstOrdering.ProduceFirst_T_(thisSystem.Collections.Generic.IReadOnlyList_T_,System.Func_T,System.DateTimeOffset_,System.DateTimeOffset,System.TimeSpan).propagation 'Abblix\.Jwt\.ExternalKeys\.ProduceFirstOrdering\.ProduceFirst\\(this System\.Collections\.Generic\.IReadOnlyList\, System\.Func\, System\.DateTimeOffset, System\.TimeSpan\)\.propagation')\. If none has cleared it yet \(bootstrap: the very first version is still fresh\), the newest overall leads, since there is no older version a client could be holding instead\. --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.StoredKey.md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ### [Abblix\.Jwt\.ExternalKeys](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys 'Abblix\.Jwt\.ExternalKeys') ## StoredKey Class One entry of the key ring: a private key the server minted, encrypted to the custodian's key\-encryption key, plus the two facts needed to place it without opening it\. ```csharp public sealed record StoredKey : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → StoredKey Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[StoredKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.StoredKey 'Abblix\.Jwt\.ExternalKeys\.StoredKey')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Remarks The entry is self\-contained on purpose\. Every pod derives the same state from the same set of entries with no coordination, and the only operation that ever needs synchronising is creating one, so an entry is written once and never updated\. That is what keeps [IKeyRingStore](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.IKeyRingStore 'Abblix\.Jwt\.ExternalKeys\.IKeyRingStore') to an insert\-if\-absent and no CAS on update\. ### Properties ## StoredKey\.CreatedAt Property {#Abblix.Jwt.ExternalKeys.StoredKey.CreatedAt} When the key was minted, which decides when it starts signing: the active key is the newest one past `KeyRingOptions.KeyRolloverPropagation`\. ```csharp public System.DateTimeOffset CreatedAt { get; init; } ``` #### Property Value [System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset') ### Remarks Stored rather than derived from [Id](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.StoredKey#Abblix.Jwt.ExternalKeys.StoredKey.Id 'Abblix\.Jwt\.ExternalKeys\.StoredKey\.Id'), though the period in the id implies it\. The id is a coordinate on the rotation grid; this is the fact\. Deriving it would let a change to the rotation interval silently reinterpret when existing keys were created\. ## StoredKey\.Id Property {#Abblix.Jwt.ExternalKeys.StoredKey.Id} The entry's identity, and the token every pod races for: it is derived deterministically from the key's role, its algorithm and the rotation period, so all pods compute the same value and exactly one insert wins\. ```csharp public string Id { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## StoredKey\.Jwe Property {#Abblix.Jwt.ExternalKeys.StoredKey.Jwe} The envelope: the private JWK's JSON, encrypted to the KEK, in JWE compact serialization\. Its header names the KEK version that unwraps it \(`kid`\) and the algorithms used \(`alg`, `enc`\), so the entry repeats none of that\. ```csharp public string Jwe { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ReplayPrevention.md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ## Abblix\.Jwt\.ReplayPrevention Namespace | Classes | | | :--- | :--- | | [DistributedReplayCache](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ReplayPrevention.DistributedReplayCache 'Abblix\.Jwt\.ReplayPrevention\.DistributedReplayCache') | A replay cache over the host's [Microsoft\.Extensions\.Caching\.Distributed\.IDistributedCache](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.caching.distributed.idistributedcache 'Microsoft\.Extensions\.Caching\.Distributed\.IDistributedCache'): process\-local when the host registers the in\-memory distributed cache, shared when it registers Redis or another backend \- so a scaled\-out deployment gains one common memory by swapping the store, not the cache\. | | [ReplayCacheBase](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ReplayPrevention.ReplayCacheBase 'Abblix\.Jwt\.ReplayPrevention\.ReplayCacheBase') | Everything a replay cache does apart from the one operation only its store can perform\. A derived class supplies that operation \- reserve this key if it is absent, and say whether it was \- and inherits the rest: the freshness window turned into a lifetime and floored, the key namespaced, and the store's answer passed back as the verdict\. | | Interfaces | | | :--- | :--- | | [IReplayCache](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ReplayPrevention.IReplayCache 'Abblix\.Jwt\.ReplayPrevention\.IReplayCache') | Remembers the identifiers of single\-use tokens so a second presentation of the same one can be told from the first\. Every JWT profile that forbids replay needs this and needs it in the same shape \- a DPoP proof \(RFC 9449 Section 11\.1\), a client assertion \(RFC 7523 Section 3\) and a Security Event Token \(RFC 8417 Section 2\.2\) differ in what they call the identifier and how long it stays interesting, never in the question they ask of the cache\. | --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ReplayPrevention.DistributedReplayCache.md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ### [Abblix\.Jwt\.ReplayPrevention](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ReplayPrevention 'Abblix\.Jwt\.ReplayPrevention') ## DistributedReplayCache Class A replay cache over the host's [Microsoft\.Extensions\.Caching\.Distributed\.IDistributedCache](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.caching.distributed.idistributedcache 'Microsoft\.Extensions\.Caching\.Distributed\.IDistributedCache'): process\-local when the host registers the in\-memory distributed cache, shared when it registers Redis or another backend \- so a scaled\-out deployment gains one common memory by swapping the store, not the cache\. ```csharp public sealed class DistributedReplayCache : Abblix.Jwt.ReplayPrevention.ReplayCacheBase ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [ReplayCacheBase](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ReplayPrevention.ReplayCacheBase 'Abblix\.Jwt\.ReplayPrevention\.ReplayCacheBase') → DistributedReplayCache ### Remarks The add\-if\-absent underneath is probabilistic, not strict: two concurrent presenters of one identifier can both hear "new" within a single cache round trip, because [Microsoft\.Extensions\.Caching\.Distributed\.IDistributedCache](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.caching.distributed.idistributedcache 'Microsoft\.Extensions\.Caching\.Distributed\.IDistributedCache') offers Get and Set and no compare\-and\-set\. Each profile decides whether that is acceptable \- RFC 9449 Section 11\.1 accepts probabilistic replay defence for DPoP proofs, and RFC 8935 Section 2 lets a transmitter redeliver a SET regardless, so a lost race costs one duplicate idempotent pass\. A client assertion is the one that does not read that way, since RFC 7523 Section 3 lets an authorization server reject a reused one\. A deployment relying on that rejection takes a [ReplayCacheBase](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ReplayPrevention.ReplayCacheBase 'Abblix\.Jwt\.ReplayPrevention\.ReplayCacheBase') over a store that decides and writes in one operation\. ### Constructors ## DistributedReplayCache\(IDistributedCache, TimeProvider, string\) Constructor {#Abblix.Jwt.ReplayPrevention.DistributedReplayCache.DistributedReplayCache(Microsoft.Extensions.Caching.Distributed.IDistributedCache,System.TimeProvider,string)} A replay cache over the host's [Microsoft\.Extensions\.Caching\.Distributed\.IDistributedCache](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.caching.distributed.idistributedcache 'Microsoft\.Extensions\.Caching\.Distributed\.IDistributedCache'): process\-local when the host registers the in\-memory distributed cache, shared when it registers Redis or another backend \- so a scaled\-out deployment gains one common memory by swapping the store, not the cache\. ```csharp public DistributedReplayCache(Microsoft.Extensions.Caching.Distributed.IDistributedCache cache, System.TimeProvider clock, string keyPrefix); ``` #### Parameters ###### `cache` [Microsoft\.Extensions\.Caching\.Distributed\.IDistributedCache](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.caching.distributed.idistributedcache 'Microsoft\.Extensions\.Caching\.Distributed\.IDistributedCache') {#Abblix.Jwt.ReplayPrevention.DistributedReplayCache.DistributedReplayCache(Microsoft.Extensions.Caching.Distributed.IDistributedCache,System.TimeProvider,string).cache} The distributed cache the host registered; the store is the host's choice\. ###### `clock` [System\.TimeProvider](https://learn.microsoft.com/en-us/dotnet/api/system.timeprovider 'System\.TimeProvider') {#Abblix.Jwt.ReplayPrevention.DistributedReplayCache.DistributedReplayCache(Microsoft.Extensions.Caching.Distributed.IDistributedCache,System.TimeProvider,string).clock} The clock the retention window is measured against\. ###### `keyPrefix` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Jwt.ReplayPrevention.DistributedReplayCache.DistributedReplayCache(Microsoft.Extensions.Caching.Distributed.IDistributedCache,System.TimeProvider,string).keyPrefix} Keeps these entries out of the way of whatever else shares the host's cache\. It is the caller's to choose and its exact text is a deployment contract, not an implementation detail: entries written under one prefix are invisible under another, so changing it mid\-rollout leaves the identifiers already reserved unreachable until they age out\. ### Remarks The add\-if\-absent underneath is probabilistic, not strict: two concurrent presenters of one identifier can both hear "new" within a single cache round trip, because [Microsoft\.Extensions\.Caching\.Distributed\.IDistributedCache](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.caching.distributed.idistributedcache 'Microsoft\.Extensions\.Caching\.Distributed\.IDistributedCache') offers Get and Set and no compare\-and\-set\. Each profile decides whether that is acceptable \- RFC 9449 Section 11\.1 accepts probabilistic replay defence for DPoP proofs, and RFC 8935 Section 2 lets a transmitter redeliver a SET regardless, so a lost race costs one duplicate idempotent pass\. A client assertion is the one that does not read that way, since RFC 7523 Section 3 lets an authorization server reject a reused one\. A deployment relying on that rejection takes a [ReplayCacheBase](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ReplayPrevention.ReplayCacheBase 'Abblix\.Jwt\.ReplayPrevention\.ReplayCacheBase') over a store that decides and writes in one operation\. --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ReplayPrevention.IReplayCache.md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ### [Abblix\.Jwt\.ReplayPrevention](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ReplayPrevention 'Abblix\.Jwt\.ReplayPrevention') ## IReplayCache Interface Remembers the identifiers of single\-use tokens so a second presentation of the same one can be told from the first\. Every JWT profile that forbids replay needs this and needs it in the same shape \- a DPoP proof \(RFC 9449 Section 11\.1\), a client assertion \(RFC 7523 Section 3\) and a Security Event Token \(RFC 8417 Section 2\.2\) differ in what they call the identifier and how long it stays interesting, never in the question they ask of the cache\. ```csharp public interface IReplayCache ``` Derived ↳ [ReplayCacheBase](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ReplayPrevention.ReplayCacheBase 'Abblix\.Jwt\.ReplayPrevention\.ReplayCacheBase') ### Remarks The contract is reserve\-and\-check in one call, so a caller cannot read, decide and write in three steps that another caller slips between\. Whether the reservation is strictly atomic is the implementation's promise, not this interface's: the shipped [DistributedReplayCache](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ReplayPrevention.DistributedReplayCache 'Abblix\.Jwt\.ReplayPrevention\.DistributedReplayCache') rides `IDistributedCache`, which exposes only Get and Set, so its answer is probabilistic within one cache round trip\. A deployment that needs strict single\-use takes a backend\-native primitive behind this same interface, which is what [ReplayCacheBase](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ReplayPrevention.ReplayCacheBase 'Abblix\.Jwt\.ReplayPrevention\.ReplayCacheBase') is for: it holds everything around the primitive and leaves the primitive itself to a subclass \- Redis `SET NX PX`, SQL `INSERT ... ON CONFLICT DO NOTHING`, and their equivalents\. ### Methods ## IReplayCache\.TryReserveAsync\(string, DateTimeOffset, CancellationToken\) Method {#Abblix.Jwt.ReplayPrevention.IReplayCache.TryReserveAsync(string,System.DateTimeOffset,System.Threading.CancellationToken)} Reserves an identifier, answering whether this is its first sighting\. ```csharp System.Threading.Tasks.Task TryReserveAsync(string identifier, System.DateTimeOffset expiresAt, System.Threading.CancellationToken cancellationToken=default(System.Threading.CancellationToken)); ``` #### Parameters ###### `identifier` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Jwt.ReplayPrevention.IReplayCache.TryReserveAsync(string,System.DateTimeOffset,System.Threading.CancellationToken).identifier} What identifies the token\. A profile whose identifier is unique only within a scope composes that scope into the value it passes \- a SET's "jti" is unique per event feed \(RFC 8417 Section 2\.2\), so its receiver reserves the issuer and the identifier together\. ###### `expiresAt` [System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset') {#Abblix.Jwt.ReplayPrevention.IReplayCache.TryReserveAsync(string,System.DateTimeOffset,System.Threading.CancellationToken).expiresAt} When the identifier stops being worth remembering, which is the last moment a replay of this token could still pass the caller's own freshness checks\. Forgetting earlier would let that token replay; the implementation is free to remember longer\. ###### `cancellationToken` [System\.Threading\.CancellationToken](https://learn.microsoft.com/en-us/dotnet/api/system.threading.cancellationtoken 'System\.Threading\.CancellationToken') {#Abblix.Jwt.ReplayPrevention.IReplayCache.TryReserveAsync(string,System.DateTimeOffset,System.Threading.CancellationToken).cancellationToken} Cancels the cache round trip\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') True when the identifier was newly reserved and the token is therefore fresh; false when it was already there, which is a replay\. --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ReplayPrevention.ReplayCacheBase.md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ### [Abblix\.Jwt\.ReplayPrevention](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ReplayPrevention 'Abblix\.Jwt\.ReplayPrevention') ## ReplayCacheBase Class Everything a replay cache does apart from the one operation only its store can perform\. A derived class supplies that operation \- reserve this key if it is absent, and say whether it was \- and inherits the rest: the freshness window turned into a lifetime and floored, the key namespaced, and the store's answer passed back as the verdict\. ```csharp public abstract class ReplayCacheBase : Abblix.Jwt.ReplayPrevention.IReplayCache ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ReplayCacheBase Derived ↳ [DistributedReplayCache](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ReplayPrevention.DistributedReplayCache 'Abblix\.Jwt\.ReplayPrevention\.DistributedReplayCache') Implements [IReplayCache](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ReplayPrevention.IReplayCache 'Abblix\.Jwt\.ReplayPrevention\.IReplayCache') ### Remarks Every store that can decide a first sighting decides it the same way and they differ only in spelling - Redis `SET key value NX PX ttl`, PostgreSQL `INSERT ... ON CONFLICT DO NOTHING`, DynamoDB a conditional put - so the shape belongs here and the spelling belongs to a subclass, which costs this assembly no dependency on any of them. A subclass rather than a delegate because the implementation deserves a NAME. It is what a container registers, what a stack trace prints, and what an operator reads when asking which replay cache a deployment actually wired - and "the strict one" and "the probabilistic one" differ in exactly the way a name is needed to tell apart, since both answer the same contract and only one of them can be relied on to refuse. What a subclass must NOT do is as fixed as what it must: no read before the write, no release, no retry. Whether the reservation is indivisible is the store's promise, and it is the whole of what distinguishes a strict cache from [DistributedReplayCache](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ReplayPrevention.DistributedReplayCache 'Abblix\.Jwt\.ReplayPrevention\.DistributedReplayCache'); a subclass that read first would hand back the very race the shape exists to close. Redis. One command, and the condition is evaluated by the server inside the write that performs it, so no caller can be between the two. Redis expires the key itself, which is the whole of the retention question here: ```csharp public sealed class RedisReplayCache(IConnectionMultiplexer connection, TimeProvider clock, string prefix) : ReplayCacheBase(clock, prefix) { private readonly IDatabase _database = connection.GetDatabase() protected override Task ReserveIfAbsentAsync( string key, TimeSpan timeToLive, CancellationToken cancellationToken) => _database.StringSetAsync(key, 1, timeToLive, When.NotExists) } ``` The stored value is a presence marker and nothing reads it: presence of the key is the whole fact. `When.NotExists` is what makes the answer meaningful - with `When.Always` the call still compiles, still returns a bool, and returns true every time, so every replay reads as fresh. PostgreSQL. The primary key does the deciding, and the statement affects one row when it inserted and none when it conflicted: ```csharp INSERT INTO replay_reservations (reservation_key, expires_at) VALUES (@key, @expiresAt) ON CONFLICT (reservation_key) DO NOTHING ``` A row count of one is a first sighting, zero is a replay - the same answer Redis gives, from the uniqueness constraint rather than from a flag. What differs is retention: a table does not expire anything, so the subclass computes `expires_at` from the lifetime it was handed and something must remove rows past it. Until they are removed the identifier stays reserved, and the direction of that error is the reassuring one - a replay cache that remembers too long refuses a request it could have allowed, while one that forgets too early accepts a replay. So a cleanup that lags is a size problem, never a security one, and it may be a scheduled delete or a partition drop rather than anything the reservation path waits for. How to know an implementation is right. Not by reading it: a read-then-write version satisfies the signature, passes every sequential test and fails only under load. Drive it with many callers reserving ONE identifier at once, over separate connections - a single pooled connection can serialize them and hide the defect - and require the count of true answers to be exactly one. That assertion holds under every interleaving when the store decides, and fails as soon as any two callers overlap when it does not. ### Methods ## ReplayCacheBase\.TryReserveAsync\(string, DateTimeOffset, CancellationToken\) Method {#Abblix.Jwt.ReplayPrevention.ReplayCacheBase.TryReserveAsync(string,System.DateTimeOffset,System.Threading.CancellationToken)} Reserves an identifier, answering whether this is its first sighting\. ```csharp public System.Threading.Tasks.Task TryReserveAsync(string identifier, System.DateTimeOffset expiresAt, System.Threading.CancellationToken cancellationToken=default(System.Threading.CancellationToken)); ``` #### Parameters ###### `identifier` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Jwt.ReplayPrevention.ReplayCacheBase.TryReserveAsync(string,System.DateTimeOffset,System.Threading.CancellationToken).identifier} What identifies the token\. A profile whose identifier is unique only within a scope composes that scope into the value it passes \- a SET's "jti" is unique per event feed \(RFC 8417 Section 2\.2\), so its receiver reserves the issuer and the identifier together\. ###### `expiresAt` [System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset') {#Abblix.Jwt.ReplayPrevention.ReplayCacheBase.TryReserveAsync(string,System.DateTimeOffset,System.Threading.CancellationToken).expiresAt} When the identifier stops being worth remembering, which is the last moment a replay of this token could still pass the caller's own freshness checks\. Forgetting earlier would let that token replay; the implementation is free to remember longer\. ###### `cancellationToken` [System\.Threading\.CancellationToken](https://learn.microsoft.com/en-us/dotnet/api/system.threading.cancellationtoken 'System\.Threading\.CancellationToken') {#Abblix.Jwt.ReplayPrevention.ReplayCacheBase.TryReserveAsync(string,System.DateTimeOffset,System.Threading.CancellationToken).cancellationToken} Cancels the cache round trip\. Implements [TryReserveAsync\(string, DateTimeOffset, CancellationToken\)](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ReplayPrevention.IReplayCache#Abblix.Jwt.ReplayPrevention.IReplayCache.TryReserveAsync(string,System.DateTimeOffset,System.Threading.CancellationToken) 'Abblix\.Jwt\.ReplayPrevention\.IReplayCache\.TryReserveAsync\(string, System\.DateTimeOffset, System\.Threading\.CancellationToken\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') True when the identifier was newly reserved and the token is therefore fresh; false when it was already there, which is a replay\. --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Signing.md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ## Abblix\.Jwt\.Signing Namespace | Interfaces | | | :--- | :--- | | [IDataSigner](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Signing.IDataSigner 'Abblix\.Jwt\.Signing\.IDataSigner') | A signing backend that owns a slice of the server's signing keys and produces JWS signature bytes for the keys it owns\. Backends compose as peers behind [Abblix\.Jwt\.Signing\.CompositeSigner](https://learn.microsoft.com/en-us/dotnet/api/abblix.jwt.signing.compositesigner 'Abblix\.Jwt\.Signing\.CompositeSigner'), which asks each in turn whether it owns the key \([CanSign\(JsonWebKey\)](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Signing.IDataSigner#Abblix.Jwt.Signing.IDataSigner.CanSign(Abblix.Jwt.JsonWebKey) 'Abblix\.Jwt\.Signing\.IDataSigner\.CanSign\(Abblix\.Jwt\.JsonWebKey\)')\) and routes to the first that does: the in\-process [Abblix\.Jwt\.Signing\.LocalKeySigner](https://learn.microsoft.com/en-us/dotnet/api/abblix.jwt.signing.localkeysigner 'Abblix\.Jwt\.Signing\.LocalKeySigner') owns keys that carry private material, an external custodian backend \([Abblix\.Jwt\.ExternalKeys\.ExternalKeySigner](https://learn.microsoft.com/en-us/dotnet/api/abblix.jwt.externalkeys.externalkeysigner 'Abblix\.Jwt\.ExternalKeys\.ExternalKeySigner')\) owns the public\-only keys whose `kid` is its handle\. This is the byte\-level counterpart of the token\-level [IJsonWebTokenSigner](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.IJsonWebTokenSigner 'Abblix\.Jwt\.IJsonWebTokenSigner'): it works with bytes, not a whole token, so an HSM/KMS/vault integration is one more backend and never touches JWS framing\. | | [ISignatureAlgorithm<TJsonWebKey>](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Signing.ISignatureAlgorithm_TJsonWebKey_ 'Abblix\.Jwt\.Signing\.ISignatureAlgorithm\') | Defines the contract for signing and verifying JWT tokens using a specific cryptographic algorithm\. | --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Signing.IDataSigner.md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ### [Abblix\.Jwt\.Signing](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Signing 'Abblix\.Jwt\.Signing') ## IDataSigner Interface A signing backend that owns a slice of the server's signing keys and produces JWS signature bytes for the keys it owns\. Backends compose as peers behind [Abblix\.Jwt\.Signing\.CompositeSigner](https://learn.microsoft.com/en-us/dotnet/api/abblix.jwt.signing.compositesigner 'Abblix\.Jwt\.Signing\.CompositeSigner'), which asks each in turn whether it owns the key \([CanSign\(JsonWebKey\)](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Signing.IDataSigner#Abblix.Jwt.Signing.IDataSigner.CanSign(Abblix.Jwt.JsonWebKey) 'Abblix\.Jwt\.Signing\.IDataSigner\.CanSign\(Abblix\.Jwt\.JsonWebKey\)')\) and routes to the first that does: the in\-process [Abblix\.Jwt\.Signing\.LocalKeySigner](https://learn.microsoft.com/en-us/dotnet/api/abblix.jwt.signing.localkeysigner 'Abblix\.Jwt\.Signing\.LocalKeySigner') owns keys that carry private material, an external custodian backend \([Abblix\.Jwt\.ExternalKeys\.ExternalKeySigner](https://learn.microsoft.com/en-us/dotnet/api/abblix.jwt.externalkeys.externalkeysigner 'Abblix\.Jwt\.ExternalKeys\.ExternalKeySigner')\) owns the public\-only keys whose `kid` is its handle\. This is the byte\-level counterpart of the token\-level [IJsonWebTokenSigner](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.IJsonWebTokenSigner 'Abblix\.Jwt\.IJsonWebTokenSigner'): it works with bytes, not a whole token, so an HSM/KMS/vault integration is one more backend and never touches JWS framing\. ```csharp public interface IDataSigner ``` ### Methods ## IDataSigner\.CanSign\(JsonWebKey\) Method {#Abblix.Jwt.Signing.IDataSigner.CanSign(Abblix.Jwt.JsonWebKey)} Reports whether this signer owns [key](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Signing.IDataSigner#Abblix.Jwt.Signing.IDataSigner.CanSign(Abblix.Jwt.JsonWebKey).key 'Abblix\.Jwt\.Signing\.IDataSigner\.CanSign\(Abblix\.Jwt\.JsonWebKey\)\.key') and can therefore sign with it\. Ownership is a property of the key, not of the algorithm: the in\-process backend owns keys that carry private material, an external custodian backend owns the public\-only keys whose `kid` is one of its handles\. ```csharp bool CanSign(Abblix.Jwt.JsonWebKey key); ``` #### Parameters ###### `key` [JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey') {#Abblix.Jwt.Signing.IDataSigner.CanSign(Abblix.Jwt.JsonWebKey).key} The signing key the composite is about to route\. #### Returns [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') `true` if this signer can sign with [key](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Signing.IDataSigner#Abblix.Jwt.Signing.IDataSigner.CanSign(Abblix.Jwt.JsonWebKey).key 'Abblix\.Jwt\.Signing\.IDataSigner\.CanSign\(Abblix\.Jwt\.JsonWebKey\)\.key'); otherwise `false`\. ## IDataSigner\.SignAsync\(JsonWebKey, string, byte\[\], CancellationToken\) Method {#Abblix.Jwt.Signing.IDataSigner.SignAsync(Abblix.Jwt.JsonWebKey,string,byte[],System.Threading.CancellationToken)} Produces the signature bytes for [data](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Signing.IDataSigner#Abblix.Jwt.Signing.IDataSigner.SignAsync(Abblix.Jwt.JsonWebKey,string,byte[],System.Threading.CancellationToken).data 'Abblix\.Jwt\.Signing\.IDataSigner\.SignAsync\(Abblix\.Jwt\.JsonWebKey, string, byte\[\], System\.Threading\.CancellationToken\)\.data') under [algorithm](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Signing.IDataSigner#Abblix.Jwt.Signing.IDataSigner.SignAsync(Abblix.Jwt.JsonWebKey,string,byte[],System.Threading.CancellationToken).algorithm 'Abblix\.Jwt\.Signing\.IDataSigner\.SignAsync\(Abblix\.Jwt\.JsonWebKey, string, byte\[\], System\.Threading\.CancellationToken\)\.algorithm') using [key](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Signing.IDataSigner#Abblix.Jwt.Signing.IDataSigner.SignAsync(Abblix.Jwt.JsonWebKey,string,byte[],System.Threading.CancellationToken).key 'Abblix\.Jwt\.Signing\.IDataSigner\.SignAsync\(Abblix\.Jwt\.JsonWebKey, string, byte\[\], System\.Threading\.CancellationToken\)\.key'), in the JWS wire format for the algorithm\. ```csharp System.Threading.Tasks.Task SignAsync(Abblix.Jwt.JsonWebKey key, string algorithm, byte[] data, System.Threading.CancellationToken cancellationToken); ``` #### Parameters ###### `key` [JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey') {#Abblix.Jwt.Signing.IDataSigner.SignAsync(Abblix.Jwt.JsonWebKey,string,byte[],System.Threading.CancellationToken).key} The signing key\. Its `kid` is the custodian's handle when it is external\. ###### `algorithm` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Jwt.Signing.IDataSigner.SignAsync(Abblix.Jwt.JsonWebKey,string,byte[],System.Threading.CancellationToken).algorithm} The JWS algorithm identifier \(e\.g\. RS256, ES256\) the signature must use\. ###### `data` [System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Jwt.Signing.IDataSigner.SignAsync(Abblix.Jwt.JsonWebKey,string,byte[],System.Threading.CancellationToken).data} The signing input bytes, BASE64URL\(header\) \+ '\.' \+ BASE64URL\(payload\)\. ###### `cancellationToken` [System\.Threading\.CancellationToken](https://learn.microsoft.com/en-us/dotnet/api/system.threading.cancellationtoken 'System\.Threading\.CancellationToken') {#Abblix.Jwt.Signing.IDataSigner.SignAsync(Abblix.Jwt.JsonWebKey,string,byte[],System.Threading.CancellationToken).cancellationToken} Cancels the signing operation, including a custodian round\-trip\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') The raw signature bytes in JWS wire format for the algorithm\. --- Source: https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Signing.ISignatureAlgorithm_TJsonWebKey_.md #### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index') ### [Abblix\.Jwt\.Signing](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Signing 'Abblix\.Jwt\.Signing') ## ISignatureAlgorithm\ Interface Defines the contract for signing and verifying JWT tokens using a specific cryptographic algorithm\. ```csharp public interface ISignatureAlgorithm where TJsonWebKey : Abblix.Jwt.JsonWebKey ``` #### Type parameters ###### `TJsonWebKey` {#Abblix.Jwt.Signing.ISignatureAlgorithm_TJsonWebKey_.TJsonWebKey} ### Properties ## ISignatureAlgorithm\\.Algorithm Property {#Abblix.Jwt.Signing.ISignatureAlgorithm_TJsonWebKey_.Algorithm} The JWS signing algorithm identifier this signer implements \(e\.g\. "RS256", "ES384"\)\. Must equal the DI key the signer is registered under: discovery enumerates the keyed registrations and projects this value into the `*_signing_alg_values_supported` lists, so a mismatch would advertise an algorithm name the dispatch cannot resolve\. ```csharp string Algorithm { get; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Methods ## ISignatureAlgorithm\\.Sign\(TJsonWebKey, byte\[\]\) Method {#Abblix.Jwt.Signing.ISignatureAlgorithm_TJsonWebKey_.Sign(TJsonWebKey,byte[])} Signs the provided data using the configured algorithm and specified key\. ```csharp byte[] Sign(TJsonWebKey key, byte[] data); ``` #### Parameters ###### `key` [TJsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Signing.ISignatureAlgorithm_TJsonWebKey_#Abblix.Jwt.Signing.ISignatureAlgorithm_TJsonWebKey_.TJsonWebKey 'Abblix\.Jwt\.Signing\.ISignatureAlgorithm\\.TJsonWebKey') {#Abblix.Jwt.Signing.ISignatureAlgorithm_TJsonWebKey_.Sign(TJsonWebKey,byte[]).key} The key to use for signing\. ###### `data` [System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Jwt.Signing.ISignatureAlgorithm_TJsonWebKey_.Sign(TJsonWebKey,byte[]).data} The data to sign \(typically the JWT header\.payload part\)\. #### Returns [System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') The signature bytes\. ## ISignatureAlgorithm\\.Verify\(TJsonWebKey, byte\[\], byte\[\]\) Method {#Abblix.Jwt.Signing.ISignatureAlgorithm_TJsonWebKey_.Verify(TJsonWebKey,byte[],byte[])} Verifies the signature of the provided data using the configured algorithm and specified key\. ```csharp bool Verify(TJsonWebKey key, byte[] data, byte[] signature); ``` #### Parameters ###### `key` [TJsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Signing.ISignatureAlgorithm_TJsonWebKey_#Abblix.Jwt.Signing.ISignatureAlgorithm_TJsonWebKey_.TJsonWebKey 'Abblix\.Jwt\.Signing\.ISignatureAlgorithm\\.TJsonWebKey') {#Abblix.Jwt.Signing.ISignatureAlgorithm_TJsonWebKey_.Verify(TJsonWebKey,byte[],byte[]).key} The key to use for verification\. ###### `data` [System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Jwt.Signing.ISignatureAlgorithm_TJsonWebKey_.Verify(TJsonWebKey,byte[],byte[]).data} The data that was signed \(typically the JWT header\.payload part\)\. ###### `signature` [System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Jwt.Signing.ISignatureAlgorithm_TJsonWebKey_.Verify(TJsonWebKey,byte[],byte[]).signature} The signature to verify\. #### Returns [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') True if the signature is valid; otherwise, false\. --- Source: https://www.abblix.com/en/docs/api/abblix-jwt-vault.md #### [Abblix\.Jwt\.Vault](https://www.abblix.com/en/docs/api/abblix-jwt-vault 'index') ## Abblix\.Jwt\.Vault Assembly | Namespaces | | | :--- | :--- | | [Abblix\.Jwt\.Vault](https://www.abblix.com/en/docs/api/abblix-jwt-vault/Abblix.Jwt.Vault 'Abblix\.Jwt\.Vault') | | --- Source: https://www.abblix.com/en/docs/api/abblix-jwt-vault/Abblix.Jwt.Vault.md #### [Abblix\.Jwt\.Vault](https://www.abblix.com/en/docs/api/abblix-jwt-vault 'index') ## Abblix\.Jwt\.Vault Namespace | Classes | | | :--- | :--- | | [AppRoleAuthenticationOptions](https://www.abblix.com/en/docs/api/abblix-jwt-vault/Abblix.Jwt.Vault.AppRoleAuthenticationOptions 'Abblix\.Jwt\.Vault\.AppRoleAuthenticationOptions') | The AppRole auth method: the host proves who it is with a role and secret identifier pair\. | | [KubernetesAuthenticationOptions](https://www.abblix.com/en/docs/api/abblix-jwt-vault/Abblix.Jwt.Vault.KubernetesAuthenticationOptions 'Abblix\.Jwt\.Vault\.KubernetesAuthenticationOptions') | The Kubernetes auth method: the pod proves who it is with the service\-account token Kubernetes projected into it, and Vault answers with a token for the named role\. | | [ServiceCollectionExtensions](https://www.abblix.com/en/docs/api/abblix-jwt-vault/Abblix.Jwt.Vault.ServiceCollectionExtensions 'Abblix\.Jwt\.Vault\.ServiceCollectionExtensions') | Registers the HashiCorp Vault / OpenBao Transit custodian for any host that signs or decrypts JSON Web Tokens, whether or not it is an OpenID Provider\. | | [VaultAuthenticationOptions](https://www.abblix.com/en/docs/api/abblix-jwt-vault/Abblix.Jwt.Vault.VaultAuthenticationOptions 'Abblix\.Jwt\.Vault\.VaultAuthenticationOptions') | Makes the package obtain its own Vault token by logging in against an auth method, and keep it alive: renew before the lease ends, log in again when the lease cannot be extended further\. Configuring this section replaces a statically supplied [Token](https://www.abblix.com/en/docs/api/abblix-jwt-vault/Abblix.Jwt.Vault.VaultTransitOptions#Abblix.Jwt.Vault.VaultTransitOptions.Token 'Abblix\.Jwt\.Vault\.VaultTransitOptions\.Token'); leaving it absent keeps today's posture, where the host hands a token over and owns its lifetime\. | | [VaultKeyValueOptions](https://www.abblix.com/en/docs/api/abblix-jwt-vault/Abblix.Jwt.Vault.VaultKeyValueOptions 'Abblix\.Jwt\.Vault\.VaultKeyValueOptions') | Points the key ring at a Vault / OpenBao KV version 2 secrets engine, on the same server the custodian uses: its address and token come from [VaultTransitOptions](https://www.abblix.com/en/docs/api/abblix-jwt-vault/Abblix.Jwt.Vault.VaultTransitOptions 'Abblix\.Jwt\.Vault\.VaultTransitOptions'), since one Vault holds both the key that protects the ring and the ring itself\. | | [VaultTransitOptions](https://www.abblix.com/en/docs/api/abblix-jwt-vault/Abblix.Jwt.Vault.VaultTransitOptions 'Abblix\.Jwt\.Vault\.VaultTransitOptions') | Points the custodian at a HashiCorp Vault / OpenBao Transit secrets engine: where it is and how to authenticate to it, and nothing about which keys to use\. Which keys, and therefore whether their private halves ever enter this process, is the placement choice that follows the custodian registration\. | | [VaultTransport](https://www.abblix.com/en/docs/api/abblix-jwt-vault/Abblix.Jwt.Vault.VaultTransport 'Abblix\.Jwt\.Vault\.VaultTransport') | The shared HTTP transport to a Vault / OpenBao server\. | --- Source: https://www.abblix.com/en/docs/api/abblix-jwt-vault/Abblix.Jwt.Vault.AppRoleAuthenticationOptions.md #### [Abblix\.Jwt\.Vault](https://www.abblix.com/en/docs/api/abblix-jwt-vault 'index') ### [Abblix\.Jwt\.Vault](https://www.abblix.com/en/docs/api/abblix-jwt-vault/Abblix.Jwt.Vault 'Abblix\.Jwt\.Vault') ## AppRoleAuthenticationOptions Class The AppRole auth method: the host proves who it is with a role and secret identifier pair\. ```csharp public sealed class AppRoleAuthenticationOptions ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → AppRoleAuthenticationOptions ### Remarks The role behind these identifiers must issue a service token without a use limit \(`token_num_uses=0`\): every Transit call spends a use invisibly, so a limited token dies mid\-flight with nothing naming the limit\. And every login consumes a `secret_id` use, including logins retried after a lost response, so a bounded `secret_id_num_uses` runs out on schedule rather than on error\. ### Properties ## AppRoleAuthenticationOptions\.Mount Property {#Abblix.Jwt.Vault.AppRoleAuthenticationOptions.Mount} Mount path of the AppRole auth method \(the default mount is `approle`\)\. ```csharp public string Mount { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## AppRoleAuthenticationOptions\.RoleId Property {#Abblix.Jwt.Vault.AppRoleAuthenticationOptions.RoleId} Identifier of the AppRole to log in as\. ```csharp public string? RoleId { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## AppRoleAuthenticationOptions\.SecretId Property {#Abblix.Jwt.Vault.AppRoleAuthenticationOptions.SecretId} The secret half of the pair\. Source it from a secret store or a mounted secret, never hardcode it\. It is re\-read from configuration on every login, so a rotated value delivered through configuration reload is picked up without a restart\. ```csharp public string? SecretId { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') --- Source: https://www.abblix.com/en/docs/api/abblix-jwt-vault/Abblix.Jwt.Vault.KubernetesAuthenticationOptions.md #### [Abblix\.Jwt\.Vault](https://www.abblix.com/en/docs/api/abblix-jwt-vault 'index') ### [Abblix\.Jwt\.Vault](https://www.abblix.com/en/docs/api/abblix-jwt-vault/Abblix.Jwt.Vault 'Abblix\.Jwt\.Vault') ## KubernetesAuthenticationOptions Class The Kubernetes auth method: the pod proves who it is with the service\-account token Kubernetes projected into it, and Vault answers with a token for the named role\. ```csharp public sealed class KubernetesAuthenticationOptions ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → KubernetesAuthenticationOptions ### Properties ## KubernetesAuthenticationOptions\.Mount Property {#Abblix.Jwt.Vault.KubernetesAuthenticationOptions.Mount} Mount path of the Kubernetes auth method \(the default mount is `kubernetes`\)\. ```csharp public string Mount { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## KubernetesAuthenticationOptions\.Role Property {#Abblix.Jwt.Vault.KubernetesAuthenticationOptions.Role} Name of the Vault role to log in as\. The role binds the service account and namespace to the policies the token receives, so it is the one value that has no default\. ```csharp public string? Role { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## KubernetesAuthenticationOptions\.ServiceAccountTokenPath Property {#Abblix.Jwt.Vault.KubernetesAuthenticationOptions.ServiceAccountTokenPath} Path of the projected service\-account token file\. The default is where Kubernetes mounts it\. The file is read on every login, never cached: the kubelet rotates the token at 80% of its lifetime, and the application is the one responsible for picking the rotation up\. ```csharp public string ServiceAccountTokenPath { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') --- Source: https://www.abblix.com/en/docs/api/abblix-jwt-vault/Abblix.Jwt.Vault.ServiceCollectionExtensions.md #### [Abblix\.Jwt\.Vault](https://www.abblix.com/en/docs/api/abblix-jwt-vault 'index') ### [Abblix\.Jwt\.Vault](https://www.abblix.com/en/docs/api/abblix-jwt-vault/Abblix.Jwt.Vault 'Abblix\.Jwt\.Vault') ## ServiceCollectionExtensions Class Registers the HashiCorp Vault / OpenBao Transit custodian for any host that signs or decrypts JSON Web Tokens, whether or not it is an OpenID Provider\. ```csharp public static class ServiceCollectionExtensions ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ServiceCollectionExtensions ### Methods ## ServiceCollectionExtensions\.AddVaultCustodian\(this IServiceCollection, Action\\) Method {#Abblix.Jwt.Vault.ServiceCollectionExtensions.AddVaultCustodian(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,System.Action_Abblix.Jwt.Vault.VaultTransitOptions_)} Registers Vault / OpenBao Transit as the custodian of the host's keys and opens the placement choice that completes the wiring\. This call is only the transport: it points a client at the Vault server and carries the auth token\. Which keys are used \- and whether their private halves ever enter this process \- is the placement call chained onto the returned builder, which must follow: a custodian without one fails at startup rather than silently falling back to whatever keys the configuration carries\. Chain both calls AFTER `AddJsonWebTokens` \(the OIDC registration performs it\), which the placement call composes onto\. ```csharp public static Abblix.Jwt.ExternalKeys.IKeyCustodianBuilder AddVaultCustodian(this Microsoft.Extensions.DependencyInjection.IServiceCollection services, System.Action configureOptions); ``` #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.Jwt.Vault.ServiceCollectionExtensions.AddVaultCustodian(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,System.Action_Abblix.Jwt.Vault.VaultTransitOptions_).services} The service collection to configure\. ###### `configureOptions` [System\.Action<](https://learn.microsoft.com/en-us/dotnet/api/system.action-1 'System\.Action\`1')[VaultTransitOptions](https://www.abblix.com/en/docs/api/abblix-jwt-vault/Abblix.Jwt.Vault.VaultTransitOptions 'Abblix\.Jwt\.Vault\.VaultTransitOptions')[>](https://learn.microsoft.com/en-us/dotnet/api/system.action-1 'System\.Action\`1') {#Abblix.Jwt.Vault.ServiceCollectionExtensions.AddVaultCustodian(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,System.Action_Abblix.Jwt.Vault.VaultTransitOptions_).configureOptions} Configures the Vault address, auth token and Transit mount\. #### Returns [IKeyCustodianBuilder](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.IKeyCustodianBuilder 'Abblix\.Jwt\.ExternalKeys\.IKeyCustodianBuilder') The builder whose placement call completes the wiring\. ### Example ```csharp services .AddVaultCustodian(vault => configuration.GetSection("Vault").Bind(vault)) .UseKeysInCustodian(new CustodianHeldKeys { SigningKeyName = "oidc-sign" }); ``` ## ServiceCollectionExtensions\.PersistRingToVaultKeyValue\(this IMintedKeysBuilder, Action\\) Method {#Abblix.Jwt.Vault.ServiceCollectionExtensions.PersistRingToVaultKeyValue(thisAbblix.Jwt.ExternalKeys.IMintedKeysBuilder,System.Action_Abblix.Jwt.Vault.VaultKeyValueOptions_)} Keeps the ring of minted keys in this Vault's KV version 2 engine, on the same server that holds the key protecting them\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection PersistRingToVaultKeyValue(this Abblix.Jwt.ExternalKeys.IMintedKeysBuilder builder, System.Action? configureOptions=null); ``` #### Parameters ###### `builder` [IMintedKeysBuilder](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.IMintedKeysBuilder 'Abblix\.Jwt\.ExternalKeys\.IMintedKeysBuilder') {#Abblix.Jwt.Vault.ServiceCollectionExtensions.PersistRingToVaultKeyValue(thisAbblix.Jwt.ExternalKeys.IMintedKeysBuilder,System.Action_Abblix.Jwt.Vault.VaultKeyValueOptions_).builder} The builder returned by `UseKeysInProcess`\. ###### `configureOptions` [System\.Action<](https://learn.microsoft.com/en-us/dotnet/api/system.action-1 'System\.Action\`1')[VaultKeyValueOptions](https://www.abblix.com/en/docs/api/abblix-jwt-vault/Abblix.Jwt.Vault.VaultKeyValueOptions 'Abblix\.Jwt\.Vault\.VaultKeyValueOptions')[>](https://learn.microsoft.com/en-us/dotnet/api/system.action-1 'System\.Action\`1') {#Abblix.Jwt.Vault.ServiceCollectionExtensions.PersistRingToVaultKeyValue(thisAbblix.Jwt.ExternalKeys.IMintedKeysBuilder,System.Action_Abblix.Jwt.Vault.VaultKeyValueOptions_).configureOptions} Configures the KV mount and the path the ring lives under\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') The service collection, for chaining\. ### Remarks It hangs off the minting placement rather than the service collection because a ring belongs to it and to no other: the placement where the custodian holds every key has nothing to store\. The engine must be KV v2. Its `cas=0` write is the insert-if-absent the ring is built on, and it is what makes exactly one pod mint a period without a lock service. What lands there is a JWE the server sealed to the custodian's key, so the engine holds ciphertext and never a secret. --- Source: https://www.abblix.com/en/docs/api/abblix-jwt-vault/Abblix.Jwt.Vault.VaultAuthenticationOptions.md #### [Abblix\.Jwt\.Vault](https://www.abblix.com/en/docs/api/abblix-jwt-vault 'index') ### [Abblix\.Jwt\.Vault](https://www.abblix.com/en/docs/api/abblix-jwt-vault/Abblix.Jwt.Vault 'Abblix\.Jwt\.Vault') ## VaultAuthenticationOptions Class Makes the package obtain its own Vault token by logging in against an auth method, and keep it alive: renew before the lease ends, log in again when the lease cannot be extended further\. Configuring this section replaces a statically supplied [Token](https://www.abblix.com/en/docs/api/abblix-jwt-vault/Abblix.Jwt.Vault.VaultTransitOptions#Abblix.Jwt.Vault.VaultTransitOptions.Token 'Abblix\.Jwt\.Vault\.VaultTransitOptions\.Token'); leaving it absent keeps today's posture, where the host hands a token over and owns its lifetime\. ```csharp public sealed class VaultAuthenticationOptions ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → VaultAuthenticationOptions ### Remarks Exactly one of the method subsections must be set\. The section is null when a host does not configure it \- there is deliberately no default instance, because an empty section and an absent one must stay distinguishable for the feature to have an off switch\. ### Properties ## VaultAuthenticationOptions\.AppRole Property {#Abblix.Jwt.Vault.VaultAuthenticationOptions.AppRole} Log in with an AppRole's role and secret identifiers, which is the arrangement for a host outside Kubernetes or one whose Vault does not trust the cluster\. ```csharp public Abblix.Jwt.Vault.AppRoleAuthenticationOptions? AppRole { get; set; } ``` #### Property Value [AppRoleAuthenticationOptions](https://www.abblix.com/en/docs/api/abblix-jwt-vault/Abblix.Jwt.Vault.AppRoleAuthenticationOptions 'Abblix\.Jwt\.Vault\.AppRoleAuthenticationOptions') ## VaultAuthenticationOptions\.Kubernetes Property {#Abblix.Jwt.Vault.VaultAuthenticationOptions.Kubernetes} Log in with the pod's projected service\-account token, which is the arrangement for a host running on Kubernetes: the kubelet rotates the file and this package re\-reads it on every login\. ```csharp public Abblix.Jwt.Vault.KubernetesAuthenticationOptions? Kubernetes { get; set; } ``` #### Property Value [KubernetesAuthenticationOptions](https://www.abblix.com/en/docs/api/abblix-jwt-vault/Abblix.Jwt.Vault.KubernetesAuthenticationOptions 'Abblix\.Jwt\.Vault\.KubernetesAuthenticationOptions') --- Source: https://www.abblix.com/en/docs/api/abblix-jwt-vault/Abblix.Jwt.Vault.VaultKeyValueOptions.md #### [Abblix\.Jwt\.Vault](https://www.abblix.com/en/docs/api/abblix-jwt-vault 'index') ### [Abblix\.Jwt\.Vault](https://www.abblix.com/en/docs/api/abblix-jwt-vault/Abblix.Jwt.Vault 'Abblix\.Jwt\.Vault') ## VaultKeyValueOptions Class Points the key ring at a Vault / OpenBao KV version 2 secrets engine, on the same server the custodian uses: its address and token come from [VaultTransitOptions](https://www.abblix.com/en/docs/api/abblix-jwt-vault/Abblix.Jwt.Vault.VaultTransitOptions 'Abblix\.Jwt\.Vault\.VaultTransitOptions'), since one Vault holds both the key that protects the ring and the ring itself\. ```csharp public sealed class VaultKeyValueOptions ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → VaultKeyValueOptions ### Remarks The engine must be KV VERSION 2\. Only v2 offers the check\-and\-set write this ring is built on, and it is what makes exactly one pod win a period: v1 overwrites blindly, which would let two pods each believe they minted the period's key\. ### Properties ## VaultKeyValueOptions\.Mount Property {#Abblix.Jwt.Vault.VaultKeyValueOptions.Mount} Mount path of the KV v2 engine \(the conventional mount is `secret`\)\. ```csharp public string Mount { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## VaultKeyValueOptions\.Path Property {#Abblix.Jwt.Vault.VaultKeyValueOptions.Path} The path under the mount that holds the ring; each key becomes one secret beneath it\. ```csharp public string Path { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') --- Source: https://www.abblix.com/en/docs/api/abblix-jwt-vault/Abblix.Jwt.Vault.VaultTransitOptions.md #### [Abblix\.Jwt\.Vault](https://www.abblix.com/en/docs/api/abblix-jwt-vault 'index') ### [Abblix\.Jwt\.Vault](https://www.abblix.com/en/docs/api/abblix-jwt-vault/Abblix.Jwt.Vault 'Abblix\.Jwt\.Vault') ## VaultTransitOptions Class Points the custodian at a HashiCorp Vault / OpenBao Transit secrets engine: where it is and how to authenticate to it, and nothing about which keys to use\. Which keys, and therefore whether their private halves ever enter this process, is the placement choice that follows the custodian registration\. ```csharp public sealed class VaultTransitOptions ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → VaultTransitOptions ### Properties ## VaultTransitOptions\.Address Property {#Abblix.Jwt.Vault.VaultTransitOptions.Address} Base URL of the Vault / OpenBao server, e\.g\. `http://127.0.0.1:8200`\. ```csharp public string Address { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## VaultTransitOptions\.Authentication Property {#Abblix.Jwt.Vault.VaultTransitOptions.Authentication} Makes the package log in to Vault itself \- with the pod's Kubernetes service account or an AppRole \- and keep the resulting token renewed for the process lifetime\. Absent by default: a host that hands over [Token](https://www.abblix.com/en/docs/api/abblix-jwt-vault/Abblix.Jwt.Vault.VaultTransitOptions#Abblix.Jwt.Vault.VaultTransitOptions.Token 'Abblix\.Jwt\.Vault\.VaultTransitOptions\.Token') keeps owning it\. ```csharp public Abblix.Jwt.Vault.VaultAuthenticationOptions? Authentication { get; set; } ``` #### Property Value [VaultAuthenticationOptions](https://www.abblix.com/en/docs/api/abblix-jwt-vault/Abblix.Jwt.Vault.VaultAuthenticationOptions 'Abblix\.Jwt\.Vault\.VaultAuthenticationOptions') ## VaultTransitOptions\.PooledConnectionLifetime Property {#Abblix.Jwt.Vault.VaultTransitOptions.PooledConnectionLifetime} How long a pooled HTTP connection is reused before it is recycled\. The Transit client is held long\-lived by the singleton key store, so recycling connections lets it pick up DNS changes without handler rotation \(default 2 minutes, matching the default IHttpClientFactory handler lifetime\)\. ```csharp public System.TimeSpan PooledConnectionLifetime { get; set; } ``` #### Property Value [System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan') ## VaultTransitOptions\.Token Property {#Abblix.Jwt.Vault.VaultTransitOptions.Token} Auth token presented as the `X-Vault-Token` header, for a host that already has one and owns its lifetime\. Source it from the environment or a secret store, never hardcode it\. A production host normally configures [Authentication](https://www.abblix.com/en/docs/api/abblix-jwt-vault/Abblix.Jwt.Vault.VaultTransitOptions#Abblix.Jwt.Vault.VaultTransitOptions.Authentication 'Abblix\.Jwt\.Vault\.VaultTransitOptions\.Authentication') instead, which REPLACES this value outright: a stale token left in configuration is then never presented, not even before the first login completes\. ```csharp public string? Token { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## VaultTransitOptions\.TransitMount Property {#Abblix.Jwt.Vault.VaultTransitOptions.TransitMount} Mount path of the Transit engine \(the default mount is `transit`\)\. ```csharp public string TransitMount { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') --- Source: https://www.abblix.com/en/docs/api/abblix-jwt-vault/Abblix.Jwt.Vault.VaultTransport.md #### [Abblix\.Jwt\.Vault](https://www.abblix.com/en/docs/api/abblix-jwt-vault 'index') ### [Abblix\.Jwt\.Vault](https://www.abblix.com/en/docs/api/abblix-jwt-vault/Abblix.Jwt.Vault 'Abblix\.Jwt\.Vault') ## VaultTransport Class The shared HTTP transport to a Vault / OpenBao server\. ```csharp public static class VaultTransport ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → VaultTransport ### Remarks One transport per server, not per engine: the custodian and the key ring talk to the same Vault with the same token, so they resolve one named client from [System\.Net\.Http\.IHttpClientFactory](https://learn.microsoft.com/en-us/dotnet/api/system.net.http.ihttpclientfactory 'System\.Net\.Http\.IHttpClientFactory') and share its connection pool and the one place where the auth header, its redaction and the connection lifetime are settled\. The send itself is a function over an [System\.Net\.Http\.HttpClient](https://learn.microsoft.com/en-us/dotnet/api/system.net.http.httpclient 'System\.Net\.Http\.HttpClient'), with no state of its own, so it is an extension rather than a service\. The type is public for one member, [HttpClientName](https://www.abblix.com/en/docs/api/abblix-jwt-vault/Abblix.Jwt.Vault.VaultTransport#Abblix.Jwt.Vault.VaultTransport.HttpClientName 'Abblix\.Jwt\.Vault\.VaultTransport\.HttpClientName'): the transport is what a host configures, and its consumers are internal, so there is nowhere narrower to publish the name from. Everything else stays internal. ### Fields ## VaultTransport\.HttpClientName Field {#Abblix.Jwt.Vault.VaultTransport.HttpClientName} The name the transport's client is registered under, published so a host can configure it without copying the string: `services.AddHttpClient(VaultTransport.HttpClientName)` reaches the same client both engines resolve, and whatever it chains \- a resilience pipeline, a proxy, a client certificate \- applies to every Vault call\. ```csharp public const string HttpClientName = "Abblix.Jwt.Vault"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks It is a name of its own rather than a typed client of whichever engine came first, because both engines share it\. --- Source: https://www.abblix.com/en/docs/api/abblix-jwt-azure.md #### [Abblix\.Jwt\.Azure](https://www.abblix.com/en/docs/api/abblix-jwt-azure 'index') ## Abblix\.Jwt\.Azure Assembly | Namespaces | | | :--- | :--- | | [Abblix\.Jwt\.Azure](https://www.abblix.com/en/docs/api/abblix-jwt-azure/Abblix.Jwt.Azure 'Abblix\.Jwt\.Azure') | | --- Source: https://www.abblix.com/en/docs/api/abblix-jwt-azure/Abblix.Jwt.Azure.md #### [Abblix\.Jwt\.Azure](https://www.abblix.com/en/docs/api/abblix-jwt-azure 'index') ## Abblix\.Jwt\.Azure Namespace | Classes | | | :--- | :--- | | [AzureBlobKeyRingOptions](https://www.abblix.com/en/docs/api/abblix-jwt-azure/Abblix.Jwt.Azure.AzureBlobKeyRingOptions 'Abblix\.Jwt\.Azure\.AzureBlobKeyRingOptions') | Points the key ring at an Azure Blob Storage container, one blob per key\. | | [AzureKeyRingTransport](https://www.abblix.com/en/docs/api/abblix-jwt-azure/Abblix.Jwt.Azure.AzureKeyRingTransport 'Abblix\.Jwt\.Azure\.AzureKeyRingTransport') | The HTTP transport the key ring's blob calls travel on\. | | [AzureKeyVaultOptions](https://www.abblix.com/en/docs/api/abblix-jwt-azure/Abblix.Jwt.Azure.AzureKeyVaultOptions 'Abblix\.Jwt\.Azure\.AzureKeyVaultOptions') | Points the custodian at an Azure Key Vault: which vault and how to authenticate to it, and nothing about which keys to use\. Which keys, and therefore whether their private halves ever enter this process, is the placement choice that follows the custodian registration\. | | [AzureKeyVaultTransport](https://www.abblix.com/en/docs/api/abblix-jwt-azure/Abblix.Jwt.Azure.AzureKeyVaultTransport 'Abblix\.Jwt\.Azure\.AzureKeyVaultTransport') | The HTTP transport the custodian's Key Vault calls travel on\. | | [KeyVaultClient](https://www.abblix.com/en/docs/api/abblix-jwt-azure/Abblix.Jwt.Azure.KeyVaultClient 'Abblix\.Jwt\.Azure\.KeyVaultClient') | Thin wrapper over the Azure Key Vault SDK\. Signing and unwrapping run inside the vault against a key whose private half never leaves it, so this type only moves bytes across the boundary\. The Azure SDK is pointed at the host's [System\.Net\.Http\.IHttpClientFactory](https://learn.microsoft.com/en-us/dotnet/api/system.net.http.ihttpclientfactory 'System\.Net\.Http\.IHttpClientFactory') transport \(like the Vault client\), so it inherits the host's HTTP handlers, logging and pooling\. A [Azure\.Security\.KeyVault\.Keys\.Cryptography\.CryptographyClient](https://learn.microsoft.com/en-us/dotnet/api/azure.security.keyvault.keys.cryptography.cryptographyclient 'Azure\.Security\.KeyVault\.Keys\.Cryptography\.CryptographyClient') is cached per key name because creating one resolves the key's metadata on first use\. | | [ServiceCollectionExtensions](https://www.abblix.com/en/docs/api/abblix-jwt-azure/Abblix.Jwt.Azure.ServiceCollectionExtensions 'Abblix\.Jwt\.Azure\.ServiceCollectionExtensions') | Registers the Azure Key Vault custodian for any host that signs or decrypts JSON Web Tokens, whether or not it is an OpenID Provider\. | --- Source: https://www.abblix.com/en/docs/api/abblix-jwt-azure/Abblix.Jwt.Azure.AzureBlobKeyRingOptions.md #### [Abblix\.Jwt\.Azure](https://www.abblix.com/en/docs/api/abblix-jwt-azure 'index') ### [Abblix\.Jwt\.Azure](https://www.abblix.com/en/docs/api/abblix-jwt-azure/Abblix.Jwt.Azure 'Abblix\.Jwt\.Azure') ## AzureBlobKeyRingOptions Class Points the key ring at an Azure Blob Storage container, one blob per key\. ```csharp public sealed class AzureBlobKeyRingOptions ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → AzureBlobKeyRingOptions ### Remarks Blob rather than a Key Vault secret, though the vault is already there: a secret write has no conditional create, so two pods minting the same period would both succeed and each publish its own key\. A blob upload takes `If-None-Match: *`, which is the insert\-if\-absent the ring needs\. ### Properties ## AzureBlobKeyRingOptions\.Container Property {#Abblix.Jwt.Azure.AzureBlobKeyRingOptions.Container} The container holding the ring\. It is created on first use if it does not exist\. ```csharp public string Container { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## AzureBlobKeyRingOptions\.ServiceUri Property {#Abblix.Jwt.Azure.AzureBlobKeyRingOptions.ServiceUri} The blob service endpoint, for example `https://myaccount.blob.core.windows.net`\. The credential is the one the custodian already uses, so no second identity is configured\. ```csharp public System.Uri ServiceUri { get; set; } ``` #### Property Value [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri') --- Source: https://www.abblix.com/en/docs/api/abblix-jwt-azure/Abblix.Jwt.Azure.AzureKeyRingTransport.md #### [Abblix\.Jwt\.Azure](https://www.abblix.com/en/docs/api/abblix-jwt-azure 'index') ### [Abblix\.Jwt\.Azure](https://www.abblix.com/en/docs/api/abblix-jwt-azure/Abblix.Jwt.Azure 'Abblix\.Jwt\.Azure') ## AzureKeyRingTransport Class The HTTP transport the key ring's blob calls travel on\. ```csharp public static class AzureKeyRingTransport ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → AzureKeyRingTransport ### Remarks Named rather than typed, because the store it serves takes a container client rather than an [System\.Net\.Http\.HttpClient](https://learn.microsoft.com/en-us/dotnet/api/system.net.http.httpclient 'System\.Net\.Http\.HttpClient')\. The custodian's own client needs no such name: it is typed, reached as `AddHttpClient()`\. ### Fields ## AzureKeyRingTransport\.HttpClientName Field {#Abblix.Jwt.Azure.AzureKeyRingTransport.HttpClientName} The name the transport's client is registered under, published so a host can configure it without copying the string: `services.AddHttpClient(AzureKeyRingTransport.HttpClientName)` reaches the same client the ring resolves, and whatever it chains \- a resilience pipeline, a proxy, a client certificate \- applies to every blob call\. ```csharp public const string HttpClientName = "Abblix.Jwt.Azure.KeyRing"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks The credential authenticates over a transport of its own, so what a host chains here does not cover the token requests\. --- Source: https://www.abblix.com/en/docs/api/abblix-jwt-azure/Abblix.Jwt.Azure.AzureKeyVaultOptions.md #### [Abblix\.Jwt\.Azure](https://www.abblix.com/en/docs/api/abblix-jwt-azure 'index') ### [Abblix\.Jwt\.Azure](https://www.abblix.com/en/docs/api/abblix-jwt-azure/Abblix.Jwt.Azure 'Abblix\.Jwt\.Azure') ## AzureKeyVaultOptions Class Points the custodian at an Azure Key Vault: which vault and how to authenticate to it, and nothing about which keys to use\. Which keys, and therefore whether their private halves ever enter this process, is the placement choice that follows the custodian registration\. ```csharp public sealed class AzureKeyVaultOptions ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → AzureKeyVaultOptions ### Properties ## AzureKeyVaultOptions\.ClientId Property {#Abblix.Jwt.Azure.AzureKeyVaultOptions.ClientId} Application \(client\) ID of the service principal; see [TenantId](https://www.abblix.com/en/docs/api/abblix-jwt-azure/Abblix.Jwt.Azure.AzureKeyVaultOptions#Abblix.Jwt.Azure.AzureKeyVaultOptions.TenantId 'Abblix\.Jwt\.Azure\.AzureKeyVaultOptions\.TenantId')\. ```csharp public string ClientId { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## AzureKeyVaultOptions\.ClientSecret Property {#Abblix.Jwt.Azure.AzureKeyVaultOptions.ClientSecret} Client secret of the service principal; see [TenantId](https://www.abblix.com/en/docs/api/abblix-jwt-azure/Abblix.Jwt.Azure.AzureKeyVaultOptions#Abblix.Jwt.Azure.AzureKeyVaultOptions.TenantId 'Abblix\.Jwt\.Azure\.AzureKeyVaultOptions\.TenantId')\. Never hardcode it\. ```csharp public string ClientSecret { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## AzureKeyVaultOptions\.KeyVaultUri Property {#Abblix.Jwt.Azure.AzureKeyVaultOptions.KeyVaultUri} The vault URI, e\.g\. `https://my-vault.vault.azure.net/`\. ```csharp public System.Uri KeyVaultUri { get; set; } ``` #### Property Value [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri') ## AzureKeyVaultOptions\.PooledConnectionLifetime Property {#Abblix.Jwt.Azure.AzureKeyVaultOptions.PooledConnectionLifetime} How long a pooled HTTP connection is reused before it is recycled\. The Azure SDK keeps one client for the vault, so recycling connections lets it pick up DNS changes without handler rotation \(default 2 minutes, matching the default IHttpClientFactory handler lifetime\)\. ```csharp public System.TimeSpan PooledConnectionLifetime { get; set; } ``` #### Property Value [System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan') ## AzureKeyVaultOptions\.TenantId Property {#Abblix.Jwt.Azure.AzureKeyVaultOptions.TenantId} Tenant ID of the service principal\. When [TenantId](https://www.abblix.com/en/docs/api/abblix-jwt-azure/Abblix.Jwt.Azure.AzureKeyVaultOptions#Abblix.Jwt.Azure.AzureKeyVaultOptions.TenantId 'Abblix\.Jwt\.Azure\.AzureKeyVaultOptions\.TenantId'), [ClientId](https://www.abblix.com/en/docs/api/abblix-jwt-azure/Abblix.Jwt.Azure.AzureKeyVaultOptions#Abblix.Jwt.Azure.AzureKeyVaultOptions.ClientId 'Abblix\.Jwt\.Azure\.AzureKeyVaultOptions\.ClientId') and [ClientSecret](https://www.abblix.com/en/docs/api/abblix-jwt-azure/Abblix.Jwt.Azure.AzureKeyVaultOptions#Abblix.Jwt.Azure.AzureKeyVaultOptions.ClientSecret 'Abblix\.Jwt\.Azure\.AzureKeyVaultOptions\.ClientSecret') are all set the custodian authenticates with a client\-secret credential; leave them blank to fall back to the default Azure credential chain \(a managed identity in production, an Azure CLI sign\-in, or the `AZURE_TENANT_ID` / `AZURE_CLIENT_ID` / `AZURE_CLIENT_SECRET` environment variables\)\. Source the secret from the environment or a secret store, never hardcode it\. ```csharp public string TenantId { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') --- Source: https://www.abblix.com/en/docs/api/abblix-jwt-azure/Abblix.Jwt.Azure.AzureKeyVaultTransport.md #### [Abblix\.Jwt\.Azure](https://www.abblix.com/en/docs/api/abblix-jwt-azure 'index') ### [Abblix\.Jwt\.Azure](https://www.abblix.com/en/docs/api/abblix-jwt-azure/Abblix.Jwt.Azure 'Abblix\.Jwt\.Azure') ## AzureKeyVaultTransport Class The HTTP transport the custodian's Key Vault calls travel on\. ```csharp public static class AzureKeyVaultTransport ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → AzureKeyVaultTransport ### Fields ## AzureKeyVaultTransport\.HttpClientName Field {#Abblix.Jwt.Azure.AzureKeyVaultTransport.HttpClientName} The name the transport's client is registered under, published so a host can configure it without copying the string: `services.AddHttpClient(AzureKeyVaultTransport.HttpClientName)` reaches the same client the custodian resolves\. ```csharp public const string HttpClientName = "KeyVaultClient"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks The value is the client type's name because this is a typed client, and that is the logical name `AddHttpClient` gives it\. The credential authenticates over a transport of its own, so what a host chains here does not cover the token requests\. --- Source: https://www.abblix.com/en/docs/api/abblix-jwt-azure/Abblix.Jwt.Azure.KeyVaultClient.md #### [Abblix\.Jwt\.Azure](https://www.abblix.com/en/docs/api/abblix-jwt-azure 'index') ### [Abblix\.Jwt\.Azure](https://www.abblix.com/en/docs/api/abblix-jwt-azure/Abblix.Jwt.Azure 'Abblix\.Jwt\.Azure') ## KeyVaultClient Class Thin wrapper over the Azure Key Vault SDK\. Signing and unwrapping run inside the vault against a key whose private half never leaves it, so this type only moves bytes across the boundary\. The Azure SDK is pointed at the host's [System\.Net\.Http\.IHttpClientFactory](https://learn.microsoft.com/en-us/dotnet/api/system.net.http.ihttpclientfactory 'System\.Net\.Http\.IHttpClientFactory') transport \(like the Vault client\), so it inherits the host's HTTP handlers, logging and pooling\. A [Azure\.Security\.KeyVault\.Keys\.Cryptography\.CryptographyClient](https://learn.microsoft.com/en-us/dotnet/api/azure.security.keyvault.keys.cryptography.cryptographyclient 'Azure\.Security\.KeyVault\.Keys\.Cryptography\.CryptographyClient') is cached per key name because creating one resolves the key's metadata on first use\. ```csharp public sealed class KeyVaultClient : Abblix.Jwt.ExternalKeys.IKeyCustodian ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → KeyVaultClient Implements [IKeyCustodian](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.IKeyCustodian 'Abblix\.Jwt\.ExternalKeys\.IKeyCustodian') ### Constructors ## KeyVaultClient\(ILogger\, IOptions\, HttpClient\) Constructor {#Abblix.Jwt.Azure.KeyVaultClient.KeyVaultClient(Microsoft.Extensions.Logging.ILogger_Abblix.Jwt.Azure.KeyVaultClient_,Microsoft.Extensions.Options.IOptions_Abblix.Jwt.Azure.AzureKeyVaultOptions_,System.Net.Http.HttpClient)} Creates the client for the vault named by [options](https://www.abblix.com/en/docs/api/abblix-jwt-azure/Abblix.Jwt.Azure.KeyVaultClient#Abblix.Jwt.Azure.KeyVaultClient.KeyVaultClient(Microsoft.Extensions.Logging.ILogger_Abblix.Jwt.Azure.KeyVaultClient_,Microsoft.Extensions.Options.IOptions_Abblix.Jwt.Azure.AzureKeyVaultOptions_,System.Net.Http.HttpClient).options 'Abblix\.Jwt\.Azure\.KeyVaultClient\.KeyVaultClient\(Microsoft\.Extensions\.Logging\.ILogger\, Microsoft\.Extensions\.Options\.IOptions\, System\.Net\.Http\.HttpClient\)\.options'), selecting a client\-secret credential when the service\-principal fields are set, or the default Azure credential chain otherwise\. ```csharp public KeyVaultClient(Microsoft.Extensions.Logging.ILogger logger, Microsoft.Extensions.Options.IOptions options, System.Net.Http.HttpClient httpClient); ``` #### Parameters ###### `logger` [Microsoft\.Extensions\.Logging\.ILogger<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1')[KeyVaultClient](https://www.abblix.com/en/docs/api/abblix-jwt-azure/Abblix.Jwt.Azure.KeyVaultClient 'Abblix\.Jwt\.Azure\.KeyVaultClient')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1') {#Abblix.Jwt.Azure.KeyVaultClient.KeyVaultClient(Microsoft.Extensions.Logging.ILogger_Abblix.Jwt.Azure.KeyVaultClient_,Microsoft.Extensions.Options.IOptions_Abblix.Jwt.Azure.AzureKeyVaultOptions_,System.Net.Http.HttpClient).logger} Logs an unwrap the vault rejected\. ###### `options` [Microsoft\.Extensions\.Options\.IOptions<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptions-1 'Microsoft\.Extensions\.Options\.IOptions\`1')[AzureKeyVaultOptions](https://www.abblix.com/en/docs/api/abblix-jwt-azure/Abblix.Jwt.Azure.AzureKeyVaultOptions 'Abblix\.Jwt\.Azure\.AzureKeyVaultOptions')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptions-1 'Microsoft\.Extensions\.Options\.IOptions\`1') {#Abblix.Jwt.Azure.KeyVaultClient.KeyVaultClient(Microsoft.Extensions.Logging.ILogger_Abblix.Jwt.Azure.KeyVaultClient_,Microsoft.Extensions.Options.IOptions_Abblix.Jwt.Azure.AzureKeyVaultOptions_,System.Net.Http.HttpClient).options} The configured Azure Key Vault options\. ###### `httpClient` [System\.Net\.Http\.HttpClient](https://learn.microsoft.com/en-us/dotnet/api/system.net.http.httpclient 'System\.Net\.Http\.HttpClient') {#Abblix.Jwt.Azure.KeyVaultClient.KeyVaultClient(Microsoft.Extensions.Logging.ILogger_Abblix.Jwt.Azure.KeyVaultClient_,Microsoft.Extensions.Options.IOptions_Abblix.Jwt.Azure.AzureKeyVaultOptions_,System.Net.Http.HttpClient).httpClient} The transport for every Key Vault call, supplied by `AddHttpClient` so the Azure SDK rides the host's HTTP pipeline\. ### Methods ## KeyVaultClient\.AgreeKeyAsync\(string, string, JsonWebKey, CancellationToken\) Method {#Abblix.Jwt.Azure.KeyVaultClient.AgreeKeyAsync(string,string,Abblix.Jwt.JsonWebKey,System.Threading.CancellationToken)} Derives the ECDH\-ES shared secret\. Azure Key Vault exposes no key\-agreement primitive, so this store does not support ECDH\-ES; a store built on AWS KMS \(DeriveSharedSecret\) or a PKCS\#11 HSM \(CKM\_ECDH1\_DERIVE\) can\. ```csharp public System.Threading.Tasks.Task AgreeKeyAsync(string keyId, string algorithm, Abblix.Jwt.JsonWebKey ephemeralPublicKey, System.Threading.CancellationToken cancellationToken); ``` #### Parameters ###### `keyId` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Jwt.Azure.KeyVaultClient.AgreeKeyAsync(string,string,Abblix.Jwt.JsonWebKey,System.Threading.CancellationToken).keyId} ###### `algorithm` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Jwt.Azure.KeyVaultClient.AgreeKeyAsync(string,string,Abblix.Jwt.JsonWebKey,System.Threading.CancellationToken).algorithm} ###### `ephemeralPublicKey` [JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey') {#Abblix.Jwt.Azure.KeyVaultClient.AgreeKeyAsync(string,string,Abblix.Jwt.JsonWebKey,System.Threading.CancellationToken).ephemeralPublicKey} ###### `cancellationToken` [System\.Threading\.CancellationToken](https://learn.microsoft.com/en-us/dotnet/api/system.threading.cancellationtoken 'System\.Threading\.CancellationToken') {#Abblix.Jwt.Azure.KeyVaultClient.AgreeKeyAsync(string,string,Abblix.Jwt.JsonWebKey,System.Threading.CancellationToken).cancellationToken} Implements [AgreeKeyAsync\(string, string, JsonWebKey, CancellationToken\)](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.IKeyCustodian#Abblix.Jwt.ExternalKeys.IKeyCustodian.AgreeKeyAsync(string,string,Abblix.Jwt.JsonWebKey,System.Threading.CancellationToken) 'Abblix\.Jwt\.ExternalKeys\.IKeyCustodian\.AgreeKeyAsync\(System\.String,System\.String,Abblix\.Jwt\.JsonWebKey,System\.Threading\.CancellationToken\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') ## KeyVaultClient\.GetKeyVersionsAsync\(string, CancellationToken\) Method {#Abblix.Jwt.Azure.KeyVaultClient.GetKeyVersionsAsync(string,System.Threading.CancellationToken)} Enumerates every enabled version of the Key Vault key as a public\-only JWK \(RSA or EC, per the key type\), each carrying the version\-specific `kid` \(`/`\) and the version's creation time\. Key Vault lists version metadata but not the public key, so each version's key is fetched\. Called at publication time, so JWKS publishing and signature verification run locally against the result and never touch the vault on the hot path\. The versioned `kid` is a Key Vault key identifier, which the crypto client turns straight back into a versioned URI for sign/unwrap, so no separate handle mapping is needed\. ```csharp public System.Collections.Generic.IAsyncEnumerable GetKeyVersionsAsync(string keyName, System.Threading.CancellationToken cancellationToken); ``` #### Parameters ###### `keyName` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Jwt.Azure.KeyVaultClient.GetKeyVersionsAsync(string,System.Threading.CancellationToken).keyName} ###### `cancellationToken` [System\.Threading\.CancellationToken](https://learn.microsoft.com/en-us/dotnet/api/system.threading.cancellationtoken 'System\.Threading\.CancellationToken') {#Abblix.Jwt.Azure.KeyVaultClient.GetKeyVersionsAsync(string,System.Threading.CancellationToken).cancellationToken} Implements [GetKeyVersionsAsync\(string, CancellationToken\)](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.IKeyCustodian#Abblix.Jwt.ExternalKeys.IKeyCustodian.GetKeyVersionsAsync(string,System.Threading.CancellationToken) 'Abblix\.Jwt\.ExternalKeys\.IKeyCustodian\.GetKeyVersionsAsync\(System\.String,System\.Threading\.CancellationToken\)') #### Returns [System\.Collections\.Generic\.IAsyncEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.iasyncenumerable-1 'System\.Collections\.Generic\.IAsyncEnumerable\`1')[KeyVersion](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.KeyVersion 'Abblix\.Jwt\.KeyVersion')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.iasyncenumerable-1 'System\.Collections\.Generic\.IAsyncEnumerable\`1') ## KeyVaultClient\.SignAsync\(string, string, byte\[\], CancellationToken\) Method {#Abblix.Jwt.Azure.KeyVaultClient.SignAsync(string,string,byte[],System.Threading.CancellationToken)} Signs the JWS signing input with a Key Vault key under the given JWS algorithm\. Key Vault hashes the data and returns the raw signature already in JWS wire format \(R\|\|S for EC\)\. ```csharp public System.Threading.Tasks.Task SignAsync(string keyId, string algorithm, byte[] data, System.Threading.CancellationToken cancellationToken); ``` #### Parameters ###### `keyId` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Jwt.Azure.KeyVaultClient.SignAsync(string,string,byte[],System.Threading.CancellationToken).keyId} ###### `algorithm` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Jwt.Azure.KeyVaultClient.SignAsync(string,string,byte[],System.Threading.CancellationToken).algorithm} ###### `data` [System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Jwt.Azure.KeyVaultClient.SignAsync(string,string,byte[],System.Threading.CancellationToken).data} ###### `cancellationToken` [System\.Threading\.CancellationToken](https://learn.microsoft.com/en-us/dotnet/api/system.threading.cancellationtoken 'System\.Threading\.CancellationToken') {#Abblix.Jwt.Azure.KeyVaultClient.SignAsync(string,string,byte[],System.Threading.CancellationToken).cancellationToken} Implements [SignAsync\(string, string, byte\[\], CancellationToken\)](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.IKeyCustodian#Abblix.Jwt.ExternalKeys.IKeyCustodian.SignAsync(string,string,byte[],System.Threading.CancellationToken) 'Abblix\.Jwt\.ExternalKeys\.IKeyCustodian\.SignAsync\(System\.String,System\.String,System\.Byte\[\],System\.Threading\.CancellationToken\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') ## KeyVaultClient\.UnwrapKeyAsync\(string, string, JsonWebTokenHeader, byte\[\], CancellationToken\) Method {#Abblix.Jwt.Azure.KeyVaultClient.UnwrapKeyAsync(string,string,Abblix.Jwt.JsonWebTokenHeader,byte[],System.Threading.CancellationToken)} Unwraps \(decrypts\) a CEK with a Key Vault RSA key under the given key\-management algorithm \(RSA\-OAEP\-256, RSA\-OAEP or RSA1\_5\)\. Key Vault decrypts a raw JWE ciphertext directly\. Returns null when the vault rejects the ciphertext, so a wrong key or tampered ciphertext is indistinguishable, which the seam's padding\-oracle mitigation relies on\. The JWE header is unused: an RSA unwrap needs only the ciphertext\. ```csharp public System.Threading.Tasks.Task UnwrapKeyAsync(string keyId, string algorithm, Abblix.Jwt.JsonWebTokenHeader header, byte[] encryptedKey, System.Threading.CancellationToken cancellationToken); ``` #### Parameters ###### `keyId` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Jwt.Azure.KeyVaultClient.UnwrapKeyAsync(string,string,Abblix.Jwt.JsonWebTokenHeader,byte[],System.Threading.CancellationToken).keyId} ###### `algorithm` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Jwt.Azure.KeyVaultClient.UnwrapKeyAsync(string,string,Abblix.Jwt.JsonWebTokenHeader,byte[],System.Threading.CancellationToken).algorithm} ###### `header` [JsonWebTokenHeader](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenHeader 'Abblix\.Jwt\.JsonWebTokenHeader') {#Abblix.Jwt.Azure.KeyVaultClient.UnwrapKeyAsync(string,string,Abblix.Jwt.JsonWebTokenHeader,byte[],System.Threading.CancellationToken).header} ###### `encryptedKey` [System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Jwt.Azure.KeyVaultClient.UnwrapKeyAsync(string,string,Abblix.Jwt.JsonWebTokenHeader,byte[],System.Threading.CancellationToken).encryptedKey} ###### `cancellationToken` [System\.Threading\.CancellationToken](https://learn.microsoft.com/en-us/dotnet/api/system.threading.cancellationtoken 'System\.Threading\.CancellationToken') {#Abblix.Jwt.Azure.KeyVaultClient.UnwrapKeyAsync(string,string,Abblix.Jwt.JsonWebTokenHeader,byte[],System.Threading.CancellationToken).cancellationToken} Implements [UnwrapKeyAsync\(string, string, JsonWebTokenHeader, byte\[\], CancellationToken\)](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.IKeyCustodian#Abblix.Jwt.ExternalKeys.IKeyCustodian.UnwrapKeyAsync(string,string,Abblix.Jwt.JsonWebTokenHeader,byte[],System.Threading.CancellationToken) 'Abblix\.Jwt\.ExternalKeys\.IKeyCustodian\.UnwrapKeyAsync\(System\.String,System\.String,Abblix\.Jwt\.JsonWebTokenHeader,System\.Byte\[\],System\.Threading\.CancellationToken\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') --- Source: https://www.abblix.com/en/docs/api/abblix-jwt-azure/Abblix.Jwt.Azure.ServiceCollectionExtensions.md #### [Abblix\.Jwt\.Azure](https://www.abblix.com/en/docs/api/abblix-jwt-azure 'index') ### [Abblix\.Jwt\.Azure](https://www.abblix.com/en/docs/api/abblix-jwt-azure/Abblix.Jwt.Azure 'Abblix\.Jwt\.Azure') ## ServiceCollectionExtensions Class Registers the Azure Key Vault custodian for any host that signs or decrypts JSON Web Tokens, whether or not it is an OpenID Provider\. ```csharp public static class ServiceCollectionExtensions ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ServiceCollectionExtensions ### Methods ## ServiceCollectionExtensions\.AddAzureCustodian\(this IServiceCollection, Action\\) Method {#Abblix.Jwt.Azure.ServiceCollectionExtensions.AddAzureCustodian(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,System.Action_Abblix.Jwt.Azure.AzureKeyVaultOptions_)} Registers Azure Key Vault as the custodian of the host's keys and opens the placement choice that completes the wiring\. This call is only the transport: it registers the vault client and its credential\. Which keys are used \- and whether their private halves ever enter this process \- is the placement call chained onto the returned builder, which must follow: a custodian without one fails at startup rather than silently falling back to whatever keys the configuration carries\. Chain both calls AFTER `AddJsonWebTokens` \(the OIDC registration performs it\), which the placement call composes onto\. ```csharp public static Abblix.Jwt.ExternalKeys.IKeyCustodianBuilder AddAzureCustodian(this Microsoft.Extensions.DependencyInjection.IServiceCollection services, System.Action configureOptions); ``` #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.Jwt.Azure.ServiceCollectionExtensions.AddAzureCustodian(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,System.Action_Abblix.Jwt.Azure.AzureKeyVaultOptions_).services} The service collection to configure\. ###### `configureOptions` [System\.Action<](https://learn.microsoft.com/en-us/dotnet/api/system.action-1 'System\.Action\`1')[AzureKeyVaultOptions](https://www.abblix.com/en/docs/api/abblix-jwt-azure/Abblix.Jwt.Azure.AzureKeyVaultOptions 'Abblix\.Jwt\.Azure\.AzureKeyVaultOptions')[>](https://learn.microsoft.com/en-us/dotnet/api/system.action-1 'System\.Action\`1') {#Abblix.Jwt.Azure.ServiceCollectionExtensions.AddAzureCustodian(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,System.Action_Abblix.Jwt.Azure.AzureKeyVaultOptions_).configureOptions} Configures the vault URI and the service\-principal credentials\. #### Returns [IKeyCustodianBuilder](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.IKeyCustodianBuilder 'Abblix\.Jwt\.ExternalKeys\.IKeyCustodianBuilder') The builder whose placement call completes the wiring\. ### Example ```csharp services .AddAzureCustodian(azure => configuration.GetSection("Azure").Bind(azure)) .UseKeysInCustodian(new CustodianHeldKeys { SigningKeyName = "oidc-sign" }); ``` ## ServiceCollectionExtensions\.PersistRingToAzureBlob\(this IMintedKeysBuilder, Action\\) Method {#Abblix.Jwt.Azure.ServiceCollectionExtensions.PersistRingToAzureBlob(thisAbblix.Jwt.ExternalKeys.IMintedKeysBuilder,System.Action_Abblix.Jwt.Azure.AzureBlobKeyRingOptions_)} Keeps the ring of minted keys in an Azure Blob Storage container, using the same credential the custodian authenticates with\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection PersistRingToAzureBlob(this Abblix.Jwt.ExternalKeys.IMintedKeysBuilder builder, System.Action configureOptions); ``` #### Parameters ###### `builder` [IMintedKeysBuilder](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.IMintedKeysBuilder 'Abblix\.Jwt\.ExternalKeys\.IMintedKeysBuilder') {#Abblix.Jwt.Azure.ServiceCollectionExtensions.PersistRingToAzureBlob(thisAbblix.Jwt.ExternalKeys.IMintedKeysBuilder,System.Action_Abblix.Jwt.Azure.AzureBlobKeyRingOptions_).builder} The builder returned by `UseKeysInProcess`\. ###### `configureOptions` [System\.Action<](https://learn.microsoft.com/en-us/dotnet/api/system.action-1 'System\.Action\`1')[AzureBlobKeyRingOptions](https://www.abblix.com/en/docs/api/abblix-jwt-azure/Abblix.Jwt.Azure.AzureBlobKeyRingOptions 'Abblix\.Jwt\.Azure\.AzureBlobKeyRingOptions')[>](https://learn.microsoft.com/en-us/dotnet/api/system.action-1 'System\.Action\`1') {#Abblix.Jwt.Azure.ServiceCollectionExtensions.PersistRingToAzureBlob(thisAbblix.Jwt.ExternalKeys.IMintedKeysBuilder,System.Action_Abblix.Jwt.Azure.AzureBlobKeyRingOptions_).configureOptions} Configures the blob service endpoint and the container\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') The service collection, for chaining\. ### Remarks It hangs off the minting placement rather than the service collection because a ring belongs to it and to no other: the placement where the vault holds every key has nothing to store\. Blob rather than a Key Vault secret, though the vault is already configured: a secret write has no conditional create, so two pods minting the same period would both succeed and each publish its own key. A blob upload takes `If-None-Match: *`, which is the insert-if-absent the ring needs. What lands there is a JWE sealed to the vault's key, so the container holds ciphertext and never a secret. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ## Abblix\.Oidc\.Server Assembly | Namespaces | | | :--- | :--- | | [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server 'Abblix\.Oidc\.Server') | | | [Abblix\.Oidc\.Server\.Common](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common 'Abblix\.Oidc\.Server\.Common') | | | [Abblix\.Oidc\.Server\.Common\.Configuration](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration 'Abblix\.Oidc\.Server\.Common\.Configuration') | | | [Abblix\.Oidc\.Server\.Common\.Constants](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants 'Abblix\.Oidc\.Server\.Common\.Constants') | | | [Abblix\.Oidc\.Server\.Common\.Exceptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Exceptions 'Abblix\.Oidc\.Server\.Common\.Exceptions') | | | [Abblix\.Oidc\.Server\.Common\.Implementation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Implementation 'Abblix\.Oidc\.Server\.Common\.Implementation') | | | [Abblix\.Oidc\.Server\.Common\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces 'Abblix\.Oidc\.Server\.Common\.Interfaces') | | | [Abblix\.Oidc\.Server\.Common\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Validation 'Abblix\.Oidc\.Server\.Common\.Validation') | | | [Abblix\.Oidc\.Server\.DeclarativeBinding](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.DeclarativeBinding 'Abblix\.Oidc\.Server\.DeclarativeBinding') | | | [Abblix\.Oidc\.Server\.Endpoints](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints 'Abblix\.Oidc\.Server\.Endpoints') | | | [Abblix\.Oidc\.Server\.Endpoints\.Authorization](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization 'Abblix\.Oidc\.Server\.Endpoints\.Authorization') | | | [Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces') | | | [Abblix\.Oidc\.Server\.Endpoints\.Authorization\.RequestFetching](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.RequestFetching') | | | [Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation') | | | [Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication') | | | [Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Interfaces') | | | [Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.RequestFetching](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.RequestFetching 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.RequestFetching') | | | [Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation') | | | [Abblix\.Oidc\.Server\.Endpoints\.CheckSession\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.CheckSession.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.CheckSession\.Interfaces') | | | [Abblix\.Oidc\.Server\.Endpoints\.Configuration](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration 'Abblix\.Oidc\.Server\.Endpoints\.Configuration') | | | [Abblix\.Oidc\.Server\.Endpoints\.Configuration\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.Configuration\.Interfaces') | | | [Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization 'Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization') | | | [Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Interfaces') | | | [Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation 'Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Validation') | | | [Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement') | | | [Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces') | | | [Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation') | | | [Abblix\.Oidc\.Server\.Endpoints\.EndSession](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession 'Abblix\.Oidc\.Server\.Endpoints\.EndSession') | | | [Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Interfaces') | | | [Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Validation 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Validation') | | | [Abblix\.Oidc\.Server\.Endpoints\.Introspection](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection 'Abblix\.Oidc\.Server\.Endpoints\.Introspection') | | | [Abblix\.Oidc\.Server\.Endpoints\.Introspection\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.Introspection\.Interfaces') | | | [Abblix\.Oidc\.Server\.Endpoints\.PushedAuthorization](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.PushedAuthorization 'Abblix\.Oidc\.Server\.Endpoints\.PushedAuthorization') | | | [Abblix\.Oidc\.Server\.Endpoints\.PushedAuthorization\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.PushedAuthorization.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.PushedAuthorization\.Interfaces') | | | [Abblix\.Oidc\.Server\.Endpoints\.Revocation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Revocation 'Abblix\.Oidc\.Server\.Endpoints\.Revocation') | | | [Abblix\.Oidc\.Server\.Endpoints\.Revocation\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Revocation.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.Revocation\.Interfaces') | | | [Abblix\.Oidc\.Server\.Endpoints\.Token](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token 'Abblix\.Oidc\.Server\.Endpoints\.Token') | | | [Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants') | | | [Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces') | | | [Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation') | | | [Abblix\.Oidc\.Server\.Endpoints\.UserInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo 'Abblix\.Oidc\.Server\.Endpoints\.UserInfo') | | | [Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Interfaces') | | | [Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Validation 'Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Validation') | | | [Abblix\.Oidc\.Server\.Features](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features 'Abblix\.Oidc\.Server\.Features') | | | [Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication') | | | [Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.AuthenticationNotifiers](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.AuthenticationNotifiers') | | | [Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.GrantProcessors](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.GrantProcessors 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.GrantProcessors') | | | [Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces') | | | [Abblix\.Oidc\.Server\.Features\.ClientAuthentication](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication 'Abblix\.Oidc\.Server\.Features\.ClientAuthentication') | | | [Abblix\.Oidc\.Server\.Features\.ClientInformation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation 'Abblix\.Oidc\.Server\.Features\.ClientInformation') | | | [Abblix\.Oidc\.Server\.Features\.Consents](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Consents 'Abblix\.Oidc\.Server\.Features\.Consents') | | | [Abblix\.Oidc\.Server\.Features\.DeviceAuthorization](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization') | | | [Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.Interfaces') | | | [Abblix\.Oidc\.Server\.Features\.DPoP](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DPoP 'Abblix\.Oidc\.Server\.Features\.DPoP') | | | [Abblix\.Oidc\.Server\.Features\.ExternalKeys](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ExternalKeys 'Abblix\.Oidc\.Server\.Features\.ExternalKeys') | | | [Abblix\.Oidc\.Server\.Features\.Hashing](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Hashing 'Abblix\.Oidc\.Server\.Features\.Hashing') | | | [Abblix\.Oidc\.Server\.Features\.ImplicitFlow](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ImplicitFlow 'Abblix\.Oidc\.Server\.Features\.ImplicitFlow') | | | [Abblix\.Oidc\.Server\.Features\.Issuer](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Issuer 'Abblix\.Oidc\.Server\.Features\.Issuer') | | | [Abblix\.Oidc\.Server\.Features\.JwtBearer](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.JwtBearer 'Abblix\.Oidc\.Server\.Features\.JwtBearer') | | | [Abblix\.Oidc\.Server\.Features\.Licensing](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Licensing 'Abblix\.Oidc\.Server\.Features\.Licensing') | | | [Abblix\.Oidc\.Server\.Features\.LogoutNotification](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification 'Abblix\.Oidc\.Server\.Features\.LogoutNotification') | | | [Abblix\.Oidc\.Server\.Features\.Nonces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Nonces 'Abblix\.Oidc\.Server\.Features\.Nonces') | | | [Abblix\.Oidc\.Server\.Features\.NoneFlow](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.NoneFlow 'Abblix\.Oidc\.Server\.Features\.NoneFlow') | | | [Abblix\.Oidc\.Server\.Features\.PairwiseIdentifiers](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.PairwiseIdentifiers 'Abblix\.Oidc\.Server\.Features\.PairwiseIdentifiers') | | | [Abblix\.Oidc\.Server\.Features\.PushedAuthorization](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.PushedAuthorization 'Abblix\.Oidc\.Server\.Features\.PushedAuthorization') | | | [Abblix\.Oidc\.Server\.Features\.RandomGenerators](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators 'Abblix\.Oidc\.Server\.Features\.RandomGenerators') | | | [Abblix\.Oidc\.Server\.Features\.ReplayPrevention](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ReplayPrevention 'Abblix\.Oidc\.Server\.Features\.ReplayPrevention') | | | [Abblix\.Oidc\.Server\.Features\.RequestObject](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RequestObject 'Abblix\.Oidc\.Server\.Features\.RequestObject') | | | [Abblix\.Oidc\.Server\.Features\.ResourceIndicators](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ResourceIndicators 'Abblix\.Oidc\.Server\.Features\.ResourceIndicators') | | | [Abblix\.Oidc\.Server\.Features\.ResponseObject](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ResponseObject 'Abblix\.Oidc\.Server\.Features\.ResponseObject') | | | [Abblix\.Oidc\.Server\.Features\.ReusePrevention](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ReusePrevention 'Abblix\.Oidc\.Server\.Features\.ReusePrevention') | | | [Abblix\.Oidc\.Server\.Features\.RichAuthorizationRequests](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RichAuthorizationRequests 'Abblix\.Oidc\.Server\.Features\.RichAuthorizationRequests') | | | [Abblix\.Oidc\.Server\.Features\.ScopeManagement](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ScopeManagement 'Abblix\.Oidc\.Server\.Features\.ScopeManagement') | | | [Abblix\.Oidc\.Server\.Features\.SecureHttpFetch](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.SecureHttpFetch 'Abblix\.Oidc\.Server\.Features\.SecureHttpFetch') | | | [Abblix\.Oidc\.Server\.Features\.SessionManagement](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.SessionManagement 'Abblix\.Oidc\.Server\.Features\.SessionManagement') | | | [Abblix\.Oidc\.Server\.Features\.Storages](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Storages 'Abblix\.Oidc\.Server\.Features\.Storages') | | | [Abblix\.Oidc\.Server\.Features\.TokenExchange](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.TokenExchange 'Abblix\.Oidc\.Server\.Features\.TokenExchange') | | | [Abblix\.Oidc\.Server\.Features\.Tokens](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens 'Abblix\.Oidc\.Server\.Features\.Tokens') | | | [Abblix\.Oidc\.Server\.Features\.Tokens\.Formatters](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.Formatters 'Abblix\.Oidc\.Server\.Features\.Tokens\.Formatters') | | | [Abblix\.Oidc\.Server\.Features\.Tokens\.Revocation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.Revocation 'Abblix\.Oidc\.Server\.Features\.Tokens\.Revocation') | | | [Abblix\.Oidc\.Server\.Features\.Tokens\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.Validation 'Abblix\.Oidc\.Server\.Features\.Tokens\.Validation') | | | [Abblix\.Oidc\.Server\.Features\.UriValidation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.UriValidation 'Abblix\.Oidc\.Server\.Features\.UriValidation') | | | [Abblix\.Oidc\.Server\.Features\.UserAuthentication](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.UserAuthentication 'Abblix\.Oidc\.Server\.Features\.UserAuthentication') | | | [Abblix\.Oidc\.Server\.Features\.UserInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.UserInfo 'Abblix\.Oidc\.Server\.Features\.UserInfo') | | | [Abblix\.Oidc\.Server\.Model](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model 'Abblix\.Oidc\.Server\.Model') | | --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ## Abblix\.Oidc\.Server Namespace | Classes | | | :--- | :--- | | [ServiceCollectionExtensions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.ServiceCollectionExtensions 'Abblix\.Oidc\.Server\.ServiceCollectionExtensions') | Extension methods for integrating OpenID Connect \(OIDC\) core services into an application's service collection\. | --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.ServiceCollectionExtensions.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server 'Abblix\.Oidc\.Server') ## ServiceCollectionExtensions Class Extension methods for integrating OpenID Connect \(OIDC\) core services into an application's service collection\. ```csharp public static class ServiceCollectionExtensions ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ServiceCollectionExtensions ### Remarks These methods facilitate the setup of essential components for implementing OIDC authentication and authorization flows, such as token issuance, client authentication, and session management\. By calling these extension methods, developers can configure and customize the OIDC server according to their application's security requirements and user management policies\. ### Methods ## ServiceCollectionExtensions\.AddEndpoints\(this IServiceCollection\) Method {#Abblix.Oidc.Server.ServiceCollectionExtensions.AddEndpoints(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection)} Configures the service collection with the always\-on OAuth 2\.0 and OpenID Connect endpoints \- the set mounted unconditionally regardless of [EnabledEndpoints](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions#Abblix.Oidc.Server.Common.Configuration.OidcOptions.EnabledEndpoints 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions\.EnabledEndpoints'): discovery, authorization, PAR, token, UserInfo and end session\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection AddEndpoints(this Microsoft.Extensions.DependencyInjection.IServiceCollection services); ``` #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.Oidc.Server.ServiceCollectionExtensions.AddEndpoints(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).services} The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') to configure with necessary endpoints\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') The configured [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection'), enabling further service registration chaining\. ### Remarks By calling this method, the application integrates support for: \- The Configuration \(discovery\) Endpoint for publishing provider metadata\. \- The Authorization Endpoint for initiating user authentication and consent\. \- Pushed Authorization Request \(PAR\) Endpoint for pre\-registering authorization requests\. \- Token Endpoint for issuing tokens following successful authentication\. \- User Info Endpoint for accessing authenticated user information\. \- End Session Endpoint for managing user logout processes\. The niche or security\-sensitive endpoints \- Revocation, Introspection, CIBA, Check Session and Dynamic Client Registration \- are not wired here\. Each is opt\-in through its dedicated `AddX()` feature method \(`AddRevocation`, `AddIntrospection`, `AddBackChannelAuthentication`, `AddCheckSession`, `AddDynamicClientRegistration`\), which registers the endpoint services and re\-enables its flag in [EnabledEndpoints](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions#Abblix.Oidc.Server.Common.Configuration.OidcOptions.EnabledEndpoints 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions\.EnabledEndpoints') \(defaulting to [Base](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcEndpoints#Abblix.Oidc.Server.Common.Configuration.OidcEndpoints.Base 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcEndpoints\.Base')\)\. ## ServiceCollectionExtensions\.AddFeatures\(this IServiceCollection\) Method {#Abblix.Oidc.Server.ServiceCollectionExtensions.AddFeatures(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection)} Registers a comprehensive set of services related to client authentication, information management, issuer identification, token services, JWT handling, session management, random value generation and logout notifications\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection AddFeatures(this Microsoft.Extensions.DependencyInjection.IServiceCollection services); ``` #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.Oidc.Server.ServiceCollectionExtensions.AddFeatures(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).services} The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') to configure with essential features\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') The configured [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection'), allowing for further chaining of service registrations\. ### Remarks This method serves as a convenience wrapper that aggregates the registration of various foundational services necessary for the application's security and functionality\. It includes: \- Client authentication mechanisms\. \- Client information management\. \- Issuer identification\. \- Token generation, validation and management services\. \- JSON Web Token \(JWT\) support\. \- Session management capabilities\. \- Random value generators for security tokens and identifiers\. \- Logout notification mechanisms\. By invoking this method, an application ensures that all critical security and operational features are configured and ready for use\. ## ServiceCollectionExtensions\.AddOidcCore\(this IServiceCollection, Action\\) Method {#Abblix.Oidc.Server.ServiceCollectionExtensions.AddOidcCore(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,System.Action_Abblix.Oidc.Server.Common.Configuration.OidcOptions,System.IServiceProvider_)} Adds OIDC server core services to the service collection with additional access to the service provider for more complex configuration scenarios\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection AddOidcCore(this Microsoft.Extensions.DependencyInjection.IServiceCollection services, System.Action configureOptions); ``` #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.Oidc.Server.ServiceCollectionExtensions.AddOidcCore(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,System.Action_Abblix.Oidc.Server.Common.Configuration.OidcOptions,System.IServiceProvider_).services} The IServiceCollection to enhance with OIDC services\. ###### `configureOptions` [System\.Action<](https://learn.microsoft.com/en-us/dotnet/api/system.action-2 'System\.Action\`2')[OidcOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions')[,](https://learn.microsoft.com/en-us/dotnet/api/system.action-2 'System\.Action\`2')[System\.IServiceProvider](https://learn.microsoft.com/en-us/dotnet/api/system.iserviceprovider 'System\.IServiceProvider')[>](https://learn.microsoft.com/en-us/dotnet/api/system.action-2 'System\.Action\`2') {#Abblix.Oidc.Server.ServiceCollectionExtensions.AddOidcCore(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,System.Action_Abblix.Oidc.Server.Common.Configuration.OidcOptions,System.IServiceProvider_).configureOptions} A delegate that configures OIDC options with access to the service provider, allowing for dynamic configurations based on other registered services\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') The IServiceCollection enabling further configurations\. ### Remarks This overload provides flexibility to access other services during the OIDC configuration, such as dynamic issuer discovery or conditional service registrations based on the environment or other services\. ## ServiceCollectionExtensions\.AddOidcCore\(this IServiceCollection, Action\\) Method {#Abblix.Oidc.Server.ServiceCollectionExtensions.AddOidcCore(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,System.Action_Abblix.Oidc.Server.Common.Configuration.OidcOptions_)} Registers the core OIDC server services and configurations into the provided service collection\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection AddOidcCore(this Microsoft.Extensions.DependencyInjection.IServiceCollection services, System.Action configureOptions); ``` #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.Oidc.Server.ServiceCollectionExtensions.AddOidcCore(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,System.Action_Abblix.Oidc.Server.Common.Configuration.OidcOptions_).services} The IServiceCollection instance to which the OIDC services are added\. ###### `configureOptions` [System\.Action<](https://learn.microsoft.com/en-us/dotnet/api/system.action-1 'System\.Action\`1')[OidcOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions')[>](https://learn.microsoft.com/en-us/dotnet/api/system.action-1 'System\.Action\`1') {#Abblix.Oidc.Server.ServiceCollectionExtensions.AddOidcCore(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,System.Action_Abblix.Oidc.Server.Common.Configuration.OidcOptions_).configureOptions} A delegate to configure OIDC server options, allowing customization of settings like issuer URL, token lifetimes, and supported grant types\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') The updated IServiceCollection instance, enabling chaining of further service registrations\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ## Abblix\.Oidc\.Server\.Common Namespace | Classes | | | :--- | :--- | | [AuthorizationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.AuthorizationContext 'Abblix\.Oidc\.Server\.Common\.AuthorizationContext') | Represents the context of an authorization process, encapsulating the key parameters required for processing authorization requests\. | | [AuthorizationContextExtensions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.AuthorizationContextExtensions 'Abblix\.Oidc\.Server\.Common\.AuthorizationContextExtensions') | Provides extension methods for working with [AuthorizationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.AuthorizationContext 'Abblix\.Oidc\.Server\.Common\.AuthorizationContext') objects, facilitating the conversion between authorization contexts and JWT claims\. | | [AuthServiceKeyDescriptor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.AuthServiceKeyDescriptor 'Abblix\.Oidc\.Server\.Common\.AuthServiceKeyDescriptor') | A service key together with the lifecycle metadata that lives AROUND it, never on it \- the [JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey') stays a pure JOSE / RFC 7517 model\. This is the unit a persistent store saves at generation and the read seam gates by time; the durable backend and the rotation that advances [Status](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.AuthServiceKeyDescriptor#Abblix.Oidc.Server.Common.AuthServiceKeyDescriptor.Status 'Abblix\.Oidc\.Server\.Common\.AuthServiceKeyDescriptor\.Status') ship separately\. | | [ClaimsExtensions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.ClaimsExtensions 'Abblix\.Oidc\.Server\.Common\.ClaimsExtensions') | Helpers for working with [System\.Security\.Claims\.ClaimsPrincipal](https://learn.microsoft.com/en-us/dotnet/api/system.security.claims.claimsprincipal 'System\.Security\.Claims\.ClaimsPrincipal') and [System\.Security\.Claims\.Claim](https://learn.microsoft.com/en-us/dotnet/api/system.security.claims.claim 'System\.Security\.Claims\.Claim') sequences: classify claims as registered/public/private \(per IANA\), filter or replace them by type, and look up values by claim name in a case\-insensitive manner\. | | [Cookie](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Cookie 'Abblix\.Oidc\.Server\.Common\.Cookie') | Represents an HTTP cookie along with its options\. | | [CookieOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.CookieOptions 'Abblix\.Oidc\.Server\.Common\.CookieOptions') | Represents options for an HTTP cookie, including properties for HTTP\-only, essential, secure, path, domain, SameSite attribute, expiration, and maximum age\. | | [HttpRequestMessageExtensions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.HttpRequestMessageExtensions 'Abblix\.Oidc\.Server\.Common\.HttpRequestMessageExtensions') | Extension methods for [System\.Net\.Http\.HttpRequestMessage](https://learn.microsoft.com/en-us/dotnet/api/system.net.http.httprequestmessage 'System\.Net\.Http\.HttpRequestMessage')\. | | [InvalidDPoPProofError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.InvalidDPoPProofError 'Abblix\.Oidc\.Server\.Common\.InvalidDPoPProofError') | Subtype of [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') tagging an RFC 9449 §7\.1 DPoP proof rejection at a protected endpoint \(UserInfo, introspection, revocation\)\. The typed marker lets the response formatter pattern\-match deterministically and emit the `WWW-Authenticate: DPoP error="invalid_dpop_proof"` challenge instead of a Bearer challenge, without string\-comparing the error code\. Mirrors [UseDPoPNonceError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.UseDPoPNonceError 'Abblix\.Oidc\.Server\.Common\.UseDPoPNonceError')\. | | [JsonWebKeyExtensions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.JsonWebKeyExtensions 'Abblix\.Oidc\.Server\.Common\.JsonWebKeyExtensions') | Provides extensions for asynchronous operations on a sequence of [JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey') objects\. | | [MissingAuthenticationError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.MissingAuthenticationError 'Abblix\.Oidc\.Server\.Common\.MissingAuthenticationError') | Subtype of [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') tagging a request to a protected endpoint that carried no authentication information at all\. RFC 6750 §3\.1: in that case the challenge SHOULD NOT include an error code or other error attributes \- a bare `WWW-Authenticate` header simply tells the client that authentication is required\. The error code still drives the internal 401 status\-code mapping; only the challenge attributes are suppressed by the builder\. Mirrors [InvalidDPoPProofError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.InvalidDPoPProofError 'Abblix\.Oidc\.Server\.Common\.InvalidDPoPProofError') as a typed marker for deterministic pattern matching\. | | [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') | Represents an error that occurred during OAuth 2\.0/OpenID Connect request processing\. | | [ParametersProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.ParametersProvider 'Abblix\.Oidc\.Server\.Common\.ParametersProvider') | Extracts parameters from an object by serializing it to a JSON element and enumerating its properties\. Pure System\.Text\.Json, framework\-neutral \- the single implementation both the MVC and Minimal API transports use\. | | [UseDPoPNonceError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.UseDPoPNonceError 'Abblix\.Oidc\.Server\.Common\.UseDPoPNonceError') | Subtype of [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') that signals an RFC 9449 §8 nonce\-challenge: the DPoP proof either omitted the `nonce` claim or carried a stale one, and the server is responding with `use_dpop_nonce` plus a fresh nonce the client must echo on the next attempt\. The carried [Nonce](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.UseDPoPNonceError#Abblix.Oidc.Server.Common.UseDPoPNonceError.Nonce 'Abblix\.Oidc\.Server\.Common\.UseDPoPNonceError\.Nonce') value travels out through the response formatter as the `DPoP-Nonce` HTTP header alongside the standard error envelope \- the body shape stays `{error, error_description}`; the nonce rides on a header, not in the JSON\. | | [WwwAuthenticateBuilder](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.WwwAuthenticateBuilder 'Abblix\.Oidc\.Server\.Common\.WwwAuthenticateBuilder') | Builds `WWW-Authenticate` challenge values for the Bearer scheme \(RFC 6750 §3\) and the DPoP scheme \(RFC 9449 §7\.1\)\. Endpoint\-agnostic and framework\-agnostic so the same emission logic serves UserInfo, introspection, revocation, and any future protected endpoint, regardless of whether the host is ASP\.NET Core MVC, minimal APIs, or another framework altogether\. | | Enums | | | :--- | :--- | | [KeyLifecycleStatus](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.KeyLifecycleStatus 'Abblix\.Oidc\.Server\.Common\.KeyLifecycleStatus') | The lifecycle state of a service key as it moves through generation, activation, retirement and deletion\. The transitions themselves are driven by the rotation engine; this contract only names the states so a persistent store and the read seam agree on their meaning\. | --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.AuthorizationContext.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common 'Abblix\.Oidc\.Server\.Common') ## AuthorizationContext Class Represents the context of an authorization process, encapsulating the key parameters required for processing authorization requests\. ```csharp public record AuthorizationContext : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → AuthorizationContext Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[AuthorizationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.AuthorizationContext 'Abblix\.Oidc\.Server\.Common\.AuthorizationContext')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Remarks This record is pivotal for tracking the state of an authorization request throughout its lifecycle\. It encapsulates details that are critical for the secure issuance of authorization codes and tokens, while ensuring compliance with OAuth 2\.0 and OpenID Connect protocols\. The context facilitates not just the validation of requests at the token endpoint, but also supports secure interactions by incorporating mechanisms like PKCE and nonce values to mitigate common attack vectors such as code injection and replay attacks\. Furthermore, it carries information about requested scopes and claims, enabling fine\-grained access control and personalized identity assertion in accordance with the client's needs and the authorization server's policies\. ### Constructors ## AuthorizationContext\(string, ScopeDefinition\[\], ResourceDefinition\[\], RequestedClaims\) Constructor {#Abblix.Oidc.Server.Common.AuthorizationContext.AuthorizationContext(string,Abblix.Oidc.Server.Common.Constants.ScopeDefinition[],Abblix.Oidc.Server.Common.Constants.ResourceDefinition[],Abblix.Oidc.Server.Model.RequestedClaims)} Initializes a new instance of the [AuthorizationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.AuthorizationContext 'Abblix\.Oidc\.Server\.Common\.AuthorizationContext') class with a client ID, a collection of scopes, and optional requested claims\. ```csharp public AuthorizationContext(string clientId, Abblix.Oidc.Server.Common.Constants.ScopeDefinition[] scopes, Abblix.Oidc.Server.Common.Constants.ResourceDefinition[] resources, Abblix.Oidc.Server.Model.RequestedClaims? requestedClaims); ``` #### Parameters ###### `clientId` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Common.AuthorizationContext.AuthorizationContext(string,Abblix.Oidc.Server.Common.Constants.ScopeDefinition[],Abblix.Oidc.Server.Common.Constants.ResourceDefinition[],Abblix.Oidc.Server.Model.RequestedClaims).clientId} The unique identifier of the client making the authorization request\. ###### `scopes` [ScopeDefinition](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ScopeDefinition 'Abblix\.Oidc\.Server\.Common\.Constants\.ScopeDefinition')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Oidc.Server.Common.AuthorizationContext.AuthorizationContext(string,Abblix.Oidc.Server.Common.Constants.ScopeDefinition[],Abblix.Oidc.Server.Common.Constants.ResourceDefinition[],Abblix.Oidc.Server.Model.RequestedClaims).scopes} An array of scope definitions requested by the client\. ###### `resources` [ResourceDefinition](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ResourceDefinition 'Abblix\.Oidc\.Server\.Common\.Constants\.ResourceDefinition')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Oidc.Server.Common.AuthorizationContext.AuthorizationContext(string,Abblix.Oidc.Server.Common.Constants.ScopeDefinition[],Abblix.Oidc.Server.Common.Constants.ResourceDefinition[],Abblix.Oidc.Server.Model.RequestedClaims).resources} An array of resource definitions associated with the authorization request\. ###### `requestedClaims` [RequestedClaims](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.RequestedClaims 'Abblix\.Oidc\.Server\.Model\.RequestedClaims') {#Abblix.Oidc.Server.Common.AuthorizationContext.AuthorizationContext(string,Abblix.Oidc.Server.Common.Constants.ScopeDefinition[],Abblix.Oidc.Server.Common.Constants.ResourceDefinition[],Abblix.Oidc.Server.Model.RequestedClaims).requestedClaims} Optional claims requested by the client for the authorization process\. ## AuthorizationContext\(string, string\[\], RequestedClaims, Uri\[\]\) Constructor {#Abblix.Oidc.Server.Common.AuthorizationContext.AuthorizationContext(string,string[],Abblix.Oidc.Server.Model.RequestedClaims,System.Uri[])} Initializes a new instance of the [AuthorizationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.AuthorizationContext 'Abblix\.Oidc\.Server\.Common\.AuthorizationContext') class\. ```csharp public AuthorizationContext(string clientId, string[] scope, Abblix.Oidc.Server.Model.RequestedClaims? requestedClaims, System.Uri[]? resources=null); ``` #### Parameters ###### `clientId` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Common.AuthorizationContext.AuthorizationContext(string,string[],Abblix.Oidc.Server.Model.RequestedClaims,System.Uri[]).clientId} The unique identifier of the client making the authorization request\. ###### `scope` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Oidc.Server.Common.AuthorizationContext.AuthorizationContext(string,string[],Abblix.Oidc.Server.Model.RequestedClaims,System.Uri[]).scope} An array of scope values requested by the client, representing the access permissions being sought\. ###### `requestedClaims` [RequestedClaims](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.RequestedClaims 'Abblix\.Oidc\.Server\.Model\.RequestedClaims') {#Abblix.Oidc.Server.Common.AuthorizationContext.AuthorizationContext(string,string[],Abblix.Oidc.Server.Model.RequestedClaims,System.Uri[]).requestedClaims} Optional claims that the client is requesting as part of the authorization process, providing additional information about the user's identity\. ###### `resources` [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Oidc.Server.Common.AuthorizationContext.AuthorizationContext(string,string[],Abblix.Oidc.Server.Model.RequestedClaims,System.Uri[]).resources} Optional RFC 8707 resource indicators \(absolute URIs\) the issued token is bound to\. This is the single construction point every path funnels the resource set through: the direct grants \(client\_credentials, password, jwt\-bearer, token\-exchange\), the authorize/CIBA/device path \(via the [ScopeDefinition](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ScopeDefinition 'Abblix\.Oidc\.Server\.Common\.Constants\.ScopeDefinition')/[ResourceDefinition](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ResourceDefinition 'Abblix\.Oidc\.Server\.Common\.Constants\.ResourceDefinition') overload below\), and the JWT round\-trip\. An empty set is canonicalized to `null` \(no audience restriction\)\. ### Properties ## AuthorizationContext\.Actor Property {#Abblix.Oidc.Server.Common.AuthorizationContext.Actor} RFC 8693 §4\.1 `act` claim: the actor party \(in delegation flows\) the issued token represents\. Stored as a raw [System\.Text\.Json\.Nodes\.JsonObject](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonobject 'System\.Text\.Json\.Nodes\.JsonObject') so nested delegation chains are preserved byte\-exact through storage\. `null` for impersonation flows and for non\-Token\-Exchange grants\. ```csharp public System.Text.Json.Nodes.JsonObject? Actor { get; init; } ``` #### Property Value [System\.Text\.Json\.Nodes\.JsonObject](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonobject 'System\.Text\.Json\.Nodes\.JsonObject') ## AuthorizationContext\.Audiences Property {#Abblix.Oidc.Server.Common.AuthorizationContext.Audiences} RFC 8693 §2\.1 `audience` request parameter passed through to the issued token\. Logical names of the relying party for which the requested token is intended\. Distinct from [Resources](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.AuthorizationContext#Abblix.Oidc.Server.Common.AuthorizationContext.Resources 'Abblix\.Oidc\.Server\.Common\.AuthorizationContext\.Resources') \(RFC 8707 absolute URIs\); audience values are opaque strings\. JWT emission folds both [Resources](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.AuthorizationContext#Abblix.Oidc.Server.Common.AuthorizationContext.Resources 'Abblix\.Oidc\.Server\.Common\.AuthorizationContext\.Resources') and `Audiences` into the `aud` claim\. ```csharp public string[]? Audiences { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') ## AuthorizationContext\.AuthorizationDetails Property {#Abblix.Oidc.Server.Common.AuthorizationContext.AuthorizationDetails} The RFC 9396 Rich Authorization Requests array stored as a raw [System\.Text\.Json\.Nodes\.JsonArray](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonarray 'System\.Text\.Json\.Nodes\.JsonArray')\. This is the source of truth \- preserved byte\-exact \(member order, type\-specific payload\) through the authorize → code → token round\-trip and protobuf persistence, without lossy typed deserialise / re\-serialise cycles\. ```csharp public System.Text.Json.Nodes.JsonArray? AuthorizationDetails { get; init; } ``` #### Property Value [System\.Text\.Json\.Nodes\.JsonArray](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonarray 'System\.Text\.Json\.Nodes\.JsonArray') ## AuthorizationContext\.CertificateSha256Thumbprint Property {#Abblix.Oidc.Server.Common.AuthorizationContext.CertificateSha256Thumbprint} Base64url\-encoded SHA\-256 thumbprint of the client X\.509 certificate used at the token endpoint for mutual TLS client authentication\. When present, access tokens carry a confirmation claim \(`cnf`\) containing `x5t#S256` equal to this value \(RFC 8705 §3\.1\)\. ```csharp public string? CertificateSha256Thumbprint { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## AuthorizationContext\.ClientId Property {#Abblix.Oidc.Server.Common.AuthorizationContext.ClientId} The unique identifier for the client making the authorization request, as registered in the authorization server\. This identifier is crucial for linking the authorization request and the issued tokens to a specific client application\. ```csharp public string ClientId { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## AuthorizationContext\.CodeChallenge Property {#Abblix.Oidc.Server.Common.AuthorizationContext.CodeChallenge} The high\-entropy cryptographic string provided by the client, used in the PKCE \(Proof Key for Code Exchange\) extension to secure the exchange of the authorization code for a token, especially in public clients and mobile applications\. ```csharp public string? CodeChallenge { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## AuthorizationContext\.CodeChallengeMethod Property {#Abblix.Oidc.Server.Common.AuthorizationContext.CodeChallengeMethod} Specifies the transformation method applied to the 'code\_verifier' when generating the 'code\_challenge', enhancing the security of PKCE by allowing the authorization server to verify the code exchange authenticity\. ```csharp public string? CodeChallengeMethod { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## AuthorizationContext\.Nonce Property {#Abblix.Oidc.Server.Common.AuthorizationContext.Nonce} A string value used to associate a client session with an ID Token, mitigating replay attacks by ensuring that an ID Token cannot be used in a different context than the one it was intended for\. ```csharp public string? Nonce { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## AuthorizationContext\.ProofKeyThumbprint Property {#Abblix.Oidc.Server.Common.AuthorizationContext.ProofKeyThumbprint} RFC 7638 base64url\-encoded JWK thumbprint of the DPoP proof\-of\-possession key bound to this authorization \(RFC 9449 §6\.1\)\. When present, access tokens carry a `cnf.jkt` confirmation claim equal to this value, locking the token to the specific key the client demonstrated control of at the token endpoint\. ```csharp public string? ProofKeyThumbprint { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## AuthorizationContext\.RedirectUri Property {#Abblix.Oidc.Server.Common.AuthorizationContext.RedirectUri} The URI where the authorization response should be sent\. This URI must match one of the registered redirects URI for the client application, ensuring that authorization responses are delivered to the correct destination securely\. ```csharp public System.Uri? RedirectUri { get; init; } ``` #### Property Value [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri') ## AuthorizationContext\.RequestedClaims Property {#Abblix.Oidc.Server.Common.AuthorizationContext.RequestedClaims} Optional\. Specifies the individual Claims requested by the client, providing detailed instructions for the authorization server on the Claims to be returned, either in the ID Token or via the UserInfo endpoint\. ```csharp public Abblix.Oidc.Server.Model.RequestedClaims? RequestedClaims { get; init; } ``` #### Property Value [RequestedClaims](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.RequestedClaims 'Abblix\.Oidc\.Server\.Model\.RequestedClaims') ## AuthorizationContext\.Resources Property {#Abblix.Oidc.Server.Common.AuthorizationContext.Resources} The resources for which the authorization is granted\. These resources are typically URIs that identify specific services or data that the client is authorized to access\. ```csharp public System.Uri[]? Resources { get; init; } ``` #### Property Value [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') ## AuthorizationContext\.Scope Property {#Abblix.Oidc.Server.Common.AuthorizationContext.Scope} Defines the scope of access requested by the client\. Scopes are used to specify the level of access or permissions that the client is requesting on the user's behalf\. They play a key role in enforcing the principle of least privilege\. ```csharp public string[] Scope { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') ## AuthorizationContext\.X509CertificateSha256Thumbprint Property {#Abblix.Oidc.Server.Common.AuthorizationContext.X509CertificateSha256Thumbprint} Legacy alias for [CertificateSha256Thumbprint](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.AuthorizationContext#Abblix.Oidc.Server.Common.AuthorizationContext.CertificateSha256Thumbprint 'Abblix\.Oidc\.Server\.Common\.AuthorizationContext\.CertificateSha256Thumbprint'): forwards to the same backing storage so existing JSON blobs and downstream callers initialising this property still resolve correctly, while the deprecation warning steers new code to the canonical name\. The X509 prefix was dropped on the canonical name to align with the cnf\-member naming used by [CertificateSha256Thumbprint](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenConfirmation#Abblix.Jwt.JsonWebTokenConfirmation.CertificateSha256Thumbprint 'Abblix\.Jwt\.JsonWebTokenConfirmation\.CertificateSha256Thumbprint')\. ```csharp public string? X509CertificateSha256Thumbprint { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Methods ## AuthorizationContext\.Deconstruct\(string, string\[\], RequestedClaims\) Method {#Abblix.Oidc.Server.Common.AuthorizationContext.Deconstruct(string,string[],Abblix.Oidc.Server.Model.RequestedClaims)} Splits the authorization context into its constructor triple, enabling pattern\-style destructuring at the call site\. ```csharp public void Deconstruct(out string clientId, out string[] scope, out Abblix.Oidc.Server.Model.RequestedClaims? requestedClaims); ``` #### Parameters ###### `clientId` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Common.AuthorizationContext.Deconstruct(string,string[],Abblix.Oidc.Server.Model.RequestedClaims).clientId} Receives the [ClientId](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.AuthorizationContext#Abblix.Oidc.Server.Common.AuthorizationContext.ClientId 'Abblix\.Oidc\.Server\.Common\.AuthorizationContext\.ClientId')\. ###### `scope` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Oidc.Server.Common.AuthorizationContext.Deconstruct(string,string[],Abblix.Oidc.Server.Model.RequestedClaims).scope} Receives the [Scope](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.AuthorizationContext#Abblix.Oidc.Server.Common.AuthorizationContext.Scope 'Abblix\.Oidc\.Server\.Common\.AuthorizationContext\.Scope') array\. ###### `requestedClaims` [RequestedClaims](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.RequestedClaims 'Abblix\.Oidc\.Server\.Model\.RequestedClaims') {#Abblix.Oidc.Server.Common.AuthorizationContext.Deconstruct(string,string[],Abblix.Oidc.Server.Model.RequestedClaims).requestedClaims} Receives the optional [RequestedClaims](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.AuthorizationContext#Abblix.Oidc.Server.Common.AuthorizationContext.RequestedClaims 'Abblix\.Oidc\.Server\.Common\.AuthorizationContext\.RequestedClaims')\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.AuthorizationContextExtensions.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common 'Abblix\.Oidc\.Server\.Common') ## AuthorizationContextExtensions Class Provides extension methods for working with [AuthorizationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.AuthorizationContext 'Abblix\.Oidc\.Server\.Common\.AuthorizationContext') objects, facilitating the conversion between authorization contexts and JWT claims\. ```csharp public static class AuthorizationContextExtensions ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → AuthorizationContextExtensions ### Methods ## AuthorizationContextExtensions\.ApplyTo\(this AuthorizationContext, JsonWebTokenPayload\) Method {#Abblix.Oidc.Server.Common.AuthorizationContextExtensions.ApplyTo(thisAbblix.Oidc.Server.Common.AuthorizationContext,Abblix.Jwt.JsonWebTokenPayload)} Applies the information from an [AuthorizationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.AuthorizationContext 'Abblix\.Oidc\.Server\.Common\.AuthorizationContext') to a [JsonWebTokenPayload](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenPayload 'Abblix\.Jwt\.JsonWebTokenPayload'), converting the context into JWT claims\. ```csharp public static void ApplyTo(this Abblix.Oidc.Server.Common.AuthorizationContext context, Abblix.Jwt.JsonWebTokenPayload payload); ``` #### Parameters ###### `context` [AuthorizationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.AuthorizationContext 'Abblix\.Oidc\.Server\.Common\.AuthorizationContext') {#Abblix.Oidc.Server.Common.AuthorizationContextExtensions.ApplyTo(thisAbblix.Oidc.Server.Common.AuthorizationContext,Abblix.Jwt.JsonWebTokenPayload).context} The [AuthorizationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.AuthorizationContext 'Abblix\.Oidc\.Server\.Common\.AuthorizationContext') containing authorization details\. ###### `payload` [JsonWebTokenPayload](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenPayload 'Abblix\.Jwt\.JsonWebTokenPayload') {#Abblix.Oidc.Server.Common.AuthorizationContextExtensions.ApplyTo(thisAbblix.Oidc.Server.Common.AuthorizationContext,Abblix.Jwt.JsonWebTokenPayload).payload} The JWT payload where the authorization context information will be applied as claims\. ### Remarks This method is useful for embedding authorization details directly into a JWT, allowing for efficient transfer and validation of authorization information\. ## AuthorizationContextExtensions\.ToAuthorizationContext\(this JsonWebTokenPayload\) Method {#Abblix.Oidc.Server.Common.AuthorizationContextExtensions.ToAuthorizationContext(thisAbblix.Jwt.JsonWebTokenPayload)} Creates an [AuthorizationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.AuthorizationContext 'Abblix\.Oidc\.Server\.Common\.AuthorizationContext') from a [JsonWebTokenPayload](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenPayload 'Abblix\.Jwt\.JsonWebTokenPayload'), converting JWT claims back into an authorization context\. ```csharp public static Abblix.Oidc.Server.Common.AuthorizationContext ToAuthorizationContext(this Abblix.Jwt.JsonWebTokenPayload payload); ``` #### Parameters ###### `payload` [JsonWebTokenPayload](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenPayload 'Abblix\.Jwt\.JsonWebTokenPayload') {#Abblix.Oidc.Server.Common.AuthorizationContextExtensions.ToAuthorizationContext(thisAbblix.Jwt.JsonWebTokenPayload).payload} The JWT payload containing claims that represent an authorization context\. #### Returns [AuthorizationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.AuthorizationContext 'Abblix\.Oidc\.Server\.Common\.AuthorizationContext') An instance of [AuthorizationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.AuthorizationContext 'Abblix\.Oidc\.Server\.Common\.AuthorizationContext') populated with information derived from the JWT claims\. ### Remarks This method facilitates the extraction of authorization details from JWT claims, reconstructing an [AuthorizationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.AuthorizationContext 'Abblix\.Oidc\.Server\.Common\.AuthorizationContext') for further processing or validation\. ## AuthorizationContextExtensions\.WithDefaultResource\(this AuthorizationContext, Uri\) Method {#Abblix.Oidc.Server.Common.AuthorizationContextExtensions.WithDefaultResource(thisAbblix.Oidc.Server.Common.AuthorizationContext,System.Uri)} Names the given resource as the audience when the context names none, so a token says which party is meant to consume it rather than which one asked for it\. ```csharp public static Abblix.Oidc.Server.Common.AuthorizationContext WithDefaultResource(this Abblix.Oidc.Server.Common.AuthorizationContext context, System.Uri? defaultResource); ``` #### Parameters ###### `context` [AuthorizationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.AuthorizationContext 'Abblix\.Oidc\.Server\.Common\.AuthorizationContext') {#Abblix.Oidc.Server.Common.AuthorizationContextExtensions.WithDefaultResource(thisAbblix.Oidc.Server.Common.AuthorizationContext,System.Uri).context} The authorization context to complete\. ###### `defaultResource` [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri') {#Abblix.Oidc.Server.Common.AuthorizationContextExtensions.WithDefaultResource(thisAbblix.Oidc.Server.Common.AuthorizationContext,System.Uri).defaultResource} The resource to fall back on, or `null` to leave the context alone\. #### Returns [AuthorizationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.AuthorizationContext 'Abblix\.Oidc\.Server\.Common\.AuthorizationContext') The context, with the default resource applied where it was needed\. ### Remarks RFC 9068 Section 3: "If the request does not include a \`resource\` parameter, the authorization server MUST use a default resource indicator in the \`aud\` claim\." With no default supplied the context is returned untouched and the audience later falls back to the issuer \(see [ApplyTo\(this AuthorizationContext, JsonWebTokenPayload\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.AuthorizationContextExtensions#Abblix.Oidc.Server.Common.AuthorizationContextExtensions.ApplyTo(thisAbblix.Oidc.Server.Common.AuthorizationContext,Abblix.Jwt.JsonWebTokenPayload) 'Abblix\.Oidc\.Server\.Common\.AuthorizationContextExtensions\.ApplyTo\(this Abblix\.Oidc\.Server\.Common\.AuthorizationContext, Abblix\.Jwt\.JsonWebTokenPayload\)')\) \- the behaviour changes only where a host states the default, because that value is read by every resource server in the deployment\. A context that already names a resource or an audience is returned unchanged: it says who the token is for, and this only fills a gap\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.AuthServiceKeyDescriptor.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common 'Abblix\.Oidc\.Server\.Common') ## AuthServiceKeyDescriptor Class A service key together with the lifecycle metadata that lives AROUND it, never on it \- the [JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey') stays a pure JOSE / RFC 7517 model\. This is the unit a persistent store saves at generation and the read seam gates by time; the durable backend and the rotation that advances [Status](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.AuthServiceKeyDescriptor#Abblix.Oidc.Server.Common.AuthServiceKeyDescriptor.Status 'Abblix\.Oidc\.Server\.Common\.AuthServiceKeyDescriptor\.Status') ship separately\. ```csharp public sealed record AuthServiceKeyDescriptor : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → AuthServiceKeyDescriptor Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[AuthServiceKeyDescriptor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.AuthServiceKeyDescriptor 'Abblix\.Oidc\.Server\.Common\.AuthServiceKeyDescriptor')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Constructors ## AuthServiceKeyDescriptor\(JsonWebKey, KeyLifecycleStatus, DateTimeOffset, DateTimeOffset, DateTimeOffset\) Constructor {#Abblix.Oidc.Server.Common.AuthServiceKeyDescriptor.AuthServiceKeyDescriptor(Abblix.Jwt.JsonWebKey,Abblix.Oidc.Server.Common.KeyLifecycleStatus,System.DateTimeOffset,System.DateTimeOffset,System.DateTimeOffset)} A service key together with the lifecycle metadata that lives AROUND it, never on it \- the [JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey') stays a pure JOSE / RFC 7517 model\. This is the unit a persistent store saves at generation and the read seam gates by time; the durable backend and the rotation that advances [Status](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.AuthServiceKeyDescriptor#Abblix.Oidc.Server.Common.AuthServiceKeyDescriptor.Status 'Abblix\.Oidc\.Server\.Common\.AuthServiceKeyDescriptor\.Status') ship separately\. ```csharp public AuthServiceKeyDescriptor(Abblix.Jwt.JsonWebKey Key, Abblix.Oidc.Server.Common.KeyLifecycleStatus Status, System.DateTimeOffset NotBefore, System.DateTimeOffset NotAfter, System.DateTimeOffset DeleteAfter); ``` #### Parameters ###### `Key` [JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey') {#Abblix.Oidc.Server.Common.AuthServiceKeyDescriptor.AuthServiceKeyDescriptor(Abblix.Jwt.JsonWebKey,Abblix.Oidc.Server.Common.KeyLifecycleStatus,System.DateTimeOffset,System.DateTimeOffset,System.DateTimeOffset).Key} The key itself\. Its `use` is the standard JOSE member on the key; secret material is present for a local key and absent for an external one \(whose private half lives with a custodian\)\. ###### `Status` [KeyLifecycleStatus](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.KeyLifecycleStatus 'Abblix\.Oidc\.Server\.Common\.KeyLifecycleStatus') {#Abblix.Oidc.Server.Common.AuthServiceKeyDescriptor.AuthServiceKeyDescriptor(Abblix.Jwt.JsonWebKey,Abblix.Oidc.Server.Common.KeyLifecycleStatus,System.DateTimeOffset,System.DateTimeOffset,System.DateTimeOffset).Status} The lifecycle state; see [KeyLifecycleStatus](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.KeyLifecycleStatus 'Abblix\.Oidc\.Server\.Common\.KeyLifecycleStatus')\. ###### `NotBefore` [System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset') {#Abblix.Oidc.Server.Common.AuthServiceKeyDescriptor.AuthServiceKeyDescriptor(Abblix.Jwt.JsonWebKey,Abblix.Oidc.Server.Common.KeyLifecycleStatus,System.DateTimeOffset,System.DateTimeOffset,System.DateTimeOffset).NotBefore} When the key becomes eligible to sign\. ###### `NotAfter` [System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset') {#Abblix.Oidc.Server.Common.AuthServiceKeyDescriptor.AuthServiceKeyDescriptor(Abblix.Jwt.JsonWebKey,Abblix.Oidc.Server.Common.KeyLifecycleStatus,System.DateTimeOffset,System.DateTimeOffset,System.DateTimeOffset).NotAfter} When the key stops signing\. After this the key still verifies published tokens until [DeleteAfter](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.AuthServiceKeyDescriptor#Abblix.Oidc.Server.Common.AuthServiceKeyDescriptor.DeleteAfter 'Abblix\.Oidc\.Server\.Common\.AuthServiceKeyDescriptor\.DeleteAfter')\. ###### `DeleteAfter` [System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset') {#Abblix.Oidc.Server.Common.AuthServiceKeyDescriptor.AuthServiceKeyDescriptor(Abblix.Jwt.JsonWebKey,Abblix.Oidc.Server.Common.KeyLifecycleStatus,System.DateTimeOffset,System.DateTimeOffset,System.DateTimeOffset).DeleteAfter} When the key may be removed from publication entirely\. It is [NotAfter](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.AuthServiceKeyDescriptor#Abblix.Oidc.Server.Common.AuthServiceKeyDescriptor.NotAfter 'Abblix\.Oidc\.Server\.Common\.AuthServiceKeyDescriptor\.NotAfter') plus the maximum lifetime of any token the key could have signed, so no live token can still reference it\. ### Properties ## AuthServiceKeyDescriptor\.DeleteAfter Property {#Abblix.Oidc.Server.Common.AuthServiceKeyDescriptor.DeleteAfter} When the key may be removed from publication entirely\. It is [NotAfter](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.AuthServiceKeyDescriptor#Abblix.Oidc.Server.Common.AuthServiceKeyDescriptor.NotAfter 'Abblix\.Oidc\.Server\.Common\.AuthServiceKeyDescriptor\.NotAfter') plus the maximum lifetime of any token the key could have signed, so no live token can still reference it\. ```csharp public System.DateTimeOffset DeleteAfter { get; init; } ``` #### Property Value [System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset') ## AuthServiceKeyDescriptor\.Key Property {#Abblix.Oidc.Server.Common.AuthServiceKeyDescriptor.Key} The key itself\. Its `use` is the standard JOSE member on the key; secret material is present for a local key and absent for an external one \(whose private half lives with a custodian\)\. ```csharp public Abblix.Jwt.JsonWebKey Key { get; init; } ``` #### Property Value [JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey') ## AuthServiceKeyDescriptor\.NotAfter Property {#Abblix.Oidc.Server.Common.AuthServiceKeyDescriptor.NotAfter} When the key stops signing\. After this the key still verifies published tokens until [DeleteAfter](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.AuthServiceKeyDescriptor#Abblix.Oidc.Server.Common.AuthServiceKeyDescriptor.DeleteAfter 'Abblix\.Oidc\.Server\.Common\.AuthServiceKeyDescriptor\.DeleteAfter')\. ```csharp public System.DateTimeOffset NotAfter { get; init; } ``` #### Property Value [System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset') ## AuthServiceKeyDescriptor\.NotBefore Property {#Abblix.Oidc.Server.Common.AuthServiceKeyDescriptor.NotBefore} When the key becomes eligible to sign\. ```csharp public System.DateTimeOffset NotBefore { get; init; } ``` #### Property Value [System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset') ## AuthServiceKeyDescriptor\.Status Property {#Abblix.Oidc.Server.Common.AuthServiceKeyDescriptor.Status} The lifecycle state; see [KeyLifecycleStatus](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.KeyLifecycleStatus 'Abblix\.Oidc\.Server\.Common\.KeyLifecycleStatus')\. ```csharp public Abblix.Oidc.Server.Common.KeyLifecycleStatus Status { get; init; } ``` #### Property Value [KeyLifecycleStatus](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.KeyLifecycleStatus 'Abblix\.Oidc\.Server\.Common\.KeyLifecycleStatus') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.ClaimsExtensions.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common 'Abblix\.Oidc\.Server\.Common') ## ClaimsExtensions Class Helpers for working with [System\.Security\.Claims\.ClaimsPrincipal](https://learn.microsoft.com/en-us/dotnet/api/system.security.claims.claimsprincipal 'System\.Security\.Claims\.ClaimsPrincipal') and [System\.Security\.Claims\.Claim](https://learn.microsoft.com/en-us/dotnet/api/system.security.claims.claim 'System\.Security\.Claims\.Claim') sequences: classify claims as registered/public/private \(per IANA\), filter or replace them by type, and look up values by claim name in a case\-insensitive manner\. ```csharp public static class ClaimsExtensions ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ClaimsExtensions ### Methods ## ClaimsExtensions\.ExcludeClaims\(this IEnumerable\, string\[\]\) Method {#Abblix.Oidc.Server.Common.ClaimsExtensions.ExcludeClaims(thisSystem.Collections.Generic.IEnumerable_System.Security.Claims.Claim_,string[])} Returns the claims whose type does not match any of the given types, using case\-insensitive comparison\. ```csharp public static System.Collections.Generic.IEnumerable ExcludeClaims(this System.Collections.Generic.IEnumerable claims, params string[] claimTypes); ``` #### Parameters ###### `claims` [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.Security\.Claims\.Claim](https://learn.microsoft.com/en-us/dotnet/api/system.security.claims.claim 'System\.Security\.Claims\.Claim')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') {#Abblix.Oidc.Server.Common.ClaimsExtensions.ExcludeClaims(thisSystem.Collections.Generic.IEnumerable_System.Security.Claims.Claim_,string[]).claims} The source sequence of claims to filter\. ###### `claimTypes` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Oidc.Server.Common.ClaimsExtensions.ExcludeClaims(thisSystem.Collections.Generic.IEnumerable_System.Security.Claims.Claim_,string[]).claimTypes} The claim type names to drop from the sequence\. #### Returns [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.Security\.Claims\.Claim](https://learn.microsoft.com/en-us/dotnet/api/system.security.claims.claim 'System\.Security\.Claims\.Claim')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ## ClaimsExtensions\.ExcludeRegisteredClaims\(this IEnumerable\\) Method {#Abblix.Oidc.Server.Common.ClaimsExtensions.ExcludeRegisteredClaims(thisSystem.Collections.Generic.IEnumerable_System.Security.Claims.Claim_)} Returns the claims whose type is not in the IANA registered list \(e\.g\. iss, sub, aud, exp\)\. Useful when projecting only application\-specific claims into a downstream payload\. ```csharp public static System.Collections.Generic.IEnumerable ExcludeRegisteredClaims(this System.Collections.Generic.IEnumerable claims); ``` #### Parameters ###### `claims` [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.Security\.Claims\.Claim](https://learn.microsoft.com/en-us/dotnet/api/system.security.claims.claim 'System\.Security\.Claims\.Claim')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') {#Abblix.Oidc.Server.Common.ClaimsExtensions.ExcludeRegisteredClaims(thisSystem.Collections.Generic.IEnumerable_System.Security.Claims.Claim_).claims} #### Returns [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.Security\.Claims\.Claim](https://learn.microsoft.com/en-us/dotnet/api/system.security.claims.claim 'System\.Security\.Claims\.Claim')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ## ClaimsExtensions\.Find\(this IEnumerable\, string\) Method {#Abblix.Oidc.Server.Common.ClaimsExtensions.Find(thisSystem.Collections.Generic.IEnumerable_System.Security.Claims.Claim_,string)} Returns the first claim whose type matches the given name \(case\-insensitive\), or `null` when none exists\. ```csharp public static System.Security.Claims.Claim? Find(this System.Collections.Generic.IEnumerable claims, string name); ``` #### Parameters ###### `claims` [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.Security\.Claims\.Claim](https://learn.microsoft.com/en-us/dotnet/api/system.security.claims.claim 'System\.Security\.Claims\.Claim')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') {#Abblix.Oidc.Server.Common.ClaimsExtensions.Find(thisSystem.Collections.Generic.IEnumerable_System.Security.Claims.Claim_,string).claims} ###### `name` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Common.ClaimsExtensions.Find(thisSystem.Collections.Generic.IEnumerable_System.Security.Claims.Claim_,string).name} #### Returns [System\.Security\.Claims\.Claim](https://learn.microsoft.com/en-us/dotnet/api/system.security.claims.claim 'System\.Security\.Claims\.Claim') ## ClaimsExtensions\.FindRequired\(this IEnumerable\, string\) Method {#Abblix.Oidc.Server.Common.ClaimsExtensions.FindRequired(thisSystem.Collections.Generic.IEnumerable_System.Security.Claims.Claim_,string)} Returns the first claim of the given name, or throws when no such claim exists\. Use when the caller treats absence of the claim as a programming error rather than a recoverable case\. ```csharp public static System.Security.Claims.Claim FindRequired(this System.Collections.Generic.IEnumerable claims, string name); ``` #### Parameters ###### `claims` [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.Security\.Claims\.Claim](https://learn.microsoft.com/en-us/dotnet/api/system.security.claims.claim 'System\.Security\.Claims\.Claim')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') {#Abblix.Oidc.Server.Common.ClaimsExtensions.FindRequired(thisSystem.Collections.Generic.IEnumerable_System.Security.Claims.Claim_,string).claims} ###### `name` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Common.ClaimsExtensions.FindRequired(thisSystem.Collections.Generic.IEnumerable_System.Security.Claims.Claim_,string).name} #### Returns [System\.Security\.Claims\.Claim](https://learn.microsoft.com/en-us/dotnet/api/system.security.claims.claim 'System\.Security\.Claims\.Claim') #### Exceptions [System\.InvalidOperationException](https://learn.microsoft.com/en-us/dotnet/api/system.invalidoperationexception 'System\.InvalidOperationException') No claim with the requested name was found\. ## ClaimsExtensions\.FindValue\(this IEnumerable\, string\) Method {#Abblix.Oidc.Server.Common.ClaimsExtensions.FindValue(thisSystem.Collections.Generic.IEnumerable_System.Security.Claims.Claim_,string)} Returns the value of the first claim whose type matches the given name, or `null` when no such claim exists\. ```csharp public static string? FindValue(this System.Collections.Generic.IEnumerable claims, string name); ``` #### Parameters ###### `claims` [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.Security\.Claims\.Claim](https://learn.microsoft.com/en-us/dotnet/api/system.security.claims.claim 'System\.Security\.Claims\.Claim')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') {#Abblix.Oidc.Server.Common.ClaimsExtensions.FindValue(thisSystem.Collections.Generic.IEnumerable_System.Security.Claims.Claim_,string).claims} ###### `name` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Common.ClaimsExtensions.FindValue(thisSystem.Collections.Generic.IEnumerable_System.Security.Claims.Claim_,string).name} #### Returns [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ClaimsExtensions\.GetPrivateClaims\(this IEnumerable\\) Method {#Abblix.Oidc.Server.Common.ClaimsExtensions.GetPrivateClaims(thisSystem.Collections.Generic.IEnumerable_System.Security.Claims.Claim_)} These are the custom claims created to share information between parties that agree on using them and are neither registered or public claims\. ```csharp public static System.Collections.Generic.IEnumerable GetPrivateClaims(this System.Collections.Generic.IEnumerable claims); ``` #### Parameters ###### `claims` [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.Security\.Claims\.Claim](https://learn.microsoft.com/en-us/dotnet/api/system.security.claims.claim 'System\.Security\.Claims\.Claim')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') {#Abblix.Oidc.Server.Common.ClaimsExtensions.GetPrivateClaims(thisSystem.Collections.Generic.IEnumerable_System.Security.Claims.Claim_).claims} #### Returns [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.Security\.Claims\.Claim](https://learn.microsoft.com/en-us/dotnet/api/system.security.claims.claim 'System\.Security\.Claims\.Claim')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ## ClaimsExtensions\.GetPublicClaims\(this IEnumerable\\) Method {#Abblix.Oidc.Server.Common.ClaimsExtensions.GetPublicClaims(thisSystem.Collections.Generic.IEnumerable_System.Security.Claims.Claim_)} These can be defined at will by those using JWTs\. But to avoid collisions they should be defined in the IANA JSON Web Token Registry or be defined as a URI that contains a collision resistant namespace\. ```csharp public static System.Collections.Generic.IEnumerable GetPublicClaims(this System.Collections.Generic.IEnumerable claims); ``` #### Parameters ###### `claims` [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.Security\.Claims\.Claim](https://learn.microsoft.com/en-us/dotnet/api/system.security.claims.claim 'System\.Security\.Claims\.Claim')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') {#Abblix.Oidc.Server.Common.ClaimsExtensions.GetPublicClaims(thisSystem.Collections.Generic.IEnumerable_System.Security.Claims.Claim_).claims} #### Returns [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.Security\.Claims\.Claim](https://learn.microsoft.com/en-us/dotnet/api/system.security.claims.claim 'System\.Security\.Claims\.Claim')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ## ClaimsExtensions\.GetRegisteredClaims\(this IEnumerable\\) Method {#Abblix.Oidc.Server.Common.ClaimsExtensions.GetRegisteredClaims(thisSystem.Collections.Generic.IEnumerable_System.Security.Claims.Claim_)} These are a set of predefined claims which are not mandatory but recommended, to provide a set of useful, interoperable claims\. Some of them are: iss \(issuer\), exp \(expiration time\), sub \(subject\), aud \(audience\), and others\. ```csharp public static System.Collections.Generic.IEnumerable GetRegisteredClaims(this System.Collections.Generic.IEnumerable claims); ``` #### Parameters ###### `claims` [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.Security\.Claims\.Claim](https://learn.microsoft.com/en-us/dotnet/api/system.security.claims.claim 'System\.Security\.Claims\.Claim')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') {#Abblix.Oidc.Server.Common.ClaimsExtensions.GetRegisteredClaims(thisSystem.Collections.Generic.IEnumerable_System.Security.Claims.Claim_).claims} #### Returns [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.Security\.Claims\.Claim](https://learn.microsoft.com/en-us/dotnet/api/system.security.claims.claim 'System\.Security\.Claims\.Claim')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ## ClaimsExtensions\.GetUserClaimsOnly\(this IEnumerable\\) Method {#Abblix.Oidc.Server.Common.ClaimsExtensions.GetUserClaimsOnly(thisSystem.Collections.Generic.IEnumerable_System.Security.Claims.Claim_)} Returns the user\-facing claim subset: the subject claim plus everything that is not an IANA registered JWT claim\. Drops protocol metadata \(iss, exp, aud, etc\.\) while preserving identity and profile claims\. ```csharp public static System.Collections.Generic.IEnumerable GetUserClaimsOnly(this System.Collections.Generic.IEnumerable claims); ``` #### Parameters ###### `claims` [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.Security\.Claims\.Claim](https://learn.microsoft.com/en-us/dotnet/api/system.security.claims.claim 'System\.Security\.Claims\.Claim')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') {#Abblix.Oidc.Server.Common.ClaimsExtensions.GetUserClaimsOnly(thisSystem.Collections.Generic.IEnumerable_System.Security.Claims.Claim_).claims} #### Returns [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.Security\.Claims\.Claim](https://learn.microsoft.com/en-us/dotnet/api/system.security.claims.claim 'System\.Security\.Claims\.Claim')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ## ClaimsExtensions\.IsAuthenticated\(this ClaimsPrincipal\) Method {#Abblix.Oidc.Server.Common.ClaimsExtensions.IsAuthenticated(thisSystem.Security.Claims.ClaimsPrincipal)} Determines whether the principal carries an authenticated identity, treating a null principal or an unauthenticated identity as not authenticated\. ```csharp public static bool IsAuthenticated(this System.Security.Claims.ClaimsPrincipal principal); ``` #### Parameters ###### `principal` [System\.Security\.Claims\.ClaimsPrincipal](https://learn.microsoft.com/en-us/dotnet/api/system.security.claims.claimsprincipal 'System\.Security\.Claims\.ClaimsPrincipal') {#Abblix.Oidc.Server.Common.ClaimsExtensions.IsAuthenticated(thisSystem.Security.Claims.ClaimsPrincipal).principal} The principal to inspect; may be `null`\. #### Returns [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') `true` when the principal has an identity flagged as authenticated\. ## ClaimsExtensions\.SetClaim\(this ICollection\, string, string\) Method {#Abblix.Oidc.Server.Common.ClaimsExtensions.SetClaim(thisSystem.Collections.Generic.ICollection_System.Security.Claims.Claim_,string,string)} Inserts, updates, or removes a claim by name in the given collection so that exactly one claim with that type remains, holding the supplied value\. Passing `null` for [value](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.ClaimsExtensions#Abblix.Oidc.Server.Common.ClaimsExtensions.SetClaim(thisSystem.Collections.Generic.ICollection_System.Security.Claims.Claim_,string,string).value 'Abblix\.Oidc\.Server\.Common\.ClaimsExtensions\.SetClaim\(this System\.Collections\.Generic\.ICollection\, string, string\)\.value') deletes the claim\. When the existing value already equals [value](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.ClaimsExtensions#Abblix.Oidc.Server.Common.ClaimsExtensions.SetClaim(thisSystem.Collections.Generic.ICollection_System.Security.Claims.Claim_,string,string).value 'Abblix\.Oidc\.Server\.Common\.ClaimsExtensions\.SetClaim\(this System\.Collections\.Generic\.ICollection\, string, string\)\.value'), the collection is left untouched\. ```csharp public static void SetClaim(this System.Collections.Generic.ICollection claims, string name, string? value); ``` #### Parameters ###### `claims` [System\.Collections\.Generic\.ICollection<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.icollection-1 'System\.Collections\.Generic\.ICollection\`1')[System\.Security\.Claims\.Claim](https://learn.microsoft.com/en-us/dotnet/api/system.security.claims.claim 'System\.Security\.Claims\.Claim')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.icollection-1 'System\.Collections\.Generic\.ICollection\`1') {#Abblix.Oidc.Server.Common.ClaimsExtensions.SetClaim(thisSystem.Collections.Generic.ICollection_System.Security.Claims.Claim_,string,string).claims} The mutable claim collection to update in place\. ###### `name` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Common.ClaimsExtensions.SetClaim(thisSystem.Collections.Generic.ICollection_System.Security.Claims.Claim_,string,string).name} The claim type to set or remove\. ###### `value` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Common.ClaimsExtensions.SetClaim(thisSystem.Collections.Generic.ICollection_System.Security.Claims.Claim_,string,string).value} The new value, or `null` to remove any existing claim of that name\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Cookie.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common 'Abblix\.Oidc\.Server\.Common') ## Cookie Class Represents an HTTP cookie along with its options\. ```csharp public record Cookie : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → Cookie Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[Cookie](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Cookie 'Abblix\.Oidc\.Server\.Common\.Cookie')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Constructors ## Cookie\(string, CookieOptions\) Constructor {#Abblix.Oidc.Server.Common.Cookie.Cookie(string,Abblix.Oidc.Server.Common.CookieOptions)} Represents an HTTP cookie along with its options\. ```csharp public Cookie(string Name, Abblix.Oidc.Server.Common.CookieOptions Options); ``` #### Parameters ###### `Name` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Common.Cookie.Cookie(string,Abblix.Oidc.Server.Common.CookieOptions).Name} `Options` [CookieOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.CookieOptions 'Abblix\.Oidc\.Server\.Common\.CookieOptions') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.CookieOptions.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common 'Abblix\.Oidc\.Server\.Common') ## CookieOptions Class Represents options for an HTTP cookie, including properties for HTTP\-only, essential, secure, path, domain, SameSite attribute, expiration, and maximum age\. ```csharp public record CookieOptions : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → CookieOptions Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[CookieOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.CookieOptions 'Abblix\.Oidc\.Server\.Common\.CookieOptions')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Properties ## CookieOptions\.Domain Property {#Abblix.Oidc.Server.Common.CookieOptions.Domain} The domain for which the cookie is valid\. ```csharp public string? Domain { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## CookieOptions\.Expires Property {#Abblix.Oidc.Server.Common.CookieOptions.Expires} The expiration date and time of the cookie\. ```csharp public System.Nullable Expires { get; set; } ``` #### Property Value [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') ## CookieOptions\.HttpOnly Property {#Abblix.Oidc.Server.Common.CookieOptions.HttpOnly} Indicates if the cookie is accessible only through HTTP\. ```csharp public bool HttpOnly { get; set; } ``` #### Property Value [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') ## CookieOptions\.IsEssential Property {#Abblix.Oidc.Server.Common.CookieOptions.IsEssential} Indicates if the cookie is essential for the application's functionality\. ```csharp public bool IsEssential { get; set; } ``` #### Property Value [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') ## CookieOptions\.MaxAge Property {#Abblix.Oidc.Server.Common.CookieOptions.MaxAge} The maximum age of the cookie as a time span\. ```csharp public System.Nullable MaxAge { get; set; } ``` #### Property Value [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') ## CookieOptions\.Path Property {#Abblix.Oidc.Server.Common.CookieOptions.Path} The path for which the cookie is valid\. ```csharp public string? Path { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## CookieOptions\.SameSite Property {#Abblix.Oidc.Server.Common.CookieOptions.SameSite} The SameSite attribute of the cookie\. ```csharp public string? SameSite { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## CookieOptions\.Secure Property {#Abblix.Oidc.Server.Common.CookieOptions.Secure} Indicates if the cookie should only be sent over secure channels \(HTTPS\)\. ```csharp public bool Secure { get; set; } ``` #### Property Value [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.HttpRequestMessageExtensions.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common 'Abblix\.Oidc\.Server\.Common') ## HttpRequestMessageExtensions Class Extension methods for [System\.Net\.Http\.HttpRequestMessage](https://learn.microsoft.com/en-us/dotnet/api/system.net.http.httprequestmessage 'System\.Net\.Http\.HttpRequestMessage')\. ```csharp public static class HttpRequestMessageExtensions ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → HttpRequestMessageExtensions ### Methods ## HttpRequestMessageExtensions\.AddBearerToken\(this HttpRequestMessage, string\) Method {#Abblix.Oidc.Server.Common.HttpRequestMessageExtensions.AddBearerToken(thisSystem.Net.Http.HttpRequestMessage,string)} Adds a Bearer token authorization header to the HTTP request\. ```csharp public static void AddBearerToken(this System.Net.Http.HttpRequestMessage request, string bearerToken); ``` #### Parameters ###### `request` [System\.Net\.Http\.HttpRequestMessage](https://learn.microsoft.com/en-us/dotnet/api/system.net.http.httprequestmessage 'System\.Net\.Http\.HttpRequestMessage') {#Abblix.Oidc.Server.Common.HttpRequestMessageExtensions.AddBearerToken(thisSystem.Net.Http.HttpRequestMessage,string).request} The HTTP request message\. ###### `bearerToken` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Common.HttpRequestMessageExtensions.AddBearerToken(thisSystem.Net.Http.HttpRequestMessage,string).bearerToken} The bearer token to include in the Authorization header\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.InvalidDPoPProofError.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common 'Abblix\.Oidc\.Server\.Common') ## InvalidDPoPProofError Class Subtype of [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') tagging an RFC 9449 §7\.1 DPoP proof rejection at a protected endpoint \(UserInfo, introspection, revocation\)\. The typed marker lets the response formatter pattern\-match deterministically and emit the `WWW-Authenticate: DPoP error="invalid_dpop_proof"` challenge instead of a Bearer challenge, without string\-comparing the error code\. Mirrors [UseDPoPNonceError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.UseDPoPNonceError 'Abblix\.Oidc\.Server\.Common\.UseDPoPNonceError')\. ```csharp public sealed record InvalidDPoPProofError : Abblix.Oidc.Server.Common.OidcError, System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') → InvalidDPoPProofError Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[InvalidDPoPProofError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.InvalidDPoPProofError 'Abblix\.Oidc\.Server\.Common\.InvalidDPoPProofError')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Constructors ## InvalidDPoPProofError\(string\) Constructor {#Abblix.Oidc.Server.Common.InvalidDPoPProofError.InvalidDPoPProofError(string)} Subtype of [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') tagging an RFC 9449 §7\.1 DPoP proof rejection at a protected endpoint \(UserInfo, introspection, revocation\)\. The typed marker lets the response formatter pattern\-match deterministically and emit the `WWW-Authenticate: DPoP error="invalid_dpop_proof"` challenge instead of a Bearer challenge, without string\-comparing the error code\. Mirrors [UseDPoPNonceError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.UseDPoPNonceError 'Abblix\.Oidc\.Server\.Common\.UseDPoPNonceError')\. ```csharp public InvalidDPoPProofError(string Description); ``` #### Parameters `Description` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.JsonWebKeyExtensions.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common 'Abblix\.Oidc\.Server\.Common') ## JsonWebKeyExtensions Class Provides extensions for asynchronous operations on a sequence of [JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey') objects\. ```csharp public static class JsonWebKeyExtensions ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → JsonWebKeyExtensions ### Methods ## JsonWebKeyExtensions\.FirstByAlgorithmAsync\(this IAsyncEnumerable\, string\) Method {#Abblix.Oidc.Server.Common.JsonWebKeyExtensions.FirstByAlgorithmAsync(thisSystem.Collections.Generic.IAsyncEnumerable_Abblix.Jwt.JsonWebKey_,string)} Asynchronously retrieves the first [JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey') able to perform the specified algorithm\. ```csharp public static System.Threading.Tasks.Task FirstByAlgorithmAsync(this System.Collections.Generic.IAsyncEnumerable credentials, string? algorithm); ``` #### Parameters ###### `credentials` [System\.Collections\.Generic\.IAsyncEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.iasyncenumerable-1 'System\.Collections\.Generic\.IAsyncEnumerable\`1')[JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.iasyncenumerable-1 'System\.Collections\.Generic\.IAsyncEnumerable\`1') {#Abblix.Oidc.Server.Common.JsonWebKeyExtensions.FirstByAlgorithmAsync(thisSystem.Collections.Generic.IAsyncEnumerable_Abblix.Jwt.JsonWebKey_,string).credentials} The asynchronous sequence of [JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey') objects\. ###### `algorithm` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Common.JsonWebKeyExtensions.FirstByAlgorithmAsync(thisSystem.Collections.Generic.IAsyncEnumerable_Abblix.Jwt.JsonWebKey_,string).algorithm} The algorithm to match\. Returns null if [None](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.SigningAlgorithms#Abblix.Jwt.SigningAlgorithms.None 'Abblix\.Jwt\.SigningAlgorithms\.None') is provided\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') The first [JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey') able to perform the algorithm\. ### Remarks A key qualifies by declaring the algorithm, or \- when it declares none, which RFC 7517 section 4\.4 permits and a certificate\-imported key always does \- by its material being able to perform it, per [SupportsAlgorithm\(this JsonWebKey, string\)](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKeyExtensions#Abblix.Jwt.JsonWebKeyExtensions.SupportsAlgorithm(thisAbblix.Jwt.JsonWebKey,string) 'Abblix\.Jwt\.JsonWebKeyExtensions\.SupportsAlgorithm\(Abblix\.Jwt\.JsonWebKey,System\.String\)')\. Order is left to the caller, deliberately. Ranking a declared `alg` above an undeclared one would override the order the provider handed down, and that order is load-bearing: a key ring returns the active key first, so reordering here would pick a key the ring deliberately kept behind - during a rollover, the newcomer instead of the key clients still expect. Whether a key names its algorithm says nothing about which key should produce. ## JsonWebKeyExtensions\.FirstByAlgorithmAsync\(this IAsyncEnumerable\, string, string\) Method {#Abblix.Oidc.Server.Common.JsonWebKeyExtensions.FirstByAlgorithmAsync(thisSystem.Collections.Generic.IAsyncEnumerable_Abblix.Jwt.JsonWebKey_,string,string)} Asynchronously retrieves the first [JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey') matching an optional algorithm and an optional key id\. This is the key\-id\-aware sibling of [FirstByAlgorithmAsync\(this IAsyncEnumerable<JsonWebKey>, string\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.JsonWebKeyExtensions#Abblix.Oidc.Server.Common.JsonWebKeyExtensions.FirstByAlgorithmAsync(thisSystem.Collections.Generic.IAsyncEnumerable_Abblix.Jwt.JsonWebKey_,string) 'Abblix\.Oidc\.Server\.Common\.JsonWebKeyExtensions\.FirstByAlgorithmAsync\(this System\.Collections\.Generic\.IAsyncEnumerable\, string\)'): signing passes the token's `alg` and pinned `kid`; encryption passes a `null` algorithm \(the key\-management `alg` is derived from the chosen key afterwards\) and only the pinned `kid`\. ```csharp public static System.Threading.Tasks.Task FirstByAlgorithmAsync(this System.Collections.Generic.IAsyncEnumerable credentials, string? algorithm, string? keyId); ``` #### Parameters ###### `credentials` [System\.Collections\.Generic\.IAsyncEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.iasyncenumerable-1 'System\.Collections\.Generic\.IAsyncEnumerable\`1')[JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.iasyncenumerable-1 'System\.Collections\.Generic\.IAsyncEnumerable\`1') {#Abblix.Oidc.Server.Common.JsonWebKeyExtensions.FirstByAlgorithmAsync(thisSystem.Collections.Generic.IAsyncEnumerable_Abblix.Jwt.JsonWebKey_,string,string).credentials} The asynchronous sequence of [JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey') objects\. ###### `algorithm` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Common.JsonWebKeyExtensions.FirstByAlgorithmAsync(thisSystem.Collections.Generic.IAsyncEnumerable_Abblix.Jwt.JsonWebKey_,string,string).algorithm} The algorithm to match, or `null` to not filter by algorithm\. A key qualifies by declaring it or, declaring none, by being able to perform it\. Returns `null` for [None](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.SigningAlgorithms#Abblix.Jwt.SigningAlgorithms.None 'Abblix\.Jwt\.SigningAlgorithms\.None')\. ###### `keyId` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Common.JsonWebKeyExtensions.FirstByAlgorithmAsync(thisSystem.Collections.Generic.IAsyncEnumerable_Abblix.Jwt.JsonWebKey_,string,string).keyId} The `kid` to match, or `null` to not filter by key id\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') The first matching key, or `null` when the sequence yields none and neither filter was applied\. Throws when a filter was applied but nothing matched, so a pinned key id or a required algorithm that resolves to no key fails loudly rather than silently downgrading\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.KeyLifecycleStatus.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common 'Abblix\.Oidc\.Server\.Common') ## KeyLifecycleStatus Enum The lifecycle state of a service key as it moves through generation, activation, retirement and deletion\. The transitions themselves are driven by the rotation engine; this contract only names the states so a persistent store and the read seam agree on their meaning\. ```csharp public enum KeyLifecycleStatus ``` ### Fields ###### `Pending` 0 {#Abblix.Oidc.Server.Common.KeyLifecycleStatus.Pending} Generated and published for verification, but not yet used for signing\. Publishing a key before it signs \(publish\-before\-sign\) gives relying parties time to fetch it, so the first token it signs already verifies against a key they hold\. ###### `Active` 1 {#Abblix.Oidc.Server.Common.KeyLifecycleStatus.Active} The current signing key: within its `not_before` / `not_after` window\. ###### `Retiring` 2 {#Abblix.Oidc.Server.Common.KeyLifecycleStatus.Retiring} Past `not_after`, so it no longer signs, but still published so tokens it already signed keep verifying until they expire\. ###### `Retired` 3 {#Abblix.Oidc.Server.Common.KeyLifecycleStatus.Retired} Past `delete_after`: no live token can reference it, so it is removed from publication\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.MissingAuthenticationError.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common 'Abblix\.Oidc\.Server\.Common') ## MissingAuthenticationError Class Subtype of [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') tagging a request to a protected endpoint that carried no authentication information at all\. RFC 6750 §3\.1: in that case the challenge SHOULD NOT include an error code or other error attributes \- a bare `WWW-Authenticate` header simply tells the client that authentication is required\. The error code still drives the internal 401 status\-code mapping; only the challenge attributes are suppressed by the builder\. Mirrors [InvalidDPoPProofError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.InvalidDPoPProofError 'Abblix\.Oidc\.Server\.Common\.InvalidDPoPProofError') as a typed marker for deterministic pattern matching\. ```csharp public sealed record MissingAuthenticationError : Abblix.Oidc.Server.Common.OidcError, System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') → MissingAuthenticationError Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[MissingAuthenticationError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.MissingAuthenticationError 'Abblix\.Oidc\.Server\.Common\.MissingAuthenticationError')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Constructors ## MissingAuthenticationError\(string\) Constructor {#Abblix.Oidc.Server.Common.MissingAuthenticationError.MissingAuthenticationError(string)} Subtype of [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') tagging a request to a protected endpoint that carried no authentication information at all\. RFC 6750 §3\.1: in that case the challenge SHOULD NOT include an error code or other error attributes \- a bare `WWW-Authenticate` header simply tells the client that authentication is required\. The error code still drives the internal 401 status\-code mapping; only the challenge attributes are suppressed by the builder\. Mirrors [InvalidDPoPProofError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.InvalidDPoPProofError 'Abblix\.Oidc\.Server\.Common\.InvalidDPoPProofError') as a typed marker for deterministic pattern matching\. ```csharp public MissingAuthenticationError(string Description); ``` #### Parameters `Description` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common 'Abblix\.Oidc\.Server\.Common') ## OidcError Class Represents an error that occurred during OAuth 2\.0/OpenID Connect request processing\. ```csharp public record OidcError : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → OidcError Derived ↳ [InvalidDPoPProofError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.InvalidDPoPProofError 'Abblix\.Oidc\.Server\.Common\.InvalidDPoPProofError') ↳ [MissingAuthenticationError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.MissingAuthenticationError 'Abblix\.Oidc\.Server\.Common\.MissingAuthenticationError') ↳ [UseDPoPNonceError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.UseDPoPNonceError 'Abblix\.Oidc\.Server\.Common\.UseDPoPNonceError') ↳ [AuthorizationRequestValidationError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationRequestValidationError') ↳ [BackChannelAuthenticationForbidden](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.BackChannelAuthenticationForbidden 'Abblix\.Oidc\.Server\.Model\.BackChannelAuthenticationForbidden') ↳ [BackChannelAuthenticationUnauthorized](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.BackChannelAuthenticationUnauthorized 'Abblix\.Oidc\.Server\.Model\.BackChannelAuthenticationUnauthorized') Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Constructors ## OidcError\(string, string\) Constructor {#Abblix.Oidc.Server.Common.OidcError.OidcError(string,string)} Represents an error that occurred during OAuth 2\.0/OpenID Connect request processing\. ```csharp public OidcError(string Error, string ErrorDescription); ``` #### Parameters ###### `Error` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Common.OidcError.OidcError(string,string).Error} The error code indicating the nature of the error\. ###### `ErrorDescription` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Common.OidcError.OidcError(string,string).ErrorDescription} A human\-readable description of the error\. ### Properties ## OidcError\.Error Property {#Abblix.Oidc.Server.Common.OidcError.Error} The error code indicating the nature of the error\. ```csharp public string Error { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## OidcError\.ErrorDescription Property {#Abblix.Oidc.Server.Common.OidcError.ErrorDescription} A human\-readable description of the error\. ```csharp public string ErrorDescription { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.ParametersProvider.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common 'Abblix\.Oidc\.Server\.Common') ## ParametersProvider Class Extracts parameters from an object by serializing it to a JSON element and enumerating its properties\. Pure System\.Text\.Json, framework\-neutral \- the single implementation both the MVC and Minimal API transports use\. ```csharp public class ParametersProvider : Abblix.Oidc.Server.Common.Interfaces.IParametersProvider ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ParametersProvider Implements [IParametersProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IParametersProvider 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IParametersProvider') ### Methods ## ParametersProvider\.GetParameters\(object\) Method {#Abblix.Oidc.Server.Common.ParametersProvider.GetParameters(object)} Retrieves the parameters as name/value pairs from the specified object\. ```csharp public System.Collections.Generic.IEnumerable<(string name,string? value)> GetParameters(object obj); ``` #### Parameters ###### `obj` [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') {#Abblix.Oidc.Server.Common.ParametersProvider.GetParameters(object).obj} The object to extract parameters from\. Implements [GetParameters\(object\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IParametersProvider#Abblix.Oidc.Server.Common.Interfaces.IParametersProvider.GetParameters(object) 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IParametersProvider\.GetParameters\(object\)') #### Returns [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[<](https://learn.microsoft.com/en-us/dotnet/api/system.valuetuple 'System\.ValueTuple')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[,](https://learn.microsoft.com/en-us/dotnet/api/system.valuetuple 'System\.ValueTuple')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.valuetuple 'System\.ValueTuple')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') The parameter name/value pairs\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.UseDPoPNonceError.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common 'Abblix\.Oidc\.Server\.Common') ## UseDPoPNonceError Class Subtype of [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') that signals an RFC 9449 §8 nonce\-challenge: the DPoP proof either omitted the `nonce` claim or carried a stale one, and the server is responding with `use_dpop_nonce` plus a fresh nonce the client must echo on the next attempt\. The carried [Nonce](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.UseDPoPNonceError#Abblix.Oidc.Server.Common.UseDPoPNonceError.Nonce 'Abblix\.Oidc\.Server\.Common\.UseDPoPNonceError\.Nonce') value travels out through the response formatter as the `DPoP-Nonce` HTTP header alongside the standard error envelope \- the body shape stays `{error, error_description}`; the nonce rides on a header, not in the JSON\. ```csharp public sealed record UseDPoPNonceError : Abblix.Oidc.Server.Common.OidcError, System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') → UseDPoPNonceError Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[UseDPoPNonceError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.UseDPoPNonceError 'Abblix\.Oidc\.Server\.Common\.UseDPoPNonceError')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Constructors ## UseDPoPNonceError\(string\) Constructor {#Abblix.Oidc.Server.Common.UseDPoPNonceError.UseDPoPNonceError(string)} Subtype of [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') that signals an RFC 9449 §8 nonce\-challenge: the DPoP proof either omitted the `nonce` claim or carried a stale one, and the server is responding with `use_dpop_nonce` plus a fresh nonce the client must echo on the next attempt\. The carried [Nonce](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.UseDPoPNonceError#Abblix.Oidc.Server.Common.UseDPoPNonceError.Nonce 'Abblix\.Oidc\.Server\.Common\.UseDPoPNonceError\.Nonce') value travels out through the response formatter as the `DPoP-Nonce` HTTP header alongside the standard error envelope \- the body shape stays `{error, error_description}`; the nonce rides on a header, not in the JSON\. ```csharp public UseDPoPNonceError(string Nonce); ``` #### Parameters ###### `Nonce` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Common.UseDPoPNonceError.UseDPoPNonceError(string).Nonce} The fresh nonce the client should attach to the next DPoP proof\. ### Properties ## UseDPoPNonceError\.Nonce Property {#Abblix.Oidc.Server.Common.UseDPoPNonceError.Nonce} The fresh nonce the client should attach to the next DPoP proof\. ```csharp public string Nonce { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.WwwAuthenticateBuilder.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common 'Abblix\.Oidc\.Server\.Common') ## WwwAuthenticateBuilder Class Builds `WWW-Authenticate` challenge values for the Bearer scheme \(RFC 6750 §3\) and the DPoP scheme \(RFC 9449 §7\.1\)\. Endpoint\-agnostic and framework\-agnostic so the same emission logic serves UserInfo, introspection, revocation, and any future protected endpoint, regardless of whether the host is ASP\.NET Core MVC, minimal APIs, or another framework altogether\. ```csharp public static class WwwAuthenticateBuilder ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → WwwAuthenticateBuilder ### Remarks The Bearer challenge attaches `error` / `error_description` when the inbound failure is in fact a Bearer\-token failure \(`invalid_token`, `insufficient_scope`\)\. When the failure is a DPoP\-specific error and Bearer is advertised alongside DPoP, the Bearer line carries only the realm \- RFC 9449 §7\.1 example: «the Bearer scheme didn't fail; the client used the DPoP scheme», so attaching `error="invalid_dpop_proof"` to the Bearer line would be misleading\. ### Methods ## WwwAuthenticateBuilder\.BuildBasicChallenge\(string\) Method {#Abblix.Oidc.Server.Common.WwwAuthenticateBuilder.BuildBasicChallenge(string)} Builds a `WWW-Authenticate: Basic` challenge per RFC 7617 §2 for client\-authentication failures \(RFC 6749 §5\.2\)\. Only the realm parameter is emitted: unlike Bearer \(RFC 6750 §3\), the Basic scheme defines no error attributes, so the error itself stays in the JSON body\. ```csharp public static string BuildBasicChallenge(string? realm); ``` #### Parameters ###### `realm` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Common.WwwAuthenticateBuilder.BuildBasicChallenge(string).realm} #### Returns [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## WwwAuthenticateBuilder\.BuildBearerChallenge\(OidcError, string, bool\) Method {#Abblix.Oidc.Server.Common.WwwAuthenticateBuilder.BuildBearerChallenge(Abblix.Oidc.Server.Common.OidcError,string,bool)} Builds a `WWW-Authenticate: Bearer` challenge per RFC 6750 §3\. The `error` and `error_description` attributes are emitted only when the inbound failure is a Bearer\-scheme failure; pass [includeError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.WwwAuthenticateBuilder#Abblix.Oidc.Server.Common.WwwAuthenticateBuilder.BuildBearerChallenge(Abblix.Oidc.Server.Common.OidcError,string,bool).includeError 'Abblix\.Oidc\.Server\.Common\.WwwAuthenticateBuilder\.BuildBearerChallenge\(Abblix\.Oidc\.Server\.Common\.OidcError, string, bool\)\.includeError') as `false` for dual\-scheme responses where the Bearer line is informational\. ```csharp public static string BuildBearerChallenge(Abblix.Oidc.Server.Common.OidcError error, string? realm, bool includeError=true); ``` #### Parameters ###### `error` [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') {#Abblix.Oidc.Server.Common.WwwAuthenticateBuilder.BuildBearerChallenge(Abblix.Oidc.Server.Common.OidcError,string,bool).error} ###### `realm` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Common.WwwAuthenticateBuilder.BuildBearerChallenge(Abblix.Oidc.Server.Common.OidcError,string,bool).realm} ###### `includeError` [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') {#Abblix.Oidc.Server.Common.WwwAuthenticateBuilder.BuildBearerChallenge(Abblix.Oidc.Server.Common.OidcError,string,bool).includeError} #### Returns [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## WwwAuthenticateBuilder\.BuildChallenges\(OidcError, string, IEnumerable\, bool\) Method {#Abblix.Oidc.Server.Common.WwwAuthenticateBuilder.BuildChallenges(Abblix.Oidc.Server.Common.OidcError,string,System.Collections.Generic.IEnumerable_string_,bool)} Builds the full set of `WWW-Authenticate` challenge lines for an error response\. Returns DPoP first, Bearer second \(matching the RFC 9449 §7\.1 example ordering\) when both schemes are advertised\. ```csharp public static System.Collections.Generic.IReadOnlyList BuildChallenges(Abblix.Oidc.Server.Common.OidcError error, string? realm, System.Collections.Generic.IEnumerable dpopAlgs, bool advertiseBearer); ``` #### Parameters ###### `error` [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') {#Abblix.Oidc.Server.Common.WwwAuthenticateBuilder.BuildChallenges(Abblix.Oidc.Server.Common.OidcError,string,System.Collections.Generic.IEnumerable_string_,bool).error} ###### `realm` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Common.WwwAuthenticateBuilder.BuildChallenges(Abblix.Oidc.Server.Common.OidcError,string,System.Collections.Generic.IEnumerable_string_,bool).realm} ###### `dpopAlgs` [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') {#Abblix.Oidc.Server.Common.WwwAuthenticateBuilder.BuildChallenges(Abblix.Oidc.Server.Common.OidcError,string,System.Collections.Generic.IEnumerable_string_,bool).dpopAlgs} ###### `advertiseBearer` [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') {#Abblix.Oidc.Server.Common.WwwAuthenticateBuilder.BuildChallenges(Abblix.Oidc.Server.Common.OidcError,string,System.Collections.Generic.IEnumerable_string_,bool).advertiseBearer} #### Returns [System\.Collections\.Generic\.IReadOnlyList<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ireadonlylist-1 'System\.Collections\.Generic\.IReadOnlyList\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ireadonlylist-1 'System\.Collections\.Generic\.IReadOnlyList\`1') ## WwwAuthenticateBuilder\.BuildDPoPChallenge\(OidcError, string, IEnumerable\\) Method {#Abblix.Oidc.Server.Common.WwwAuthenticateBuilder.BuildDPoPChallenge(Abblix.Oidc.Server.Common.OidcError,string,System.Collections.Generic.IEnumerable_string_)} Builds a `WWW-Authenticate: DPoP` challenge per RFC 9449 §7\.1, advertising the JWS algorithms the AS accepts on a proof\. ```csharp public static string BuildDPoPChallenge(Abblix.Oidc.Server.Common.OidcError error, string? realm, System.Collections.Generic.IEnumerable algs); ``` #### Parameters ###### `error` [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') {#Abblix.Oidc.Server.Common.WwwAuthenticateBuilder.BuildDPoPChallenge(Abblix.Oidc.Server.Common.OidcError,string,System.Collections.Generic.IEnumerable_string_).error} ###### `realm` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Common.WwwAuthenticateBuilder.BuildDPoPChallenge(Abblix.Oidc.Server.Common.OidcError,string,System.Collections.Generic.IEnumerable_string_).realm} ###### `algs` [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') {#Abblix.Oidc.Server.Common.WwwAuthenticateBuilder.BuildDPoPChallenge(Abblix.Oidc.Server.Common.OidcError,string,System.Collections.Generic.IEnumerable_string_).algs} #### Returns [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ## Abblix\.Oidc\.Server\.Common\.Configuration Namespace | Classes | | | :--- | :--- | | [BackChannelAuthenticationOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.BackChannelAuthenticationOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.BackChannelAuthenticationOptions') | Provides configuration options for the backchannel authentication process\. | | [BackChannelLogoutOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.BackChannelLogoutOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.BackChannelLogoutOptions') | Back\-channel logout settings for a single client, as defined by the OpenID Connect Back\-Channel Logout 1\.0 specification\. The OP delivers a signed logout token directly \(server\-to\-server\) to the configured endpoint when an end\-session occurs, bypassing the user agent\. | | [CheckSessionCookieOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.CheckSessionCookieOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.CheckSessionCookieOptions') | Defines options for the session check cookie used in monitoring changes in session status\. | | [ClientIdOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.ClientIdOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.ClientIdOptions') | Represents options for generating client IDs\. | | [ClientJwksConfigurationExtensions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.ClientJwksConfigurationExtensions 'Abblix\.Oidc\.Server\.Common\.Configuration\.ClientJwksConfigurationExtensions') | Configuration\-time extensions that populate [Jwks](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.Jwks 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo\.Jwks') from raw configuration sections by binding into [JsonWebKeySetSettings](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.JsonWebKeySetSettings 'Abblix\.Oidc\.Server\.Common\.Configuration\.JsonWebKeySetSettings') \(a flat DTO that [Microsoft\.Extensions\.Configuration](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.configuration 'Microsoft\.Extensions\.Configuration') can handle natively\) and mapping to the polymorphic [JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey') hierarchy\. | | [ClientSecretOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.ClientSecretOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.ClientSecretOptions') | Configuration options for generating client secrets in OAuth2/OpenID Connect authentication\. | | [ClientSecretsOptionsValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.ClientSecretsOptionsValidator 'Abblix\.Oidc\.Server\.Common\.Configuration\.ClientSecretsOptionsValidator') | Fails loudly at startup when a configured client cannot authenticate with the secret it appears to carry, instead of answering `invalid_client` to every request it ever makes\. | | [ClockSkewCeilingValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.ClockSkewCeilingValidator 'Abblix\.Oidc\.Server\.Common\.Configuration\.ClockSkewCeilingValidator') | Refuses a configured clock skew the validator would not honour, while the host is still starting \- and only where a profile puts a bound on it at all\. | | [DefaultResourceIndicatorValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.DefaultResourceIndicatorValidator 'Abblix\.Oidc\.Server\.Common\.Configuration\.DefaultResourceIndicatorValidator') | Refuses at startup a [DefaultResourceIndicator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions#Abblix.Oidc.Server.Common.Configuration.OidcOptions.DefaultResourceIndicator 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions\.DefaultResourceIndicator') that would put an unusable value in every access token's `aud` claim\. | | [DeviceAuthorizationOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.DeviceAuthorizationOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.DeviceAuthorizationOptions') | Provides configuration options for the Device Authorization Grant \(RFC 8628\)\. | | [DiscoveryOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.DiscoveryOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.DiscoveryOptions') | Defines discovery endpoint options\. | | [DPoPNonceOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.DPoPNonceOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.DPoPNonceOptions') | DPoP\-specific extension of [NonceOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Nonces.NonceOptions 'Abblix\.Oidc\.Server\.Features\.Nonces\.NonceOptions') per RFC 9449 §8\. Inherits the generic primitive's `AcceptanceWindow` and `RotationInterval` so DPoP can override them independently of any other nonce\-service consumer, and adds the per\-endpoint policy that says which OAuth endpoints reject DPoP proofs without a `nonce` claim \(responding with `use_dpop_nonce` and a fresh `DPoP-Nonce` header\)\. | | [DPoPOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.DPoPOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.DPoPOptions') | Configuration options for OAuth 2\.0 DPoP \(RFC 9449\), covering the proof validator's `iat` tolerance and DPoP\-specific nonce policy\. The nonce sub\-section inherits from the generic [NonceOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Nonces.NonceOptions 'Abblix\.Oidc\.Server\.Features\.Nonces\.NonceOptions') so DPoP can configure stricter values independently of other nonce\-service consumers without duplicating field definitions\. | | [FrontChannelLogoutOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.FrontChannelLogoutOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.FrontChannelLogoutOptions') | Front\-channel logout settings for a single client, as defined by the OpenID Connect Front\-Channel Logout 1\.0 specification\. Tells the authorization server which URL to load in a hidden iframe during end\-session processing and whether the iframe URL must carry the user's session identifier\. | | [JsonWebKeySetSettings](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.JsonWebKeySetSettings 'Abblix\.Oidc\.Server\.Common\.Configuration\.JsonWebKeySetSettings') | Flat configuration DTO for a [JsonWebKeySet](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKeySet 'Abblix\.Jwt\.JsonWebKeySet'), mirroring RFC 7517 Section 5 \(a JSON object with a single `keys` array\)\. See [JsonWebKeySettings](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.JsonWebKeySettings 'Abblix\.Oidc\.Server\.Common\.Configuration\.JsonWebKeySettings') for the per\-key DTO and the design rationale\. | | [JsonWebKeySettings](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.JsonWebKeySettings 'Abblix\.Oidc\.Server\.Common\.Configuration\.JsonWebKeySettings') | Flat configuration DTO for a single JSON Web Key, suitable for binding via `Microsoft.Extensions.Configuration` which cannot instantiate the abstract [JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey') base type directly\. All cryptographic byte\-array members are bound as base64url\-encoded strings per RFC 7517; [ToJsonWebKey\(\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.JsonWebKeySettings#Abblix.Oidc.Server.Common.Configuration.JsonWebKeySettings.ToJsonWebKey() 'Abblix\.Oidc\.Server\.Common\.Configuration\.JsonWebKeySettings\.ToJsonWebKey\(\)') decodes them and maps the flat shape to the correct concrete subtype based on [Kty](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.JsonWebKeySettings#Abblix.Oidc.Server.Common.Configuration.JsonWebKeySettings.Kty 'Abblix\.Oidc\.Server\.Common\.Configuration\.JsonWebKeySettings\.Kty')\. | | [JwtBearerOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.JwtBearerOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.JwtBearerOptions') | Configuration options for JWT Bearer grant type \(RFC 7523\)\. Defines trusted external identity providers whose JWT assertions can be exchanged for access tokens\. | | [JwtEncryptionSettings](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.JwtEncryptionSettings 'Abblix\.Oidc\.Server\.Common\.Configuration\.JwtEncryptionSettings') | How a JWT the authorization server issues for itself is encrypted\. Reused, one instance per service token type\. Whether the token is encrypted at all is governed by [Encrypt](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.ServiceTokenOptions#Abblix.Oidc.Server.Common.Configuration.ServiceTokenOptions.Encrypt 'Abblix\.Oidc\.Server\.Common\.Configuration\.ServiceTokenOptions\.Encrypt'); this block only selects the key\-management algorithm and key used when it is\. | | [JwtSigningSettings](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.JwtSigningSettings 'Abblix\.Oidc\.Server\.Common\.Configuration\.JwtSigningSettings') | The signing settings for a JWT the authorization server issues for itself\. Reused, one instance per service token type, so each type carries its own explicit JWS `alg` and signing\-key selection instead of the previously hardcoded RS256\. | | [MtlsAliasesOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.MtlsAliasesOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.MtlsAliasesOptions') | Options for RFC 8705 mTLS endpoint aliases in discovery\. Allows explicitly setting alias URIs\. Use DiscoveryOptions\.MtlsBaseUri to auto\-compute aliases\. | | [NewClientOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.NewClientOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.NewClientOptions') | Defaults used by the dynamic client registration endpoint when minting credentials for a newly registered client: how its client identifier and client secret are generated and how long the secret stays valid\. | | [OidcOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions') | The root of the OIDC configuration\. Provides the simplest way to configure and start your OIDC server\. | | [RegistrationRequestSizeValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.RegistrationRequestSizeValidator 'Abblix\.Oidc\.Server\.Common\.Configuration\.RegistrationRequestSizeValidator') | Refuses at startup a [MaxRegistrationRequestSize](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions#Abblix.Oidc.Server.Common.Configuration.OidcOptions.MaxRegistrationRequestSize 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions\.MaxRegistrationRequestSize') that no request could satisfy\. | | [RevocationRetentionOptionsValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.RevocationRetentionOptionsValidator 'Abblix\.Oidc\.Server\.Common\.Configuration\.RevocationRetentionOptionsValidator') | Fails at startup on a revocation setting that would let a revocation report success and do nothing\. | | [SecretLengthOptionsValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.SecretLengthOptionsValidator 'Abblix\.Oidc\.Server\.Common\.Configuration\.SecretLengthOptionsValidator') | Fails loudly at startup when a configured secret\-bearing length is below the security floor for its kind, instead of silently generating a guessable client secret, authorization code or identifier at runtime\. Every shipped default is already at or above these floors, so a valid configuration is unaffected; the validator only rejects a deliberately shortened value\. | | [ServiceTokenOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.ServiceTokenOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.ServiceTokenOptions') | The signing and encryption settings for one type of JWT the authorization server issues for itself \(access, refresh, registration access or initial access token\)\. The same shape is reused for every type via [ServiceTokensOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.ServiceTokensOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.ServiceTokensOptions')\. | | [ServiceTokensAlgorithmsValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.ServiceTokensAlgorithmsValidator 'Abblix\.Oidc\.Server\.Common\.Configuration\.ServiceTokensAlgorithmsValidator') | Fails loudly at startup when a configured [ServiceTokensOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.ServiceTokensOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.ServiceTokensOptions') names a signing or key\-management algorithm that no registered signer or encryptor can produce, instead of letting the contradiction surface at token\-issuance time as a per\-request failure\. The accepted sets are read from the live JWT registrations, the same union OpenID Connect discovery advertises, so a host that adds or replaces an algorithm is validated against exactly what it registered \- no static allow\-list to keep in sync\. | | [ServiceTokensOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.ServiceTokensOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.ServiceTokensOptions') | The per\-type signing and encryption settings for the four JWTs the authorization server issues for itself\. Grouping the four here keeps them together and avoids a name clash with the per\-client [RefreshToken](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.RefreshToken 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo\.RefreshToken') \(which governs lifetime and reuse, a different concern\)\. Each token type signs with RS256 and, when a server encryption key is configured, is encrypted to it by default, as in prior versions; a host disables encryption for a specific type by setting that type's [Encrypt](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.ServiceTokenOptions#Abblix.Oidc.Server.Common.Configuration.ServiceTokenOptions.Encrypt 'Abblix\.Oidc\.Server\.Common\.Configuration\.ServiceTokenOptions\.Encrypt') to `false`\. | | [SoftwareStatementOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.SoftwareStatementOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.SoftwareStatementOptions') | Configuration options for software statement validation per RFC 7591 Section 2\.3\. Software statements are signed JWTs issued by a third\-party authority asserting metadata values about the client software\. | | [TrustedIssuer](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.TrustedIssuer 'Abblix\.Oidc\.Server\.Common\.Configuration\.TrustedIssuer') | Represents a trusted external identity provider for JWT Bearer grant type\. | | Structs | | | :--- | :--- | | [RefreshTokenOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.RefreshTokenOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.RefreshTokenOptions') | Lifetime and reuse policy for refresh tokens issued by the token endpoint\. Combines an absolute ceiling with an optional sliding window so long\-running sessions stay alive only while the client keeps using them\. | | Enums | | | :--- | :--- | | [OidcEndpoints](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcEndpoints 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcEndpoints') | Flags representing the various OpenID Connect \(OIDC\) endpoints that the provider can expose\. These flags enable fine\-grained control over which endpoints are enabled or disabled\. | --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.BackChannelAuthenticationOptions.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common\.Configuration](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration 'Abblix\.Oidc\.Server\.Common\.Configuration') ## BackChannelAuthenticationOptions Class Provides configuration options for the backchannel authentication process\. ```csharp public record BackChannelAuthenticationOptions : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → BackChannelAuthenticationOptions Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[BackChannelAuthenticationOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.BackChannelAuthenticationOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.BackChannelAuthenticationOptions')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Fields ## BackChannelAuthenticationOptions\.MinimumRequestIdLength Field {#Abblix.Oidc.Server.Common.Configuration.BackChannelAuthenticationOptions.MinimumRequestIdLength} Minimum length for authentication request identifiers as required by CIBA specification \(128 bits = 16 bytes\)\. ```csharp public const int MinimumRequestIdLength = 16; ``` #### Field Value [System\.Int32](https://learn.microsoft.com/en-us/dotnet/api/system.int32 'System\.Int32') ### Properties ## BackChannelAuthenticationOptions\.DefaultExpiry Property {#Abblix.Oidc.Server.Common.Configuration.BackChannelAuthenticationOptions.DefaultExpiry} Specifies the default expiration time for backchannel authentication requests\. This value defines how long the authentication request will remain valid if no specific expiration time is requested\. It is set to 5 minutes by default\. ```csharp public System.TimeSpan DefaultExpiry { get; set; } ``` #### Property Value [System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan') ## BackChannelAuthenticationOptions\.LongPollingTimeout Property {#Abblix.Oidc.Server.Common.Configuration.BackChannelAuthenticationOptions.LongPollingTimeout} Specifies the maximum time a long\-polling request will wait for authentication status changes\. This timeout balances responsiveness \(shorter timeout\) vs server load \(longer timeout\)\. Default is 30 seconds\. ```csharp public System.TimeSpan LongPollingTimeout { get; set; } ``` #### Property Value [System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan') ### Remarks When a client polls for tokens while authentication is pending and long\-polling is enabled, the server holds the connection open for up to this duration\. If authentication completes during this window, the response is returned immediately\. Otherwise, authorization\_pending is returned after the timeout\. ## BackChannelAuthenticationOptions\.MaximumExpiry Property {#Abblix.Oidc.Server.Common.Configuration.BackChannelAuthenticationOptions.MaximumExpiry} Specifies the maximum allowed expiration time for backchannel authentication requests\. This value restricts the maximum duration an authentication request can be valid for, even if a longer expiration is requested\. It is set to 30 minutes by default\. ```csharp public System.TimeSpan MaximumExpiry { get; set; } ``` #### Property Value [System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan') ## BackChannelAuthenticationOptions\.NotificationHttpClientHandlerLifetime Property {#Abblix.Oidc.Server.Common.Configuration.BackChannelAuthenticationOptions.NotificationHttpClientHandlerLifetime} Specifies the lifetime for HTTP client handlers used in ping mode notifications\. This controls how long HttpClient instances are pooled before being recreated\. ```csharp public System.TimeSpan NotificationHttpClientHandlerLifetime { get; set; } ``` #### Property Value [System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan') ### Remarks Default is 5 minutes\. Shorter lifetimes help with DNS changes and connection pool refresh, but may impact performance\. Longer lifetimes reduce overhead but may cause stale connections\. ## BackChannelAuthenticationOptions\.NotificationHttpClientTimeout Property {#Abblix.Oidc.Server.Common.Configuration.BackChannelAuthenticationOptions.NotificationHttpClientTimeout} Bounds how long the server waits when POSTing a ping/push notification to a client's notification endpoint\. Caps the time a slow or unresponsive client\-controlled endpoint can tie up the authentication\-completion path\. Default is 30 seconds\. ```csharp public System.TimeSpan NotificationHttpClientTimeout { get; set; } ``` #### Property Value [System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan') ## BackChannelAuthenticationOptions\.PollingInterval Property {#Abblix.Oidc.Server.Common.Configuration.BackChannelAuthenticationOptions.PollingInterval} Defines the polling interval used by clients to check the status of a backchannel authentication request\. It is set to 5 seconds by default, ensuring that clients can frequently check for authentication updates without overwhelming the server\. ```csharp public System.TimeSpan PollingInterval { get; set; } ``` #### Property Value [System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan') ## BackChannelAuthenticationOptions\.RequestIdLength Property {#Abblix.Oidc.Server.Common.Configuration.BackChannelAuthenticationOptions.RequestIdLength} Specifies the length of authentication request identifiers used by the OIDC server\. This value ensures that each backchannel authentication request is uniquely identified\. Per CIBA specification, the auth\_req\_id MUST have a minimum entropy of 128 bits \(16 bytes\)\. ```csharp public int RequestIdLength { get; init; } ``` #### Property Value [System\.Int32](https://learn.microsoft.com/en-us/dotnet/api/system.int32 'System\.Int32') ### Remarks The minimum value is 16 bytes \(128 bits\) as required by OpenID Connect CIBA specification\. Default is 64 bytes \(512 bits\) for enhanced security\. ## BackChannelAuthenticationOptions\.UseLongPolling Property {#Abblix.Oidc.Server.Common.Configuration.BackChannelAuthenticationOptions.UseLongPolling} Indicates whether long polling is used for backchannel authentication status updates\. When set to true, clients may use long polling techniques to wait for authentication status changes, which reduces the need for frequent polling requests\. ```csharp public bool UseLongPolling { get; set; } ``` #### Property Value [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') ## BackChannelAuthenticationOptions\.UserCodeParameterSupported Property {#Abblix.Oidc.Server.Common.Configuration.BackChannelAuthenticationOptions.UserCodeParameterSupported} Indicates whether the server supports the user\_code parameter in backchannel authentication requests\. When enabled, clients may provide a user code that must be validated during authentication\. ```csharp public bool UserCodeParameterSupported { get; set; } ``` #### Property Value [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') ### Remarks This is an optional CIBA feature\. When enabled, the UserCodeValidator will enforce user code presence for clients configured to require it\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.BackChannelLogoutOptions.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common\.Configuration](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration 'Abblix\.Oidc\.Server\.Common\.Configuration') ## BackChannelLogoutOptions Class Back\-channel logout settings for a single client, as defined by the OpenID Connect Back\-Channel Logout 1\.0 specification\. The OP delivers a signed logout token directly \(server\-to\-server\) to the configured endpoint when an end\-session occurs, bypassing the user agent\. ```csharp public record BackChannelLogoutOptions : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → BackChannelLogoutOptions Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[BackChannelLogoutOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.BackChannelLogoutOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.BackChannelLogoutOptions')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Constructors ## BackChannelLogoutOptions\(Uri, bool\) Constructor {#Abblix.Oidc.Server.Common.Configuration.BackChannelLogoutOptions.BackChannelLogoutOptions(System.Uri,bool)} Back\-channel logout settings for a single client, as defined by the OpenID Connect Back\-Channel Logout 1\.0 specification\. The OP delivers a signed logout token directly \(server\-to\-server\) to the configured endpoint when an end\-session occurs, bypassing the user agent\. ```csharp public BackChannelLogoutOptions(System.Uri Uri, bool RequiresSessionId=true); ``` #### Parameters ###### `Uri` [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri') {#Abblix.Oidc.Server.Common.Configuration.BackChannelLogoutOptions.BackChannelLogoutOptions(System.Uri,bool).Uri} The client's back\-channel logout endpoint that receives the logout token\. ###### `RequiresSessionId` [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') {#Abblix.Oidc.Server.Common.Configuration.BackChannelLogoutOptions.BackChannelLogoutOptions(System.Uri,bool).RequiresSessionId} When `true`, the logout token must include the `sid` claim so the client can scope the invalidation to a specific session\. ### Properties ## BackChannelLogoutOptions\.LogoutTokenExpiresIn Property {#Abblix.Oidc.Server.Common.Configuration.BackChannelLogoutOptions.LogoutTokenExpiresIn} Lifetime of the issued logout token\. Kept short to limit the replay window for the token, since back\-channel logout tokens cross the network as bearer credentials\. ```csharp public System.TimeSpan LogoutTokenExpiresIn { get; set; } ``` #### Property Value [System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan') ## BackChannelLogoutOptions\.RequiresSessionId Property {#Abblix.Oidc.Server.Common.Configuration.BackChannelLogoutOptions.RequiresSessionId} When `true`, the issued logout token must carry the `sid` claim so the client can invalidate the matching session rather than every session of the user\. ```csharp public bool RequiresSessionId { get; init; } ``` #### Property Value [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') ## BackChannelLogoutOptions\.Uri Property {#Abblix.Oidc.Server.Common.Configuration.BackChannelLogoutOptions.Uri} The client's back\-channel logout endpoint that receives the signed logout token\. ```csharp public System.Uri Uri { get; init; } ``` #### Property Value [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.CheckSessionCookieOptions.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common\.Configuration](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration 'Abblix\.Oidc\.Server\.Common\.Configuration') ## CheckSessionCookieOptions Class Defines options for the session check cookie used in monitoring changes in session status\. ```csharp public record CheckSessionCookieOptions : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → CheckSessionCookieOptions Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[CheckSessionCookieOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.CheckSessionCookieOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.CheckSessionCookieOptions')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Properties ## CheckSessionCookieOptions\.Domain Property {#Abblix.Oidc.Server.Common.Configuration.CheckSessionCookieOptions.Domain} The domain name where the cookie is available\. Specifying the domain restricts where the cookie is sent\. Leaving this value null means the cookie is sent to all subdomains\. ```csharp public string? Domain { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## CheckSessionCookieOptions\.Name Property {#Abblix.Oidc.Server.Common.Configuration.CheckSessionCookieOptions.Name} The name of the cookie used to monitor session status changes\. The default value is "Abblix\.SessionId"\. ```csharp public string Name { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## CheckSessionCookieOptions\.Path Property {#Abblix.Oidc.Server.Common.Configuration.CheckSessionCookieOptions.Path} The path for the cookie\. Can be set to the check\_session\_iframe endpoint path \(e\.g\., "/connect/checksession"\) to ensure the cookie is only sent to that endpoint, or left as "/" for broader availability\. The default value is "/" \(root path\)\. ```csharp public string Path { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## CheckSessionCookieOptions\.SameSite Property {#Abblix.Oidc.Server.Common.Configuration.CheckSessionCookieOptions.SameSite} The SameSite attribute for the cookie which asserts that a cookie must not be sent with cross\-origin requests, providing some protection against cross\-site request forgery attacks \(CSRF\)\. The default value is "None", which permits the cookie to be sent with cross\-site requests\. Valid options are "None", "Lax", and "Strict"\. Note: For OpenID Connect Session Management to work in modern browsers, SameSite must be "None" to allow the cookie to be accessed from the check\_session\_iframe running in cross\-origin context\. ```csharp public string SameSite { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.ClientIdOptions.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common\.Configuration](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration 'Abblix\.Oidc\.Server\.Common\.Configuration') ## ClientIdOptions Class Represents options for generating client IDs\. ```csharp public record ClientIdOptions : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ClientIdOptions Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[ClientIdOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.ClientIdOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.ClientIdOptions')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Properties ## ClientIdOptions\.Length Property {#Abblix.Oidc.Server.Common.Configuration.ClientIdOptions.Length} The length of the generated client ID\. ```csharp public int Length { get; init; } ``` #### Property Value [System\.Int32](https://learn.microsoft.com/en-us/dotnet/api/system.int32 'System\.Int32') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.ClientJwksConfigurationExtensions.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common\.Configuration](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration 'Abblix\.Oidc\.Server\.Common\.Configuration') ## ClientJwksConfigurationExtensions Class Configuration\-time extensions that populate [Jwks](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.Jwks 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo\.Jwks') from raw configuration sections by binding into [JsonWebKeySetSettings](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.JsonWebKeySetSettings 'Abblix\.Oidc\.Server\.Common\.Configuration\.JsonWebKeySetSettings') \(a flat DTO that [Microsoft\.Extensions\.Configuration](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.configuration 'Microsoft\.Extensions\.Configuration') can handle natively\) and mapping to the polymorphic [JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey') hierarchy\. ```csharp public static class ClientJwksConfigurationExtensions ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ClientJwksConfigurationExtensions ### Remarks The same primitive is exposed at two layers so the host can apply the fix as close to the source binding as practical: - `settings.Clients.WithJwksFromConfiguration(section)` - eager, runs right after `configuration.Get()`, so every later consumer of `settings.Clients` sees populated `Jwks`. - `options.AddClientJwksFromConfiguration(section)` - convenience inside the `AddOidcServices` options lambda, equivalent to mutating `options.Clients` through `WithJwksFromConfiguration`. ### Methods ## ClientJwksConfigurationExtensions\.AddClientJwksFromConfiguration\(this OidcOptions, IConfigurationSection\) Method {#Abblix.Oidc.Server.Common.Configuration.ClientJwksConfigurationExtensions.AddClientJwksFromConfiguration(thisAbblix.Oidc.Server.Common.Configuration.OidcOptions,Microsoft.Extensions.Configuration.IConfigurationSection)} Convenience wrapper for use inside the `AddOidcServices` options lambda: equivalent to `options.Clients = options.Clients.WithJwksFromConfiguration(section)`\. ```csharp public static void AddClientJwksFromConfiguration(this Abblix.Oidc.Server.Common.Configuration.OidcOptions options, Microsoft.Extensions.Configuration.IConfigurationSection clientsSection); ``` #### Parameters ###### `options` [OidcOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions') {#Abblix.Oidc.Server.Common.Configuration.ClientJwksConfigurationExtensions.AddClientJwksFromConfiguration(thisAbblix.Oidc.Server.Common.Configuration.OidcOptions,Microsoft.Extensions.Configuration.IConfigurationSection).options} ###### `clientsSection` [Microsoft\.Extensions\.Configuration\.IConfigurationSection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.configuration.iconfigurationsection 'Microsoft\.Extensions\.Configuration\.IConfigurationSection') {#Abblix.Oidc.Server.Common.Configuration.ClientJwksConfigurationExtensions.AddClientJwksFromConfiguration(thisAbblix.Oidc.Server.Common.Configuration.OidcOptions,Microsoft.Extensions.Configuration.IConfigurationSection).clientsSection} ## ClientJwksConfigurationExtensions\.WithJwksFromConfiguration\\(this IEnumerable\, IConfigurationSection\) Method {#Abblix.Oidc.Server.Common.Configuration.ClientJwksConfigurationExtensions.WithJwksFromConfiguration_T_(thisSystem.Collections.Generic.IEnumerable_T_,Microsoft.Extensions.Configuration.IConfigurationSection)} Returns the same client collection with [Jwks](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.Jwks 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo\.Jwks') populated for each entry whose configuration counterpart includes an inline `Jwks` sub\-section\. Mutates in place when the input is already a [T](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.ClientJwksConfigurationExtensions#Abblix.Oidc.Server.Common.Configuration.ClientJwksConfigurationExtensions.WithJwksFromConfiguration_T_(thisSystem.Collections.Generic.IEnumerable_T_,Microsoft.Extensions.Configuration.IConfigurationSection).T 'Abblix\.Oidc\.Server\.Common\.Configuration\.ClientJwksConfigurationExtensions\.WithJwksFromConfiguration\\(this System\.Collections\.Generic\.IEnumerable\, Microsoft\.Extensions\.Configuration\.IConfigurationSection\)\.T') array; otherwise materialises a fresh array\. ```csharp public static T[] WithJwksFromConfiguration(this System.Collections.Generic.IEnumerable clients, Microsoft.Extensions.Configuration.IConfigurationSection clientsSection) where T : Abblix.Oidc.Server.Features.ClientInformation.ClientInfo; ``` #### Type parameters ###### `T` {#Abblix.Oidc.Server.Common.Configuration.ClientJwksConfigurationExtensions.WithJwksFromConfiguration_T_(thisSystem.Collections.Generic.IEnumerable_T_,Microsoft.Extensions.Configuration.IConfigurationSection).T} A concrete client type \- either [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') directly or a host\-supplied derived type \(e\.g\. carrying app\-specific metadata\)\. The return type preserves [T](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.ClientJwksConfigurationExtensions#Abblix.Oidc.Server.Common.Configuration.ClientJwksConfigurationExtensions.WithJwksFromConfiguration_T_(thisSystem.Collections.Generic.IEnumerable_T_,Microsoft.Extensions.Configuration.IConfigurationSection).T 'Abblix\.Oidc\.Server\.Common\.Configuration\.ClientJwksConfigurationExtensions\.WithJwksFromConfiguration\\(this System\.Collections\.Generic\.IEnumerable\, Microsoft\.Extensions\.Configuration\.IConfigurationSection\)\.T') so the host can assign the result back to its own strongly\-typed `Clients` array without casting\. #### Parameters ###### `clients` [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[T](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.ClientJwksConfigurationExtensions#Abblix.Oidc.Server.Common.Configuration.ClientJwksConfigurationExtensions.WithJwksFromConfiguration_T_(thisSystem.Collections.Generic.IEnumerable_T_,Microsoft.Extensions.Configuration.IConfigurationSection).T 'Abblix\.Oidc\.Server\.Common\.Configuration\.ClientJwksConfigurationExtensions\.WithJwksFromConfiguration\\(this System\.Collections\.Generic\.IEnumerable\, Microsoft\.Extensions\.Configuration\.IConfigurationSection\)\.T')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') {#Abblix.Oidc.Server.Common.Configuration.ClientJwksConfigurationExtensions.WithJwksFromConfiguration_T_(thisSystem.Collections.Generic.IEnumerable_T_,Microsoft.Extensions.Configuration.IConfigurationSection).clients} The clients whose `Jwks` should be populated\. ###### `clientsSection` [Microsoft\.Extensions\.Configuration\.IConfigurationSection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.configuration.iconfigurationsection 'Microsoft\.Extensions\.Configuration\.IConfigurationSection') {#Abblix.Oidc.Server.Common.Configuration.ClientJwksConfigurationExtensions.WithJwksFromConfiguration_T_(thisSystem.Collections.Generic.IEnumerable_T_,Microsoft.Extensions.Configuration.IConfigurationSection).clientsSection} The configuration section that holds the Clients tree \- typically `configuration.GetSection("Clients")`\. #### Returns [T](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.ClientJwksConfigurationExtensions#Abblix.Oidc.Server.Common.Configuration.ClientJwksConfigurationExtensions.WithJwksFromConfiguration_T_(thisSystem.Collections.Generic.IEnumerable_T_,Microsoft.Extensions.Configuration.IConfigurationSection).T 'Abblix\.Oidc\.Server\.Common\.Configuration\.ClientJwksConfigurationExtensions\.WithJwksFromConfiguration\\(this System\.Collections\.Generic\.IEnumerable\, Microsoft\.Extensions\.Configuration\.IConfigurationSection\)\.T')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') The same clients \(as an array\) with any newly populated `Jwks`\. #### Exceptions [System\.InvalidOperationException](https://learn.microsoft.com/en-us/dotnet/api/system.invalidoperationexception 'System\.InvalidOperationException') A `Jwks` sub\-section contains a key with a missing or unsupported `kty` discriminator\. [System\.FormatException](https://learn.microsoft.com/en-us/dotnet/api/system.formatexception 'System\.FormatException') A byte\-array member of a JWK is not valid base64url\. ### Remarks Per-client self-correcting: an entry whose [Jwks](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.Jwks 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo\.Jwks') is already non-null (because the host populated it programmatically or a future TFM's binder gained native polymorphic support) is skipped. Configuration entries without a matching `ClientId` in [clients](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.ClientJwksConfigurationExtensions#Abblix.Oidc.Server.Common.Configuration.ClientJwksConfigurationExtensions.WithJwksFromConfiguration_T_(thisSystem.Collections.Generic.IEnumerable_T_,Microsoft.Extensions.Configuration.IConfigurationSection).clients 'Abblix\.Oidc\.Server\.Common\.Configuration\.ClientJwksConfigurationExtensions\.WithJwksFromConfiguration\\(this System\.Collections\.Generic\.IEnumerable\, Microsoft\.Extensions\.Configuration\.IConfigurationSection\)\.clients') are silently skipped, so the same `appsettings.json` can declare clients that only some deployments load. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.ClientSecretOptions.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common\.Configuration](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration 'Abblix\.Oidc\.Server\.Common\.Configuration') ## ClientSecretOptions Class Configuration options for generating client secrets in OAuth2/OpenID Connect authentication\. ```csharp public record ClientSecretOptions : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ClientSecretOptions Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[ClientSecretOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.ClientSecretOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.ClientSecretOptions')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Properties ## ClientSecretOptions\.ExpiresAfter Property {#Abblix.Oidc.Server.Common.Configuration.ClientSecretOptions.ExpiresAfter} The expiration duration for the client secret\. Defines how long after creation the secret will remain valid\. Default value is 30 days\. ```csharp public System.TimeSpan ExpiresAfter { get; init; } ``` #### Property Value [System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan') ## ClientSecretOptions\.Length Property {#Abblix.Oidc.Server.Common.Configuration.ClientSecretOptions.Length} The length of the generated client secret, in characters\. The default is 32: a client authenticating with `client_secret_jwt` \(OpenID Connect Core §9\) uses the secret's UTF\-8 bytes as the HMAC key, and RFC 7518 §3\.2 requires an HS256 key of at least 32 bytes\. A host whose clients sign with HS384 or HS512 should raise this to 48 or 64 respectively so the derived key meets that algorithm's floor\. ```csharp public int Length { get; init; } ``` #### Property Value [System\.Int32](https://learn.microsoft.com/en-us/dotnet/api/system.int32 'System\.Int32') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.ClientSecretsOptionsValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common\.Configuration](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration 'Abblix\.Oidc\.Server\.Common\.Configuration') ## ClientSecretsOptionsValidator Class Fails loudly at startup when a configured client cannot authenticate with the secret it appears to carry, instead of answering `invalid_client` to every request it ever makes\. ```csharp public class ClientSecretsOptionsValidator : Microsoft.Extensions.Options.IValidateOptions ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ClientSecretsOptionsValidator Implements [Microsoft\.Extensions\.Options\.IValidateOptions<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ivalidateoptions-1 'Microsoft\.Extensions\.Options\.IValidateOptions\`1')[OidcOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ivalidateoptions-1 'Microsoft\.Extensions\.Options\.IValidateOptions\`1') ### Remarks A registry kept in configuration makes a mistyped hash easy and its consequences invisible\. The \.NET configuration binder discards an element whose binding threw, so a hash the file spells wrongly leaves the client with no secret at all rather than with a bad one, and nothing downstream distinguishes that from a client deliberately registered without secrets: the token endpoint simply refuses it, logging at debug level\. A hash of the wrong length is the same mistake caught one step later \- a digest pasted into the wrong notation decodes without error and compares against nothing\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.ClockSkewCeilingValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common\.Configuration](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration 'Abblix\.Oidc\.Server\.Common\.Configuration') ## ClockSkewCeilingValidator Class Refuses a configured clock skew the validator would not honour, while the host is still starting \- and only where a profile puts a bound on it at all\. ```csharp public sealed class ClockSkewCeilingValidator : Microsoft.Extensions.Options.IValidateOptions ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ClockSkewCeilingValidator Implements [Microsoft\.Extensions\.Options\.IValidateOptions<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ivalidateoptions-1 'Microsoft\.Extensions\.Options\.IValidateOptions\`1')[OidcOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ivalidateoptions-1 'Microsoft\.Extensions\.Options\.IValidateOptions\`1') ### Remarks FAPI 2\.0 Security Profile section 5\.3\.2\.1: a server held to it "shall reject JWTs with an `iat` or `nbf` timestamp greater than 60 seconds in the future"\. RFC 7523 Section 3, which governs a bearer assertion outside that profile, names no bound, so a deployment not held to a profile may legitimately allow minutes and this guard says nothing to it\. Where a bound does apply, the validator holds it whatever is configured \- so this guard is not what makes the requirement true\. It exists because a setting that is silently clamped is worse than one that is refused: a deployment could set a window, read the setting back, and believe a number the validator was cutting down\. This says which value and which bound, at startup, where the operator is still looking\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.DefaultResourceIndicatorValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common\.Configuration](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration 'Abblix\.Oidc\.Server\.Common\.Configuration') ## DefaultResourceIndicatorValidator Class Refuses at startup a [DefaultResourceIndicator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions#Abblix.Oidc.Server.Common.Configuration.OidcOptions.DefaultResourceIndicator 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions\.DefaultResourceIndicator') that would put an unusable value in every access token's `aud` claim\. ```csharp public sealed class DefaultResourceIndicatorValidator : Microsoft.Extensions.Options.IValidateOptions ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → DefaultResourceIndicatorValidator Implements [Microsoft\.Extensions\.Options\.IValidateOptions<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ivalidateoptions-1 'Microsoft\.Extensions\.Options\.IValidateOptions\`1')[OidcOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ivalidateoptions-1 'Microsoft\.Extensions\.Options\.IValidateOptions\`1') ### Remarks Both refusals are contradictions the host cannot see at runtime, because the token still issues and only the resource server rejects it \- somewhere else, later, and reported as an invalid token rather than as a misconfiguration here\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.DeviceAuthorizationOptions.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common\.Configuration](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration 'Abblix\.Oidc\.Server\.Common\.Configuration') ## DeviceAuthorizationOptions Class Provides configuration options for the Device Authorization Grant \(RFC 8628\)\. ```csharp public record DeviceAuthorizationOptions : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → DeviceAuthorizationOptions Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[DeviceAuthorizationOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.DeviceAuthorizationOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.DeviceAuthorizationOptions')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Properties ## DeviceAuthorizationOptions\.CodeLifetime Property {#Abblix.Oidc.Server.Common.Configuration.DeviceAuthorizationOptions.CodeLifetime} The lifetime of device\_code and user\_code\. After this duration, the codes expire and the client must start a new device authorization request\. ```csharp public System.TimeSpan CodeLifetime { get; set; } ``` #### Property Value [System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan') ## DeviceAuthorizationOptions\.DeviceCodeLength Property {#Abblix.Oidc.Server.Common.Configuration.DeviceAuthorizationOptions.DeviceCodeLength} The length in bytes of the device code\. The device code is a high\-entropy string used by the client to poll the token endpoint\. Must be at least 128 bits \(16 bytes\) of entropy per RFC 8628 Section 5\.2\. ```csharp public int DeviceCodeLength { get; set; } ``` #### Property Value [System\.Int32](https://learn.microsoft.com/en-us/dotnet/api/system.int32 'System\.Int32') ## DeviceAuthorizationOptions\.IpRateLimitStateExpiration Property {#Abblix.Oidc.Server.Common.Configuration.DeviceAuthorizationOptions.IpRateLimitStateExpiration} The expiration time for IP rate limit state in storage\. Should be longer than RateLimitSlidingWindow to prevent premature cleanup\. ```csharp public System.TimeSpan IpRateLimitStateExpiration { get; set; } ``` #### Property Value [System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan') ## DeviceAuthorizationOptions\.MaxBackoffDuration Property {#Abblix.Oidc.Server.Common.Configuration.DeviceAuthorizationOptions.MaxBackoffDuration} The maximum duration for exponential backoff blocking\. Prevents indefinite blocking even with many failed attempts\. ```csharp public System.TimeSpan MaxBackoffDuration { get; set; } ``` #### Property Value [System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan') ## DeviceAuthorizationOptions\.MaxFailuresBeforeBackoff Property {#Abblix.Oidc.Server.Common.Configuration.DeviceAuthorizationOptions.MaxFailuresBeforeBackoff} The maximum number of failed user code verification attempts before exponential backoff is applied\. RFC 8628 Section 5\.1 recommends rate\-limiting user code attempts, the user code being short enough to type and therefore short enough to guess\. ```csharp public int MaxFailuresBeforeBackoff { get; set; } ``` #### Property Value [System\.Int32](https://learn.microsoft.com/en-us/dotnet/api/system.int32 'System\.Int32') ## DeviceAuthorizationOptions\.MaxIpFailuresPerMinute Property {#Abblix.Oidc.Server.Common.Configuration.DeviceAuthorizationOptions.MaxIpFailuresPerMinute} The maximum number of failed user code verification attempts allowed from a single IP address within a one\-minute sliding window\. Prevents distributed brute force attacks\. ```csharp public int MaxIpFailuresPerMinute { get; set; } ``` #### Property Value [System\.Int32](https://learn.microsoft.com/en-us/dotnet/api/system.int32 'System\.Int32') ## DeviceAuthorizationOptions\.PollingInterval Property {#Abblix.Oidc.Server.Common.Configuration.DeviceAuthorizationOptions.PollingInterval} The minimum interval that the client should wait between polling requests to the token endpoint\. ```csharp public System.TimeSpan PollingInterval { get; set; } ``` #### Property Value [System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan') ## DeviceAuthorizationOptions\.RateLimitSlidingWindow Property {#Abblix.Oidc.Server.Common.Configuration.DeviceAuthorizationOptions.RateLimitSlidingWindow} The duration of the sliding window for per\-IP rate limiting\. Failed attempts outside this window are not counted toward the rate limit\. ```csharp public System.TimeSpan RateLimitSlidingWindow { get; set; } ``` #### Property Value [System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan') ## DeviceAuthorizationOptions\.UserCodeAlphabet Property {#Abblix.Oidc.Server.Common.Configuration.DeviceAuthorizationOptions.UserCodeAlphabet} The alphabet used to generate user codes\. Defaults to numeric digits "0123456789" for universal device compatibility\. Can be set to letters like "BCDFGHJKLMNPQRSTVWXZ" \(consonants without ambiguous characters\) or alphanumeric like "BCDFGHJKLMNPQRSTVWXZ23456789"\. ```csharp public string UserCodeAlphabet { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## DeviceAuthorizationOptions\.UserCodeLength Property {#Abblix.Oidc.Server.Common.Configuration.DeviceAuthorizationOptions.UserCodeLength} The length of the user code \(number of characters\)\. ```csharp public int UserCodeLength { get; set; } ``` #### Property Value [System\.Int32](https://learn.microsoft.com/en-us/dotnet/api/system.int32 'System\.Int32') ## DeviceAuthorizationOptions\.VerificationUri Property {#Abblix.Oidc.Server.Common.Configuration.DeviceAuthorizationOptions.VerificationUri} The user\-facing URI where users can enter their user code\. This should be short and easy to remember as users will manually type it\. Must use HTTPS\. RFC 8628 does not say so for verification\_uri; the requirement is RFC 6749 Section 3\.1's, which asks for TLS wherever the user authenticates\. ```csharp public System.Uri VerificationUri { get; set; } ``` #### Property Value [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.DiscoveryOptions.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common\.Configuration](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration 'Abblix\.Oidc\.Server\.Common\.Configuration') ## DiscoveryOptions Class Defines discovery endpoint options\. ```csharp public class DiscoveryOptions ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → DiscoveryOptions ### Properties ## DiscoveryOptions\.AcrValuesSupported Property {#Abblix.Oidc.Server.Common.Configuration.DiscoveryOptions.AcrValuesSupported} Optional ACR \(Authentication Context Class Reference\) values supported by this provider\. These values represent authentication assurance levels that can be requested and achieved\. If not set, no acr\_values\_supported will be included in the discovery document\. ```csharp public System.Collections.Generic.IEnumerable? AcrValuesSupported { get; set; } ``` #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ## DiscoveryOptions\.AllowEndpointPathsDiscovery Property {#Abblix.Oidc.Server.Common.Configuration.DiscoveryOptions.AllowEndpointPathsDiscovery} Allows exposing exact paths to OIDC endpoints via discovery manifest\. ```csharp public bool AllowEndpointPathsDiscovery { get; set; } ``` #### Property Value [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') ## DiscoveryOptions\.MtlsBaseUri Property {#Abblix.Oidc.Server.Common.Configuration.DiscoveryOptions.MtlsBaseUri} RFC 8705: Optional base URI for computing mTLS endpoint aliases automatically\. If set, and a specific alias is not provided, discovery will derive the alias by taking the standard endpoint path and applying this base URI \(scheme/host/port and optional base path\)\. ```csharp public System.Uri? MtlsBaseUri { get; set; } ``` #### Property Value [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri') ## DiscoveryOptions\.MtlsEndpointAliases Property {#Abblix.Oidc.Server.Common.Configuration.DiscoveryOptions.MtlsEndpointAliases} RFC 8705: Optional mTLS endpoint aliases to advertise\. Configure with absolute URIs hosted on an mTLS\-enabled origin\. ```csharp public Abblix.Oidc.Server.Common.Configuration.MtlsAliasesOptions? MtlsEndpointAliases { get; set; } ``` #### Property Value [MtlsAliasesOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.MtlsAliasesOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.MtlsAliasesOptions') ## DiscoveryOptions\.SignedMetadata Property {#Abblix.Oidc.Server.Common.Configuration.DiscoveryOptions.SignedMetadata} RFC 8414 §2\.1: when enabled, the discovery document additionally carries a `signed_metadata` JWS whose payload is the same metadata set, signed with the authorization server's signing key\. This lets relying parties verify the configuration's origin independently of the TLS layer \(relevant behind CDNs, API gateways, or aggressive caches\)\. Off by default: clients that do not validate the signature gain nothing from it, and an unconsumed field only adds payload weight\. ```csharp public bool SignedMetadata { get; set; } ``` #### Property Value [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.DPoPNonceOptions.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common\.Configuration](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration 'Abblix\.Oidc\.Server\.Common\.Configuration') ## DPoPNonceOptions Class DPoP\-specific extension of [NonceOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Nonces.NonceOptions 'Abblix\.Oidc\.Server\.Features\.Nonces\.NonceOptions') per RFC 9449 §8\. Inherits the generic primitive's `AcceptanceWindow` and `RotationInterval` so DPoP can override them independently of any other nonce\-service consumer, and adds the per\-endpoint policy that says which OAuth endpoints reject DPoP proofs without a `nonce` claim \(responding with `use_dpop_nonce` and a fresh `DPoP-Nonce` header\)\. ```csharp public class DPoPNonceOptions : Abblix.Oidc.Server.Features.Nonces.NonceOptions ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [NonceOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Nonces.NonceOptions 'Abblix\.Oidc\.Server\.Features\.Nonces\.NonceOptions') → DPoPNonceOptions ### Remarks Per\-endpoint flags exist only for endpoints where RFC 9449 specifies DPoP applicability: the token endpoint \(§5\) and protected resources / UserInfo \(§7\)\. RFC 9449 §6\.2 explicitly disclaims DPoP at the introspection endpoint and stays silent on the revocation endpoint, so flags for those endpoints would be misleading non\-spec promises and are intentionally absent\. DPoP is the only nonce-service consumer at present, so the active `RollingHmacNonceService` binds directly against this type via [DPoP](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions#Abblix.Oidc.Server.Common.Configuration.OidcOptions.DPoP 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions\.DPoP').[Nonce](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.DPoPOptions#Abblix.Oidc.Server.Common.Configuration.DPoPOptions.Nonce 'Abblix\.Oidc\.Server\.Common\.Configuration\.DPoPOptions\.Nonce'); the inherited [AcceptanceWindow](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Nonces.NonceOptions#Abblix.Oidc.Server.Features.Nonces.NonceOptions.AcceptanceWindow 'Abblix\.Oidc\.Server\.Features\.Nonces\.NonceOptions\.AcceptanceWindow') and [RotationInterval](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Nonces.NonceOptions#Abblix.Oidc.Server.Features.Nonces.NonceOptions.RotationInterval 'Abblix\.Oidc\.Server\.Features\.Nonces\.NonceOptions\.RotationInterval') drive issuance. When a second consumer (e.g. state-parameter validation) arrives, it brings its own [NonceOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Nonces.NonceOptions 'Abblix\.Oidc\.Server\.Features\.Nonces\.NonceOptions')-derived options class and its own service registration; the inheritance hierarchy is what lets each consumer diverge on window and rotation independently. ### Properties ## DPoPNonceOptions\.RequireAtTokenEndpoint Property {#Abblix.Oidc.Server.Common.Configuration.DPoPNonceOptions.RequireAtTokenEndpoint} When `true`, the token endpoint rejects DPoP requests that omit a nonce claim with `use_dpop_nonce` per RFC 9449 §8\. Defaults to `false`; raise to `true` to opt the deployment into nonce\-protected token issuance\. ```csharp public bool RequireAtTokenEndpoint { get; set; } ``` #### Property Value [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') ## DPoPNonceOptions\.RequireAtUserInfoEndpoint Property {#Abblix.Oidc.Server.Common.Configuration.DPoPNonceOptions.RequireAtUserInfoEndpoint} Same as [RequireAtTokenEndpoint](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.DPoPNonceOptions#Abblix.Oidc.Server.Common.Configuration.DPoPNonceOptions.RequireAtTokenEndpoint 'Abblix\.Oidc\.Server\.Common\.Configuration\.DPoPNonceOptions\.RequireAtTokenEndpoint') but for the UserInfo endpoint per RFC 9449 §7\. Defaults to `false`\. ```csharp public bool RequireAtUserInfoEndpoint { get; set; } ``` #### Property Value [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.DPoPOptions.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common\.Configuration](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration 'Abblix\.Oidc\.Server\.Common\.Configuration') ## DPoPOptions Class Configuration options for OAuth 2\.0 DPoP \(RFC 9449\), covering the proof validator's `iat` tolerance and DPoP\-specific nonce policy\. The nonce sub\-section inherits from the generic [NonceOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Nonces.NonceOptions 'Abblix\.Oidc\.Server\.Features\.Nonces\.NonceOptions') so DPoP can configure stricter values independently of other nonce\-service consumers without duplicating field definitions\. ```csharp public class DPoPOptions ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → DPoPOptions ### Properties ## DPoPOptions\.IssuedAtTolerance Property {#Abblix.Oidc.Server.Common.Configuration.DPoPOptions.IssuedAtTolerance} Tolerance window applied to the `iat` claim of an incoming DPoP proof: the proof is accepted if its `iat` falls within this duration of the server's current time\. Default is 1 minute\. Tighter than the JWT `exp` machinery because DPoP proofs have no expiration claim \- `iat` bounds them\. ```csharp public System.TimeSpan IssuedAtTolerance { get; set; } ``` #### Property Value [System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan') ## DPoPOptions\.Nonce Property {#Abblix.Oidc.Server.Common.Configuration.DPoPOptions.Nonce} DPoP\-specific nonce configuration: per\-endpoint require\-nonce policy \(RFC 9449 §8\) plus DPoP\-specific overrides of the generic [AcceptanceWindow](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Nonces.NonceOptions#Abblix.Oidc.Server.Features.Nonces.NonceOptions.AcceptanceWindow 'Abblix\.Oidc\.Server\.Features\.Nonces\.NonceOptions\.AcceptanceWindow') and [RotationInterval](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Nonces.NonceOptions#Abblix.Oidc.Server.Features.Nonces.NonceOptions.RotationInterval 'Abblix\.Oidc\.Server\.Features\.Nonces\.NonceOptions\.RotationInterval')\. ```csharp public Abblix.Oidc.Server.Common.Configuration.DPoPNonceOptions Nonce { get; set; } ``` #### Property Value [DPoPNonceOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.DPoPNonceOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.DPoPNonceOptions') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.FrontChannelLogoutOptions.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common\.Configuration](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration 'Abblix\.Oidc\.Server\.Common\.Configuration') ## FrontChannelLogoutOptions Class Front\-channel logout settings for a single client, as defined by the OpenID Connect Front\-Channel Logout 1\.0 specification\. Tells the authorization server which URL to load in a hidden iframe during end\-session processing and whether the iframe URL must carry the user's session identifier\. ```csharp public record FrontChannelLogoutOptions : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → FrontChannelLogoutOptions Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[FrontChannelLogoutOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.FrontChannelLogoutOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.FrontChannelLogoutOptions')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Constructors ## FrontChannelLogoutOptions\(Uri, bool\) Constructor {#Abblix.Oidc.Server.Common.Configuration.FrontChannelLogoutOptions.FrontChannelLogoutOptions(System.Uri,bool)} Front\-channel logout settings for a single client, as defined by the OpenID Connect Front\-Channel Logout 1\.0 specification\. Tells the authorization server which URL to load in a hidden iframe during end\-session processing and whether the iframe URL must carry the user's session identifier\. ```csharp public FrontChannelLogoutOptions(System.Uri Uri, bool RequiresSessionId=true); ``` #### Parameters ###### `Uri` [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri') {#Abblix.Oidc.Server.Common.Configuration.FrontChannelLogoutOptions.FrontChannelLogoutOptions(System.Uri,bool).Uri} The client's front\-channel logout endpoint, loaded in a hidden iframe at the OP\. ###### `RequiresSessionId` [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') {#Abblix.Oidc.Server.Common.Configuration.FrontChannelLogoutOptions.FrontChannelLogoutOptions(System.Uri,bool).RequiresSessionId} When `true`, the OP appends `iss` and `sid` query parameters to [Uri](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.FrontChannelLogoutOptions#Abblix.Oidc.Server.Common.Configuration.FrontChannelLogoutOptions.FrontChannelLogoutOptions(System.Uri,bool).Uri 'Abblix\.Oidc\.Server\.Common\.Configuration\.FrontChannelLogoutOptions\.FrontChannelLogoutOptions\(System\.Uri, bool\)\.Uri') so the client can scope the logout to the correct session\. ### Properties ## FrontChannelLogoutOptions\.RequiresSessionId Property {#Abblix.Oidc.Server.Common.Configuration.FrontChannelLogoutOptions.RequiresSessionId} When `true`, the OP appends `iss` and `sid` query parameters to Uri so the client can scope the logout to the correct session\. ```csharp public bool RequiresSessionId { get; init; } ``` #### Property Value [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') ## FrontChannelLogoutOptions\.Uri Property {#Abblix.Oidc.Server.Common.Configuration.FrontChannelLogoutOptions.Uri} The client's front\-channel logout endpoint, loaded in a hidden iframe at the OP\. ```csharp public System.Uri Uri { get; init; } ``` #### Property Value [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.JsonWebKeySetSettings.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common\.Configuration](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration 'Abblix\.Oidc\.Server\.Common\.Configuration') ## JsonWebKeySetSettings Class Flat configuration DTO for a [JsonWebKeySet](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKeySet 'Abblix\.Jwt\.JsonWebKeySet'), mirroring RFC 7517 Section 5 \(a JSON object with a single `keys` array\)\. See [JsonWebKeySettings](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.JsonWebKeySettings 'Abblix\.Oidc\.Server\.Common\.Configuration\.JsonWebKeySettings') for the per\-key DTO and the design rationale\. ```csharp public sealed class JsonWebKeySetSettings ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → JsonWebKeySetSettings ### Properties ## JsonWebKeySetSettings\.Keys Property {#Abblix.Oidc.Server.Common.Configuration.JsonWebKeySetSettings.Keys} The set of keys\. Maps to the `keys` array per RFC 7517 §5\. ```csharp public System.Collections.Generic.List? Keys { get; init; } ``` #### Property Value [System\.Collections\.Generic\.List<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.list-1 'System\.Collections\.Generic\.List\`1')[JsonWebKeySettings](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.JsonWebKeySettings 'Abblix\.Oidc\.Server\.Common\.Configuration\.JsonWebKeySettings')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.list-1 'System\.Collections\.Generic\.List\`1') ### Methods ## JsonWebKeySetSettings\.ToJsonWebKeySet\(\) Method {#Abblix.Oidc.Server.Common.Configuration.JsonWebKeySetSettings.ToJsonWebKeySet()} Maps this flat DTO to [JsonWebKeySet](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKeySet 'Abblix\.Jwt\.JsonWebKeySet') by invoking [ToJsonWebKey\(\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.JsonWebKeySettings#Abblix.Oidc.Server.Common.Configuration.JsonWebKeySettings.ToJsonWebKey() 'Abblix\.Oidc\.Server\.Common\.Configuration\.JsonWebKeySettings\.ToJsonWebKey\(\)') on each entry\. ```csharp public Abblix.Jwt.JsonWebKeySet ToJsonWebKeySet(); ``` #### Returns [JsonWebKeySet](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKeySet 'Abblix\.Jwt\.JsonWebKeySet') ### Operators ## JsonWebKeySetSettings\.implicit operator JsonWebKeySet\(JsonWebKeySetSettings\) Operator {#Abblix.Oidc.Server.Common.Configuration.JsonWebKeySetSettings.op_ImplicitAbblix.Jwt.JsonWebKeySet(Abblix.Oidc.Server.Common.Configuration.JsonWebKeySetSettings)} Convenience implicit conversion to [JsonWebKeySet](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKeySet 'Abblix\.Jwt\.JsonWebKeySet'); delegates to [ToJsonWebKeySet\(\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.JsonWebKeySetSettings#Abblix.Oidc.Server.Common.Configuration.JsonWebKeySetSettings.ToJsonWebKeySet() 'Abblix\.Oidc\.Server\.Common\.Configuration\.JsonWebKeySetSettings\.ToJsonWebKeySet\(\)')\. ```csharp public static Abblix.Jwt.JsonWebKeySet implicit operator Abblix.Jwt.JsonWebKeySet(Abblix.Oidc.Server.Common.Configuration.JsonWebKeySetSettings settings); ``` #### Parameters ###### `settings` [JsonWebKeySetSettings](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.JsonWebKeySetSettings 'Abblix\.Oidc\.Server\.Common\.Configuration\.JsonWebKeySetSettings') {#Abblix.Oidc.Server.Common.Configuration.JsonWebKeySetSettings.op_ImplicitAbblix.Jwt.JsonWebKeySet(Abblix.Oidc.Server.Common.Configuration.JsonWebKeySetSettings).settings} #### Returns [JsonWebKeySet](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKeySet 'Abblix\.Jwt\.JsonWebKeySet') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.JsonWebKeySettings.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common\.Configuration](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration 'Abblix\.Oidc\.Server\.Common\.Configuration') ## JsonWebKeySettings Class Flat configuration DTO for a single JSON Web Key, suitable for binding via `Microsoft.Extensions.Configuration` which cannot instantiate the abstract [JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey') base type directly\. All cryptographic byte\-array members are bound as base64url\-encoded strings per RFC 7517; [ToJsonWebKey\(\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.JsonWebKeySettings#Abblix.Oidc.Server.Common.Configuration.JsonWebKeySettings.ToJsonWebKey() 'Abblix\.Oidc\.Server\.Common\.Configuration\.JsonWebKeySettings\.ToJsonWebKey\(\)') decodes them and maps the flat shape to the correct concrete subtype based on [Kty](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.JsonWebKeySettings#Abblix.Oidc.Server.Common.Configuration.JsonWebKeySettings.Kty 'Abblix\.Oidc\.Server\.Common\.Configuration\.JsonWebKeySettings\.Kty')\. ```csharp public sealed class JsonWebKeySettings ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → JsonWebKeySettings ### Remarks Design rationale: a flat DTO that mirrors the RFC 7517 wire format keeps the configuration path free of `System.Text.Json` roundtrips and custom converters. Every JWK member binds out-of-the-box as a nullable string, the mapper handles base64url decoding and the `kty` dispatch in one place, and the schema lives as explicit C# code - refactor-safe and IntelliSense-friendly. The configuration binder itself produces path-aware error messages on invalid input, so operators do not have to translate generic JSON exceptions back to config paths. Each property carries a [Microsoft\.Extensions\.Configuration\.ConfigurationKeyNameAttribute](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.configuration.configurationkeynameattribute 'Microsoft\.Extensions\.Configuration\.ConfigurationKeyNameAttribute') pointing at the RFC 7517 wire name from [JsonWebKeyPropertyNames](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKeyPropertyNames 'Abblix\.Jwt\.JsonWebKeyPropertyNames'), so config keys can be written exactly as JWK consumers expect them (`kty`, `n`, `e`, ...) and the binder maps them unambiguously to the C# properties. A native polymorphic binding via `[JsonPolymorphic]` + `[JsonDerivedType]` was considered and rejected after empirical verification on net8.0 / net9.0 / net10.0: `Microsoft.Extensions.Configuration.Binder` does not honour these `System.Text.Json` attributes and still throws «Cannot create instance of abstract type» on [JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey'). The flat DTO is the practical workaround until the binder gains its own polymorphism support. Adding support for a new JWK type that the RFC introduces (for example OKP per RFC 8037 for Ed25519 / X25519 keys) is a fully localised change: add the new fields to this DTO and a new branch in the `Kty` switch inside [ToJsonWebKey\(\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.JsonWebKeySettings#Abblix.Oidc.Server.Common.Configuration.JsonWebKeySettings.ToJsonWebKey() 'Abblix\.Oidc\.Server\.Common\.Configuration\.JsonWebKeySettings\.ToJsonWebKey\(\)'). No changes required in the polymorphic [JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey') hierarchy beyond the new concrete subtype itself. ### Properties ## JsonWebKeySettings\.Alg Property {#Abblix.Oidc.Server.Common.Configuration.JsonWebKeySettings.Alg} Algorithm intended for use with this key\. ```csharp public string? Alg { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JsonWebKeySettings\.Crv Property {#Abblix.Oidc.Server.Common.Configuration.JsonWebKeySettings.Crv} EC curve identifier \(crv\): `P-256`, `P-384`, or `P-521`\. ```csharp public string? Crv { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JsonWebKeySettings\.D Property {#Abblix.Oidc.Server.Common.Configuration.JsonWebKeySettings.D} RSA or EC private exponent / key \(d\)\. ```csharp public string? D { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JsonWebKeySettings\.Dp Property {#Abblix.Oidc.Server.Common.Configuration.JsonWebKeySettings.Dp} RSA first factor CRT exponent \(dp\)\. ```csharp public string? Dp { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JsonWebKeySettings\.Dq Property {#Abblix.Oidc.Server.Common.Configuration.JsonWebKeySettings.Dq} RSA second factor CRT exponent \(dq\)\. ```csharp public string? Dq { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JsonWebKeySettings\.E Property {#Abblix.Oidc.Server.Common.Configuration.JsonWebKeySettings.E} RSA public exponent \(e\)\. ```csharp public string? E { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JsonWebKeySettings\.K Property {#Abblix.Oidc.Server.Common.Configuration.JsonWebKeySettings.K} Symmetric \(oct\) key value\. ```csharp public string? K { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JsonWebKeySettings\.Kid Property {#Abblix.Oidc.Server.Common.Configuration.JsonWebKeySettings.Kid} Key ID for selection in multi\-key environments\. ```csharp public string? Kid { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JsonWebKeySettings\.Kty Property {#Abblix.Oidc.Server.Common.Configuration.JsonWebKeySettings.Kty} Key type discriminator: `RSA`, `EC`, or `oct`\. ```csharp public string? Kty { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JsonWebKeySettings\.N Property {#Abblix.Oidc.Server.Common.Configuration.JsonWebKeySettings.N} RSA modulus \(n\)\. ```csharp public string? N { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JsonWebKeySettings\.P Property {#Abblix.Oidc.Server.Common.Configuration.JsonWebKeySettings.P} RSA first prime factor \(p\)\. ```csharp public string? P { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JsonWebKeySettings\.Q Property {#Abblix.Oidc.Server.Common.Configuration.JsonWebKeySettings.Q} RSA second prime factor \(q\)\. ```csharp public string? Q { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JsonWebKeySettings\.Qi Property {#Abblix.Oidc.Server.Common.Configuration.JsonWebKeySettings.Qi} RSA first CRT coefficient \(qi\)\. ```csharp public string? Qi { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JsonWebKeySettings\.Use Property {#Abblix.Oidc.Server.Common.Configuration.JsonWebKeySettings.Use} Public key use: `sig` or `enc`\. ```csharp public string? Use { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JsonWebKeySettings\.X Property {#Abblix.Oidc.Server.Common.Configuration.JsonWebKeySettings.X} EC X coordinate\. ```csharp public string? X { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JsonWebKeySettings\.Y Property {#Abblix.Oidc.Server.Common.Configuration.JsonWebKeySettings.Y} EC Y coordinate\. ```csharp public string? Y { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Methods ## JsonWebKeySettings\.ToJsonWebKey\(\) Method {#Abblix.Oidc.Server.Common.Configuration.JsonWebKeySettings.ToJsonWebKey()} Maps this flat DTO to the corresponding concrete [JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey') subtype\. ```csharp public Abblix.Jwt.JsonWebKey ToJsonWebKey(); ``` #### Returns [JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey') #### Exceptions [System\.InvalidOperationException](https://learn.microsoft.com/en-us/dotnet/api/system.invalidoperationexception 'System\.InvalidOperationException') [Kty](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.JsonWebKeySettings#Abblix.Oidc.Server.Common.Configuration.JsonWebKeySettings.Kty 'Abblix\.Oidc\.Server\.Common\.Configuration\.JsonWebKeySettings\.Kty') is missing or not `RSA`/`EC`/`oct`\. [System\.FormatException](https://learn.microsoft.com/en-us/dotnet/api/system.formatexception 'System\.FormatException') A byte\-array member is not valid base64url\. ### Operators ## JsonWebKeySettings\.implicit operator JsonWebKey\(JsonWebKeySettings\) Operator {#Abblix.Oidc.Server.Common.Configuration.JsonWebKeySettings.op_ImplicitAbblix.Jwt.JsonWebKey(Abblix.Oidc.Server.Common.Configuration.JsonWebKeySettings)} Convenience implicit conversion to [JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey'); delegates to [ToJsonWebKey\(\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.JsonWebKeySettings#Abblix.Oidc.Server.Common.Configuration.JsonWebKeySettings.ToJsonWebKey() 'Abblix\.Oidc\.Server\.Common\.Configuration\.JsonWebKeySettings\.ToJsonWebKey\(\)')\. ```csharp public static Abblix.Jwt.JsonWebKey implicit operator Abblix.Jwt.JsonWebKey(Abblix.Oidc.Server.Common.Configuration.JsonWebKeySettings settings); ``` #### Parameters ###### `settings` [JsonWebKeySettings](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.JsonWebKeySettings 'Abblix\.Oidc\.Server\.Common\.Configuration\.JsonWebKeySettings') {#Abblix.Oidc.Server.Common.Configuration.JsonWebKeySettings.op_ImplicitAbblix.Jwt.JsonWebKey(Abblix.Oidc.Server.Common.Configuration.JsonWebKeySettings).settings} #### Returns [JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.JwtBearerOptions.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common\.Configuration](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration 'Abblix\.Oidc\.Server\.Common\.Configuration') ## JwtBearerOptions Class Configuration options for JWT Bearer grant type \(RFC 7523\)\. Defines trusted external identity providers whose JWT assertions can be exchanged for access tokens\. ```csharp public record JwtBearerOptions : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → JwtBearerOptions Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[JwtBearerOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.JwtBearerOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.JwtBearerOptions')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Properties ## JwtBearerOptions\.AllowedTokenTypes Property {#Abblix.Oidc.Server.Common.Configuration.JwtBearerOptions.AllowedTokenTypes} Allowed values for the 'typ' \(type\) header in JWT assertions\. When not empty, JWTs must have a typ header matching one of these values\. Common values include "JWT" and "at\+jwt"\. Default is empty \(typ header validation disabled\)\. ```csharp public string[] AllowedTokenTypes { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') ### Remarks While RFC 7523 does not mandate typ header validation, validating it prevents token confusion attacks in multi\-token environments where different token types \(access tokens, ID tokens, assertions\) may coexist\. Set to \["JWT"\] or \["at\+jwt"\] based on your token ecosystem requirements\. ## JwtBearerOptions\.ClockSkew Property {#Abblix.Oidc.Server.Common.Configuration.JwtBearerOptions.ClockSkew} The clock skew tolerance applied to a bearer assertion, in both directions\. Absent unless this deployment sets one, which leaves the answer to the security profile in force\. ```csharp public System.Nullable ClockSkew { get; set; } ``` #### Property Value [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') ### Remarks An assertion arrives from an issuer whose clock this server does not run, which is why the tolerance a profile-free deployment gets here is looser than the one applied to tokens minted closer to home. RFC 7523 Section 3 allows for clock skew without naming a bound, so the value a profile-free deployment receives is this server's choice rather than the specification's. FAPI 2.0 Security Profile section 5.3.2.1 makes a tighter choice of its own, and separately names a furthest point - which is a ceiling on whatever is set here rather than a value this resolves to. Absent rather than the default written here, because the two are not the same fact. A number nobody chose cannot be told apart from one a deployment set on purpose, so a guard refusing a value a profile will not honour would refuse the default as well - failing every FAPI deployment at startup over a value it never touched. Absence says "decide for me"; a value says "I mean this", and only the second is worth refusing. It bounds two things, both about the same clock: how far a timestamp may sit either side of this server's, and how much older than [MaxJwtAge](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.JwtBearerOptions#Abblix.Oidc.Server.Common.Configuration.JwtBearerOptions.MaxJwtAge 'Abblix\.Oidc\.Server\.Common\.Configuration\.JwtBearerOptions\.MaxJwtAge') an assertion may be. ## JwtBearerOptions\.JwksCacheDuration Property {#Abblix.Oidc.Server.Common.Configuration.JwtBearerOptions.JwksCacheDuration} The duration for which JWKS \(JSON Web Key Sets\) are cached before being refreshed\. Reduces network calls and improves performance while ensuring keys are periodically updated\. Default is 1 hour\. ```csharp public System.TimeSpan JwksCacheDuration { get; set; } ``` #### Property Value [System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan') ## JwtBearerOptions\.MaxJwtAge Property {#Abblix.Oidc.Server.Common.Configuration.JwtBearerOptions.MaxJwtAge} Maximum age of JWT assertions based on the 'iat' \(issued at\) claim\. JWTs issued more than this duration in the past will be rejected\. Set to null to disable this validation\. Default is 10 minutes\. ```csharp public System.Nullable MaxJwtAge { get; set; } ``` #### Property Value [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') ### Remarks Per RFC 7523 Section 3: "The authorization server MAY reject JWTs with an 'iat' claim value that is unreasonably far in the past\." This provides defense\-in\-depth against replay attacks, especially useful when RequireJti is disabled or when the JTI cache has gaps\. ## JwtBearerOptions\.MaxJwtSize Property {#Abblix.Oidc.Server.Common.Configuration.JwtBearerOptions.MaxJwtSize} Maximum allowed size for JWT assertions in characters\. Prevents denial\-of\-service attacks via excessively large JWTs\. Default is 8192 \(8KB\)\. ```csharp public int MaxJwtSize { get; set; } ``` #### Property Value [System\.Int32](https://learn.microsoft.com/en-us/dotnet/api/system.int32 'System\.Int32') ## JwtBearerOptions\.RequireJti Property {#Abblix.Oidc.Server.Common.Configuration.JwtBearerOptions.RequireJti} Indicates whether the 'jti' \(JWT ID\) claim is required for replay protection\. When enabled, JWTs without a jti claim will be rejected to prevent replay attacks\. Default is true\. RFC 7523 Section 6 leaves replay protection optional and at the implementation's discretion, so refusing an assertion without a jti is this server's choice rather than a requirement it inherits\. ```csharp public bool RequireJti { get; set; } ``` #### Property Value [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') ## JwtBearerOptions\.StrictAudienceValidation Property {#Abblix.Oidc.Server.Common.Configuration.JwtBearerOptions.StrictAudienceValidation} When true, the JWT audience claim must exactly match the token endpoint URL per RFC 7523 Section 3\. When false, the application base URI is also accepted for compatibility with common implementations\. Default is true for strict RFC 7523 compliance and security\. ```csharp public bool StrictAudienceValidation { get; set; } ``` #### Property Value [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') ### Remarks Set to false only if you have legacy clients that use the application base URI as audience\. Accepting the base URI widens the attack surface as JWTs intended for other endpoints on the same server could potentially be misused\. ## JwtBearerOptions\.TrustedIssuers Property {#Abblix.Oidc.Server.Common.Configuration.JwtBearerOptions.TrustedIssuers} Collection of trusted issuers configuration for JWT Bearer grant type\. Each entry defines an external identity provider that is trusted to issue JWT assertions that can be exchanged for access tokens at this authorization server\. ```csharp public System.Collections.Generic.IEnumerable TrustedIssuers { get; set; } ``` #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[TrustedIssuer](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.TrustedIssuer 'Abblix\.Oidc\.Server\.Common\.Configuration\.TrustedIssuer')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ### Remarks Use cases include: \- Service\-to\-service authentication with pre\-existing trust relationships \- Token exchange between federated identity providers \- Cross\-domain single sign\-on \(SSO\) scenarios \- API\-to\-API communication with JWT from external identity provider ### Methods ## JwtBearerOptions\.ResolveClockSkew\(ClientSecurityProfile\) Method {#Abblix.Oidc.Server.Common.Configuration.JwtBearerOptions.ResolveClockSkew(Abblix.Oidc.Server.Common.Constants.ClientSecurityProfile)} The tolerance actually applied to a bearer assertion: what this deployment set, or what the profile in force supplies\. ```csharp public Abblix.Jwt.ClockSkew ResolveClockSkew(Abblix.Oidc.Server.Common.Constants.ClientSecurityProfile profile); ``` #### Parameters ###### `profile` [ClientSecurityProfile](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ClientSecurityProfile 'Abblix\.Oidc\.Server\.Common\.Constants\.ClientSecurityProfile') {#Abblix.Oidc.Server.Common.Configuration.JwtBearerOptions.ResolveClockSkew(Abblix.Oidc.Server.Common.Constants.ClientSecurityProfile).profile} The security profile this deployment is held to\. #### Returns [ClockSkew](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ClockSkew 'Abblix\.Jwt\.ClockSkew') ### Remarks Every reader of the setting goes through here\. Three readers each applying their own fallback are three chances to disagree about what an absent value meant, and the disagreement would surface as one check refusing an assertion another had just accepted\. ## JwtBearerOptions\.ResolveClockSkew\(SecurityProfileRequirements\) Method {#Abblix.Oidc.Server.Common.Configuration.JwtBearerOptions.ResolveClockSkew(Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileRequirements)} The same, over a bundle the caller has already resolved \- which a per\-client caller has, since the client's own profile decides for it\. ```csharp public Abblix.Jwt.ClockSkew ResolveClockSkew(Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileRequirements requirements); ``` #### Parameters ###### `requirements` [SecurityProfileRequirements](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileRequirements 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.SecurityProfileRequirements') {#Abblix.Oidc.Server.Common.Configuration.JwtBearerOptions.ResolveClockSkew(Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileRequirements).requirements} The control bundle in force\. #### Returns [ClockSkew](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ClockSkew 'Abblix\.Jwt\.ClockSkew') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.JwtEncryptionSettings.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common\.Configuration](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration 'Abblix\.Oidc\.Server\.Common\.Configuration') ## JwtEncryptionSettings Class How a JWT the authorization server issues for itself is encrypted\. Reused, one instance per service token type\. Whether the token is encrypted at all is governed by [Encrypt](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.ServiceTokenOptions#Abblix.Oidc.Server.Common.Configuration.ServiceTokenOptions.Encrypt 'Abblix\.Oidc\.Server\.Common\.Configuration\.ServiceTokenOptions\.Encrypt'); this block only selects the key\-management algorithm and key used when it is\. ```csharp public record JwtEncryptionSettings : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → JwtEncryptionSettings Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[JwtEncryptionSettings](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.JwtEncryptionSettings 'Abblix\.Oidc\.Server\.Common\.Configuration\.JwtEncryptionSettings')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Remarks The content\-encryption algorithm \(the JWE `enc`\) is not per\-key, so it is not carried here; it stays on the root [DefaultContentEncryptionAlgorithm](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions#Abblix.Oidc.Server.Common.Configuration.OidcOptions.DefaultContentEncryptionAlgorithm 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions\.DefaultContentEncryptionAlgorithm')\. ### Properties ## JwtEncryptionSettings\.Algorithm Property {#Abblix.Oidc.Server.Common.Configuration.JwtEncryptionSettings.Algorithm} The JWE key\-management algorithm \(the `alg` header value, e\.g\. `RSA-OAEP-256`\)\. When `null` it is derived from the selected encryption key's declared `alg` \(RFC 7517 Section 4\.4\), falling back to `RSA-OAEP-256` when the key declares none\. ```csharp public string? Algorithm { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JwtEncryptionSettings\.KeyId Property {#Abblix.Oidc.Server.Common.Configuration.JwtEncryptionSettings.KeyId} The `kid` of the encryption key to use\. When `null` the first configured encryption key is chosen; when set, the key with this identifier is pinned\. ```csharp public string? KeyId { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.JwtSigningSettings.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common\.Configuration](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration 'Abblix\.Oidc\.Server\.Common\.Configuration') ## JwtSigningSettings Class The signing settings for a JWT the authorization server issues for itself\. Reused, one instance per service token type, so each type carries its own explicit JWS `alg` and signing\-key selection instead of the previously hardcoded RS256\. ```csharp public record JwtSigningSettings : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → JwtSigningSettings Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[JwtSigningSettings](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.JwtSigningSettings 'Abblix\.Oidc\.Server\.Common\.Configuration\.JwtSigningSettings')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Properties ## JwtSigningSettings\.Algorithm Property {#Abblix.Oidc.Server.Common.Configuration.JwtSigningSettings.Algorithm} The JWS signing algorithm \(the `alg` header value, e\.g\. `RS256`, `ES256`\)\. Defaults to [RS256](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.SigningAlgorithms#Abblix.Jwt.SigningAlgorithms.RS256 'Abblix\.Jwt\.SigningAlgorithms\.RS256') so that, left unset, the token is byte\-identical to what the server issued before this setting existed\. ```csharp public string Algorithm { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JwtSigningSettings\.KeyId Property {#Abblix.Oidc.Server.Common.Configuration.JwtSigningSettings.KeyId} The `kid` of the signing key to use\. When `null` the first key matching [Algorithm](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.JwtSigningSettings#Abblix.Oidc.Server.Common.Configuration.JwtSigningSettings.Algorithm 'Abblix\.Oidc\.Server\.Common\.Configuration\.JwtSigningSettings\.Algorithm') is chosen \(RFC 7517 Section 4\.4\); when set, the key with this identifier is pinned and its `kid` is emitted in the JWS header\. ```csharp public string? KeyId { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.MtlsAliasesOptions.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common\.Configuration](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration 'Abblix\.Oidc\.Server\.Common\.Configuration') ## MtlsAliasesOptions Class Options for RFC 8705 mTLS endpoint aliases in discovery\. Allows explicitly setting alias URIs\. Use DiscoveryOptions\.MtlsBaseUri to auto\-compute aliases\. ```csharp public class MtlsAliasesOptions ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → MtlsAliasesOptions ### Properties ## MtlsAliasesOptions\.IntrospectionEndpoint Property {#Abblix.Oidc.Server.Common.Configuration.MtlsAliasesOptions.IntrospectionEndpoint} Mutual\-TLS alias for the introspection endpoint, advertised in discovery as `mtls_endpoint_aliases.introspection_endpoint`\. ```csharp public System.Uri? IntrospectionEndpoint { get; set; } ``` #### Property Value [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri') ## MtlsAliasesOptions\.RevocationEndpoint Property {#Abblix.Oidc.Server.Common.Configuration.MtlsAliasesOptions.RevocationEndpoint} Mutual\-TLS alias for the revocation endpoint, advertised in discovery as `mtls_endpoint_aliases.revocation_endpoint`\. ```csharp public System.Uri? RevocationEndpoint { get; set; } ``` #### Property Value [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri') ## MtlsAliasesOptions\.TokenEndpoint Property {#Abblix.Oidc.Server.Common.Configuration.MtlsAliasesOptions.TokenEndpoint} Mutual\-TLS alias for the token endpoint, advertised in discovery as `mtls_endpoint_aliases.token_endpoint`\. Clients that authenticate via certificate\-bound access tokens are expected to use this URI instead of the regular token endpoint\. ```csharp public System.Uri? TokenEndpoint { get; set; } ``` #### Property Value [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri') ## MtlsAliasesOptions\.UserInfoEndpoint Property {#Abblix.Oidc.Server.Common.Configuration.MtlsAliasesOptions.UserInfoEndpoint} Mutual\-TLS alias for the userinfo endpoint, advertised in discovery as `mtls_endpoint_aliases.userinfo_endpoint`\. ```csharp public System.Uri? UserInfoEndpoint { get; set; } ``` #### Property Value [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.NewClientOptions.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common\.Configuration](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration 'Abblix\.Oidc\.Server\.Common\.Configuration') ## NewClientOptions Class Defaults used by the dynamic client registration endpoint when minting credentials for a newly registered client: how its client identifier and client secret are generated and how long the secret stays valid\. ```csharp public record NewClientOptions : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → NewClientOptions Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[NewClientOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.NewClientOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.NewClientOptions')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Properties ## NewClientOptions\.ClientId Property {#Abblix.Oidc.Server.Common.Configuration.NewClientOptions.ClientId} Generation parameters for the client identifier issued to a newly registered client\. ```csharp public Abblix.Oidc.Server.Common.Configuration.ClientIdOptions ClientId { get; init; } ``` #### Property Value [ClientIdOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.ClientIdOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.ClientIdOptions') ## NewClientOptions\.ClientSecret Property {#Abblix.Oidc.Server.Common.Configuration.NewClientOptions.ClientSecret} Generation parameters and lifetime policy for the client secret issued to a newly registered client\. ```csharp public Abblix.Oidc.Server.Common.Configuration.ClientSecretOptions ClientSecret { get; init; } ``` #### Property Value [ClientSecretOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.ClientSecretOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.ClientSecretOptions') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcEndpoints.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common\.Configuration](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration 'Abblix\.Oidc\.Server\.Common\.Configuration') ## OidcEndpoints Enum Flags representing the various OpenID Connect \(OIDC\) endpoints that the provider can expose\. These flags enable fine\-grained control over which endpoints are enabled or disabled\. ```csharp public enum OidcEndpoints ``` ### Fields ###### `All` 8191 {#Abblix.Oidc.Server.Common.Configuration.OidcEndpoints.All} All OIDC endpoints are available, covering the full range of OpenID Connect operations\. ###### `Base` 1119 {#Abblix.Oidc.Server.Common.Configuration.OidcEndpoints.Base} The base set of endpoints for a typical OpenID Provider: discovery, JWKS, the interactive authorization and token core, PAR, UserInfo and RP\-initiated logout\. This is the default value of [EnabledEndpoints](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions#Abblix.Oidc.Server.Common.Configuration.OidcOptions.EnabledEndpoints 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions\.EnabledEndpoints') \- the minimal functional provider on top of which the opt\-in endpoints are added\. It deliberately excludes the six opt\-in endpoints \- [CheckSession](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcEndpoints#Abblix.Oidc.Server.Common.Configuration.OidcEndpoints.CheckSession 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcEndpoints\.CheckSession'), [Revocation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcEndpoints#Abblix.Oidc.Server.Common.Configuration.OidcEndpoints.Revocation 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcEndpoints\.Revocation'), [Introspection](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcEndpoints#Abblix.Oidc.Server.Common.Configuration.OidcEndpoints.Introspection 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcEndpoints\.Introspection'), [RegisterClient](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcEndpoints#Abblix.Oidc.Server.Common.Configuration.OidcEndpoints.RegisterClient 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcEndpoints\.RegisterClient'), [BackChannelAuthentication](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcEndpoints#Abblix.Oidc.Server.Common.Configuration.OidcEndpoints.BackChannelAuthentication 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcEndpoints\.BackChannelAuthentication') and [DeviceAuthorization](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcEndpoints#Abblix.Oidc.Server.Common.Configuration.OidcEndpoints.DeviceAuthorization 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcEndpoints\.DeviceAuthorization') \- each of which is niche, security\-sensitive or carries its own grant, and is enabled by a dedicated `AddX()` call that both registers the feature and re\-enables its flag\. A server that opts into none of them exposes exactly this set and neither advertises nor validates an endpoint it was never asked to serve\. ###### `Configuration` 1 {#Abblix.Oidc.Server.Common.Configuration.OidcEndpoints.Configuration} The configuration endpoint, used by clients to dynamically discover information about the OpenID Provider\. This typically provides metadata such as available endpoints, supported grant types, and signing algorithms\. ###### `Keys` 2 {#Abblix.Oidc.Server.Common.Configuration.OidcEndpoints.Keys} The keys endpoint, which provides public keys for validating the signatures of issued tokens\. It is essential for clients to verify the integrity and authenticity of tokens\. ###### `Authorize` 4 {#Abblix.Oidc.Server.Common.Configuration.OidcEndpoints.Authorize} The authorization endpoint, where user authentication and consent is initiated\. This is the entry point for most OpenID Connect flows, particularly for obtaining authorization codes\. ###### `Token` 8 {#Abblix.Oidc.Server.Common.Configuration.OidcEndpoints.Token} The token endpoint, used to exchange authorization codes for tokens such as access tokens and ID tokens\. It also supports other grant types like client credentials and refresh tokens\. ###### `UserInfo` 16 {#Abblix.Oidc.Server.Common.Configuration.OidcEndpoints.UserInfo} The user info endpoint, where authenticated user claims are retrieved after a successful authentication process\. It provides information such as the user's name, email, and other identity claims\. ###### `CheckSession` 32 {#Abblix.Oidc.Server.Common.Configuration.OidcEndpoints.CheckSession} The check session endpoint, typically used in single sign\-on \(SSO\) scenarios to monitor the user's session state\. It helps in detecting if the user session is still active or if the user has logged out\. ###### `EndSession` 64 {#Abblix.Oidc.Server.Common.Configuration.OidcEndpoints.EndSession} The end session endpoint, which allows clients to log the user out from the OpenID Provider\. It is used to terminate the user's session and notify relying parties of the logout event\. ###### `Revocation` 128 {#Abblix.Oidc.Server.Common.Configuration.OidcEndpoints.Revocation} The revocation endpoint, where clients can revoke access or refresh tokens\. This is a security measure to invalidate tokens that are no longer needed or in cases of token compromise\. ###### `Introspection` 256 {#Abblix.Oidc.Server.Common.Configuration.OidcEndpoints.Introspection} The introspection endpoint, where clients can check the status of a token \(e\.g\., whether it is active or expired\)\. It provides detailed information about the token such as its expiration time and associated scopes\. ###### `RegisterClient` 512 {#Abblix.Oidc.Server.Common.Configuration.OidcEndpoints.RegisterClient} The client registration endpoint, which allows dynamic registration of clients\. Clients can use this endpoint to register themselves with the OpenID Provider, typically during setup\. ###### `PushedAuthorizationRequest` 1024 {#Abblix.Oidc.Server.Common.Configuration.OidcEndpoints.PushedAuthorizationRequest} The pushed authorization request endpoint, where clients can pre\-register authorization requests with the provider\. It provides an additional layer of security in certain authorization flows\. ###### `BackChannelAuthentication` 2048 {#Abblix.Oidc.Server.Common.Configuration.OidcEndpoints.BackChannelAuthentication} The backchannel authentication endpoint, used in CIBA \(Client\-Initiated Backchannel Authentication\) flows\. It allows clients to initiate out\-of\-band authentication requests, often via a separate user device\. ###### `DeviceAuthorization` 4096 {#Abblix.Oidc.Server.Common.Configuration.OidcEndpoints.DeviceAuthorization} The device authorization endpoint, used in Device Authorization Grant \(RFC 8628\) flows\. It allows devices with limited input capabilities to obtain user authorization via a secondary device\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common\.Configuration](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration 'Abblix\.Oidc\.Server\.Common\.Configuration') ## OidcOptions Class The root of the OIDC configuration\. Provides the simplest way to configure and start your OIDC server\. ```csharp public record OidcOptions : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → OidcOptions Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[OidcOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Properties ## OidcOptions\.AccountSelectionUri Property {#Abblix.Oidc.Server.Common.Configuration.OidcOptions.AccountSelectionUri} The URL to a user interface or service that allows users to select an account during the authentication process\. This is useful in scenarios where users have multiple accounts and need to choose which one to use for signing in\. ```csharp public System.Uri? AccountSelectionUri { get; set; } ``` #### Property Value [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri') ## OidcOptions\.AuthorizationCodeLength Property {#Abblix.Oidc.Server.Common.Configuration.OidcOptions.AuthorizationCodeLength} The standard length of the authorization code generated by the server\. ```csharp public int AuthorizationCodeLength { get; set; } ``` #### Property Value [System\.Int32](https://learn.microsoft.com/en-us/dotnet/api/system.int32 'System\.Int32') ## OidcOptions\.BackChannelAuthentication Property {#Abblix.Oidc.Server.Common.Configuration.OidcOptions.BackChannelAuthentication} Configuration options for the backchannel authentication flow, used in scenarios such as Client\-Initiated Backchannel Authentication \(CIBA\)\. ```csharp public Abblix.Oidc.Server.Common.Configuration.BackChannelAuthenticationOptions BackChannelAuthentication { get; set; } ``` #### Property Value [BackChannelAuthenticationOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.BackChannelAuthenticationOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.BackChannelAuthenticationOptions') ## OidcOptions\.CheckSessionCookie Property {#Abblix.Oidc.Server.Common.Configuration.OidcOptions.CheckSessionCookie} Options related to the check session mechanism in OIDC\. This configuration controls how the OIDC server manages session state information, allowing clients to monitor the login session's status\. Properly configuring these options ensures that clients can react to session changes \(e\.g\., logout\) in a timely and secure manner\. ```csharp public Abblix.Oidc.Server.Common.Configuration.CheckSessionCookieOptions CheckSessionCookie { get; set; } ``` #### Property Value [CheckSessionCookieOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.CheckSessionCookieOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.CheckSessionCookieOptions') ## OidcOptions\.Clients Property {#Abblix.Oidc.Server.Common.Configuration.OidcOptions.Clients} A collection of client configurations supported by this OIDC server\. Each [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') object defines the settings and capabilities of a registered client, including client ID, client secrets, redirect URIs, and other OAuth2/OIDC parameters\. Proper client configuration is essential for securing client applications and enabling them to interact with the OIDC server according to the OAuth2 and OIDC specifications\. ```csharp public System.Collections.Generic.IEnumerable Clients { get; set; } ``` #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ## OidcOptions\.ConsentUri Property {#Abblix.Oidc.Server.Common.Configuration.OidcOptions.ConsentUri} The URL to a user interface or service for obtaining user consent during the authentication process\. Consent is often required when the client application requests access to user data or when sharing information between different parties\. This URI should point to a page or API that can manage consent workflows and communicate the user's decisions back to the OIDC server\. ```csharp public System.Uri? ConsentUri { get; set; } ``` #### Property Value [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri') ## OidcOptions\.DefaultAuthorizationResponseEncryptionAlgorithm Property {#Abblix.Oidc.Server.Common.Configuration.OidcOptions.DefaultAuthorizationResponseEncryptionAlgorithm} The content encryption algorithm used for an encrypted authorization response \(JARM\) when the client registered `authorization_encrypted_response_alg` but omitted `authorization_encrypted_response_enc`\. ```csharp public string DefaultAuthorizationResponseEncryptionAlgorithm { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks Separate from [DefaultContentEncryptionAlgorithm](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions#Abblix.Oidc.Server.Common.Configuration.OidcOptions.DefaultContentEncryptionAlgorithm 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions\.DefaultContentEncryptionAlgorithm') because the specification names a different value for this one response: JWT Secured Authorization Response Mode section 3 says that "if authorization\_encrypted\_response\_alg is specified, the default for this value is A128CBC\-HS256"\. A client registering only the key\-management algorithm expects that, so the server has to encrypt with it or produce a response the client cannot read\. It is a setting rather than a constant so a deployment whose clients all understand a stronger algorithm can raise the floor, the same way the general default can be raised\. ## OidcOptions\.DefaultContentEncryptionAlgorithm Property {#Abblix.Oidc.Server.Common.Configuration.OidcOptions.DefaultContentEncryptionAlgorithm} The default content encryption algorithm used for encrypting JWT tokens\. Per RFC 7518 Section 5, specifies how the JWT payload is encrypted using the Content Encryption Key \(CEK\)\. Common values: A256CBC\-HS512, A128CBC\-HS256, A256GCM, A128GCM\. Defaults to A256CBC\-HS512 for maximum security\. ```csharp public string DefaultContentEncryptionAlgorithm { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## OidcOptions\.DefaultResourceIndicator Property {#Abblix.Oidc.Server.Common.Configuration.OidcOptions.DefaultResourceIndicator} The resource an access token is minted for when the request names none\. Left null, the token's `aud` falls back to the client identifier, which is what prior versions did\. ```csharp public System.Uri? DefaultResourceIndicator { get; set; } ``` #### Property Value [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri') ### Remarks RFC 9068 Section 3 requires an authorization server to "use a default resource indicator in the \`aud\` claim" when a request carries no `resource` parameter, and Section 4 tells a resource server to reject a token whose `aud` does not name it\. A client identifier names the party that asked for the token rather than the one meant to consume it, so a conforming resource server should refuse it; a deployment with one API therefore says so here once, instead of teaching every client to send `resource`\. This is opt\-in because the value is read by every resource server in the deployment: changing it is a change to their contract, not to this server's configuration alone\. The fallback is unchanged until a host states otherwise\. Must be an absolute URI naming a registered [Resources](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions#Abblix.Oidc.Server.Common.Configuration.OidcOptions.Resources 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions\.Resources') entry \- startup refuses anything else, since a token minted for a resource this server does not know is one nobody can accept\. ## OidcOptions\.DefaultSecurityProfile Property {#Abblix.Oidc.Server.Common.Configuration.OidcOptions.DefaultSecurityProfile} The security profile this deployment holds EVERY client to, whatever [SecurityProfile](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.SecurityProfile 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo\.SecurityProfile') each one names for itself\. A single\-profile deployment sets this once \- for example to [Fapi2](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ClientSecurityProfile#Abblix.Oidc.Server.Common.Constants.ClientSecurityProfile.Fapi2 'Abblix\.Oidc\.Server\.Common\.Constants\.ClientSecurityProfile\.Fapi2') \- and every client is held to the FAPI 2\.0 control bundle\. This is a floor rather than a default: a client can ask for more and no registration can take it out from under what is set here\. The default [None](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ClientSecurityProfile#Abblix.Oidc.Server.Common.Constants.ClientSecurityProfile.None 'Abblix\.Oidc\.Server\.Common\.Constants\.ClientSecurityProfile\.None') demands nothing, leaving each client governed by whatever it names for itself, or by its individual metadata flags where it names nothing\. ```csharp public Abblix.Oidc.Server.Common.Constants.ClientSecurityProfile DefaultSecurityProfile { get; set; } ``` #### Property Value [ClientSecurityProfile](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ClientSecurityProfile 'Abblix\.Oidc\.Server\.Common\.Constants\.ClientSecurityProfile') ## OidcOptions\.DeviceAuthorization Property {#Abblix.Oidc.Server.Common.Configuration.OidcOptions.DeviceAuthorization} Configuration options for the Device Authorization Grant \(RFC 8628\), used for devices with limited input capabilities\. ```csharp public Abblix.Oidc.Server.Common.Configuration.DeviceAuthorizationOptions? DeviceAuthorization { get; set; } ``` #### Property Value [DeviceAuthorizationOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.DeviceAuthorizationOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.DeviceAuthorizationOptions') ## OidcOptions\.Discovery Property {#Abblix.Oidc.Server.Common.Configuration.OidcOptions.Discovery} Configuration options for OIDC discovery\. These options control how the OIDC server advertises its capabilities and endpoints to clients through the OIDC Discovery mechanism\. Proper configuration ensures that clients can dynamically discover information about the OIDC server, such as URLs for authorization, token, userinfo, and JWKS endpoints, supported scopes, response types, and more\. ```csharp public Abblix.Oidc.Server.Common.Configuration.DiscoveryOptions Discovery { get; set; } ``` #### Property Value [DiscoveryOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.DiscoveryOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.DiscoveryOptions') ## OidcOptions\.DPoP Property {#Abblix.Oidc.Server.Common.Configuration.OidcOptions.DPoP} Configuration options for OAuth 2\.0 DPoP \(RFC 9449\), governing the [Abblix\.Oidc\.Server\.Features\.DPoP\.ProofValidator](https://learn.microsoft.com/en-us/dotnet/api/abblix.oidc.server.features.dpop.proofvalidator 'Abblix\.Oidc\.Server\.Features\.DPoP\.ProofValidator') behaviour and related primitives\. ```csharp public Abblix.Oidc.Server.Common.Configuration.DPoPOptions DPoP { get; set; } ``` #### Property Value [DPoPOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.DPoPOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.DPoPOptions') ## OidcOptions\.EnabledEndpoints Property {#Abblix.Oidc.Server.Common.Configuration.OidcOptions.EnabledEndpoints} Specifies which OIDC endpoints are enabled on the server\. This property allows for fine\-grained control over the available functionality, enabling or disabling specific endpoints based on the server's role, security considerations, or operational requirements\. Defaults to [Base](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcEndpoints#Abblix.Oidc.Server.Common.Configuration.OidcEndpoints.Base 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcEndpoints\.Base') \- the core interactive OIDC set plus PAR and RP\-initiated logout\. The six niche or security\-sensitive endpoints \(CheckSession, Revocation, Introspection, dynamic client registration, CIBA and device authorization\) are off by default and each turned on by its dedicated `AddX()` opt\-in, which registers the feature and re\-enables the corresponding flag\. Leaving them off keeps a server that never opts in from advertising \- or validating \- an endpoint it was never asked to serve\. Setting this to [All](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcEndpoints#Abblix.Oidc.Server.Common.Configuration.OidcEndpoints.All 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcEndpoints\.All') only re\-advertises and routes every endpoint \- the handler for each opt\-in endpoint \(CheckSession, Revocation, Introspection, dynamic client registration, CIBA, device authorization\) is still registered solely by its `AddX()` call, so `All` restores the previous every\-endpoint\-on behaviour only when combined with all of those opt\-in calls\. Setting `All` without them advertises and routes endpoints whose handlers are absent, so every request to such an endpoint fails at runtime\. ```csharp public Abblix.Oidc.Server.Common.Configuration.OidcEndpoints EnabledEndpoints { get; set; } ``` #### Property Value [OidcEndpoints](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcEndpoints 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcEndpoints') ## OidcOptions\.EncryptionKeys Property {#Abblix.Oidc.Server.Common.Configuration.OidcOptions.EncryptionKeys} The collection of JSON Web Keys \(JWK\) used for encrypting tokens or sensitive information sent to the clients\. Encryption is essential for protecting sensitive data within tokens, especially when tokens are passed through less secure channels or when storing tokens on the client side\. These keys are used to encrypt ID tokens and, optionally, access tokens when the OIDC server sends them to clients\. Clients use the corresponding public keys to decrypt the tokens and access the contained claims\. ```csharp public System.Collections.Generic.IReadOnlyCollection EncryptionKeys { get; set; } ``` #### Property Value [System\.Collections\.Generic\.IReadOnlyCollection<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ireadonlycollection-1 'System\.Collections\.Generic\.IReadOnlyCollection\`1')[JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ireadonlycollection-1 'System\.Collections\.Generic\.IReadOnlyCollection\`1') ## OidcOptions\.FilterAuthorizationDetailsByLocation Property {#Abblix.Oidc.Server.Common.Configuration.OidcOptions.FilterAuthorizationDetailsByLocation} Whether an access token carries only the `authorization_details` entries whose `locations` name one of its audiences\. Off, every granted entry is emitted, which is what prior versions did\. ```csharp public bool FilterAuthorizationDetailsByLocation { get; set; } ``` #### Property Value [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') ### Remarks A deployment fact rather than a protocol one, which is why it is a switch and not a default\. RFC 9396 §2\.2 says `locations` "typically" holds URIs identifying resource servers, and §9\.1's own worked example pairs a client\-style `aud` with a resource URI in `locations` \- so the two members are not required to be drawn from the same namespace, and comparing them is only meaningful where a deployment has decided they are\. §7 leaves what an access token carries to the authorization server where the client did not ask, and §13 asks for need\-to\-know "as determined by local policy"\. This is that policy, stated once\. The shape this was written for: several resource servers, every access token that carries authorization details minted for a `resource`, and each server's `locations` written exactly as the resource indicator it is registered under\. That is RFC 9396 §12's multiple\-resource\-server case, which is what `locations` was defined for\. Matching a deployment against that description is the operator's judgement, not a recommendation made here\. With no [Resources](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions#Abblix.Oidc.Server.Common.Configuration.OidcOptions.Resources 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions\.Resources') registered and no token exchange in use, the audience is the issuer on every token and the filter can only delete: nothing can put a resource in the audience for a `locations` value to match\. That combination is not refused at startup, because it cannot be told apart there from a deployment whose audiences arrive through RFC 8693 token exchange, where they come from the client's own allowlist rather than from this list and the filter works\. Turn it on and an entry naming only other resource servers stops travelling to this one, which is what §9\.1 recommends where the comparison holds\. Turn it on where it does not \- RFC 8693 audiences are opaque logical names, and a [DefaultResourceIndicator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions#Abblix.Oidc.Server.Common.Configuration.OidcOptions.DefaultResourceIndicator 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions\.DefaultResourceIndicator') names one API while `locations` name others \- and every located entry disappears from every token\. The switch is off until a host says the two agree, because nothing here can check that they do\. The case worth knowing about is not a misconfiguration\. A request that names no resource gets the issuer as its audience, and the issuer names this server rather than any resource, so EVERY located entry is dropped from that token\. Correct under the policy \- such a token is addressed here, and an entry located elsewhere cannot be exercised with it \- and it means a deployment using resource indicators for its APIs while also issuing ordinary OpenID Connect tokens loses located entries from all of the latter\. RFC 9396 Appendix A\.1 is exactly that shape: it locates an entry at the UserInfo endpoint, which no resource indicator names, so an opted\-in deployment following that example loses the entry from every token it issues\. Worth knowing, and NOT a cost of turning this on: introspection already treats an entry with no `locations` the other way round, withholding it from a caller that did not register for it\. A resource server can read such an entry out of the token and not get it back when it introspects the same token, and that holds with this setting off as well\. The refresh token is never filtered: it is read by this server rather than by a resource server, and it is what a later refresh for a DIFFERENT resource is rebuilt from\. ## OidcOptions\.GrantIdLength Property {#Abblix.Oidc.Server.Common.Configuration.OidcOptions.GrantIdLength} Specifies the length, in random bytes, of the refresh\-token grant identifier \(the `grant_id` claim\)\. The grant id binds every refresh token of one authorization grant into a single lineage for rotation and family revocation \(RFC 9700 Section 4\.14\.2\), so it must carry enough entropy to make the identifier unguessable\. ```csharp public int GrantIdLength { get; set; } ``` #### Property Value [System\.Int32](https://learn.microsoft.com/en-us/dotnet/api/system.int32 'System\.Int32') ## OidcOptions\.IgnoreParametersOutsideRequestObject Property {#Abblix.Oidc.Server.Common.Configuration.OidcOptions.IgnoreParametersOutsideRequestObject} Governs how a request object resolves a parameter that appears both inside the object and in the OAuth query syntax \- a choice between two specifications\. When `false` \(the default\), request\-object processing follows the OpenID Connect Core §6\.1 merge semantics: the object's values supersede those passed outside it, but a parameter passed only outside the object is still used\. Set to `true` for the strict RFC 9101 §6\.3 rule, where the authorization request is exactly the content of the object and any parameter passed outside it is ignored \("the authorization server MUST only use the parameters in the Request Object"\)\. The strict rule suits FAPI\-style OAuth deployments; as an OpenID Provider the server defaults to the merge behaviour, since strict processing would drop parameters that existing OpenID Connect clients commonly pass outside the object\. A client held to the FAPI 2\.0 security profile is processed strictly regardless of this global default\. This switch affects only parameter exclusivity; the other RFC 9101 §6\.3 requirement \- that a `client_id` or `response_type` present both inside and outside the object be identical \- is enforced in both modes and cannot be turned off\. ```csharp public bool IgnoreParametersOutsideRequestObject { get; set; } ``` #### Property Value [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') ## OidcOptions\.InteractionUri Property {#Abblix.Oidc.Server.Common.Configuration.OidcOptions.InteractionUri} The URL to a user interface or service for handling additional interactions required during the authentication process\. This can include multiple factor authentication, user consent, or any custom interaction required by the authentication flow\. The OIDC server can redirect users to this URI when additional interaction is needed\. ```csharp public System.Uri? InteractionUri { get; set; } ``` #### Property Value [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri') ## OidcOptions\.Issuer Property {#Abblix.Oidc.Server.Common.Configuration.OidcOptions.Issuer} Represents the unique identifier of the OIDC server\. It is recommended to use a URL controlled by the entity operating the OIDC server, and it should be consistent across different environments to maintain trust with client applications\. ```csharp public string? Issuer { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## OidcOptions\.JwtAuthorizationResponseExpiresIn Property {#Abblix.Oidc.Server.Common.Configuration.OidcOptions.JwtAuthorizationResponseExpiresIn} The lifetime of a JARM \(JWT Secured Authorization Response Mode\) `response` JWT\. The authorization response is consumed by the client immediately upon redirect, so a short window suffices and mostly absorbs clock skew\. JARM §2\.1 RECOMMENDS a maximum of 10 minutes; deployments with stricter requirements \(e\.g\. FAPI\) may shorten it\. ```csharp public System.TimeSpan JwtAuthorizationResponseExpiresIn { get; set; } ``` #### Property Value [System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan') ## OidcOptions\.JwtBearer Property {#Abblix.Oidc.Server.Common.Configuration.OidcOptions.JwtBearer} Configuration options for JWT Bearer grant type \(RFC 7523\)\. Defines trusted external identity providers whose JWT assertions can be exchanged for access tokens\. ```csharp public Abblix.Oidc.Server.Common.Configuration.JwtBearerOptions JwtBearer { get; set; } ``` #### Property Value [JwtBearerOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.JwtBearerOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.JwtBearerOptions') ## OidcOptions\.KeyRolloverPropagation Property {#Abblix.Oidc.Server.Common.Configuration.OidcOptions.KeyRolloverPropagation} The key\-rollover propagation window: how long a newly published signing or encryption key is served at the JWKS endpoint before the server begins producing tokens with it, giving client JWKS caches time to pick it up so a rotation never causes a verification or decryption failure\. This single value is the server's source of truth for rollover timing: the JWKS endpoint derives its `Cache-Control` max\-age from it \(so a client honouring the header is never staler than this window\), and a key provider that rotates keys dynamically \(for example the external\-custodian provider addressing a versioned HSM/KMS key\) holds a freshly rotated key as announced\-but\-not\-yet\-signing for this long\. Size it to at least the longest a client may cache the JWKS\. A static, non\-rotating key set is unaffected by the activation gate but still gets this as the advertised JWKS cache lifetime\. Defaults to one hour\. ```csharp public System.TimeSpan KeyRolloverPropagation { get; set; } ``` #### Property Value [System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan') ## OidcOptions\.LicenseJwt Property {#Abblix.Oidc.Server.Common.Configuration.OidcOptions.LicenseJwt} A JWT used for licensing and configuration validation of the OIDC service\. This token contains claims that the OIDC service uses to validate its configuration, features, and licensing status, ensuring the service operates within its licensed capabilities\. Proper validation of this token is crucial for the service's legal and functional compliance\. ```csharp public string? LicenseJwt { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## OidcOptions\.LoginSessionExpiresIn Property {#Abblix.Oidc.Server.Common.Configuration.OidcOptions.LoginSessionExpiresIn} The duration after which a login session expires\. This setting determines how long a user's authentication session remains valid before requiring re\-authentication\. Configuring this duration is essential for balancing security concerns with usability, particularly in environments with varying security requirements\. ```csharp public System.TimeSpan LoginSessionExpiresIn { get; set; } ``` #### Property Value [System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan') ## OidcOptions\.LoginUri Property {#Abblix.Oidc.Server.Common.Configuration.OidcOptions.LoginUri} The URL to initiate the login process\. This URI is typically used in scenarios where the OIDC server needs to direct users to a specific login interface or when integrating with external identity providers\. Configuring this URI allows the OIDC server to delegate the initial user authentication step to another service or UI\. ```csharp public System.Uri? LoginUri { get; set; } ``` #### Property Value [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri') ## OidcOptions\.MaxRegistrationRequestSize Property {#Abblix.Oidc.Server.Common.Configuration.OidcOptions.MaxRegistrationRequestSize} The largest body the registration and update endpoints will read, in bytes, or `null` to leave the bound entirely to the host\. A body over the limit is answered 413 before it is bound\. ```csharp public System.Nullable MaxRegistrationRequestSize { get; set; } ``` #### Property Value [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.Int64](https://learn.microsoft.com/en-us/dotnet/api/system.int64 'System\.Int64')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') ### Remarks The bound exists because these endpoints parse a foreign document and keep the members they do not model \([AdditionalMembers](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRegistrationRequest#Abblix.Oidc.Server.Model.ClientRegistrationRequest.AdditionalMembers 'Abblix\.Oidc\.Server\.Model\.ClientRegistrationRequest\.AdditionalMembers')\), which costs several times the body's own size in memory\. Model binding runs ahead of every validator, including the initial access token check and the registration access token check, so a bound expressed as a validator would be paid for after the allocation it is meant to prevent\. The refusal is about length and never about content. RFC 7591 Section 2 requires the server to ignore metadata it does not understand, so refusing a registration for carrying unknown members would contradict it - whereas declining to read an oversized body is not a statement about metadata at all, and a bound that counted unrecognised members would be. How it is enforced differs by host, and the difference is worth knowing when sizing capacity. A minimal API host publishes the value as endpoint metadata the server reads before the body, so the refusal costs no managed memory - but a server that does not implement `IHttpMaxRequestBodySizeFeature`, including the in-memory test server, ignores it. An MVC host enforces it in a resource filter that buffers the body itself, which holds regardless of server and costs up to this many bytes per concurrent request while the request is refused. The default is generous next to a real registration: an inline JWKS with several keys, a software statement and a long list of redirect URIs together stay well under a tenth of it. Raise it for a deployment that genuinely needs more. Clearing it adds no bound of ours and removes none of anybody else's: the server's own limit still applies (Kestrel defaults to 30,000,000 bytes) and so does whatever a reverse proxy in front of it enforces, which is the point of clearing it. That is why it is expressed as an absent value rather than as a very large number - a number is still a bound, and a very large one asks an MVC host to buffer a very large body. ## OidcOptions\.NewClientOptions Property {#Abblix.Oidc.Server.Common.Configuration.OidcOptions.NewClientOptions} Configuration options for registering new clients dynamically in the OIDC server\. These options define default values and constraints for new client registrations, facilitating dynamic and secure client onboarding processes\. ```csharp public Abblix.Oidc.Server.Common.Configuration.NewClientOptions NewClientOptions { get; init; } ``` #### Property Value [NewClientOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.NewClientOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.NewClientOptions') ## OidcOptions\.PkceAndNonceReuseDetectionInterval Property {#Abblix.Oidc.Server.Common.Configuration.OidcOptions.PkceAndNonceReuseDetectionInterval} Enables detection of a client reusing a constant PKCE `code_challenge` or OpenID Connect `nonce` across authorization requests, which defeats the transaction\-binding those values provide \(RFC 9700 Section 2\.1\.1 encourages the authorization server to make a reasonable effort to detect and prevent it\)\. When set, the server records each value at the moment it issues an authorization code and rejects a later authorization request from the same client that repeats a value within this interval\. Recording at code issuance \- not on every authorization request \- means re\-processing one request across a login or consent redirect is not flagged\. Left `null` \(the default\) the check is off: a conforming client generates a fresh value per request and is never affected, but a client that incorrectly reuses a value across separate authorizations would then be rejected, so it is opt\-in\. ```csharp public System.Nullable PkceAndNonceReuseDetectionInterval { get; set; } ``` #### Property Value [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') ## OidcOptions\.PushedAuthorizationRequestExpiresIn Property {#Abblix.Oidc.Server.Common.Configuration.OidcOptions.PushedAuthorizationRequestExpiresIn} The duration for which a Pushed Authorization Request \(PAR\) is valid\. PAR is a security enhancement that allows clients to pre\-register authorization requests directly with the authorization server\. This duration specifies the maximum time a pre\-registered request is considered valid, balancing the need for security with usability in completing the authorization process\. ```csharp public System.TimeSpan PushedAuthorizationRequestExpiresIn { get; set; } ``` #### Property Value [System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan') ## OidcOptions\.RegistrationUri Property {#Abblix.Oidc.Server.Common.Configuration.OidcOptions.RegistrationUri} The URL of the account\-creation \(registration\) UI the user is redirected to when a client requests user registration via `prompt=create` \(Initiating User Registration via OpenID Connect 1\.0\)\. When not set, [LoginUri](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions#Abblix.Oidc.Server.Common.Configuration.OidcOptions.LoginUri 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions\.LoginUri') is used instead, so hosts whose login page also offers registration need no extra configuration\. ```csharp public System.Uri? RegistrationUri { get; set; } ``` #### Property Value [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri') ## OidcOptions\.RequestUriLength Property {#Abblix.Oidc.Server.Common.Configuration.OidcOptions.RequestUriLength} The standard length of the request URI generated by the server for Pushed Authorization Requests \(PAR\)\. ```csharp public int RequestUriLength { get; set; } ``` #### Property Value [System\.Int32](https://learn.microsoft.com/en-us/dotnet/api/system.int32 'System\.Int32') ## OidcOptions\.RequestUriParameterName Property {#Abblix.Oidc.Server.Common.Configuration.OidcOptions.RequestUriParameterName} The name of the parameter used by the OIDC server to pass the authorization request identifier\. This parameter name is used in URLs and requests to reference specific authorization requests, especially in advanced features like Pushed Authorization Requests \(PAR\)\. Customizing this parameter name can help align with specific client requirements or naming conventions\. ```csharp public string RequestUriParameterName { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## OidcOptions\.RequireInitialAccessToken Property {#Abblix.Oidc.Server.Common.Configuration.OidcOptions.RequireInitialAccessToken} Determines whether the client registration endpoint requires an initial access token in the Authorization header\. When `true`, POST requests to the registration endpoint must include a valid Bearer token\. When `false`, open registration is allowed\. ```csharp public bool RequireInitialAccessToken { get; set; } ``` #### Property Value [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') ### Remarks The default deviates from a SHOULD deliberately\. RFC 7591 Section 3: "To support open registration and facilitate wider interoperability, the client registration endpoint SHOULD allow registration requests with no authorization \(which is to say, with no initial access token in the request\)\." Appendix A\.1\.2 describes the other choice, protected registration, as an equally supported deployment, and that is what this default picks: an endpoint that mints client credentials to anyone who asks is not a safe starting point, and a host that wants open registration opts into it in one line\. The trade the specification names in return is interoperability, since client software cannot register itself unattended\. ## OidcOptions\.RequirePushedAuthorizationRequests Property {#Abblix.Oidc.Server.Common.Configuration.OidcOptions.RequirePushedAuthorizationRequests} Determines whether the OIDC server requires Pushed Authorization Requests \(PAR\)\. ```csharp public bool RequirePushedAuthorizationRequests { get; set; } ``` #### Property Value [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') ## OidcOptions\.RequireSignedRequestObject Property {#Abblix.Oidc.Server.Common.Configuration.OidcOptions.RequireSignedRequestObject} Determines whether request objects must be signed by the client, enhancing security for certain sensitive operations\. ```csharp public bool RequireSignedRequestObject { get; set; } ``` #### Property Value [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') ## OidcOptions\.Resources Property {#Abblix.Oidc.Server.Common.Configuration.OidcOptions.Resources} The resource definitions supported by the OIDC server\. This setting outlines the resources that clients can request access to during authorization, ensuring the OIDC server can enforce access control policies and permissions based on these definitions\. ```csharp public Abblix.Oidc.Server.Common.Constants.ResourceDefinition[]? Resources { get; set; } ``` #### Property Value [ResourceDefinition](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ResourceDefinition 'Abblix\.Oidc\.Server\.Common\.Constants\.ResourceDefinition')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') ## OidcOptions\.RevocationCutoffRetention Property {#Abblix.Oidc.Server.Common.Configuration.OidcOptions.RevocationCutoffRetention} How long a subject\- or session\-level revocation cutoff is kept\. ```csharp public System.TimeSpan RevocationCutoffRetention { get; set; } ``` #### Property Value [System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan') ### Remarks A cutoff refuses tokens issued before it, so it stops mattering once the longest\-lived token it could refuse has expired on its own, and keeping it past that costs one small record per revoked principal\. Dropping it early is the failure that matters, and it is silent: a refresh token issued before a revocation and still alive when the record expires starts working again, rotates into a fresh one, and nothing logs anything. Set this to the longest [RefreshToken](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.RefreshToken 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo\.RefreshToken') absolute lifetime any client is configured with. It cannot be derived here - lifetimes are per client and the client store answers by identifier rather than by enumeration - so the value is yours to keep in step, and only a non-positive one is refused at startup. The default covers a month, which is the longest refresh token most deployments issue and far past this server's own default of eight hours. ## OidcOptions\.RevocationCutoffSkew Property {#Abblix.Oidc.Server.Common.Configuration.OidcOptions.RevocationCutoffSkew} How far a token may appear to have been issued after a revocation cutoff and still be refused by it\. ```csharp public System.TimeSpan RevocationCutoffSkew { get; set; } ``` #### Property Value [System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan') ### Remarks The cutoff compares an instant one instance recorded against an `iat` another instance stamped, so the two come from different clocks\. The error is not symmetric in consequence\. A token that reads as older than it is gets refused once and the client asks again; a token that reads as newer escapes the revocation entirely, and because a refresh rotation carries the original `iat` forward it keeps escaping on every use\. A drift of seconds therefore becomes access that never ends, and nothing reports it\. The value is added to the cutoff, so it widens what a revocation catches, and the cost is that it catches more than the revocation named. A token minted after a legitimate sign-in, but inside this window of a cutoff, cannot be told apart from a drifted old one and is refused. That is not one retry - it lasts the whole window, because every token minted inside it carries an issue time inside it. A user reinstated a moment after being suspended waits this long before their tokens work. So this is priced against clock drift and nothing else: it must exceed the worst difference between the instance that stamps a token and the instance that records a revocation, and buy no more than that. On hosts running NTP the difference is milliseconds, and the default of five seconds is three orders of magnitude above it while staying short enough to read as a retry. Raise it only for a deployment that knows its clocks are worse, and price the lockout when doing so. It applies to tokens alone. An authentication session is judged with no tolerance at all, because there the same widening would refuse the fresh sign-in a user answers the refusal with, and that retry lands in the same window - a loop rather than a wait. Zero is allowed and means the tokens are trusted to carry comparable instants, which is true of a single-instance deployment and of nothing else. ## OidcOptions\.RevokedInitialAccessTokenSubjects Property {#Abblix.Oidc.Server.Common.Configuration.OidcOptions.RevokedInitialAccessTokenSubjects} The set of revoked initial access token identifiers \(JWT subject claims\)\. Tokens whose subject appears in this set will be rejected during client registration\. For production use with large or dynamic revocation lists, replace [IInitialAccessTokenRevocationProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IInitialAccessTokenRevocationProvider 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IInitialAccessTokenRevocationProvider') with a database\- or cache\-backed implementation\. ```csharp public System.Collections.Generic.HashSet RevokedInitialAccessTokenSubjects { get; set; } ``` #### Property Value [System\.Collections\.Generic\.HashSet<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.hashset-1 'System\.Collections\.Generic\.HashSet\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.hashset-1 'System\.Collections\.Generic\.HashSet\`1') ## OidcOptions\.RevokeSessionTokensOnLogout Property {#Abblix.Oidc.Server.Common.Configuration.OidcOptions.RevokeSessionTokensOnLogout} Whether ending a session also revokes the tokens issued within it\. ```csharp public bool RevokeSessionTokensOnLogout { get; set; } ``` #### Property Value [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') ### Remarks Off, which keeps a refresh token working after the user has signed out of the browser\. That is what a native application relies on to stay signed in while the web session ends, and turning it on for an existing deployment would log those users out with nothing in their own code having changed\. Turn it on where a sign-out is meant to mean the end of access rather than the end of a browser session, and read the specification's advice as advice. OpenID Connect RP-Initiated Logout 1.0 says nothing about tokens at all, but Back-Channel Logout 1.0 Section 2.7 does: "Refresh tokens issued without the offline_access property to a session being logged out SHOULD be revoked. Refresh tokens issued with the offline_access property normally SHOULD NOT be revoked." Every refresh token this server mints carries `offline_access`, because that scope is what makes it issue one at all. So the first sentence applies to nothing here, and the second describes every token this option would revoke - which is why it is off. Turning it on is a deliberate departure from a SHOULD NOT, and the word "normally" is what leaves room for it: a deployment whose sign-out is meant to end access has a reason the specification's default case does not cover. What it reaches is what a revocation cutoff reaches: refresh tokens, and access tokens a resource server introspects. An access token validated locally against its signature and expiry never comes back here. ## OidcOptions\.Scopes Property {#Abblix.Oidc.Server.Common.Configuration.OidcOptions.Scopes} The supported scopes and their respective claim types, which outline the access permissions and associated data that clients can request\. This setting determines what information and operations are available to different clients based on the scopes they request during authorization\. ```csharp public Abblix.Oidc.Server.Common.Constants.ScopeDefinition[]? Scopes { get; set; } ``` #### Property Value [ScopeDefinition](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ScopeDefinition 'Abblix\.Oidc\.Server\.Common\.Constants\.ScopeDefinition')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') ## OidcOptions\.ServiceTokens Property {#Abblix.Oidc.Server.Common.Configuration.OidcOptions.ServiceTokens} Per\-type signing and encryption settings for the JWTs the server issues for itself \(access, refresh, registration access and initial access tokens\)\. Each type signs with RS256 and, when a server [EncryptionKeys](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions#Abblix.Oidc.Server.Common.Configuration.OidcOptions.EncryptionKeys 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions\.EncryptionKeys') entry is configured, is encrypted to it by default, as in prior versions\. A host controls each type independently: it can pin the signing algorithm or key, choose the key\-management algorithm or encryption key, or disable encryption for a specific type by setting that type's [Encrypt](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.ServiceTokenOptions#Abblix.Oidc.Server.Common.Configuration.ServiceTokenOptions.Encrypt 'Abblix\.Oidc\.Server\.Common\.Configuration\.ServiceTokenOptions\.Encrypt') to `false` \(for example to keep the access token readable by external resource servers\)\. ```csharp public Abblix.Oidc.Server.Common.Configuration.ServiceTokensOptions ServiceTokens { get; set; } ``` #### Property Value [ServiceTokensOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.ServiceTokensOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.ServiceTokensOptions') ## OidcOptions\.SessionIdLength Property {#Abblix.Oidc.Server.Common.Configuration.OidcOptions.SessionIdLength} Specifies the length of session identifiers used by the OIDC server\. The length determines the uniqueness and security of the session identifiers\. ```csharp public int SessionIdLength { get; set; } ``` #### Property Value [System\.Int32](https://learn.microsoft.com/en-us/dotnet/api/system.int32 'System\.Int32') ## OidcOptions\.SigningKeys Property {#Abblix.Oidc.Server.Common.Configuration.OidcOptions.SigningKeys} The collection of JSON Web Keys \(JWK\) used for signing tokens issued by the OIDC server\. Signing tokens is a critical security measure that ensures the integrity and authenticity of the tokens\. These keys are used to digitally sign ID tokens, access tokens, and other JWT tokens issued by the server, allowing clients to verify that the tokens have not been tampered with and were indeed issued by this server\. It is recommended to rotate these keys periodically to maintain the security of the token signing process\. ```csharp public System.Collections.Generic.IReadOnlyCollection SigningKeys { get; set; } ``` #### Property Value [System\.Collections\.Generic\.IReadOnlyCollection<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ireadonlycollection-1 'System\.Collections\.Generic\.IReadOnlyCollection\`1')[JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ireadonlycollection-1 'System\.Collections\.Generic\.IReadOnlyCollection\`1') ## OidcOptions\.SoftwareStatement Property {#Abblix.Oidc.Server.Common.Configuration.OidcOptions.SoftwareStatement} Configuration options for software statement validation per RFC 7591 Section 2\.3\. ```csharp public Abblix.Oidc.Server.Common.Configuration.SoftwareStatementOptions SoftwareStatement { get; set; } ``` #### Property Value [SoftwareStatementOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.SoftwareStatementOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.SoftwareStatementOptions') ## OidcOptions\.TokenIdLength Property {#Abblix.Oidc.Server.Common.Configuration.OidcOptions.TokenIdLength} Specifies the length of token identifiers used by the OIDC server\. This value determines the length of the unique ID assigned to tokens\. ```csharp public int TokenIdLength { get; set; } ``` #### Property Value [System\.Int32](https://learn.microsoft.com/en-us/dotnet/api/system.int32 'System\.Int32') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.RefreshTokenOptions.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common\.Configuration](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration 'Abblix\.Oidc\.Server\.Common\.Configuration') ## RefreshTokenOptions Struct Lifetime and reuse policy for refresh tokens issued by the token endpoint\. Combines an absolute ceiling with an optional sliding window so long\-running sessions stay alive only while the client keeps using them\. ```csharp public record struct RefreshTokenOptions : System.IEquatable ``` Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[RefreshTokenOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.RefreshTokenOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.RefreshTokenOptions')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Constructors ## RefreshTokenOptions\(\) Constructor {#Abblix.Oidc.Server.Common.Configuration.RefreshTokenOptions.RefreshTokenOptions()} Lifetime and reuse policy for refresh tokens issued by the token endpoint\. Combines an absolute ceiling with an optional sliding window so long\-running sessions stay alive only while the client keeps using them\. ```csharp public RefreshTokenOptions(); ``` ### Properties ## RefreshTokenOptions\.AbsoluteExpiresIn Property {#Abblix.Oidc.Server.Common.Configuration.RefreshTokenOptions.AbsoluteExpiresIn} Hard upper bound on a refresh token's lifetime, measured from the moment it was issued\. The token is rejected once this period elapses, regardless of how recently it was used\. ```csharp public System.TimeSpan AbsoluteExpiresIn { get; init; } ``` #### Property Value [System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan') ## RefreshTokenOptions\.AllowReuse Property {#Abblix.Oidc.Server.Common.Configuration.RefreshTokenOptions.AllowReuse} When `false` \(the secure default\), each refresh rotates the token: the previous value is marked superseded as soon as a new one is issued, and later reuse of a superseded token revokes the whole token family \(RFC 9700 Section 4\.14\.2\)\. Set to `true` to opt a client into multi\-use refresh tokens that may be redeemed repeatedly until they expire \- appropriate only for confidential clients whose client authentication already binds the token to its identity \(RFC 6749\)\. ```csharp public bool AllowReuse { get; init; } ``` #### Property Value [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') ## RefreshTokenOptions\.SlidingExpiresIn Property {#Abblix.Oidc.Server.Common.Configuration.RefreshTokenOptions.SlidingExpiresIn} Optional sliding window: each successful refresh extends the token's expiration by this amount, up to the absolute ceiling\. Set to `null` to disable sliding behavior\. ```csharp public System.Nullable SlidingExpiresIn { get; init; } ``` #### Property Value [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.RegistrationRequestSizeValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common\.Configuration](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration 'Abblix\.Oidc\.Server\.Common\.Configuration') ## RegistrationRequestSizeValidator Class Refuses at startup a [MaxRegistrationRequestSize](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions#Abblix.Oidc.Server.Common.Configuration.OidcOptions.MaxRegistrationRequestSize 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions\.MaxRegistrationRequestSize') that no request could satisfy\. ```csharp public sealed class RegistrationRequestSizeValidator : Microsoft.Extensions.Options.IValidateOptions ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → RegistrationRequestSizeValidator Implements [Microsoft\.Extensions\.Options\.IValidateOptions<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ivalidateoptions-1 'Microsoft\.Extensions\.Options\.IValidateOptions\`1')[OidcOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ivalidateoptions-1 'Microsoft\.Extensions\.Options\.IValidateOptions\`1') ### Remarks A non\-positive limit takes the endpoints down rather than bounding them, and it does so differently on each host: an MVC host answers 413 to every registration, including a valid one of a few hundred bytes, while a minimal API host hands the value to a server that rejects it and answers 500\. Neither reads as a configuration error at the point it surfaces, and both look to an operator like the endpoint being broken\. Zero is refused alongside a negative value because it means the same thing here: a request body always carries at least the two braces of an empty JSON object. A deployment that wants no bound of ours clears the option instead, which this validator lets through. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.RevocationRetentionOptionsValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common\.Configuration](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration 'Abblix\.Oidc\.Server\.Common\.Configuration') ## RevocationRetentionOptionsValidator Class Fails at startup on a revocation setting that would let a revocation report success and do nothing\. ```csharp public sealed class RevocationRetentionOptionsValidator : Microsoft.Extensions.Options.IValidateOptions ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → RevocationRetentionOptionsValidator Implements [Microsoft\.Extensions\.Options\.IValidateOptions<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ivalidateoptions-1 'Microsoft\.Extensions\.Options\.IValidateOptions\`1')[OidcOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ivalidateoptions-1 'Microsoft\.Extensions\.Options\.IValidateOptions\`1') ### Remarks A revocation is one record with an expiry\. At zero or below, the record expires as it is written, so `RevokeSubjectAsync` returns successfully and the tokens it was called about keep working \- a security control that reports success and does nothing, which is the shape that gets discovered by an incident rather than by a test\. Only the value that can never work is rejected. A value that is merely too short for a deployment's longest-lived refresh token cannot be detected here: token lifetimes are per client and the client store is not enumerable, so nothing at startup knows what the longest one is. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.SecretLengthOptionsValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common\.Configuration](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration 'Abblix\.Oidc\.Server\.Common\.Configuration') ## SecretLengthOptionsValidator Class Fails loudly at startup when a configured secret\-bearing length is below the security floor for its kind, instead of silently generating a guessable client secret, authorization code or identifier at runtime\. Every shipped default is already at or above these floors, so a valid configuration is unaffected; the validator only rejects a deliberately shortened value\. ```csharp public class SecretLengthOptionsValidator : Microsoft.Extensions.Options.IValidateOptions ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → SecretLengthOptionsValidator Implements [Microsoft\.Extensions\.Options\.IValidateOptions<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ivalidateoptions-1 'Microsoft\.Extensions\.Options\.IValidateOptions\`1')[OidcOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ivalidateoptions-1 'Microsoft\.Extensions\.Options\.IValidateOptions\`1') ### Fields ## SecretLengthOptionsValidator\.MinimumClientSecretLength Field {#Abblix.Oidc.Server.Common.Configuration.SecretLengthOptionsValidator.MinimumClientSecretLength} Minimum length, in characters, of a generated client secret\. A client authenticating with `client_secret_jwt` \(OpenID Connect Core §9\) uses the secret's UTF\-8 bytes as the HMAC key, and RFC 7518 §3\.2 requires an HS256 key of at least 32 bytes; a shorter secret cannot serve that method at all\. ```csharp public const int MinimumClientSecretLength = 32; ``` #### Field Value [System\.Int32](https://learn.microsoft.com/en-us/dotnet/api/system.int32 'System\.Int32') ## SecretLengthOptionsValidator\.MinimumRandomSecretLength Field {#Abblix.Oidc.Server.Common.Configuration.SecretLengthOptionsValidator.MinimumRandomSecretLength} Minimum length, in characters, of an opaque random secret the server issues as a bearer value \(authorization code, PAR request URI, session/token/grant identifier\)\. Below this a random token becomes guessable; the value is a hard safety floor, well under every shipped default\. ```csharp public const int MinimumRandomSecretLength = 16; ``` #### Field Value [System\.Int32](https://learn.microsoft.com/en-us/dotnet/api/system.int32 'System\.Int32') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.ServiceTokenOptions.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common\.Configuration](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration 'Abblix\.Oidc\.Server\.Common\.Configuration') ## ServiceTokenOptions Class The signing and encryption settings for one type of JWT the authorization server issues for itself \(access, refresh, registration access or initial access token\)\. The same shape is reused for every type via [ServiceTokensOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.ServiceTokensOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.ServiceTokensOptions')\. ```csharp public record ServiceTokenOptions : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ServiceTokenOptions Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[ServiceTokenOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.ServiceTokenOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.ServiceTokenOptions')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Properties ## ServiceTokenOptions\.Encrypt Property {#Abblix.Oidc.Server.Common.Configuration.ServiceTokenOptions.Encrypt} Whether to encrypt this token type to the server's own encryption key\. ```csharp public System.Nullable Encrypt { get; set; } ``` #### Property Value [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') ### Remarks Three states, and the difference between two of them decides how a missing key is answered: - `false` keeps the token a signed JWS even when an encryption key exists, for example to keep the access token readable by external resource servers that validate it against the published key set. The server's encryption keys are not resolved at all. - `true` requires encryption. If no encryption key can be resolved the server refuses to issue the token rather than falling back to a signed JWS, because a host that asked for confidentiality and silently did not get it has no way to find out. - `null`, the default, states nothing: the token is encrypted when a server encryption key is available and signed only when none is, which is the behaviour of prior versions. A host that never touched this setting therefore sees no change and no new failure. ## ServiceTokenOptions\.Encryption Property {#Abblix.Oidc.Server.Common.Configuration.ServiceTokenOptions.Encryption} How this token type is encrypted when [Encrypt](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.ServiceTokenOptions#Abblix.Oidc.Server.Common.Configuration.ServiceTokenOptions.Encrypt 'Abblix\.Oidc\.Server\.Common\.Configuration\.ServiceTokenOptions\.Encrypt') is on and a server encryption key is available: the JWE key\-management algorithm and the key to use\. Left at its defaults it derives the algorithm from the selected key and takes the first configured encryption key\. ```csharp public Abblix.Oidc.Server.Common.Configuration.JwtEncryptionSettings Encryption { get; set; } ``` #### Property Value [JwtEncryptionSettings](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.JwtEncryptionSettings 'Abblix\.Oidc\.Server\.Common\.Configuration\.JwtEncryptionSettings') ## ServiceTokenOptions\.Signing Property {#Abblix.Oidc.Server.Common.Configuration.ServiceTokenOptions.Signing} The signing settings, always present\. Left at its defaults it signs with RS256 and lets the server choose the first matching key, reproducing the output the server produced before this option existed\. ```csharp public Abblix.Oidc.Server.Common.Configuration.JwtSigningSettings Signing { get; set; } ``` #### Property Value [JwtSigningSettings](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.JwtSigningSettings 'Abblix\.Oidc\.Server\.Common\.Configuration\.JwtSigningSettings') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.ServiceTokensAlgorithmsValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common\.Configuration](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration 'Abblix\.Oidc\.Server\.Common\.Configuration') ## ServiceTokensAlgorithmsValidator Class Fails loudly at startup when a configured [ServiceTokensOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.ServiceTokensOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.ServiceTokensOptions') names a signing or key\-management algorithm that no registered signer or encryptor can produce, instead of letting the contradiction surface at token\-issuance time as a per\-request failure\. The accepted sets are read from the live JWT registrations, the same union OpenID Connect discovery advertises, so a host that adds or replaces an algorithm is validated against exactly what it registered \- no static allow\-list to keep in sync\. ```csharp public sealed class ServiceTokensAlgorithmsValidator : Microsoft.Extensions.Options.IValidateOptions ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ServiceTokensAlgorithmsValidator Implements [Microsoft\.Extensions\.Options\.IValidateOptions<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ivalidateoptions-1 'Microsoft\.Extensions\.Options\.IValidateOptions\`1')[OidcOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ivalidateoptions-1 'Microsoft\.Extensions\.Options\.IValidateOptions\`1') ### Constructors ## ServiceTokensAlgorithmsValidator\(IJsonWebTokenCreator, IKeyCustodian\) Constructor {#Abblix.Oidc.Server.Common.Configuration.ServiceTokensAlgorithmsValidator.ServiceTokensAlgorithmsValidator(Abblix.Jwt.IJsonWebTokenCreator,Abblix.Jwt.ExternalKeys.IKeyCustodian)} Fails loudly at startup when a configured [ServiceTokensOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.ServiceTokensOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.ServiceTokensOptions') names a signing or key\-management algorithm that no registered signer or encryptor can produce, instead of letting the contradiction surface at token\-issuance time as a per\-request failure\. The accepted sets are read from the live JWT registrations, the same union OpenID Connect discovery advertises, so a host that adds or replaces an algorithm is validated against exactly what it registered \- no static allow\-list to keep in sync\. ```csharp public ServiceTokensAlgorithmsValidator(Abblix.Jwt.IJsonWebTokenCreator jwtCreator, Abblix.Jwt.ExternalKeys.IKeyCustodian? custodian=null); ``` #### Parameters ###### `jwtCreator` [IJsonWebTokenCreator](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.IJsonWebTokenCreator 'Abblix\.Jwt\.IJsonWebTokenCreator') {#Abblix.Oidc.Server.Common.Configuration.ServiceTokensAlgorithmsValidator.ServiceTokensAlgorithmsValidator(Abblix.Jwt.IJsonWebTokenCreator,Abblix.Jwt.ExternalKeys.IKeyCustodian).jwtCreator} Source of the registered signing and JWE key\-management algorithms\. Kept lightweight on purpose, so validating options does not drag the runtime token pipeline \(and its storage\) into startup\. ###### `custodian` [IKeyCustodian](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.IKeyCustodian 'Abblix\.Jwt\.ExternalKeys\.IKeyCustodian') {#Abblix.Oidc.Server.Common.Configuration.ServiceTokensAlgorithmsValidator.ServiceTokensAlgorithmsValidator(Abblix.Jwt.IJsonWebTokenCreator,Abblix.Jwt.ExternalKeys.IKeyCustodian).custodian} Present when the host holds its keys in an external custodian \(a Vault or Key Vault backend\), absent when they come from [EncryptionKeys](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions#Abblix.Oidc.Server.Common.Configuration.OidcOptions.EncryptionKeys 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions\.EncryptionKeys')\. It is a registration marker only, and is never called here: it answers where the keys come from without reading them, and without reading the options that are still being created\. Injecting the key provider instead would re\-enter [Microsoft\.Extensions\.Options\.IOptions<>\.Value](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptions-1.value 'Microsoft\.Extensions\.Options\.IOptions\`1\.Value') from inside its own creation\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.ServiceTokensOptions.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common\.Configuration](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration 'Abblix\.Oidc\.Server\.Common\.Configuration') ## ServiceTokensOptions Class The per\-type signing and encryption settings for the four JWTs the authorization server issues for itself\. Grouping the four here keeps them together and avoids a name clash with the per\-client [RefreshToken](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.RefreshToken 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo\.RefreshToken') \(which governs lifetime and reuse, a different concern\)\. Each token type signs with RS256 and, when a server encryption key is configured, is encrypted to it by default, as in prior versions; a host disables encryption for a specific type by setting that type's [Encrypt](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.ServiceTokenOptions#Abblix.Oidc.Server.Common.Configuration.ServiceTokenOptions.Encrypt 'Abblix\.Oidc\.Server\.Common\.Configuration\.ServiceTokenOptions\.Encrypt') to `false`\. ```csharp public record ServiceTokensOptions : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ServiceTokensOptions Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[ServiceTokensOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.ServiceTokensOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.ServiceTokensOptions')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Properties ## ServiceTokensOptions\.AccessToken Property {#Abblix.Oidc.Server.Common.Configuration.ServiceTokensOptions.AccessToken} Settings for the access token\. Like the other service tokens it is encrypted to the server's own key when one is configured\. A host whose access token is validated by external resource servers against the published key set \(which hold only the signing public key\) sets [Encrypt](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.ServiceTokenOptions#Abblix.Oidc.Server.Common.Configuration.ServiceTokenOptions.Encrypt 'Abblix\.Oidc\.Server\.Common\.Configuration\.ServiceTokenOptions\.Encrypt') to `false` so the token stays a readable signed JWS\. ```csharp public Abblix.Oidc.Server.Common.Configuration.ServiceTokenOptions AccessToken { get; set; } ``` #### Property Value [ServiceTokenOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.ServiceTokenOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.ServiceTokenOptions') ## ServiceTokensOptions\.InitialAccessToken Property {#Abblix.Oidc.Server.Common.Configuration.ServiceTokensOptions.InitialAccessToken} Settings for the initial access token \(RFC 7591 Section 3\)\. A server round\-trip value, read back only by the server, so encrypting it to the server's own key is safe\. ```csharp public Abblix.Oidc.Server.Common.Configuration.ServiceTokenOptions InitialAccessToken { get; set; } ``` #### Property Value [ServiceTokenOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.ServiceTokenOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.ServiceTokenOptions') ## ServiceTokensOptions\.RefreshToken Property {#Abblix.Oidc.Server.Common.Configuration.ServiceTokensOptions.RefreshToken} Settings for the refresh token\. A server round\-trip value \(issued, stored opaquely by the holder, presented back and validated by the server\), so encrypting it to the server's own key both protects its contents at rest and is read back by the server itself\. ```csharp public Abblix.Oidc.Server.Common.Configuration.ServiceTokenOptions RefreshToken { get; set; } ``` #### Property Value [ServiceTokenOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.ServiceTokenOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.ServiceTokenOptions') ## ServiceTokensOptions\.RegistrationAccessToken Property {#Abblix.Oidc.Server.Common.Configuration.ServiceTokensOptions.RegistrationAccessToken} Settings for the registration access token \(RFC 7592\)\. A server round\-trip value, read back only by the server, so encrypting it to the server's own key is safe\. ```csharp public Abblix.Oidc.Server.Common.Configuration.ServiceTokenOptions RegistrationAccessToken { get; set; } ``` #### Property Value [ServiceTokenOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.ServiceTokenOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.ServiceTokenOptions') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.SoftwareStatementOptions.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common\.Configuration](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration 'Abblix\.Oidc\.Server\.Common\.Configuration') ## SoftwareStatementOptions Class Configuration options for software statement validation per RFC 7591 Section 2\.3\. Software statements are signed JWTs issued by a third\-party authority asserting metadata values about the client software\. ```csharp public record SoftwareStatementOptions : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → SoftwareStatementOptions Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[SoftwareStatementOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.SoftwareStatementOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.SoftwareStatementOptions')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Properties ## SoftwareStatementOptions\.ApprovedSoftwareIds Property {#Abblix.Oidc.Server.Common.Configuration.SoftwareStatementOptions.ApprovedSoftwareIds} Optional set of approved software identifiers\. If non\-empty, only software statements with a software\_id claim matching one of these values will be accepted\. When empty, all software IDs from trusted issuers are accepted\. ```csharp public System.Collections.Generic.HashSet ApprovedSoftwareIds { get; set; } ``` #### Property Value [System\.Collections\.Generic\.HashSet<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.hashset-1 'System\.Collections\.Generic\.HashSet\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.hashset-1 'System\.Collections\.Generic\.HashSet\`1') ## SoftwareStatementOptions\.RequireSoftwareStatement Property {#Abblix.Oidc.Server.Common.Configuration.SoftwareStatementOptions.RequireSoftwareStatement} Whether a software statement is required for client registration\. When `true`, registration requests without a software\_statement will be rejected\. ```csharp public bool RequireSoftwareStatement { get; set; } ``` #### Property Value [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') ## SoftwareStatementOptions\.TrustedIssuers Property {#Abblix.Oidc.Server.Common.Configuration.SoftwareStatementOptions.TrustedIssuers} The trusted issuers whose software statements are accepted\. Each issuer provides a JWKS endpoint for signature verification\. ```csharp public Abblix.Oidc.Server.Common.Configuration.TrustedIssuer[] TrustedIssuers { get; set; } ``` #### Property Value [TrustedIssuer](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.TrustedIssuer 'Abblix\.Oidc\.Server\.Common\.Configuration\.TrustedIssuer')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.TrustedIssuer.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common\.Configuration](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration 'Abblix\.Oidc\.Server\.Common\.Configuration') ## TrustedIssuer Class Represents a trusted external identity provider for JWT Bearer grant type\. ```csharp public record TrustedIssuer : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → TrustedIssuer Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[TrustedIssuer](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.TrustedIssuer 'Abblix\.Oidc\.Server\.Common\.Configuration\.TrustedIssuer')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Properties ## TrustedIssuer\.AllowedAlgorithms Property {#Abblix.Oidc.Server.Common.Configuration.TrustedIssuer.AllowedAlgorithms} The list of allowed signing algorithms for JWT assertions from this issuer\. If specified, JWTs signed with algorithms not in this list will be rejected\. If null or empty, the default secure algorithms are used: RS256, RS384, RS512, ES256, ES384, ES512\. ```csharp public string[]? AllowedAlgorithms { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') ### Remarks This provides defense against algorithm substitution attacks \(e\.g\., CVE\-2015\-9235\)\. The 'none' algorithm is never allowed regardless of this setting\. ## TrustedIssuer\.AllowedScopes Property {#Abblix.Oidc.Server.Common.Configuration.TrustedIssuer.AllowedScopes} The list of allowed scopes that can be requested when using JWT assertions from this issuer\. If null, all scopes are allowed\. If specified, only listed scopes will be granted\. ```csharp public string[]? AllowedScopes { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') ## TrustedIssuer\.Description Property {#Abblix.Oidc.Server.Common.Configuration.TrustedIssuer.Description} Optional description of this trusted issuer for documentation and logging purposes\. ```csharp public string? Description { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## TrustedIssuer\.Issuer Property {#Abblix.Oidc.Server.Common.Configuration.TrustedIssuer.Issuer} The issuer identifier \(iss claim value\) of the trusted identity provider\. Must exactly match the 'iss' claim in JWT assertions from this provider\. ```csharp public string Issuer { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Example https://accounts.google.com ## TrustedIssuer\.JwksUri Property {#Abblix.Oidc.Server.Common.Configuration.TrustedIssuer.JwksUri} The URL to the JSON Web Key Set \(JWKS\) endpoint for this issuer\. Used to retrieve public keys for verifying JWT assertion signatures\. ```csharp public System.Uri JwksUri { get; init; } ``` #### Property Value [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri') ### Example https://accounts.google.com/.well-known/jwks.json ### Remarks Typically this is the issuer's \.well\-known/jwks\.json endpoint\. The keys will be cached and refreshed according to standard JWKS caching policies\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ## Abblix\.Oidc\.Server\.Common\.Constants Namespace | Classes | | | :--- | :--- | | [ApplicationTypes](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ApplicationTypes 'Abblix\.Oidc\.Server\.Common\.Constants\.ApplicationTypes') | Defines constants for different types of applications in OAuth 2\.0 and OpenID Connect contexts\. | | [AuthenticationMethodReferences](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.AuthenticationMethodReferences 'Abblix\.Oidc\.Server\.Common\.Constants\.AuthenticationMethodReferences') | Contains IANA\-registered Authentication Method Reference \(AMR\) values as per RFC 8176\. | | [BackchannelTokenDeliveryModes](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.BackchannelTokenDeliveryModes 'Abblix\.Oidc\.Server\.Common\.Constants\.BackchannelTokenDeliveryModes') | Defines the available delivery modes for backchannel token delivery in Client\-Initiated Backchannel Authentication \(CIBA\)\. These modes specify how the authentication server communicates the result of the backchannel authentication process to the client\. | | [ClientAssertionTypes](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ClientAssertionTypes 'Abblix\.Oidc\.Server\.Common\.Constants\.ClientAssertionTypes') | Provides constants for client assertion types used in OAuth 2\.0\. | | [ClientAuthenticationMethods](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ClientAuthenticationMethods 'Abblix\.Oidc\.Server\.Common\.Constants\.ClientAuthenticationMethods') | This class defines various client authentication methods used in OAuth 2\.0\. | | [CodeChallengeMethods](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.CodeChallengeMethods 'Abblix\.Oidc\.Server\.Common\.Constants\.CodeChallengeMethods') | Static class representing the methods for PKCE \(Proof Key for Code Exchange\) code challenges\. | | [DisplayModes](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.DisplayModes 'Abblix\.Oidc\.Server\.Common\.Constants\.DisplayModes') | The class representing the display modes for the authentication and consent UI\. | | [ErrorCodes](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ErrorCodes 'Abblix\.Oidc\.Server\.Common\.Constants\.ErrorCodes') | Represents OAuth 2\.0 and OpenID Connect error codes\. | | [GrantTypes](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.GrantTypes 'Abblix\.Oidc\.Server\.Common\.Constants\.GrantTypes') | Represents OAuth 2\.0 grant types\. | | [HttpRequestHeaders](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.HttpRequestHeaders 'Abblix\.Oidc\.Server\.Common\.Constants\.HttpRequestHeaders') | This class defines HTTP header names commonly used in HTTP requests\. | | [JwtTypes](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.JwtTypes 'Abblix\.Oidc\.Server\.Common\.Constants\.JwtTypes') | The `typ` values this server mints for its own token kinds, and the refusal decision that sees them\. The specification\-fixed vocabulary lives in the JWT core's [JsonWebTokenTypes](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenTypes 'Abblix\.Jwt\.JsonWebTokenTypes'), shared by every package on the core; what stays here is what only this product can own \- its vendor\-tree values \- plus the combined known set the two vocabularies form together\. | | [MediaTypes](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.MediaTypes 'Abblix\.Oidc\.Server\.Common\.Constants\.MediaTypes') | Represents common media types used in HTTP requests and responses\. | | [OidcConstants](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.OidcConstants 'Abblix\.Oidc\.Server\.Common\.Constants\.OidcConstants') | Shared identifiers the HTTP transport adapters \(MVC, Minimal API\) agree on\. The core declares them so both adapters reference one value rather than each carrying its own copy\. | | [Prompts](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.Prompts 'Abblix\.Oidc\.Server\.Common\.Constants\.Prompts') | Values accepted in the OpenID Connect `prompt` authorization request parameter, instructing the authorization server how to interact with the end user before issuing a response\. | | [RequestUrn](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.RequestUrn 'Abblix\.Oidc\.Server\.Common\.Constants\.RequestUrn') | Provides constants for OAuth request URIs, ensuring they conform to the standardized URN notation\. | | [ResourceDefinition](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ResourceDefinition 'Abblix\.Oidc\.Server\.Common\.Constants\.ResourceDefinition') | Represents a resource with associated scopes, defining the permissions and access levels within an application\. This record is typically used to configure and enforce authorization policies based on resource identifiers and their corresponding scopes\. | | [ResponseModes](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ResponseModes 'Abblix\.Oidc\.Server\.Common\.Constants\.ResponseModes') | Represents common response modes used in OAuth 2\.0 and OpenID Connect flows\. | | [ResponseTypes](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ResponseTypes 'Abblix\.Oidc\.Server\.Common\.Constants\.ResponseTypes') | Represents common response types used in OAuth 2\.0 and OpenID Connect flows\. | | [ResponseTypesExtensions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ResponseTypesExtensions 'Abblix\.Oidc\.Server\.Common\.Constants\.ResponseTypesExtensions') | Extension methods that classify an OAuth 2\.0 `response_type` combination \- the array of its space\-separated parts \(`code`, `token`, `id_token`\)\. They centralise the shared response\-type predicates so the same rule is applied wherever a request's flow is derived from its response types\. | | [ScopeDefinition](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ScopeDefinition 'Abblix\.Oidc\.Server\.Common\.Constants\.ScopeDefinition') | Defines a structure for OAuth 2\.0 scope definitions, specifying the scope and associated claim types\. | | [Scopes](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.Scopes 'Abblix\.Oidc\.Server\.Common\.Constants\.Scopes') | Represents common OAuth 2\.0 and OpenID Connect scopes\. | | [StandardScopes](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.StandardScopes 'Abblix\.Oidc\.Server\.Common\.Constants\.StandardScopes') | Provides definitions for standard OpenID Connect scopes and their associated claims\. | | [SubjectTypes](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.SubjectTypes 'Abblix\.Oidc\.Server\.Common\.Constants\.SubjectTypes') | Represents subject types used in OpenID Connect\. | | [TokenExchangeTokenTypes](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.TokenExchangeTokenTypes 'Abblix\.Oidc\.Server\.Common\.Constants\.TokenExchangeTokenTypes') | Token type identifiers for RFC 8693 Token Exchange\. Used as the value of the wire\-level `subject_token_type`, `actor_token_type`, and `requested_token_type` parameters, and echoed back in the token response's `issued_token_type` field\. | | [TokenTypeIdentifiers](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.TokenTypeIdentifiers 'Abblix\.Oidc\.Server\.Common\.Constants\.TokenTypeIdentifiers') | Represents token type identifiers for various token types as specified in RFC 8693\. | | [TokenTypes](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.TokenTypes 'Abblix\.Oidc\.Server\.Common\.Constants\.TokenTypes') | Represents token types used in authentication and authorization\. | | Enums | | | :--- | :--- | | [ClientSecurityProfile](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ClientSecurityProfile 'Abblix\.Oidc\.Server\.Common\.Constants\.ClientSecurityProfile') | A named bundle of security controls a client is held to\. Selecting a profile forces the whole bundle on the client at once and prevents an individual toggle from silently weakening it, which is what makes a client conformant with one setting instead of several hand\-tuned flags\. | | [ClientType](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ClientType 'Abblix\.Oidc\.Server\.Common\.Constants\.ClientType') | Enumeration representing the type of OAuth 2\.0 client\. | | [FlowTypes](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.FlowTypes 'Abblix\.Oidc\.Server\.Common\.Constants\.FlowTypes') | Represents OAuth 2\.0 flow types\. | --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ApplicationTypes.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common\.Constants](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants 'Abblix\.Oidc\.Server\.Common\.Constants') ## ApplicationTypes Class Defines constants for different types of applications in OAuth 2\.0 and OpenID Connect contexts\. ```csharp public static class ApplicationTypes ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ApplicationTypes ### Fields ## ApplicationTypes\.Native Field {#Abblix.Oidc.Server.Common.Constants.ApplicationTypes.Native} Represents a native application type\. This type is typically used for applications installed on a device, such as mobile apps or desktop applications\. ```csharp public const string Native = "native"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ApplicationTypes\.Web Field {#Abblix.Oidc.Server.Common.Constants.ApplicationTypes.Web} Represents a web application type\. This type is used for applications that are accessed through a web browser and typically hosted on a web server\. ```csharp public const string Web = "web"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.AuthenticationMethodReferences.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common\.Constants](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants 'Abblix\.Oidc\.Server\.Common\.Constants') ## AuthenticationMethodReferences Class Contains IANA\-registered Authentication Method Reference \(AMR\) values as per RFC 8176\. ```csharp public static class AuthenticationMethodReferences ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → AuthenticationMethodReferences ### Fields ## AuthenticationMethodReferences\.Face Field {#Abblix.Oidc.Server.Common.Constants.AuthenticationMethodReferences.Face} Facial recognition biometric \(RFC 8176 `face`\)\. ```csharp public const string Face = "face"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## AuthenticationMethodReferences\.Fingerprint Field {#Abblix.Oidc.Server.Common.Constants.AuthenticationMethodReferences.Fingerprint} Fingerprint biometric \(RFC 8176 `fpt`\)\. ```csharp public const string Fingerprint = "fpt"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## AuthenticationMethodReferences\.Geolocation Field {#Abblix.Oidc.Server.Common.Constants.AuthenticationMethodReferences.Geolocation} Geolocation as a factor \(RFC 8176 `geo`\)\. ```csharp public const string Geolocation = "geo"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## AuthenticationMethodReferences\.HardwareKey Field {#Abblix.Oidc.Server.Common.Constants.AuthenticationMethodReferences.HardwareKey} Proof of possession of a hardware\-secured key \(RFC 8176 `hwk`\)\. ```csharp public const string HardwareKey = "hwk"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## AuthenticationMethodReferences\.IrisScan Field {#Abblix.Oidc.Server.Common.Constants.AuthenticationMethodReferences.IrisScan} Iris scan biometric \(RFC 8176 `iris`\)\. ```csharp public const string IrisScan = "iris"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## AuthenticationMethodReferences\.KnowledgeBased Field {#Abblix.Oidc.Server.Common.Constants.AuthenticationMethodReferences.KnowledgeBased} Knowledge\-based authentication, e\.g\. challenge questions \(RFC 8176 `kba`\)\. ```csharp public const string KnowledgeBased = "kba"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## AuthenticationMethodReferences\.MultiChannel Field {#Abblix.Oidc.Server.Common.Constants.AuthenticationMethodReferences.MultiChannel} Multiple\-channel authentication where parts of the flow run on different channels \(RFC 8176 `mca`\)\. ```csharp public const string MultiChannel = "mca"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## AuthenticationMethodReferences\.MultiFactor Field {#Abblix.Oidc.Server.Common.Constants.AuthenticationMethodReferences.MultiFactor} Multiple\-factor authentication, asserting that two or more independent factors were used \(RFC 8176 `mfa`\)\. ```csharp public const string MultiFactor = "mfa"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## AuthenticationMethodReferences\.OneTimePassword Field {#Abblix.Oidc.Server.Common.Constants.AuthenticationMethodReferences.OneTimePassword} One\-time password \(RFC 8176 `otp`\), e\.g\. TOTP/HOTP code or emailed code\. ```csharp public const string OneTimePassword = "otp"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## AuthenticationMethodReferences\.Password Field {#Abblix.Oidc.Server.Common.Constants.AuthenticationMethodReferences.Password} Password\-based authentication \(RFC 8176 `pwd`\)\. ```csharp public const string Password = "pwd"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## AuthenticationMethodReferences\.Pin Field {#Abblix.Oidc.Server.Common.Constants.AuthenticationMethodReferences.Pin} Personal identification number or unlock pattern \(RFC 8176 `pin`\)\. ```csharp public const string Pin = "pin"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## AuthenticationMethodReferences\.ProofOfPossession Field {#Abblix.Oidc.Server.Common.Constants.AuthenticationMethodReferences.ProofOfPossession} Proof of possession of a cryptographic key \(RFC 8176 `pop`\)\. ```csharp public const string ProofOfPossession = "pop"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## AuthenticationMethodReferences\.RetinaScan Field {#Abblix.Oidc.Server.Common.Constants.AuthenticationMethodReferences.RetinaScan} Retina scan biometric \(RFC 8176 `retina`\)\. ```csharp public const string RetinaScan = "retina"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## AuthenticationMethodReferences\.RiskBased Field {#Abblix.Oidc.Server.Common.Constants.AuthenticationMethodReferences.RiskBased} Risk\-based authentication that adapts factors to a computed risk score \(RFC 8176 `rba`\)\. ```csharp public const string RiskBased = "rba"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## AuthenticationMethodReferences\.SmartCard Field {#Abblix.Oidc.Server.Common.Constants.AuthenticationMethodReferences.SmartCard} Smart\-card\-based authentication, typically with a client certificate \(RFC 8176 `sc`\)\. ```csharp public const string SmartCard = "sc"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## AuthenticationMethodReferences\.Sms Field {#Abblix.Oidc.Server.Common.Constants.AuthenticationMethodReferences.Sms} SMS\-delivered confirmation code \(RFC 8176 `sms`\)\. ```csharp public const string Sms = "sms"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## AuthenticationMethodReferences\.SoftwareKey Field {#Abblix.Oidc.Server.Common.Constants.AuthenticationMethodReferences.SoftwareKey} Proof of possession of a software\-secured key \(RFC 8176 `swk`\)\. ```csharp public const string SoftwareKey = "swk"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## AuthenticationMethodReferences\.Telephone Field {#Abblix.Oidc.Server.Common.Constants.AuthenticationMethodReferences.Telephone} Telephone call confirmation \(RFC 8176 `tel`\)\. ```csharp public const string Telephone = "tel"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## AuthenticationMethodReferences\.UserPresence Field {#Abblix.Oidc.Server.Common.Constants.AuthenticationMethodReferences.UserPresence} User presence test, asserting the user was actively present at authentication \(RFC 8176 `user`\)\. ```csharp public const string UserPresence = "user"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## AuthenticationMethodReferences\.VoiceBiometric Field {#Abblix.Oidc.Server.Common.Constants.AuthenticationMethodReferences.VoiceBiometric} Voice biometric \(RFC 8176 `vbm`\)\. ```csharp public const string VoiceBiometric = "vbm"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## AuthenticationMethodReferences\.WindowsIntegratedAuth Field {#Abblix.Oidc.Server.Common.Constants.AuthenticationMethodReferences.WindowsIntegratedAuth} Windows Integrated Authentication via Kerberos or NTLM \(RFC 8176 `wia`\)\. ```csharp public const string WindowsIntegratedAuth = "wia"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.BackchannelTokenDeliveryModes.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common\.Constants](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants 'Abblix\.Oidc\.Server\.Common\.Constants') ## BackchannelTokenDeliveryModes Class Defines the available delivery modes for backchannel token delivery in Client\-Initiated Backchannel Authentication \(CIBA\)\. These modes specify how the authentication server communicates the result of the backchannel authentication process to the client\. ```csharp public static class BackchannelTokenDeliveryModes ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → BackchannelTokenDeliveryModes ### Fields ## BackchannelTokenDeliveryModes\.Ping Field {#Abblix.Oidc.Server.Common.Constants.BackchannelTokenDeliveryModes.Ping} The "ping" mode where the authorization server notifies the client via a callback when the user has been authenticated\. The client still needs to make a subsequent request to retrieve the token\. ```csharp public const string Ping = "ping"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## BackchannelTokenDeliveryModes\.Poll Field {#Abblix.Oidc.Server.Common.Constants.BackchannelTokenDeliveryModes.Poll} The "poll" mode where the client periodically polls the authorization server to check if the user has been authenticated\. This method is useful in cases where the client prefers to control the polling interval and the process\. ```csharp public const string Poll = "poll"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## BackchannelTokenDeliveryModes\.Push Field {#Abblix.Oidc.Server.Common.Constants.BackchannelTokenDeliveryModes.Push} The "push" mode where the authorization server directly pushes the token to the client once the user has been authenticated\. This method streamlines the process by delivering the token to the client without the need for further requests\. ```csharp public const string Push = "push"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ClientAssertionTypes.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common\.Constants](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants 'Abblix\.Oidc\.Server\.Common\.Constants') ## ClientAssertionTypes Class Provides constants for client assertion types used in OAuth 2\.0\. ```csharp public static class ClientAssertionTypes ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ClientAssertionTypes ### Fields ## ClientAssertionTypes\.JwtBearer Field {#Abblix.Oidc.Server.Common.Constants.ClientAssertionTypes.JwtBearer} URN identifying a JWT bearer token as the client authentication assertion at the token endpoint, per RFC 7523 \(JSON Web Token Profile for OAuth 2\.0 Client Authentication and Authorization Grants\)\. Submitted as the `client_assertion_type` parameter together with the signed JWT in `client_assertion`\. ```csharp public const string JwtBearer = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ClientAuthenticationMethods.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common\.Constants](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants 'Abblix\.Oidc\.Server\.Common\.Constants') ## ClientAuthenticationMethods Class This class defines various client authentication methods used in OAuth 2\.0\. ```csharp public static class ClientAuthenticationMethods ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ClientAuthenticationMethods ### Fields ## ClientAuthenticationMethods\.ClientSecretBasic Field {#Abblix.Oidc.Server.Common.Constants.ClientAuthenticationMethods.ClientSecretBasic} Client authenticates with the authorization server using the client ID and secret via HTTP Basic Authentication\. ```csharp public const string ClientSecretBasic = "client_secret_basic"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ClientAuthenticationMethods\.ClientSecretJwt Field {#Abblix.Oidc.Server.Common.Constants.ClientAuthenticationMethods.ClientSecretJwt} The client uses a JWT \(JSON Web Token\) as a client assertion to authenticate\. ```csharp public const string ClientSecretJwt = "client_secret_jwt"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ClientAuthenticationMethods\.ClientSecretPost Field {#Abblix.Oidc.Server.Common.Constants.ClientAuthenticationMethods.ClientSecretPost} Similar to ClientSecretBasic, but the client secret is sent in the request body\. ```csharp public const string ClientSecretPost = "client_secret_post"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ClientAuthenticationMethods\.None Field {#Abblix.Oidc.Server.Common.Constants.ClientAuthenticationMethods.None} Indicates that no client authentication is for the OAuth request\. ```csharp public const string None = "none"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ClientAuthenticationMethods\.PrivateKeyJwt Field {#Abblix.Oidc.Server.Common.Constants.ClientAuthenticationMethods.PrivateKeyJwt} Similar to ClientSecretJwt, but it uses a private key to sign the JWT\. ```csharp public const string PrivateKeyJwt = "private_key_jwt"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ClientAuthenticationMethods\.SelfSignedTlsClientAuth Field {#Abblix.Oidc.Server.Common.Constants.ClientAuthenticationMethods.SelfSignedTlsClientAuth} Mutual TLS client authentication using a self\-signed client certificate and the client's registered JWKS to identify acceptable public keys\. RFC 8705\. ```csharp public const string SelfSignedTlsClientAuth = "self_signed_tls_client_auth"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ClientAuthenticationMethods\.TlsClientAuth Field {#Abblix.Oidc.Server.Common.Constants.ClientAuthenticationMethods.TlsClientAuth} Mutual TLS client authentication where the client's certificate chain is validated against the AS trust store and matched using client metadata \(subject/SAN\)\. RFC 8705\. ```csharp public const string TlsClientAuth = "tls_client_auth"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ClientSecurityProfile.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common\.Constants](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants 'Abblix\.Oidc\.Server\.Common\.Constants') ## ClientSecurityProfile Enum A named bundle of security controls a client is held to\. Selecting a profile forces the whole bundle on the client at once and prevents an individual toggle from silently weakening it, which is what makes a client conformant with one setting instead of several hand\-tuned flags\. ```csharp public enum ClientSecurityProfile ``` ### Fields ###### `None` 0 {#Abblix.Oidc.Server.Common.Constants.ClientSecurityProfile.None} No bundled profile: nothing is demanded beyond the client's individual metadata flags\. As a client's explicit value it therefore adds nothing to whatever the deployment already demands, and takes nothing away; as the server\-wide [DefaultSecurityProfile](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions#Abblix.Oidc.Server.Common.Configuration.OidcOptions.DefaultSecurityProfile 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions\.DefaultSecurityProfile') it demands nothing of anyone\. A client that states no preference leaves its profile unset \(`null`\) rather than selecting this\. ###### `Fapi2` 1 {#Abblix.Oidc.Server.Common.Constants.ClientSecurityProfile.Fapi2} The FAPI 2\.0 Security Profile\. Forces PKCE restricted to `S256`, Pushed Authorization Requests, sender\-constrained \(DPoP\) tokens, and the authorization\-code response type only, regardless of the client's individual toggles\. This is the prerequisite for running the OpenID Foundation FAPI 2\.0 conformance suite against the client\. ### Remarks Deliberately a closed enum rather than a set of independent booleans: the value set is fixed by the library \(a host cannot invent a profile\), and a single discriminator is what the effective\-policy lookup and the fail\-loud self\-consistency check both key on\. New profiles \(message\-signing, HAIP, \.\.\.\) extend this enum; the control mapping lives in [SecurityProfileRequirements](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileRequirements 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.SecurityProfileRequirements') so adding one touches a single place\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ClientType.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common\.Constants](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants 'Abblix\.Oidc\.Server\.Common\.Constants') ## ClientType Enum Enumeration representing the type of OAuth 2\.0 client\. ```csharp public enum ClientType ``` ### Fields ###### `Public` 0 {#Abblix.Oidc.Server.Common.Constants.ClientType.Public} Represents a public client that does not have a client secret\. ###### `Confidential` 1 {#Abblix.Oidc.Server.Common.Constants.ClientType.Confidential} Represents a confidential client that has a client secret\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.CodeChallengeMethods.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common\.Constants](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants 'Abblix\.Oidc\.Server\.Common\.Constants') ## CodeChallengeMethods Class Static class representing the methods for PKCE \(Proof Key for Code Exchange\) code challenges\. ```csharp public static class CodeChallengeMethods ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → CodeChallengeMethods ### Fields ## CodeChallengeMethods\.Plain Field {#Abblix.Oidc.Server.Common.Constants.CodeChallengeMethods.Plain} Represents the "plain" code challenge method where the code verifier is sent without hashing\. ```csharp public const string Plain = "plain"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## CodeChallengeMethods\.S256 Field {#Abblix.Oidc.Server.Common.Constants.CodeChallengeMethods.S256} Represents the "S256" code challenge method where the code verifier is hashed using SHA\-256\. ```csharp public const string S256 = "S256"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## CodeChallengeMethods\.S512 Field {#Abblix.Oidc.Server.Common.Constants.CodeChallengeMethods.S512} Represents the "S512" code challenge method where the code verifier is hashed using SHA\-512\. This method provides a higher level of security through a stronger hashing algorithm\. ```csharp public const string S512 = "S512"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.DisplayModes.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common\.Constants](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants 'Abblix\.Oidc\.Server\.Common\.Constants') ## DisplayModes Class The class representing the display modes for the authentication and consent UI\. ```csharp public static class DisplayModes ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → DisplayModes ### Fields ## DisplayModes\.Page Field {#Abblix.Oidc.Server.Common.Constants.DisplayModes.Page} The Authorization Server SHOULD display the authentication and consent UI consistent with a full User Agent page view\. If the display parameter is not specified, this is the default display mode\. ```csharp public const string Page = "page"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## DisplayModes\.Popup Field {#Abblix.Oidc.Server.Common.Constants.DisplayModes.Popup} The Authorization Server SHOULD display the authentication and consent UI consistent with a popup User Agent window\. The popup User Agent window should be of an appropriate size for a login\-focused dialog and should not obscure the entire window that it is popping up over\. ```csharp public const string Popup = "popup"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## DisplayModes\.Touch Field {#Abblix.Oidc.Server.Common.Constants.DisplayModes.Touch} The Authorization Server SHOULD display the authentication and consent UI consistent with a device that leverages a touch interface\. ```csharp public const string Touch = "touch"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## DisplayModes\.Wap Field {#Abblix.Oidc.Server.Common.Constants.DisplayModes.Wap} The Authorization Server SHOULD display the authentication and consent UI consistent with a "feature phone" type display\. ```csharp public const string Wap = "wap"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ErrorCodes.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common\.Constants](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants 'Abblix\.Oidc\.Server\.Common\.Constants') ## ErrorCodes Class Represents OAuth 2\.0 and OpenID Connect error codes\. ```csharp public static class ErrorCodes ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ErrorCodes ### Fields ## ErrorCodes\.AccessDenied Field {#Abblix.Oidc.Server.Common.Constants.ErrorCodes.AccessDenied} The resource owner or authorization server denied the request\. ```csharp public const string AccessDenied = "access_denied"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ErrorCodes\.AccountSelectionRequired Field {#Abblix.Oidc.Server.Common.Constants.ErrorCodes.AccountSelectionRequired} The End\-User is REQUIRED to select a session at the Authorization Server\. The End\-User MAY be authenticated at the Authorization Server with different associated accounts, but the End\-User did not select a session\. This error MAY be returned when the prompt parameter value in the Authentication Request is none, but the Authentication Request cannot be completed without displaying a user interface to prompt for a session to use\. ```csharp public const string AccountSelectionRequired = "account_selection_required"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ErrorCodes\.AuthorizationPending Field {#Abblix.Oidc.Server.Common.Constants.ErrorCodes.AuthorizationPending} The authorization request is still pending as the end\-user has not yet been authenticated\. ```csharp public const string AuthorizationPending = "authorization_pending"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ErrorCodes\.ConfirmationRequired Field {#Abblix.Oidc.Server.Common.Constants.ErrorCodes.ConfirmationRequired} The request requires additional confirmation from the resource owner or authorization server\. ```csharp public const string ConfirmationRequired = "confirmation_required"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ErrorCodes\.ConsentRequired Field {#Abblix.Oidc.Server.Common.Constants.ErrorCodes.ConsentRequired} The Authorization Server requires End\-User consent\. This error MAY be returned when the prompt parameter value in the Authentication Request is none, but the Authentication Request cannot be completed without displaying a user interface for End\-User consent\. ```csharp public const string ConsentRequired = "consent_required"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ErrorCodes\.ExpiredLoginHintToken Field {#Abblix.Oidc.Server.Common.Constants.ErrorCodes.ExpiredLoginHintToken} The login\_hint\_token provided in the authentication request is not valid because it has expired\. ```csharp public const string ExpiredLoginHintToken = "expired_login_hint_token"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ErrorCodes\.ExpiredToken Field {#Abblix.Oidc.Server.Common.Constants.ErrorCodes.ExpiredToken} The auth\_req\_id has expired\. The Client will need to make a new Authentication Request\. ```csharp public const string ExpiredToken = "expired_token"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ErrorCodes\.InsufficientScope Field {#Abblix.Oidc.Server.Common.Constants.ErrorCodes.InsufficientScope} The request requires higher privileges than provided by the access token\. Per RFC 6750 Section 3\.1, the resource server MUST respond with HTTP 403 \(Forbidden\) and SHOULD include the `scope` attribute in the `WWW-Authenticate` header listing the required scopes\. ```csharp public const string InsufficientScope = "insufficient_scope"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ErrorCodes\.InteractionRequired Field {#Abblix.Oidc.Server.Common.Constants.ErrorCodes.InteractionRequired} The Authorization Server requires End\-User interaction of some form to proceed\. This error MAY be returned when the prompt parameter value in the Authentication Request is none, but the Authentication Request cannot be completed without displaying a user interface for End\-User interaction\. ```csharp public const string InteractionRequired = "interaction_required"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ErrorCodes\.InvalidAuthorizationDetails Field {#Abblix.Oidc.Server.Common.Constants.ErrorCodes.InvalidAuthorizationDetails} The `authorization_details` parameter in the request is invalid per RFC 9396 §5: an entry's `type` is unknown to the AS, fields do not match the registered per\-type schema, field values are out of the wrong JSON type, or the request otherwise fails to satisfy the per\-type validator\. The AS MUST refuse to process the request\. ```csharp public const string InvalidAuthorizationDetails = "invalid_authorization_details"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ErrorCodes\.InvalidBindingMessage Field {#Abblix.Oidc.Server.Common.Constants.ErrorCodes.InvalidBindingMessage} The binding message is invalid or unacceptable for use in the context of the given request\. ```csharp public const string InvalidBindingMessage = "invalid_binding_message"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ErrorCodes\.InvalidClient Field {#Abblix.Oidc.Server.Common.Constants.ErrorCodes.InvalidClient} Client authentication failed \(e\.g\., unknown client, no client authentication included, or unsupported authentication method\)\. The authorization server MAY return an HTTP 401 \(Unauthorized\) status code to indicate which HTTP authentication schemes are supported\. If the client attempted to authenticate via the "Authorization" request header field, the authorization server MUST respond with an HTTP 401 \(Unauthorized\) status code and include the "WWW\-Authenticate" response header field matching the authentication scheme used by the client\. ```csharp public const string InvalidClient = "invalid_client"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ErrorCodes\.InvalidClientMetadata Field {#Abblix.Oidc.Server.Common.Constants.ErrorCodes.InvalidClientMetadata} The value of one of the Client Metadata fields is invalid and the server has rejected this request\. ```csharp public const string InvalidClientMetadata = "invalid_client_metadata"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks Note that an Authorization Server MAY choose to substitute a valid value for any requested parameter of a Client's Metadata\. ## ErrorCodes\.InvalidDPoPProof Field {#Abblix.Oidc.Server.Common.Constants.ErrorCodes.InvalidDPoPProof} The DPoP proof JWT presented with the request is invalid \(RFC 9449 §7\.1\)\. This is the OAuth\-protocol\-level error code returned to the client for ANY structural, algorithmic, claim\-binding, signature, or replay\-protection failure of a DPoP proof\. The fine\-grained internal reason \(used in logs and metrics\) is carried separately\. ```csharp public const string InvalidDPoPProof = "invalid_dpop_proof"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ErrorCodes\.InvalidGrant Field {#Abblix.Oidc.Server.Common.Constants.ErrorCodes.InvalidGrant} The provided authorization grant \(e\.g\., authorization code, resource owner credentials\) or refresh token is invalid, expired, revoked, does not match the redirection URI used in the authorization request, or was issued to another client\. ```csharp public const string InvalidGrant = "invalid_grant"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ErrorCodes\.InvalidRedirectUri Field {#Abblix.Oidc.Server.Common.Constants.ErrorCodes.InvalidRedirectUri} The value of one or more redirect\_uris is invalid\. ```csharp public const string InvalidRedirectUri = "invalid_redirect_uri"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ErrorCodes\.InvalidRequest Field {#Abblix.Oidc.Server.Common.Constants.ErrorCodes.InvalidRequest} The request is missing a parameter, includes an unsupported parameter value \(other than grant type\), repeats a parameter, includes multiple credentials, utilizes more than one mechanism for authenticating the client, or is otherwise malformed\. ```csharp public const string InvalidRequest = "invalid_request"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ErrorCodes\.InvalidRequestObject Field {#Abblix.Oidc.Server.Common.Constants.ErrorCodes.InvalidRequestObject} The request parameter contains an invalid Request Object\. ```csharp public const string InvalidRequestObject = "invalid_request_object"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ErrorCodes\.InvalidRequestUri Field {#Abblix.Oidc.Server.Common.Constants.ErrorCodes.InvalidRequestUri} The request\_uri in the Authorization Request returns an error or contains invalid data\. ```csharp public const string InvalidRequestUri = "invalid_request_uri"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ErrorCodes\.InvalidScope Field {#Abblix.Oidc.Server.Common.Constants.ErrorCodes.InvalidScope} The requested scope is invalid, unknown, malformed, or exceeds the scope granted by the resource owner\. ```csharp public const string InvalidScope = "invalid_scope"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ErrorCodes\.InvalidSoftwareStatement Field {#Abblix.Oidc.Server.Common.Constants.ErrorCodes.InvalidSoftwareStatement} The software statement presented is invalid per RFC 7591 Section 3\.2\.2\. ```csharp public const string InvalidSoftwareStatement = "invalid_software_statement"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ErrorCodes\.InvalidTarget Field {#Abblix.Oidc.Server.Common.Constants.ErrorCodes.InvalidTarget} The target resource or identifier provided in the request is invalid\. ```csharp public const string InvalidTarget = "invalid_target"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ErrorCodes\.InvalidToken Field {#Abblix.Oidc.Server.Common.Constants.ErrorCodes.InvalidToken} The access token provided is expired, revoked, malformed, or invalid for other reasons\. Per RFC 6750 Section 3\.1, the resource server MUST respond with HTTP 401 \(Unauthorized\)\. ```csharp public const string InvalidToken = "invalid_token"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ErrorCodes\.InvalidUserCode Field {#Abblix.Oidc.Server.Common.Constants.ErrorCodes.InvalidUserCode} The user code was invalid\. ```csharp public const string InvalidUserCode = "invalid_user_code"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ErrorCodes\.LoginRequired Field {#Abblix.Oidc.Server.Common.Constants.ErrorCodes.LoginRequired} The Authorization Server requires End\-User authentication\. This error MAY be returned when the prompt parameter value in the Authentication Request is none, but the Authentication Request cannot be completed without displaying a user interface for End\-User authentication\. ```csharp public const string LoginRequired = "login_required"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ErrorCodes\.MissingUserCode Field {#Abblix.Oidc.Server.Common.Constants.ErrorCodes.MissingUserCode} User code is required but was missing from the request\. ```csharp public const string MissingUserCode = "missing_user_code"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ErrorCodes\.RegistrationNotSupported Field {#Abblix.Oidc.Server.Common.Constants.ErrorCodes.RegistrationNotSupported} The OpenId Provider does not support use of the registration parameter defined in Section 7\.2\.1: https://openid.net/specs/openid-connect-core-1\_0.html\#RegistrationParameter ```csharp public const string RegistrationNotSupported = "registration_not_supported"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ErrorCodes\.RequestNotSupported Field {#Abblix.Oidc.Server.Common.Constants.ErrorCodes.RequestNotSupported} The OpenId Provider does not support use of the request parameter defined in Section 6: https://openid.net/specs/openid-connect-core-1\_0.html\#JWTRequests ```csharp public const string RequestNotSupported = "request_not_supported"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ErrorCodes\.RequestUriNotSupported Field {#Abblix.Oidc.Server.Common.Constants.ErrorCodes.RequestUriNotSupported} The OpenId Provider does not support use of the request\_uri parameter defined in Section 6: https://openid.net/specs/openid-connect-core-1\_0.html\#JWTRequests ```csharp public const string RequestUriNotSupported = "request_uri_not_supported"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ErrorCodes\.ServerError Field {#Abblix.Oidc.Server.Common.Constants.ErrorCodes.ServerError} The authorization server encountered an unexpected condition that prevented it from fulfilling the request\. ```csharp public const string ServerError = "server_error"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks This error code is necessary because a 500 Internal Server Error HTTP status code cannot be returned to the client via an HTTP redirect\. ## ErrorCodes\.SlowDown Field {#Abblix.Oidc.Server.Common.Constants.ErrorCodes.SlowDown} A variant of "authorization\_pending", the authorization request is still pending and polling should continue, but the interval MUST be increased by at least 5 seconds for this and all further requests\. ```csharp public const string SlowDown = "slow_down"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ErrorCodes\.TemporarilyUnavailable Field {#Abblix.Oidc.Server.Common.Constants.ErrorCodes.TemporarilyUnavailable} The authorization server is currently unable to handle the request due to a temporary overloading or maintenance of the server\. ```csharp public const string TemporarilyUnavailable = "temporarily_unavailable"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks This error code is necessary because a 500 Internal Server Error HTTP status code cannot be returned to the client via an HTTP redirect\. ## ErrorCodes\.UnapprovedSoftwareStatement Field {#Abblix.Oidc.Server.Common.Constants.ErrorCodes.UnapprovedSoftwareStatement} The software statement was valid but the software has not been approved for use by this authorization server per RFC 7591 Section 3\.2\.2\. ```csharp public const string UnapprovedSoftwareStatement = "unapproved_software_statement"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ErrorCodes\.UnauthorizedClient Field {#Abblix.Oidc.Server.Common.Constants.ErrorCodes.UnauthorizedClient} The authenticated client is not authorized to use this authorization grant type\. ```csharp public const string UnauthorizedClient = "unauthorized_client"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ErrorCodes\.UnknownUserId Field {#Abblix.Oidc.Server.Common.Constants.ErrorCodes.UnknownUserId} The OpenID Provider is not able to identify which end\-user the Client wishes to be authenticated by the hint provided in the request \(login\_hint\_token, id\_token\_hint, or login\_hint\)\. ```csharp public const string UnknownUserId = "unknown_user_id"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ErrorCodes\.UnsupportedGrantType Field {#Abblix.Oidc.Server.Common.Constants.ErrorCodes.UnsupportedGrantType} The authorization grant type is not supported by the authorization server\. ```csharp public const string UnsupportedGrantType = "unsupported_grant_type"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ErrorCodes\.UnsupportedResponseType Field {#Abblix.Oidc.Server.Common.Constants.ErrorCodes.UnsupportedResponseType} The authorization server does not support obtaining a response using this method\. ```csharp public const string UnsupportedResponseType = "unsupported_response_type"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ErrorCodes\.UnsupportedTokenType Field {#Abblix.Oidc.Server.Common.Constants.ErrorCodes.UnsupportedTokenType} The authorization server does not support the revocation of the presented token type\. That is, the client tried to revoke an access token on a server not supporting this feature\. ```csharp public const string UnsupportedTokenType = "unsupported_token_type"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ErrorCodes\.UseDPoPNonce Field {#Abblix.Oidc.Server.Common.Constants.ErrorCodes.UseDPoPNonce} The authorization server or resource server requires a DPoP\-Nonce in the proof \(RFC 9449 §8\)\. The response carries a `DPoP-Nonce` header with the nonce value the client must include in subsequent proofs\. ```csharp public const string UseDPoPNonce = "use_dpop_nonce"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.FlowTypes.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common\.Constants](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants 'Abblix\.Oidc\.Server\.Common\.Constants') ## FlowTypes Enum Represents OAuth 2\.0 flow types\. ```csharp public enum FlowTypes ``` ### Fields ###### `AuthorizationCode` 1 {#Abblix.Oidc.Server.Common.Constants.FlowTypes.AuthorizationCode} When using the Authorization Code Flow, all tokens are returned from the Token Endpoint\. The Authorization Code Flow returns an Authorization Code to the Client, which can then exchange it for an ID Token and an Access Token directly\. This provides the benefit of not exposing any tokens to the User Agent and possibly other malicious applications with access to the User Agent\. The Authorization Server can also authenticate the Client before exchanging the Authorization Code for an Access Token\. The Authorization Code flow is suitable for Clients that can securely maintain a Client Secret between themselves and the Authorization Server\. ### Remarks https://openid.net/specs/openid-connect-core-1\_0.html\#CodeFlowAuth ###### `Implicit` 2 {#Abblix.Oidc.Server.Common.Constants.FlowTypes.Implicit} When using the Implicit Flow, all tokens are returned from the Authorization Endpoint; the Token Endpoint is not used\. The Implicit Flow is mainly used by Clients implemented in a browser using a scripting language\. The Access Token and ID Token are returned directly to the Client, which may expose them to the End\-User and applications that have access to the End\-User's User Agent\. The Authorization Server does not perform Client Authentication\. ### Remarks https://openid.net/specs/openid-connect-core-1\_0.html\#ImplicitFlowAuth ###### `Hybrid` 3 {#Abblix.Oidc.Server.Common.Constants.FlowTypes.Hybrid} When using the Hybrid Flow, some tokens are returned from the Authorization Endpoint and others are returned from the Token Endpoint\. The mechanisms for returning tokens in the Hybrid Flow are specified in OAuth 2\.0 Multiple Response Type Encoding Practices\. ### Remarks https://openid.net/specs/openid-connect-core-1\_0.html\#HybridFlowSteps ###### `None` 4 {#Abblix.Oidc.Server.Common.Constants.FlowTypes.None} The `none` response type flow \(OAuth 2\.0 Multiple Response Type Encoding Practices §4\): the authorization request runs to completion but the response carries no authorization code and no tokens\. A distinct non\-zero value so it never collides with `default(FlowTypes)`, which the flow detector uses as its "no flow detected" sentinel; it does not combine with the token\-part flags above\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.GrantTypes.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common\.Constants](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants 'Abblix\.Oidc\.Server\.Common\.Constants') ## GrantTypes Class Represents OAuth 2\.0 grant types\. ```csharp public static class GrantTypes ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → GrantTypes ### Fields ## GrantTypes\.AuthorizationCode Field {#Abblix.Oidc.Server.Common.Constants.GrantTypes.AuthorizationCode} Represents the Authorization Code grant type\. Used when a client wants to exchange an authorization code for an access token\. Commonly used in web applications with server\-side backends\. ```csharp public const string AuthorizationCode = "authorization_code"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## GrantTypes\.Ciba Field {#Abblix.Oidc.Server.Common.Constants.GrantTypes.Ciba} Represents the CIBA \(Client Initiated Backchannel Authentication\) grant type\. Used for authentication with minimal user interaction, often in use cases like strong customer authentication\. ```csharp public const string Ciba = "urn:openid:params:grant-type:ciba"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## GrantTypes\.ClientCredentials Field {#Abblix.Oidc.Server.Common.Constants.GrantTypes.ClientCredentials} Represents the Client Credentials grant type\. Used when a client requests an access token using its own credentials\. Suitable for machine\-to\-machine communication\. ```csharp public const string ClientCredentials = "client_credentials"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## GrantTypes\.DeviceAuthorization Field {#Abblix.Oidc.Server.Common.Constants.GrantTypes.DeviceAuthorization} Represents the Device Authorization grant type\. This grant type is used in scenarios where the client device lacks a browser or has limited input capabilities, allowing it to get user authorization from another device with better input capabilities\. It is particularly useful for devices in the IoT \(Internet of Things\) sector and smart devices that require user interaction for authorization\. ```csharp public const string DeviceAuthorization = "urn:ietf:params:oauth:grant-type:device_code"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## GrantTypes\.Implicit Field {#Abblix.Oidc.Server.Common.Constants.GrantTypes.Implicit} Represents the Implicit grant type\. Used in single\-page applications to get access tokens directly from the authorization endpoint\. Suitable for browser\-based applications\. ```csharp public const string Implicit = "implicit"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## GrantTypes\.JwtBearer Field {#Abblix.Oidc.Server.Common.Constants.GrantTypes.JwtBearer} Represents the JWT Bearer grant type\. Allows clients to request access tokens using a JWT \(JSON Web Token\) assertion\. Useful for securing API\-to\-API communication\. ```csharp public const string JwtBearer = "urn:ietf:params:oauth:grant-type:jwt-bearer"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## GrantTypes\.Password Field {#Abblix.Oidc.Server.Common.Constants.GrantTypes.Password} Represents the Password grant type\. Allows clients to exchange a username and password for an access token\. Should be used with caution due to potential security risks\. ```csharp public const string Password = "password"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## GrantTypes\.RefreshToken Field {#Abblix.Oidc.Server.Common.Constants.GrantTypes.RefreshToken} Represents the Refresh Token grant type\. Used to get a new access token using a refresh token\. Helpful for maintaining user sessions without requiring re\-authentication\. ```csharp public const string RefreshToken = "refresh_token"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## GrantTypes\.TokenExchange Field {#Abblix.Oidc.Server.Common.Constants.GrantTypes.TokenExchange} Represents the Token Exchange grant type per RFC 8693\. Allows a client holding a token issued by this AS \(or, in federated scenarios, by a trusted external IdP\) to exchange it for a new token with possibly narrower scope, different audience, or a different token type\. Supports both impersonation \(the issued token represents the original subject directly\) and delegation \(an `act` claim chain records the intermediate actor\)\. ```csharp public const string TokenExchange = "urn:ietf:params:oauth:grant-type:token-exchange"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.HttpRequestHeaders.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common\.Constants](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants 'Abblix\.Oidc\.Server\.Common\.Constants') ## HttpRequestHeaders Class This class defines HTTP header names commonly used in HTTP requests\. ```csharp public static class HttpRequestHeaders ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → HttpRequestHeaders ### Fields ## HttpRequestHeaders\.Authorization Field {#Abblix.Oidc.Server.Common.Constants.HttpRequestHeaders.Authorization} The "Authorization" header is used in HTTP requests to include authentication credentials\. It is crucial for securing API endpoints and providing proof of client identity or permissions\. ```csharp public const string Authorization = "Authorization"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## HttpRequestHeaders\.DPoP Field {#Abblix.Oidc.Server.Common.Constants.HttpRequestHeaders.DPoP} The "DPoP" request header carries the proof JWT bound to the current request method\+URI per RFC 9449 §4\.1\. Present on token, userinfo, introspection, and revocation requests when the client demonstrates proof\-of\-possession of the access\-token\-binding key\. ```csharp public const string DPoP = "DPoP"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## HttpRequestHeaders\.DPoPNonce Field {#Abblix.Oidc.Server.Common.Constants.HttpRequestHeaders.DPoPNonce} The "DPoP\-Nonce" response header carries the fresh nonce on a `use_dpop_nonce` challenge response per RFC 9449 §8 / §9\. Although a response header by direction, it lives alongside the request\-header constants here to keep all DPoP wire\-form names in one place; consumers are response formatters writing it onto outbound responses\. ```csharp public const string DPoPNonce = "DPoP-Nonce"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.JwtTypes.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common\.Constants](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants 'Abblix\.Oidc\.Server\.Common\.Constants') ## JwtTypes Class The `typ` values this server mints for its own token kinds, and the refusal decision that sees them\. The specification\-fixed vocabulary lives in the JWT core's [JsonWebTokenTypes](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenTypes 'Abblix\.Jwt\.JsonWebTokenTypes'), shared by every package on the core; what stays here is what only this product can own \- its vendor\-tree values \- plus the combined known set the two vocabularies form together\. ```csharp public static class JwtTypes ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → JwtTypes ### Remarks RFC 6838 Section 3\.2 is where the prefix comes from: the vendor tree "is used for media types associated with publicly available products", and its registrations "will be distinguished by the leading facet vnd\."\. Names without it belong to the standards tree, where a future registration of the same word would collide with ours \- and, worse for a reader, a name sitting there looks exactly as authoritative as one that was actually standardised\. Changing a prefixed value is possible but not free: it changes what an already-issued token looks like, so tokens minted before the change stop being recognised. ### Fields ## JwtTypes\.AccessToken Field {#Abblix.Oidc.Server.Common.Constants.JwtTypes.AccessToken} The "AccessToken" JWT type per RFC 9068, fixed by the specification\. ```csharp public const string AccessToken = "at+jwt"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JwtTypes\.DPoPProof Field {#Abblix.Oidc.Server.Common.Constants.JwtTypes.DPoPProof} The "DPoP proof" JWT type per RFC 9449 §4\.2, fixed by the specification\. ```csharp public const string DPoPProof = "dpop+jwt"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JwtTypes\.InitialAccessToken Field {#Abblix.Oidc.Server.Common.Constants.JwtTypes.InitialAccessToken} The "InitialAccessToken" JWT type is used to authorize calls to the client registration endpoint per RFC 7591 Section 3\. ```csharp public const string InitialAccessToken = "vnd.abblix.iat+jwt"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks Not replaceable by [AccessToken](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenTypes#Abblix.Jwt.JsonWebTokenTypes.AccessToken 'Abblix\.Jwt\.JsonWebTokenTypes\.AccessToken'), and here the type is load\-bearing on its own\. Beyond it, the validator asks only for a non\-empty subject that has not been revoked, so sharing a type with the access token would let any access token this server issued register clients\. ## JwtTypes\.Jwt Field {#Abblix.Oidc.Server.Common.Constants.JwtTypes.Jwt} Standard JSON Web Token type\. Per RFC 7519 Section 5\.1, this is the recommended value for the 'typ' header parameter\. ```csharp public const string Jwt = "JWT"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JwtTypes\.LogoutToken Field {#Abblix.Oidc.Server.Common.Constants.JwtTypes.LogoutToken} The "LogoutToken" JWT type per OpenID Connect Back\-Channel Logout, fixed by the specification\. ```csharp public const string LogoutToken = "logout+jwt"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## JwtTypes\.RefreshToken Field {#Abblix.Oidc.Server.Common.Constants.JwtTypes.RefreshToken} The "RefreshToken" JWT type is used to represent refresh tokens, which allow obtaining new access tokens without reauthentication\. ```csharp public const string RefreshToken = "vnd.abblix.rt+jwt"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks Not replaceable by [AccessToken](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenTypes#Abblix.Jwt.JsonWebTokenTypes.AccessToken 'Abblix\.Jwt\.JsonWebTokenTypes\.AccessToken'), and the reason is a protection rather than a preference\. A refresh token carries the resources of its grant in the audience claim, exactly as the access token of that grant does, so with a shared type nothing would separate the two and a resource server presented with a refresh token would have no ground to refuse it\. There is also nowhere standard to move to: the IANA media types registry holds no entry for a refresh token, which follows from RFC 6749 Section 1\.5 making it a value "intended for use only with authorization servers"\. ## JwtTypes\.RegistrationAccessToken Field {#Abblix.Oidc.Server.Common.Constants.JwtTypes.RegistrationAccessToken} The "RegistrationAccessToken" JWT type is used in OAuth 2\.0 Dynamic Client Registration for securely registering clients\. ```csharp public const string RegistrationAccessToken = "vnd.abblix.dcr+jwt"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks Not replaceable by [AccessToken](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenTypes#Abblix.Jwt.JsonWebTokenTypes.AccessToken 'Abblix\.Jwt\.JsonWebTokenTypes\.AccessToken')\. Its validator does ask for more \- the subject must name the client being managed, and the identifier must match the one that client records \- but the second of those is enforced only where a record exists, which leaves a statically configured client defended by the subject alone\. An access token issued for the client itself carries that same subject, so the type is what keeps the two apart\. See also [InitialAccessToken](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.JwtTypes#Abblix.Oidc.Server.Common.Constants.JwtTypes.InitialAccessToken 'Abblix\.Oidc\.Server\.Common\.Constants\.JwtTypes\.InitialAccessToken'), which has nothing else at all\. ## JwtTypes\.TokenIntrospection Field {#Abblix.Oidc.Server.Common.Constants.JwtTypes.TokenIntrospection} The "token introspection response" JWT type per RFC 9701 §5, fixed by the specification\. ```csharp public const string TokenIntrospection = "token-introspection+jwt"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Methods ## JwtTypes\.IsPermitted\(string, string\[\]\) Method {#Abblix.Oidc.Server.Common.Constants.JwtTypes.IsPermitted(string,string[])} Reports whether a `typ` is one this position permits, over the combined vocabulary of the core registry and this server's vendor values\. The decision itself \- refusal by kind, with an absent, generic or unfamiliar value passing untouched \- is [IsPermitted\(string, IReadOnlyList<string>, string\[\]\)](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenTypes#Abblix.Jwt.JsonWebTokenTypes.IsPermitted(string,System.Collections.Generic.IReadOnlyList_string_,string[]) 'Abblix\.Jwt\.JsonWebTokenTypes\.IsPermitted\(System\.String,System\.Collections\.Generic\.IReadOnlyList\{System\.String\},System\.String\[\]\)'); see its remarks for why the refused side is enumerated rather than the accepted one\. ```csharp public static bool IsPermitted(string? tokenType, params string[] permittedTypes); ``` #### Parameters ###### `tokenType` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Common.Constants.JwtTypes.IsPermitted(string,string[]).tokenType} The `typ` header parameter of the incoming JWT, which may be absent\. ###### `permittedTypes` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Oidc.Server.Common.Constants.JwtTypes.IsPermitted(string,string[]).permittedTypes} The types this position permits\. Pass none where the JWT that belongs there carries no `typ` at all, as an ID token does \- then every known type is out of place\. #### Returns [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') `true` for an absent, generic or unfamiliar value and for any of [permittedTypes](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.JwtTypes#Abblix.Oidc.Server.Common.Constants.JwtTypes.IsPermitted(string,string[]).permittedTypes 'Abblix\.Oidc\.Server\.Common\.Constants\.JwtTypes\.IsPermitted\(string, string\[\]\)\.permittedTypes'); `false` only for a known type that is not among them\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.MediaTypes.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common\.Constants](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants 'Abblix\.Oidc\.Server\.Common\.Constants') ## MediaTypes Class Represents common media types used in HTTP requests and responses\. ```csharp public static class MediaTypes ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → MediaTypes ### Fields ## MediaTypes\.FormUrlEncoded Field {#Abblix.Oidc.Server.Common.Constants.MediaTypes.FormUrlEncoded} Represents the "application/x\-www\-form\-urlencoded" media type for HTML form data\. ```csharp public const string FormUrlEncoded = "application/x-www-form-urlencoded"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## MediaTypes\.Javascript Field {#Abblix.Oidc.Server.Common.Constants.MediaTypes.Javascript} Represents the "text/javascript" media type for JavaScript code\. ```csharp public const string Javascript = "text/javascript"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## MediaTypes\.Jwt Field {#Abblix.Oidc.Server.Common.Constants.MediaTypes.Jwt} Represents the "application/jwt" media type for JSON Web Tokens \(JWT\)\. ```csharp public const string Jwt = "application/jwt"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## MediaTypes\.TokenIntrospectionJwt Field {#Abblix.Oidc.Server.Common.Constants.MediaTypes.TokenIntrospectionJwt} Represents the "application/token\-introspection\+jwt" media type for a JWT\-formatted token introspection response \(RFC 9701 §4\): the media type a client sends in `Accept` to request a JWT response, and the `Content-Type` the server returns it with\. ```csharp public const string TokenIntrospectionJwt = "application/token-introspection+jwt"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.OidcConstants.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common\.Constants](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants 'Abblix\.Oidc\.Server\.Common\.Constants') ## OidcConstants Class Shared identifiers the HTTP transport adapters \(MVC, Minimal API\) agree on\. The core declares them so both adapters reference one value rather than each carrying its own copy\. ```csharp public static class OidcConstants ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → OidcConstants ### Fields ## OidcConstants\.CorsPolicyName Field {#Abblix.Oidc.Server.Common.Constants.OidcConstants.CorsPolicyName} The name of the CORS policy applied to the cross\-origin OIDC endpoints\. The host registers a policy under this name \(and calls `UseCors`\); both transport adapters apply the same name so a host can share one policy\. ```csharp public const string CorsPolicyName = "OidcCorsPolicy"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.Prompts.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common\.Constants](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants 'Abblix\.Oidc\.Server\.Common\.Constants') ## Prompts Class Values accepted in the OpenID Connect `prompt` authorization request parameter, instructing the authorization server how to interact with the end user before issuing a response\. ```csharp public static class Prompts ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → Prompts ### Fields ## Prompts\.Consent Field {#Abblix.Oidc.Server.Common.Constants.Prompts.Consent} The Authorization Server SHOULD prompt the End\-User for consent before returning information to the Client\. ```csharp public const string Consent = "consent"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## Prompts\.Create Field {#Abblix.Oidc.Server.Common.Constants.Prompts.Create} This prompt indicates that the Authorization Server SHOULD prompt the End\-User to create a new account\. This is generally used for applications that include user registration as part of the authorization process\. If the Authorization Server cannot proceed with account creation, it MUST return an appropriate error, typically interaction\_required\. ```csharp public const string Create = "create"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## Prompts\.Login Field {#Abblix.Oidc.Server.Common.Constants.Prompts.Login} The Authorization Server SHOULD prompt the End\-User for re\-authentication\. ```csharp public const string Login = "login"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## Prompts\.None Field {#Abblix.Oidc.Server.Common.Constants.Prompts.None} This prompt indicates that the Authorization Server MUST NOT display any authentication or consent user interface pages\. An error is returned if an End\-User is not already authenticated or the Client does not have pre\-configured consent for the requested Claims or does not fulfill other conditions for processing the request\. ```csharp public const string None = "none"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## Prompts\.SelectAccount Field {#Abblix.Oidc.Server.Common.Constants.Prompts.SelectAccount} The Authorization Server SHOULD prompt the End\-User to select a user account\. This enables an End\-User who has multiple accounts at the Authorization Server to select amongst the multiple accounts that they might have current sessions for\. ```csharp public const string SelectAccount = "select_account"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.RequestUrn.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common\.Constants](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants 'Abblix\.Oidc\.Server\.Common\.Constants') ## RequestUrn Class Provides constants for OAuth request URIs, ensuring they conform to the standardized URN notation\. ```csharp public static class RequestUrn ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → RequestUrn ### Fields ## RequestUrn\.Prefix Field {#Abblix.Oidc.Server.Common.Constants.RequestUrn.Prefix} The prefix for OAuth request URIs as per the Internet Engineering Task Force \(IETF\) parameters\. ```csharp public const string Prefix = "urn:ietf:params:oauth:request_uri:"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ResourceDefinition.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common\.Constants](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants 'Abblix\.Oidc\.Server\.Common\.Constants') ## ResourceDefinition Class Represents a resource with associated scopes, defining the permissions and access levels within an application\. This record is typically used to configure and enforce authorization policies based on resource identifiers and their corresponding scopes\. ```csharp public record ResourceDefinition : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ResourceDefinition Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[ResourceDefinition](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ResourceDefinition 'Abblix\.Oidc\.Server\.Common\.Constants\.ResourceDefinition')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Constructors ## ResourceDefinition\(Uri, ScopeDefinition\[\]\) Constructor {#Abblix.Oidc.Server.Common.Constants.ResourceDefinition.ResourceDefinition(System.Uri,Abblix.Oidc.Server.Common.Constants.ScopeDefinition[])} Represents a resource with associated scopes, defining the permissions and access levels within an application\. This record is typically used to configure and enforce authorization policies based on resource identifiers and their corresponding scopes\. ```csharp public ResourceDefinition(System.Uri Resource, params Abblix.Oidc.Server.Common.Constants.ScopeDefinition[] Scopes); ``` #### Parameters ###### `Resource` [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri') {#Abblix.Oidc.Server.Common.Constants.ResourceDefinition.ResourceDefinition(System.Uri,Abblix.Oidc.Server.Common.Constants.ScopeDefinition[]).Resource} The identifier for the resource, often a unique name or URL representing the resource\. ###### `Scopes` [ScopeDefinition](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ScopeDefinition 'Abblix\.Oidc\.Server\.Common\.Constants\.ScopeDefinition')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Oidc.Server.Common.Constants.ResourceDefinition.ResourceDefinition(System.Uri,Abblix.Oidc.Server.Common.Constants.ScopeDefinition[]).Scopes} A variable number of scope definitions associated with the resource\. Each scope definition specifies a scope and its related claims, detailing the access levels and permissions granted\. ### Properties ## ResourceDefinition\.Jwks Property {#Abblix.Oidc.Server.Common.Constants.ResourceDefinition.Jwks} The set of JSON Web Keys published by this resource server, used to encrypt an access token issued for it\. Only public keys belong here: encryption uses the public half, and the resource keeps the private one \(RFC 9728 Section 2 describes the same key set served over [JwksUri](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ResourceDefinition#Abblix.Oidc.Server.Common.Constants.ResourceDefinition.JwksUri 'Abblix\.Oidc\.Server\.Common\.Constants\.ResourceDefinition\.JwksUri')\)\. ```csharp public Abblix.Jwt.JsonWebKeySet? Jwks { get; init; } ``` #### Property Value [JsonWebKeySet](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKeySet 'Abblix\.Jwt\.JsonWebKeySet') ### Remarks Declaring a key is what asks for the access token to be encrypted to this resource rather than left a signed JWS\. The key\-management algorithm is taken from the key's own `alg` \(RFC 7517 Section 4\.4\), so there is no separate algorithm declaration to keep in step: a key that declares none matches whatever the server offers\. ## ResourceDefinition\.JwksUri Property {#Abblix.Oidc.Server.Common.Constants.ResourceDefinition.JwksUri} The URL where this resource server publishes its JSON Web Key Set, per [RFC 9728 Section 2](https://datatracker.ietf.org/doc/html/rfc9728#section-2 'https://datatracker.ietf.org/doc/html/rfc9728\#section-2')\. Fetched with the same SSRF\-protected, cached path as a client's key set\. ```csharp public System.Uri? JwksUri { get; init; } ``` #### Property Value [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri') ### Remarks May be combined with [Jwks](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ResourceDefinition#Abblix.Oidc.Server.Common.Constants.ResourceDefinition.Jwks 'Abblix\.Oidc\.Server\.Common\.Constants\.ResourceDefinition\.Jwks'), in which case the inline keys are considered first, exactly as for a client that registers both\. ## ResourceDefinition\.Resource Property {#Abblix.Oidc.Server.Common.Constants.ResourceDefinition.Resource} The identifier for the resource, often a unique name or URL representing the resource\. ```csharp public System.Uri Resource { get; init; } ``` #### Property Value [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri') ## ResourceDefinition\.Scopes Property {#Abblix.Oidc.Server.Common.Constants.ResourceDefinition.Scopes} A variable number of scope definitions associated with the resource\. Each scope definition specifies a scope and its related claims, detailing the access levels and permissions granted\. ```csharp public Abblix.Oidc.Server.Common.Constants.ScopeDefinition[] Scopes { get; init; } ``` #### Property Value [ScopeDefinition](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ScopeDefinition 'Abblix\.Oidc\.Server\.Common\.Constants\.ScopeDefinition')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ResponseModes.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common\.Constants](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants 'Abblix\.Oidc\.Server\.Common\.Constants') ## ResponseModes Class Represents common response modes used in OAuth 2\.0 and OpenID Connect flows\. ```csharp public static class ResponseModes ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ResponseModes ### Fields ## ResponseModes\.FormPost Field {#Abblix.Oidc.Server.Common.Constants.ResponseModes.FormPost} Represents the "form\_post" response mode, where the response parameters are encoded as HTML form values and sent as a POST request to the redirect URI\. ```csharp public const string FormPost = "form_post"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ResponseModes\.FormPostJwt Field {#Abblix.Oidc.Server.Common.Constants.ResponseModes.FormPostJwt} JARM variant of [FormPost](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ResponseModes#Abblix.Oidc.Server.Common.Constants.ResponseModes.FormPost 'Abblix\.Oidc\.Server\.Common\.Constants\.ResponseModes\.FormPost'): the response parameters are packed into a single JWT delivered as an auto\-submitting HTML form's `response` field\. ```csharp public const string FormPostJwt = "form_post.jwt"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ResponseModes\.Fragment Field {#Abblix.Oidc.Server.Common.Constants.ResponseModes.Fragment} Represents the "fragment" response mode, where the response parameters are appended as URL fragments to the redirect URI\. ```csharp public const string Fragment = "fragment"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ResponseModes\.FragmentJwt Field {#Abblix.Oidc.Server.Common.Constants.ResponseModes.FragmentJwt} JARM variant of [Fragment](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ResponseModes#Abblix.Oidc.Server.Common.Constants.ResponseModes.Fragment 'Abblix\.Oidc\.Server\.Common\.Constants\.ResponseModes\.Fragment'): the response parameters are packed into a single JWT delivered via the `response` fragment parameter of the redirect URI\. ```csharp public const string FragmentJwt = "fragment.jwt"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ResponseModes\.Jwt Field {#Abblix.Oidc.Server.Common.Constants.ResponseModes.Jwt} JARM shortcut response mode: indicates the default JWT redirect encoding for the requested response type \([QueryJwt](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ResponseModes#Abblix.Oidc.Server.Common.Constants.ResponseModes.QueryJwt 'Abblix\.Oidc\.Server\.Common\.Constants\.ResponseModes\.QueryJwt') for the code flow, [FragmentJwt](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ResponseModes#Abblix.Oidc.Server.Common.Constants.ResponseModes.FragmentJwt 'Abblix\.Oidc\.Server\.Common\.Constants\.ResponseModes\.FragmentJwt') for token\-bearing flows\), per JARM §2\.3\.4\. ```csharp public const string Jwt = "jwt"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ResponseModes\.Query Field {#Abblix.Oidc.Server.Common.Constants.ResponseModes.Query} Represents the "query" response mode, where the response parameters are appended as query parameters to the redirect URI\. ```csharp public const string Query = "query"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ResponseModes\.QueryJwt Field {#Abblix.Oidc.Server.Common.Constants.ResponseModes.QueryJwt} JARM \([JWT Secured Authorization Response Mode](https://openid.net/specs/oauth-v2-jarm-final.html 'https://openid.net/specs/oauth-v2-jarm-final.html')\) variant of [Query](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ResponseModes#Abblix.Oidc.Server.Common.Constants.ResponseModes.Query 'Abblix\.Oidc\.Server\.Common\.Constants\.ResponseModes\.Query'): the response parameters are packed into a single JWT delivered via the `response` query parameter of the redirect URI\. ```csharp public const string QueryJwt = "query.jwt"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ResponseTypes.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common\.Constants](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants 'Abblix\.Oidc\.Server\.Common\.Constants') ## ResponseTypes Class Represents common response types used in OAuth 2\.0 and OpenID Connect flows\. ```csharp public static class ResponseTypes ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ResponseTypes ### Remarks Reference: https://openid.net/specs/oauth-v2-multiple-response-types-1\_0.html ### Fields ## ResponseTypes\.Code Field {#Abblix.Oidc.Server.Common.Constants.ResponseTypes.Code} Represents the "code" response type, indicating the authorization code response type\. This is used in the Authorization Code Flow to request an authorization code for later exchange\. ```csharp public const string Code = "code"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ResponseTypes\.IdToken Field {#Abblix.Oidc.Server.Common.Constants.ResponseTypes.IdToken} Represents the "id\_token" response type, indicating the ID token response type\. This is used to request only an ID token in the response, typically in OpenID Connect scenarios\. ```csharp public const string IdToken = "id_token"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ResponseTypes\.None Field {#Abblix.Oidc.Server.Common.Constants.ResponseTypes.None} Represents the "none" response type \(OAuth 2\.0 Multiple Response Type Encoding Practices §4\)\. The authorization request runs to completion but the response returns no authorization code and no tokens \- only `state` and, when advertised, `iss` \(RFC 9207\)\. It authorizes a grant without returning credentials to the client at that time\. This value MUST NOT be combined with any other response type\. ```csharp public const string None = "none"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ResponseTypes\.Token Field {#Abblix.Oidc.Server.Common.Constants.ResponseTypes.Token} Represents the "token" response type, indicating the token response type\. This is used in Implicit Flow to directly issue tokens to the client without using an authorization code\. ```csharp public const string Token = "token"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ResponseTypesExtensions.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common\.Constants](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants 'Abblix\.Oidc\.Server\.Common\.Constants') ## ResponseTypesExtensions Class Extension methods that classify an OAuth 2\.0 `response_type` combination \- the array of its space\-separated parts \(`code`, `token`, `id_token`\)\. They centralise the shared response\-type predicates so the same rule is applied wherever a request's flow is derived from its response types\. ```csharp public static class ResponseTypesExtensions ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ResponseTypesExtensions --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ScopeDefinition.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common\.Constants](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants 'Abblix\.Oidc\.Server\.Common\.Constants') ## ScopeDefinition Class Defines a structure for OAuth 2\.0 scope definitions, specifying the scope and associated claim types\. ```csharp public record ScopeDefinition : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ScopeDefinition Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[ScopeDefinition](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ScopeDefinition 'Abblix\.Oidc\.Server\.Common\.Constants\.ScopeDefinition')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Remarks The properties are settable and a parameterless constructor is available so that a definition can be read from configuration\. A configuration binder builds a positional record through its constructor, and it drops an element outright when a constructor parameter of collection type is absent or empty from the source \- which is exactly the shape of a resource scope that carries no claims\. Building the instance and then assigning its properties has no such blind spot\. ### Constructors ## ScopeDefinition\(\) Constructor {#Abblix.Oidc.Server.Common.Constants.ScopeDefinition.ScopeDefinition()} Initializes an empty definition, to be completed through its properties\. ```csharp public ScopeDefinition(); ``` ## ScopeDefinition\(string, string\[\]\) Constructor {#Abblix.Oidc.Server.Common.Constants.ScopeDefinition.ScopeDefinition(string,string[])} Initializes a definition for the given scope and the claims it asks for\. ```csharp public ScopeDefinition(string scope, params string[] claimTypes); ``` #### Parameters ###### `scope` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Common.Constants.ScopeDefinition.ScopeDefinition(string,string[]).scope} The name of the scope as it appears on the wire\. ###### `claimTypes` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Oidc.Server.Common.Constants.ScopeDefinition.ScopeDefinition(string,string[]).claimTypes} The claims this scope requests, if any\. ### Properties ## ScopeDefinition\.ClaimTypes Property {#Abblix.Oidc.Server.Common.Constants.ScopeDefinition.ClaimTypes} The claims this scope requests\. An empty set is meaningful: a scope that authorizes access to a resource has nothing to say about the user\. ```csharp public string[] ClaimTypes { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') ## ScopeDefinition\.Scope Property {#Abblix.Oidc.Server.Common.Constants.ScopeDefinition.Scope} The name of the scope as it appears on the wire\. ```csharp public string Scope { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Methods ## ScopeDefinition\.Deconstruct\(string, string\[\]\) Method {#Abblix.Oidc.Server.Common.Constants.ScopeDefinition.Deconstruct(string,string[])} Deconstructs the definition into its scope and claim types\. ```csharp public void Deconstruct(out string scope, out string[] claimTypes); ``` #### Parameters ###### `scope` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Common.Constants.ScopeDefinition.Deconstruct(string,string[]).scope} Receives [Scope](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ScopeDefinition#Abblix.Oidc.Server.Common.Constants.ScopeDefinition.Scope 'Abblix\.Oidc\.Server\.Common\.Constants\.ScopeDefinition\.Scope')\. ###### `claimTypes` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Oidc.Server.Common.Constants.ScopeDefinition.Deconstruct(string,string[]).claimTypes} Receives [ClaimTypes](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ScopeDefinition#Abblix.Oidc.Server.Common.Constants.ScopeDefinition.ClaimTypes 'Abblix\.Oidc\.Server\.Common\.Constants\.ScopeDefinition\.ClaimTypes')\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.Scopes.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common\.Constants](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants 'Abblix\.Oidc\.Server\.Common\.Constants') ## Scopes Class Represents common OAuth 2\.0 and OpenID Connect scopes\. ```csharp public static class Scopes ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → Scopes ### Fields ## Scopes\.Address Field {#Abblix.Oidc.Server.Common.Constants.Scopes.Address} The "address" scope is used to request access to the user's physical address information\. ```csharp public const string Address = "address"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## Scopes\.Email Field {#Abblix.Oidc.Server.Common.Constants.Scopes.Email} The "email" scope is used to request access to the user's email address\. ```csharp public const string Email = "email"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## Scopes\.OfflineAccess Field {#Abblix.Oidc.Server.Common.Constants.Scopes.OfflineAccess} The "offline\_access" scope is used to request a refresh token that allows the client to obtain new access tokens without user interaction\. ```csharp public const string OfflineAccess = "offline_access"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## Scopes\.OpenId Field {#Abblix.Oidc.Server.Common.Constants.Scopes.OpenId} The "openid" scope is used to indicate that the request is an OpenID Connect request, allowing the identity of the user to be included in the response\. ```csharp public const string OpenId = "openid"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## Scopes\.Phone Field {#Abblix.Oidc.Server.Common.Constants.Scopes.Phone} The "phone" scope is used to request access to the user's phone number\. ```csharp public const string Phone = "phone"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## Scopes\.Profile Field {#Abblix.Oidc.Server.Common.Constants.Scopes.Profile} The "profile" scope is used to request access to the user's profile information, such as their name, picture, and other profile\-related details\. ```csharp public const string Profile = "profile"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.StandardScopes.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common\.Constants](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants 'Abblix\.Oidc\.Server\.Common\.Constants') ## StandardScopes Class Provides definitions for standard OpenID Connect scopes and their associated claims\. ```csharp public static class StandardScopes ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → StandardScopes ### Fields ## StandardScopes\.Address Field {#Abblix.Oidc.Server.Common.Constants.StandardScopes.Address} Represents the 'address' scope, including claims about the end\-user's physical address\. ```csharp public static readonly ScopeDefinition Address; ``` #### Field Value [ScopeDefinition](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ScopeDefinition 'Abblix\.Oidc\.Server\.Common\.Constants\.ScopeDefinition') ## StandardScopes\.Email Field {#Abblix.Oidc.Server.Common.Constants.StandardScopes.Email} Represents the 'email' scope, including claims about the end\-user's email address and verification status\. ```csharp public static readonly ScopeDefinition Email; ``` #### Field Value [ScopeDefinition](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ScopeDefinition 'Abblix\.Oidc\.Server\.Common\.Constants\.ScopeDefinition') ## StandardScopes\.OfflineAccess Field {#Abblix.Oidc.Server.Common.Constants.StandardScopes.OfflineAccess} Represents the 'offline\_access' scope, which allows the client to request refresh tokens for long\-term access\. ```csharp public static readonly ScopeDefinition OfflineAccess; ``` #### Field Value [ScopeDefinition](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ScopeDefinition 'Abblix\.Oidc\.Server\.Common\.Constants\.ScopeDefinition') ## StandardScopes\.OpenId Field {#Abblix.Oidc.Server.Common.Constants.StandardScopes.OpenId} Represents the 'openid' scope, which is essential for OpenID Connect processes\. ```csharp public static readonly ScopeDefinition OpenId; ``` #### Field Value [ScopeDefinition](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ScopeDefinition 'Abblix\.Oidc\.Server\.Common\.Constants\.ScopeDefinition') ## StandardScopes\.Phone Field {#Abblix.Oidc.Server.Common.Constants.StandardScopes.Phone} Represents the 'phone' scope, including claims about the end\-user's phone number and verification status\. ```csharp public static readonly ScopeDefinition Phone; ``` #### Field Value [ScopeDefinition](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ScopeDefinition 'Abblix\.Oidc\.Server\.Common\.Constants\.ScopeDefinition') ## StandardScopes\.Profile Field {#Abblix.Oidc.Server.Common.Constants.StandardScopes.Profile} Represents the 'profile' scope, including claims about the end\-user's profile information\. ```csharp public static readonly ScopeDefinition Profile; ``` #### Field Value [ScopeDefinition](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ScopeDefinition 'Abblix\.Oidc\.Server\.Common\.Constants\.ScopeDefinition') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.SubjectTypes.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common\.Constants](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants 'Abblix\.Oidc\.Server\.Common\.Constants') ## SubjectTypes Class Represents subject types used in OpenID Connect\. ```csharp public static class SubjectTypes ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → SubjectTypes ### Fields ## SubjectTypes\.Pairwise Field {#Abblix.Oidc.Server.Common.Constants.SubjectTypes.Pairwise} The "pairwise" subject type indicates that the subject identifier is a pairwise identifier, which means that it is unique to a specific client, enhancing user privacy\. ```csharp public const string Pairwise = "pairwise"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## SubjectTypes\.Public Field {#Abblix.Oidc.Server.Common.Constants.SubjectTypes.Public} The "public" subject type indicates that the subject identifier is a public identifier, which means that it can be used across multiple clients and should not be tied to a specific client\. ```csharp public const string Public = "public"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.TokenExchangeTokenTypes.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common\.Constants](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants 'Abblix\.Oidc\.Server\.Common\.Constants') ## TokenExchangeTokenTypes Class Token type identifiers for RFC 8693 Token Exchange\. Used as the value of the wire\-level `subject_token_type`, `actor_token_type`, and `requested_token_type` parameters, and echoed back in the token response's `issued_token_type` field\. ```csharp public static class TokenExchangeTokenTypes ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → TokenExchangeTokenTypes ### Fields ## TokenExchangeTokenTypes\.AccessToken Field {#Abblix.Oidc.Server.Common.Constants.TokenExchangeTokenTypes.AccessToken} OAuth 2\.0 access token \(opaque or JWT\)\. RFC 8693 §3\. ```csharp public const string AccessToken = "urn:ietf:params:oauth:token-type:access_token"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## TokenExchangeTokenTypes\.IdToken Field {#Abblix.Oidc.Server.Common.Constants.TokenExchangeTokenTypes.IdToken} OpenID Connect ID token \(always a JWT\)\. RFC 8693 §3\. ```csharp public const string IdToken = "urn:ietf:params:oauth:token-type:id_token"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## TokenExchangeTokenTypes\.Jwt Field {#Abblix.Oidc.Server.Common.Constants.TokenExchangeTokenTypes.Jwt} JSON Web Token of unspecified profile\. RFC 8693 §3\. ```csharp public const string Jwt = "urn:ietf:params:oauth:token-type:jwt"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## TokenExchangeTokenTypes\.RefreshToken Field {#Abblix.Oidc.Server.Common.Constants.TokenExchangeTokenTypes.RefreshToken} OAuth 2\.0 refresh token\. RFC 8693 §3\. ```csharp public const string RefreshToken = "urn:ietf:params:oauth:token-type:refresh_token"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## TokenExchangeTokenTypes\.Saml1 Field {#Abblix.Oidc.Server.Common.Constants.TokenExchangeTokenTypes.Saml1} SAML 1\.1 assertion\. RFC 8693 §3 \-\- listed for completeness; not currently issued or accepted by this library\. ```csharp public const string Saml1 = "urn:ietf:params:oauth:token-type:saml1"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## TokenExchangeTokenTypes\.Saml2 Field {#Abblix.Oidc.Server.Common.Constants.TokenExchangeTokenTypes.Saml2} SAML 2\.0 assertion\. RFC 8693 §3 \-\- listed for completeness; not currently issued or accepted by this library\. ```csharp public const string Saml2 = "urn:ietf:params:oauth:token-type:saml2"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.TokenTypeIdentifiers.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common\.Constants](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants 'Abblix\.Oidc\.Server\.Common\.Constants') ## TokenTypeIdentifiers Class Represents token type identifiers for various token types as specified in RFC 8693\. ```csharp public static class TokenTypeIdentifiers ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → TokenTypeIdentifiers ### Remarks See https://datatracker.ietf.org/doc/html/rfc8693\#TokenTypeIdentifiers for details\. ### Fields ## TokenTypeIdentifiers\.AccessToken Field {#Abblix.Oidc.Server.Common.Constants.TokenTypeIdentifiers.AccessToken} Indicates that the token is an OAuth 2\.0 access token issued by the given authorization server\. ```csharp public static readonly Uri AccessToken; ``` #### Field Value [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri') ## TokenTypeIdentifiers\.IdToken Field {#Abblix.Oidc.Server.Common.Constants.TokenTypeIdentifiers.IdToken} Indicates that the token is an ID Token as defined in Section 2 of https://openid.net/specs/openid-connect-core-1\_0.html. ```csharp public static readonly Uri IdToken; ``` #### Field Value [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri') ## TokenTypeIdentifiers\.RefreshToken Field {#Abblix.Oidc.Server.Common.Constants.TokenTypeIdentifiers.RefreshToken} Indicates that the token is an OAuth 2\.0 refresh token issued by the given authorization server\. ```csharp public static readonly Uri RefreshToken; ``` #### Field Value [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri') ## TokenTypeIdentifiers\.Saml1 Field {#Abblix.Oidc.Server.Common.Constants.TokenTypeIdentifiers.Saml1} Indicates that the token is a base64url\-encoded SAML 1\.1 https://www.oasis-open.org/committees/download.php/3406/oasis-sstc-saml-core-1.1.pdf assertion\. ```csharp public static readonly Uri Saml1; ``` #### Field Value [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri') ## TokenTypeIdentifiers\.Saml2 Field {#Abblix.Oidc.Server.Common.Constants.TokenTypeIdentifiers.Saml2} Indicates that the token is a base64url\-encoded SAML 2\.0 \[http://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf\] assertion\. ```csharp public static readonly Uri Saml2; ``` #### Field Value [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.TokenTypes.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common\.Constants](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants 'Abblix\.Oidc\.Server\.Common\.Constants') ## TokenTypes Class Represents token types used in authentication and authorization\. ```csharp public static class TokenTypes ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → TokenTypes ### Fields ## TokenTypes\.Basic Field {#Abblix.Oidc.Server.Common.Constants.TokenTypes.Basic} Indicates the Basic authentication scheme per RFC 7617, where client credentials are transmitted as a Base64\-encoded `client_id:client_secret` pair\. ```csharp public const string Basic = "Basic"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## TokenTypes\.Bearer Field {#Abblix.Oidc.Server.Common.Constants.TokenTypes.Bearer} Indicates the Bearer token type, often used in OAuth 2\.0 for securing API requests\. ```csharp public const string Bearer = "Bearer"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## TokenTypes\.DPoP Field {#Abblix.Oidc.Server.Common.Constants.TokenTypes.DPoP} Indicates a DPoP\-bound token type per RFC 9449 §7\.1: the access token is locked to a specific proof\-of\-possession key and the client MUST present a fresh DPoP proof on every resource\-server request\. Carries a `cnf.jkt` confirmation claim equal to the JWK thumbprint of the binding key\. ```csharp public const string DPoP = "DPoP"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Exceptions.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ## Abblix\.Oidc\.Server\.Common\.Exceptions Namespace | Classes | | | :--- | :--- | | [UnexpectedTypeException](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Exceptions.UnexpectedTypeException 'Abblix\.Oidc\.Server\.Common\.Exceptions\.UnexpectedTypeException') | Represents an exception that is thrown when an unexpected data type is encountered\. | --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Exceptions.UnexpectedTypeException.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common\.Exceptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Exceptions 'Abblix\.Oidc\.Server\.Common\.Exceptions') ## UnexpectedTypeException Class Represents an exception that is thrown when an unexpected data type is encountered\. ```csharp public class UnexpectedTypeException : System.InvalidOperationException ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [System\.Exception](https://learn.microsoft.com/en-us/dotnet/api/system.exception 'System\.Exception') → [System\.SystemException](https://learn.microsoft.com/en-us/dotnet/api/system.systemexception 'System\.SystemException') → [System\.InvalidOperationException](https://learn.microsoft.com/en-us/dotnet/api/system.invalidoperationexception 'System\.InvalidOperationException') → UnexpectedTypeException ### Remarks This exception is typically used to indicate an unexpected or invalid type for a parameter or variable\. It provides information about the parameter name and the unexpected type encountered\. ### Constructors ## UnexpectedTypeException\(string, Type\) Constructor {#Abblix.Oidc.Server.Common.Exceptions.UnexpectedTypeException.UnexpectedTypeException(string,System.Type)} Creates the exception with a message naming the offending parameter and the runtime type observed\. ```csharp public UnexpectedTypeException(string? paramName, System.Type paramType); ``` #### Parameters ###### `paramName` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Common.Exceptions.UnexpectedTypeException.UnexpectedTypeException(string,System.Type).paramName} Name of the variable, parameter, or member whose type was unexpected\. ###### `paramType` [System\.Type](https://learn.microsoft.com/en-us/dotnet/api/system.type 'System\.Type') {#Abblix.Oidc.Server.Common.Exceptions.UnexpectedTypeException.UnexpectedTypeException(string,System.Type).paramType} The runtime type that the calling code did not know how to handle\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Implementation.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ## Abblix\.Oidc\.Server\.Common\.Implementation Namespace | Classes | | | :--- | :--- | | [JsonBinarySerializer](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Implementation.JsonBinarySerializer 'Abblix\.Oidc\.Server\.Common\.Implementation\.JsonBinarySerializer') | Provides functionality to serialize and deserialize objects to and from JSON binary representations\. Implements the [IBinarySerializer](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IBinarySerializer 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IBinarySerializer') interface using the System\.Text\.Json library for serialization\. | | [JsonSerializationBinder](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Implementation.JsonSerializationBinder 'Abblix\.Oidc\.Server\.Common\.Implementation\.JsonSerializationBinder') | Implements the [IJsonObjectBinder](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IJsonObjectBinder 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IJsonObjectBinder') interface to bind JSON data from a [System\.Text\.Json\.Nodes\.JsonObject](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonobject 'System\.Text\.Json\.Nodes\.JsonObject') to a specified model type\. This binder utilizes System\.Text\.Json for serialization to dynamically bind the JSON data to the model's properties, allowing for both creation of new model instances or updating existing ones based on the provided JSON data\. | --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Implementation.JsonBinarySerializer.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common\.Implementation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Implementation 'Abblix\.Oidc\.Server\.Common\.Implementation') ## JsonBinarySerializer Class Provides functionality to serialize and deserialize objects to and from JSON binary representations\. Implements the [IBinarySerializer](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IBinarySerializer 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IBinarySerializer') interface using the System\.Text\.Json library for serialization\. ```csharp public class JsonBinarySerializer : Abblix.Oidc.Server.Common.Interfaces.IBinarySerializer ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → JsonBinarySerializer Implements [IBinarySerializer](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IBinarySerializer 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IBinarySerializer') ### Constructors ## JsonBinarySerializer\(Encoding, JsonSerializerOptions\) Constructor {#Abblix.Oidc.Server.Common.Implementation.JsonBinarySerializer.JsonBinarySerializer(System.Text.Encoding,System.Text.Json.JsonSerializerOptions)} Provides functionality to serialize and deserialize objects to and from JSON binary representations\. Implements the [IBinarySerializer](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IBinarySerializer 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IBinarySerializer') interface using the System\.Text\.Json library for serialization\. ```csharp public JsonBinarySerializer(System.Text.Encoding? encoding=null, System.Text.Json.JsonSerializerOptions? options=null); ``` #### Parameters ###### `encoding` [System\.Text\.Encoding](https://learn.microsoft.com/en-us/dotnet/api/system.text.encoding 'System\.Text\.Encoding') {#Abblix.Oidc.Server.Common.Implementation.JsonBinarySerializer.JsonBinarySerializer(System.Text.Encoding,System.Text.Json.JsonSerializerOptions).encoding} ###### `options` [System\.Text\.Json\.JsonSerializerOptions](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.jsonserializeroptions 'System\.Text\.Json\.JsonSerializerOptions') {#Abblix.Oidc.Server.Common.Implementation.JsonBinarySerializer.JsonBinarySerializer(System.Text.Encoding,System.Text.Json.JsonSerializerOptions).options} ### Methods ## JsonBinarySerializer\.Deserialize\\(byte\[\]\) Method {#Abblix.Oidc.Server.Common.Implementation.JsonBinarySerializer.Deserialize_T_(byte[])} Deserializes a binary representation of a JSON object to its original type\. ```csharp public T? Deserialize(byte[] bytes); ``` #### Type parameters ###### `T` {#Abblix.Oidc.Server.Common.Implementation.JsonBinarySerializer.Deserialize_T_(byte[]).T} The type of the object to deserialize into\. #### Parameters ###### `bytes` [System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Oidc.Server.Common.Implementation.JsonBinarySerializer.Deserialize_T_(byte[]).bytes} The binary representation of the JSON object to deserialize\. Implements [Deserialize<T>\(byte\[\]\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IBinarySerializer#Abblix.Oidc.Server.Common.Interfaces.IBinarySerializer.Deserialize_T_(byte[]) 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IBinarySerializer\.Deserialize\\(byte\[\]\)') #### Returns [T](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Implementation.JsonBinarySerializer#Abblix.Oidc.Server.Common.Implementation.JsonBinarySerializer.Deserialize_T_(byte[]).T 'Abblix\.Oidc\.Server\.Common\.Implementation\.JsonBinarySerializer\.Deserialize\\(byte\[\]\)\.T') The deserialized object of type [T](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Implementation.JsonBinarySerializer#Abblix.Oidc.Server.Common.Implementation.JsonBinarySerializer.Deserialize_T_(byte[]).T 'Abblix\.Oidc\.Server\.Common\.Implementation\.JsonBinarySerializer\.Deserialize\\(byte\[\]\)\.T')\. ## JsonBinarySerializer\.Serialize\\(T\) Method {#Abblix.Oidc.Server.Common.Implementation.JsonBinarySerializer.Serialize_T_(T)} Serializes an object to a binary representation in JSON format\. ```csharp public byte[] Serialize(T obj); ``` #### Type parameters ###### `T` {#Abblix.Oidc.Server.Common.Implementation.JsonBinarySerializer.Serialize_T_(T).T} The type of the object to serialize\. #### Parameters ###### `obj` [T](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Implementation.JsonBinarySerializer#Abblix.Oidc.Server.Common.Implementation.JsonBinarySerializer.Serialize_T_(T).T 'Abblix\.Oidc\.Server\.Common\.Implementation\.JsonBinarySerializer\.Serialize\\(T\)\.T') {#Abblix.Oidc.Server.Common.Implementation.JsonBinarySerializer.Serialize_T_(T).obj} The object to serialize into JSON format\. Implements [Serialize<T>\(T\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IBinarySerializer#Abblix.Oidc.Server.Common.Interfaces.IBinarySerializer.Serialize_T_(T) 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IBinarySerializer\.Serialize\\(T\)') #### Returns [System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') A byte array representing the serialized object in JSON format\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Implementation.JsonSerializationBinder.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common\.Implementation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Implementation 'Abblix\.Oidc\.Server\.Common\.Implementation') ## JsonSerializationBinder Class Implements the [IJsonObjectBinder](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IJsonObjectBinder 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IJsonObjectBinder') interface to bind JSON data from a [System\.Text\.Json\.Nodes\.JsonObject](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonobject 'System\.Text\.Json\.Nodes\.JsonObject') to a specified model type\. This binder utilizes System\.Text\.Json for serialization to dynamically bind the JSON data to the model's properties, allowing for both creation of new model instances or updating existing ones based on the provided JSON data\. ```csharp public class JsonSerializationBinder : Abblix.Oidc.Server.Common.Interfaces.IJsonObjectBinder ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → JsonSerializationBinder Implements [IJsonObjectBinder](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IJsonObjectBinder 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IJsonObjectBinder') ### Methods ## JsonSerializationBinder\.BindModelAsync\\(JsonObject, TModel\) Method {#Abblix.Oidc.Server.Common.Implementation.JsonSerializationBinder.BindModelAsync_TModel_(System.Text.Json.Nodes.JsonObject,TModel)} Asynchronously binds JSON data from a [System\.Text\.Json\.Nodes\.JsonObject](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonobject 'System\.Text\.Json\.Nodes\.JsonObject') to a specified model of type [TModel](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Implementation.JsonSerializationBinder#Abblix.Oidc.Server.Common.Implementation.JsonSerializationBinder.BindModelAsync_TModel_(System.Text.Json.Nodes.JsonObject,TModel).TModel 'Abblix\.Oidc\.Server\.Common\.Implementation\.JsonSerializationBinder\.BindModelAsync\\(System\.Text\.Json\.Nodes\.JsonObject, TModel\)\.TModel')\. The method can update an existing model instance with the data or create and populate a new instance if none is provided\. ```csharp public System.Threading.Tasks.Task BindModelAsync(System.Text.Json.Nodes.JsonObject properties, TModel? model=null) where TModel : class; ``` #### Type parameters ###### `TModel` {#Abblix.Oidc.Server.Common.Implementation.JsonSerializationBinder.BindModelAsync_TModel_(System.Text.Json.Nodes.JsonObject,TModel).TModel} The type of the model to which the data is to be bound\. #### Parameters ###### `properties` [System\.Text\.Json\.Nodes\.JsonObject](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonobject 'System\.Text\.Json\.Nodes\.JsonObject') {#Abblix.Oidc.Server.Common.Implementation.JsonSerializationBinder.BindModelAsync_TModel_(System.Text.Json.Nodes.JsonObject,TModel).properties} The JSON data as a [System\.Text\.Json\.Nodes\.JsonObject](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonobject 'System\.Text\.Json\.Nodes\.JsonObject') containing the properties to bind to the model\. ###### `model` [TModel](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Implementation.JsonSerializationBinder#Abblix.Oidc.Server.Common.Implementation.JsonSerializationBinder.BindModelAsync_TModel_(System.Text.Json.Nodes.JsonObject,TModel).TModel 'Abblix\.Oidc\.Server\.Common\.Implementation\.JsonSerializationBinder\.BindModelAsync\\(System\.Text\.Json\.Nodes\.JsonObject, TModel\)\.TModel') {#Abblix.Oidc.Server.Common.Implementation.JsonSerializationBinder.BindModelAsync_TModel_(System.Text.Json.Nodes.JsonObject,TModel).model} An optional instance of the model to be updated\. If null, a new instance of [TModel](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Implementation.JsonSerializationBinder#Abblix.Oidc.Server.Common.Implementation.JsonSerializationBinder.BindModelAsync_TModel_(System.Text.Json.Nodes.JsonObject,TModel).TModel 'Abblix\.Oidc\.Server\.Common\.Implementation\.JsonSerializationBinder\.BindModelAsync\\(System\.Text\.Json\.Nodes\.JsonObject, TModel\)\.TModel') is created\. Implements [BindModelAsync<TModel>\(JsonObject, TModel\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IJsonObjectBinder#Abblix.Oidc.Server.Common.Interfaces.IJsonObjectBinder.BindModelAsync_TModel_(System.Text.Json.Nodes.JsonObject,TModel) 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IJsonObjectBinder\.BindModelAsync\\(System\.Text\.Json\.Nodes\.JsonObject, TModel\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[TModel](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Implementation.JsonSerializationBinder#Abblix.Oidc.Server.Common.Implementation.JsonSerializationBinder.BindModelAsync_TModel_(System.Text.Json.Nodes.JsonObject,TModel).TModel 'Abblix\.Oidc\.Server\.Common\.Implementation\.JsonSerializationBinder\.BindModelAsync\\(System\.Text\.Json\.Nodes\.JsonObject, TModel\)\.TModel')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A [System\.Threading\.Tasks\.Task](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task 'System\.Threading\.Tasks\.Task') that, when completed, results in the bound model instance of [TModel](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Implementation.JsonSerializationBinder#Abblix.Oidc.Server.Common.Implementation.JsonSerializationBinder.BindModelAsync_TModel_(System.Text.Json.Nodes.JsonObject,TModel).TModel 'Abblix\.Oidc\.Server\.Common\.Implementation\.JsonSerializationBinder\.BindModelAsync\\(System\.Text\.Json\.Nodes\.JsonObject, TModel\)\.TModel'), or null if the binding fails\. ### Remarks This method leverages the JSON serialization capabilities of System\.Text\.Json to map the JSON properties to the corresponding properties of the model\. It's designed to handle complex object graphs and can be used to easily populate models from JSON data or update existing models with new data\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ## Abblix\.Oidc\.Server\.Common\.Interfaces Namespace | Classes | | | :--- | :--- | | [AuthServiceKeysProviderExtensions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.AuthServiceKeysProviderExtensions 'Abblix\.Oidc\.Server\.Common\.Interfaces\.AuthServiceKeysProviderExtensions') | Extension helpers for [IAuthServiceKeysProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IAuthServiceKeysProvider 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IAuthServiceKeysProvider')\. | | Interfaces | | | :--- | :--- | | [IAuthServiceKeysProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IAuthServiceKeysProvider 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IAuthServiceKeysProvider') | Provides the keys of the OpenID Connect service to encrypt and sign the JWT tokens it issues, and to publish their public halves at the JWKS endpoint\. | | [IAuthServiceKeysStore](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IAuthServiceKeysStore 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IAuthServiceKeysStore') | The write\-role counterpart to [IAuthServiceKeysProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IAuthServiceKeysProvider 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IAuthServiceKeysProvider'): it persists a service key at the moment it is generated, so its public half survives even when the external keystore that holds the private half exposes it only once\. Reading stays with [IAuthServiceKeysProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IAuthServiceKeysProvider 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IAuthServiceKeysProvider')\. | | [IBinarySerializer](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IBinarySerializer 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IBinarySerializer') | Defines the contract for a binary serializer that supports serialization and deserialization of objects to and from binary format\. | | [IGrantTypeInformer](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IGrantTypeInformer') | Provides information about OAuth 2\.0 grant types supported by a component\. Components implementing this interface can be registered in dependency injection to contribute their supported grant types to the OpenID Connect discovery endpoint\. | | [IJsonObjectBinder](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IJsonObjectBinder 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IJsonObjectBinder') | Provides a mechanism to bind data from a JsonObject to a model, enabling the conversion of JSON data into a strongly typed object\. This interface abstracts the process of mapping JSON properties to a model's properties, facilitating the dynamic population of model instances with data from a JSON source\. | | [IOidcEndpointResolver](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IOidcEndpointResolver 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IOidcEndpointResolver') | Resolves the absolute URL an OIDC endpoint is served at in the running application\. | | [IParametersProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IParametersProvider 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IParametersProvider') | Extracts a flat set of name/value pairs from a response object \- the reverse of binding \- for delivery as query, fragment or form\_post parameters\. The transport adapters \(MVC, Minimal API\) share this contract because flattening a response DTO is framework\-neutral; the implementation lives in the core for the same reason\. | | [IParameterValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IParameterValidator 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IParameterValidator') | Provides a method for validating that a parameter is and not null\. | | [IRequestInfoProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IRequestInfoProvider 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IRequestInfoProvider') | Provides information about the current request, including URIs and security details\. | | [IUserCredentialsAuthenticator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IUserCredentialsAuthenticator 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IUserCredentialsAuthenticator') | Validates a username and password pair against the host's user store and produces an authorized grant when the credentials are correct\. Used by the Resource Owner Password Credentials grant \(`grant_type=password`\) at the token endpoint, so the host can plug its own identity backend behind the OAuth flow\. | --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.AuthServiceKeysProviderExtensions.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces 'Abblix\.Oidc\.Server\.Common\.Interfaces') ## AuthServiceKeysProviderExtensions Class Extension helpers for [IAuthServiceKeysProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IAuthServiceKeysProvider 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IAuthServiceKeysProvider')\. ```csharp public static class AuthServiceKeysProviderExtensions ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → AuthServiceKeysProviderExtensions ### Methods ## AuthServiceKeysProviderExtensions\.GetPublishedKeysAsync\(this IAuthServiceKeysProvider, ILogger\) Method {#Abblix.Oidc.Server.Common.Interfaces.AuthServiceKeysProviderExtensions.GetPublishedKeysAsync(thisAbblix.Oidc.Server.Common.Interfaces.IAuthServiceKeysProvider,Microsoft.Extensions.Logging.ILogger)} Builds the public key set published at the JWKS endpoint: the signing public keys marked `use=sig` and the server's asymmetric encryption public keys marked `use=enc` so a client can encrypt a request object or other inbound JWE to the server \(RFC 9101\)\. A symmetric server key has no public half and is omitted; only sanitized public halves are ever published, never private or secret material\. As a last\-resort guard against a misbehaving key provider, any key still carrying private material is stripped to its public half before it enters the set and a warning is logged: the JWKS endpoint must never leak a private key, even if an upstream provider mistakenly returns one\. ```csharp public static System.Threading.Tasks.Task GetPublishedKeysAsync(this Abblix.Oidc.Server.Common.Interfaces.IAuthServiceKeysProvider provider, Microsoft.Extensions.Logging.ILogger logger); ``` #### Parameters ###### `provider` [IAuthServiceKeysProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IAuthServiceKeysProvider 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IAuthServiceKeysProvider') {#Abblix.Oidc.Server.Common.Interfaces.AuthServiceKeysProviderExtensions.GetPublishedKeysAsync(thisAbblix.Oidc.Server.Common.Interfaces.IAuthServiceKeysProvider,Microsoft.Extensions.Logging.ILogger).provider} The provider of the service's signing and encryption keys\. ###### `logger` [Microsoft\.Extensions\.Logging\.ILogger](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger 'Microsoft\.Extensions\.Logging\.ILogger') {#Abblix.Oidc.Server.Common.Interfaces.AuthServiceKeysProviderExtensions.GetPublishedKeysAsync(thisAbblix.Oidc.Server.Common.Interfaces.IAuthServiceKeysProvider,Microsoft.Extensions.Logging.ILogger).logger} Logger used to warn when a private key is stripped before publication\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') The signing keys followed by the asymmetric encryption public keys\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IAuthServiceKeysProvider.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces 'Abblix\.Oidc\.Server\.Common\.Interfaces') ## IAuthServiceKeysProvider Interface Provides the keys of the OpenID Connect service to encrypt and sign the JWT tokens it issues, and to publish their public halves at the JWKS endpoint\. ```csharp public interface IAuthServiceKeysProvider ``` Derived ↳ [ExternalKeysProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ExternalKeys.ExternalKeysProvider 'Abblix\.Oidc\.Server\.Features\.ExternalKeys\.ExternalKeysProvider') ### Remarks The set has two distinct roles\. PUBLISHING: the whole set is published at the JWKS endpoint, so a client can verify a signature made with ANY of these keys \(including one the service no longer signs with\) and encrypt an inbound JWE to ANY of them \(the service decrypts with whichever key the client chose by `kid`\)\. This holds even for a static multi\-key configuration, independent of rotation\. PRODUCING: the service itself signs a token, and encrypts an outbound service token, with a SINGLE key per algorithm \- by convention the FIRST one returned for that algorithm\. Only the produce role depends on order; a consumer selects by `kid`, not by position\. The split is also what lets a single flat set carry a zero\-downtime rotation: return a new key AFTER the active one to announce it \(published and immediately verifiable / encryptable, but not yet produced with\), move it to first to activate it once client JWKS caches have caught up, and keep a retired key trailing \(still published so its tokens keep verifying\) until they expire\. Do NOT order the set so that a retired or not\-yet\-active key comes first for its algorithm, or the service would produce with it\. ### Methods ## IAuthServiceKeysProvider\.GetEncryptionKeys\(bool\) Method {#Abblix.Oidc.Server.Common.Interfaces.IAuthServiceKeysProvider.GetEncryptionKeys(bool)} Gets the encryption keys used by the service\. The first key per algorithm is the one it encrypts outbound tokens with; the rest are published so inbound JWE can be decrypted and to overlap a rotation\. See the ordering note in the interface remarks\. ```csharp System.Collections.Generic.IAsyncEnumerable GetEncryptionKeys(bool includePrivateKeys=false); ``` #### Parameters ###### `includePrivateKeys` [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') {#Abblix.Oidc.Server.Common.Interfaces.IAuthServiceKeysProvider.GetEncryptionKeys(bool).includePrivateKeys} Whether to include private keys in the result\. #### Returns [System\.Collections\.Generic\.IAsyncEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.iasyncenumerable-1 'System\.Collections\.Generic\.IAsyncEnumerable\`1')[JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.iasyncenumerable-1 'System\.Collections\.Generic\.IAsyncEnumerable\`1') ## IAuthServiceKeysProvider\.GetSigningKeys\(bool\) Method {#Abblix.Oidc.Server.Common.Interfaces.IAuthServiceKeysProvider.GetSigningKeys(bool)} Gets the signing keys used by the service\. The first key per algorithm is the one it signs with; the rest are published for verification and to overlap a rotation\. See the ordering note in the interface remarks\. ```csharp System.Collections.Generic.IAsyncEnumerable GetSigningKeys(bool includePrivateKeys=false); ``` #### Parameters ###### `includePrivateKeys` [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') {#Abblix.Oidc.Server.Common.Interfaces.IAuthServiceKeysProvider.GetSigningKeys(bool).includePrivateKeys} Whether to include private keys in the result\. #### Returns [System\.Collections\.Generic\.IAsyncEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.iasyncenumerable-1 'System\.Collections\.Generic\.IAsyncEnumerable\`1')[JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.iasyncenumerable-1 'System\.Collections\.Generic\.IAsyncEnumerable\`1') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IAuthServiceKeysStore.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces 'Abblix\.Oidc\.Server\.Common\.Interfaces') ## IAuthServiceKeysStore Interface The write\-role counterpart to [IAuthServiceKeysProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IAuthServiceKeysProvider 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IAuthServiceKeysProvider'): it persists a service key at the moment it is generated, so its public half survives even when the external keystore that holds the private half exposes it only once\. Reading stays with [IAuthServiceKeysProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IAuthServiceKeysProvider 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IAuthServiceKeysProvider')\. ```csharp public interface IAuthServiceKeysStore ``` ### Remarks The roles are segregated deliberately \(Interface Segregation\): this is NOT `IAuthServiceKeysStore : IAuthServiceKeysProvider`\. A component that only reads keys \(the JWKS endpoint, the token validators\) depends on the reader alone and is never coupled to persistence; the key generator depends on the writer alone\. A persistent implementation implements BOTH role interfaces over one durable backend, but the two contracts stay decoupled\. The durable backend, key generation, and the rotation that advances a descriptor's status ship separately\. ### Methods ## IAuthServiceKeysStore\.AddAsync\(AuthServiceKeyDescriptor, CancellationToken\) Method {#Abblix.Oidc.Server.Common.Interfaces.IAuthServiceKeysStore.AddAsync(Abblix.Oidc.Server.Common.AuthServiceKeyDescriptor,System.Threading.CancellationToken)} Persists a newly generated key with its lifecycle window, so it is available to the read seam for verification and publication before it is ever used to sign \(publish\-before\-sign\)\. ```csharp System.Threading.Tasks.Task AddAsync(Abblix.Oidc.Server.Common.AuthServiceKeyDescriptor descriptor, System.Threading.CancellationToken cancellationToken=default(System.Threading.CancellationToken)); ``` #### Parameters ###### `descriptor` [AuthServiceKeyDescriptor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.AuthServiceKeyDescriptor 'Abblix\.Oidc\.Server\.Common\.AuthServiceKeyDescriptor') {#Abblix.Oidc.Server.Common.Interfaces.IAuthServiceKeysStore.AddAsync(Abblix.Oidc.Server.Common.AuthServiceKeyDescriptor,System.Threading.CancellationToken).descriptor} The key and the lifecycle metadata that lives around it\. ###### `cancellationToken` [System\.Threading\.CancellationToken](https://learn.microsoft.com/en-us/dotnet/api/system.threading.cancellationtoken 'System\.Threading\.CancellationToken') {#Abblix.Oidc.Server.Common.Interfaces.IAuthServiceKeysStore.AddAsync(Abblix.Oidc.Server.Common.AuthServiceKeyDescriptor,System.Threading.CancellationToken).cancellationToken} Cancels a network\-backed persistence round\-trip\. #### Returns [System\.Threading\.Tasks\.Task](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task 'System\.Threading\.Tasks\.Task') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IBinarySerializer.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces 'Abblix\.Oidc\.Server\.Common\.Interfaces') ## IBinarySerializer Interface Defines the contract for a binary serializer that supports serialization and deserialization of objects to and from binary format\. ```csharp public interface IBinarySerializer ``` Derived ↳ [JsonBinarySerializer](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Implementation.JsonBinarySerializer 'Abblix\.Oidc\.Server\.Common\.Implementation\.JsonBinarySerializer') ↳ [CompositeBinarySerializer](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Storages.CompositeBinarySerializer 'Abblix\.Oidc\.Server\.Features\.Storages\.CompositeBinarySerializer') ↳ [ProtobufSerializer](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Storages.ProtobufSerializer 'Abblix\.Oidc\.Server\.Features\.Storages\.ProtobufSerializer') ### Methods ## IBinarySerializer\.Deserialize\\(byte\[\]\) Method {#Abblix.Oidc.Server.Common.Interfaces.IBinarySerializer.Deserialize_T_(byte[])} Deserializes a binary array to an object of type [T](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IBinarySerializer#Abblix.Oidc.Server.Common.Interfaces.IBinarySerializer.Deserialize_T_(byte[]).T 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IBinarySerializer\.Deserialize\\(byte\[\]\)\.T')\. ```csharp T? Deserialize(byte[] bytes); ``` #### Type parameters ###### `T` {#Abblix.Oidc.Server.Common.Interfaces.IBinarySerializer.Deserialize_T_(byte[]).T} The type of the object to deserialize to\. #### Parameters ###### `bytes` [System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Oidc.Server.Common.Interfaces.IBinarySerializer.Deserialize_T_(byte[]).bytes} The binary array to deserialize from\. #### Returns [T](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IBinarySerializer#Abblix.Oidc.Server.Common.Interfaces.IBinarySerializer.Deserialize_T_(byte[]).T 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IBinarySerializer\.Deserialize\\(byte\[\]\)\.T') The deserialized object of type [T](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IBinarySerializer#Abblix.Oidc.Server.Common.Interfaces.IBinarySerializer.Deserialize_T_(byte[]).T 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IBinarySerializer\.Deserialize\\(byte\[\]\)\.T')\. ## IBinarySerializer\.Serialize\\(T\) Method {#Abblix.Oidc.Server.Common.Interfaces.IBinarySerializer.Serialize_T_(T)} Serializes an object of type [T](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IBinarySerializer#Abblix.Oidc.Server.Common.Interfaces.IBinarySerializer.Serialize_T_(T).T 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IBinarySerializer\.Serialize\\(T\)\.T') to a binary array\. ```csharp byte[] Serialize(T obj); ``` #### Type parameters ###### `T` {#Abblix.Oidc.Server.Common.Interfaces.IBinarySerializer.Serialize_T_(T).T} The type of the object to serialize\. #### Parameters ###### `obj` [T](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IBinarySerializer#Abblix.Oidc.Server.Common.Interfaces.IBinarySerializer.Serialize_T_(T).T 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IBinarySerializer\.Serialize\\(T\)\.T') {#Abblix.Oidc.Server.Common.Interfaces.IBinarySerializer.Serialize_T_(T).obj} The object to serialize\. #### Returns [System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') A binary array representing the serialized object\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces 'Abblix\.Oidc\.Server\.Common\.Interfaces') ## IGrantTypeInformer Interface Provides information about OAuth 2\.0 grant types supported by a component\. Components implementing this interface can be registered in dependency injection to contribute their supported grant types to the OpenID Connect discovery endpoint\. ```csharp public interface IGrantTypeInformer ``` Derived ↳ [AuthorizationCodeBuilder](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationCodeBuilder 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.AuthorizationCodeBuilder') ↳ [IAuthorizationResponseBuilder](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseBuilder 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.IAuthorizationResponseBuilder') ↳ [AuthorizationCodeGrantHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.AuthorizationCodeGrantHandler 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.AuthorizationCodeGrantHandler') ↳ [BackChannelAuthenticationGrantHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.BackChannelAuthenticationGrantHandler 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.BackChannelAuthenticationGrantHandler') ↳ [ClientCredentialsGrantHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.ClientCredentialsGrantHandler 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.ClientCredentialsGrantHandler') ↳ [CompositeAuthorizationGrantHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.CompositeAuthorizationGrantHandler 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.CompositeAuthorizationGrantHandler') ↳ [DeviceCodeGrantHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.DeviceCodeGrantHandler 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.DeviceCodeGrantHandler') ↳ [IAuthorizationGrantHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.IAuthorizationGrantHandler') ↳ [JwtBearerGrantHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.JwtBearerGrantHandler 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.JwtBearerGrantHandler') ↳ [PasswordGrantHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.PasswordGrantHandler 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.PasswordGrantHandler') ↳ [RefreshTokenGrantHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.RefreshTokenGrantHandler 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.RefreshTokenGrantHandler') ↳ [TokenExchangeGrantHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.TokenExchangeGrantHandler 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.TokenExchangeGrantHandler') ↳ [IdTokenResponseBuilder](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ImplicitFlow.IdTokenResponseBuilder 'Abblix\.Oidc\.Server\.Features\.ImplicitFlow\.IdTokenResponseBuilder') ↳ [TokenResponseBuilder](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ImplicitFlow.TokenResponseBuilder 'Abblix\.Oidc\.Server\.Features\.ImplicitFlow\.TokenResponseBuilder') ↳ [NoneResponseBuilder](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.NoneFlow.NoneResponseBuilder 'Abblix\.Oidc\.Server\.Features\.NoneFlow\.NoneResponseBuilder') ### Remarks This interface enables the discovery endpoint to automatically aggregate all supported grant types from various components \(authorization endpoint handlers, token endpoint handlers, etc\.\) without requiring manual configuration\. ### Properties ## IGrantTypeInformer\.GrantTypesSupported Property {#Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer.GrantTypesSupported} The grant types supported by this component, as defined in OAuth 2\.0 and OpenID Connect specifications\. ```csharp System.Collections.Generic.IEnumerable GrantTypesSupported { get; } ``` #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ### Remarks Common grant types include: - "authorization_code" - Authorization Code Grant - "implicit" - Implicit Grant - "refresh_token" - Refresh Token Grant - "client_credentials" - Client Credentials Grant - "password" - Resource Owner Password Credentials Grant --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IJsonObjectBinder.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces 'Abblix\.Oidc\.Server\.Common\.Interfaces') ## IJsonObjectBinder Interface Provides a mechanism to bind data from a JsonObject to a model, enabling the conversion of JSON data into a strongly typed object\. This interface abstracts the process of mapping JSON properties to a model's properties, facilitating the dynamic population of model instances with data from a JSON source\. ```csharp public interface IJsonObjectBinder ``` Derived ↳ [JsonSerializationBinder](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Implementation.JsonSerializationBinder 'Abblix\.Oidc\.Server\.Common\.Implementation\.JsonSerializationBinder') ### Methods ## IJsonObjectBinder\.BindModelAsync\\(JsonObject, TModel\) Method {#Abblix.Oidc.Server.Common.Interfaces.IJsonObjectBinder.BindModelAsync_TModel_(System.Text.Json.Nodes.JsonObject,TModel)} Asynchronously binds data from the provided JsonObject to the specified model type\. This method allows for the flexible binding of JSON data to C\# objects, supporting both the creation of new instances and the population of existing instances\. ```csharp System.Threading.Tasks.Task BindModelAsync(System.Text.Json.Nodes.JsonObject properties, TModel? model=null) where TModel : class; ``` #### Type parameters ###### `TModel` {#Abblix.Oidc.Server.Common.Interfaces.IJsonObjectBinder.BindModelAsync_TModel_(System.Text.Json.Nodes.JsonObject,TModel).TModel} The type of the model to bind\. This type must be a class\. #### Parameters ###### `properties` [System\.Text\.Json\.Nodes\.JsonObject](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonobject 'System\.Text\.Json\.Nodes\.JsonObject') {#Abblix.Oidc.Server.Common.Interfaces.IJsonObjectBinder.BindModelAsync_TModel_(System.Text.Json.Nodes.JsonObject,TModel).properties} The JsonObject containing the data to bind to the model\. ###### `model` [TModel](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IJsonObjectBinder#Abblix.Oidc.Server.Common.Interfaces.IJsonObjectBinder.BindModelAsync_TModel_(System.Text.Json.Nodes.JsonObject,TModel).TModel 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IJsonObjectBinder\.BindModelAsync\\(System\.Text\.Json\.Nodes\.JsonObject, TModel\)\.TModel') {#Abblix.Oidc.Server.Common.Interfaces.IJsonObjectBinder.BindModelAsync_TModel_(System.Text.Json.Nodes.JsonObject,TModel).model} An optional instance of the model to populate\. If null, a new instance of TModel will be created\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[TModel](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IJsonObjectBinder#Abblix.Oidc.Server.Common.Interfaces.IJsonObjectBinder.BindModelAsync_TModel_(System.Text.Json.Nodes.JsonObject,TModel).TModel 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IJsonObjectBinder\.BindModelAsync\\(System\.Text\.Json\.Nodes\.JsonObject, TModel\)\.TModel')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task representing the asynchronous operation, which upon completion yields the bound model instance if successful, or null if the binding fails\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IOidcEndpointResolver.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces 'Abblix\.Oidc\.Server\.Common\.Interfaces') ## IOidcEndpointResolver Interface Resolves the absolute URL an OIDC endpoint is served at in the running application\. ```csharp public interface IOidcEndpointResolver ``` ### Remarks Both transport adapters register an implementation, so host code that needs one of these URLs \- an external identity provider's callback pointing back at the authorization endpoint, say \- is written once and keeps working when the host swaps one adapter for the other\. Each adapter answers from what it actually mapped: MVC from its controller routes, Minimal API from its named endpoints, so a route override or a group prefix is reflected without the caller knowing either exists\. ### Methods ## IOidcEndpointResolver\.Resolve\(OidcEndpoints\) Method {#Abblix.Oidc.Server.Common.Interfaces.IOidcEndpointResolver.Resolve(Abblix.Oidc.Server.Common.Configuration.OidcEndpoints)} Returns the absolute URL of [endpoint](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IOidcEndpointResolver#Abblix.Oidc.Server.Common.Interfaces.IOidcEndpointResolver.Resolve(Abblix.Oidc.Server.Common.Configuration.OidcEndpoints).endpoint 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IOidcEndpointResolver\.Resolve\(Abblix\.Oidc\.Server\.Common\.Configuration\.OidcEndpoints\)\.endpoint') for the current request\. ```csharp System.Uri? Resolve(Abblix.Oidc.Server.Common.Configuration.OidcEndpoints endpoint); ``` #### Parameters ###### `endpoint` [OidcEndpoints](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcEndpoints 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcEndpoints') {#Abblix.Oidc.Server.Common.Interfaces.IOidcEndpointResolver.Resolve(Abblix.Oidc.Server.Common.Configuration.OidcEndpoints).endpoint} The endpoint to resolve\. Exactly one flag, never a combination: [All](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcEndpoints#Abblix.Oidc.Server.Common.Configuration.OidcEndpoints.All 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcEndpoints\.All') and [Base](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcEndpoints#Abblix.Oidc.Server.Common.Configuration.OidcEndpoints.Base 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcEndpoints\.Base') name a set rather than an endpoint and resolve to nothing\. #### Returns [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri') The endpoint's absolute URL, or `null` when it is not mapped \- because the endpoint is disabled in [EnabledEndpoints](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions#Abblix.Oidc.Server.Common.Configuration.OidcOptions.EnabledEndpoints 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions\.EnabledEndpoints'), or because its route takes parameters this contract cannot supply, which today is the per\-client configuration endpoint of [RegisterClient](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcEndpoints#Abblix.Oidc.Server.Common.Configuration.OidcEndpoints.RegisterClient 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcEndpoints\.RegisterClient')\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IParametersProvider.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces 'Abblix\.Oidc\.Server\.Common\.Interfaces') ## IParametersProvider Interface Extracts a flat set of name/value pairs from a response object \- the reverse of binding \- for delivery as query, fragment or form\_post parameters\. The transport adapters \(MVC, Minimal API\) share this contract because flattening a response DTO is framework\-neutral; the implementation lives in the core for the same reason\. ```csharp public interface IParametersProvider ``` Derived ↳ [ParametersProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.ParametersProvider 'Abblix\.Oidc\.Server\.Common\.ParametersProvider') ### Methods ## IParametersProvider\.GetParameters\(object\) Method {#Abblix.Oidc.Server.Common.Interfaces.IParametersProvider.GetParameters(object)} Retrieves the parameters as name/value pairs from the specified object\. ```csharp System.Collections.Generic.IEnumerable<(string name,string? value)> GetParameters(object obj); ``` #### Parameters ###### `obj` [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') {#Abblix.Oidc.Server.Common.Interfaces.IParametersProvider.GetParameters(object).obj} The object to extract parameters from\. #### Returns [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[<](https://learn.microsoft.com/en-us/dotnet/api/system.valuetuple 'System\.ValueTuple')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[,](https://learn.microsoft.com/en-us/dotnet/api/system.valuetuple 'System\.ValueTuple')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.valuetuple 'System\.ValueTuple')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') The parameter name/value pairs\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IParameterValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces 'Abblix\.Oidc\.Server\.Common\.Interfaces') ## IParameterValidator Interface Provides a method for validating that a parameter is and not null\. ```csharp public interface IParameterValidator ``` ### Methods ## IParameterValidator\.Required\\(T, string\) Method {#Abblix.Oidc.Server.Common.Interfaces.IParameterValidator.Required_T_(T,string)} Validates that a parameter is and not null\. ```csharp void Required(T? value, string name) where T : class; ``` #### Type parameters ###### `T` {#Abblix.Oidc.Server.Common.Interfaces.IParameterValidator.Required_T_(T,string).T} The type of the parameter\. #### Parameters ###### `value` [T](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IParameterValidator#Abblix.Oidc.Server.Common.Interfaces.IParameterValidator.Required_T_(T,string).T 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IParameterValidator\.Required\\(T, string\)\.T') {#Abblix.Oidc.Server.Common.Interfaces.IParameterValidator.Required_T_(T,string).value} The value of the parameter\. ###### `name` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Common.Interfaces.IParameterValidator.Required_T_(T,string).name} The name of the parameter\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IRequestInfoProvider.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces 'Abblix\.Oidc\.Server\.Common\.Interfaces') ## IRequestInfoProvider Interface Provides information about the current request, including URIs and security details\. ```csharp public interface IRequestInfoProvider ``` ### Properties ## IRequestInfoProvider\.ApplicationUri Property {#Abblix.Oidc.Server.Common.Interfaces.IRequestInfoProvider.ApplicationUri} The base URI of the application\. ```csharp string ApplicationUri { get; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## IRequestInfoProvider\.IsHttps Property {#Abblix.Oidc.Server.Common.Interfaces.IRequestInfoProvider.IsHttps} Indicates whether the request is using HTTPS\. ```csharp bool IsHttps { get; } ``` #### Property Value [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') ## IRequestInfoProvider\.PathBase Property {#Abblix.Oidc.Server.Common.Interfaces.IRequestInfoProvider.PathBase} The base path of the request\. ```csharp string PathBase { get; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## IRequestInfoProvider\.RemoteIpAddress Property {#Abblix.Oidc.Server.Common.Interfaces.IRequestInfoProvider.RemoteIpAddress} The client's IP address from the current request\. May be null if the IP address cannot be determined\. ```csharp System.Net.IPAddress? RemoteIpAddress { get; } ``` #### Property Value [System\.Net\.IPAddress](https://learn.microsoft.com/en-us/dotnet/api/system.net.ipaddress 'System\.Net\.IPAddress') ## IRequestInfoProvider\.RequestMethod Property {#Abblix.Oidc.Server.Common.Interfaces.IRequestInfoProvider.RequestMethod} The HTTP method of the current request \(e\.g\. `GET`, `POST`\) in upper case per RFC 9110 §9\. Surfaced for protocol\-binding checks \(e\.g\. RFC 9449 §4\.3 DPoP `htm`\) that match the inbound method byte\-exact rather than assuming a fixed value per endpoint\. ```csharp string RequestMethod { get; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## IRequestInfoProvider\.RequestUri Property {#Abblix.Oidc.Server.Common.Interfaces.IRequestInfoProvider.RequestUri} The request URI\. ```csharp string RequestUri { get; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IUserCredentialsAuthenticator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces 'Abblix\.Oidc\.Server\.Common\.Interfaces') ## IUserCredentialsAuthenticator Interface Validates a username and password pair against the host's user store and produces an authorized grant when the credentials are correct\. Used by the Resource Owner Password Credentials grant \(`grant_type=password`\) at the token endpoint, so the host can plug its own identity backend behind the OAuth flow\. ```csharp public interface IUserCredentialsAuthenticator ``` ### Methods ## IUserCredentialsAuthenticator\.ValidateAsync\(string, string, AuthorizationContext\) Method {#Abblix.Oidc.Server.Common.Interfaces.IUserCredentialsAuthenticator.ValidateAsync(string,string,Abblix.Oidc.Server.Common.AuthorizationContext)} Validates user credentials \(username and password\) and returns a grant authorization result\. ```csharp System.Threading.Tasks.Task> ValidateAsync(string userName, string password, Abblix.Oidc.Server.Common.AuthorizationContext context); ``` #### Parameters ###### `userName` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Common.Interfaces.IUserCredentialsAuthenticator.ValidateAsync(string,string,Abblix.Oidc.Server.Common.AuthorizationContext).userName} The username provided by the user\. ###### `password` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Common.Interfaces.IUserCredentialsAuthenticator.ValidateAsync(string,string,Abblix.Oidc.Server.Common.AuthorizationContext).password} The password provided by the user\. ###### `context` [AuthorizationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.AuthorizationContext 'Abblix\.Oidc\.Server\.Common\.AuthorizationContext') {#Abblix.Oidc.Server.Common.Interfaces.IUserCredentialsAuthenticator.ValidateAsync(string,string,Abblix.Oidc.Server.Common.AuthorizationContext).context} The authorization context associated with the request\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[AuthorizedGrant](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.AuthorizedGrant')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task that represents the asynchronous validation operation and returns the grant authorization result\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Validation.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ## Abblix\.Oidc\.Server\.Common\.Validation Namespace | Classes | | | :--- | :--- | | [ErrorFactory](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Validation.ErrorFactory 'Abblix\.Oidc\.Server\.Common\.Validation\.ErrorFactory') | Builds [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') instances for the request\-binding layer shared by every endpoint and both transport adapters\. The counterpart of the per\-area error factories \(authorization validation, token grants, dynamic client registration, \.\.\.\): those cover protocol\-specific failures, this covers the malformed\-request failures the declarative model validation surfaces before any handler runs\. It sits in its own `Common.Validation` namespace rather than bare `Common` so it does not collide with those per\-area `ErrorFactory` classes in the many core files that import `Common`\. | --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Validation.ErrorFactory.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Common\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Validation 'Abblix\.Oidc\.Server\.Common\.Validation') ## ErrorFactory Class Builds [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') instances for the request\-binding layer shared by every endpoint and both transport adapters\. The counterpart of the per\-area error factories \(authorization validation, token grants, dynamic client registration, \.\.\.\): those cover protocol\-specific failures, this covers the malformed\-request failures the declarative model validation surfaces before any handler runs\. It sits in its own `Common.Validation` namespace rather than bare `Common` so it does not collide with those per\-area `ErrorFactory` classes in the many core files that import `Common`\. ```csharp public static class ErrorFactory ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ErrorFactory ### Methods ## ErrorFactory\.InvalidRequest\(IEnumerable\\) Method {#Abblix.Oidc.Server.Common.Validation.ErrorFactory.InvalidRequest(System.Collections.Generic.IEnumerable_string_)} Maps a flat sequence of model\-validation messages onto an [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') carrying the [InvalidRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ErrorCodes#Abblix.Oidc.Server.Common.Constants.ErrorCodes.InvalidRequest 'Abblix\.Oidc\.Server\.Common\.Constants\.ErrorCodes\.InvalidRequest') code\. The input is a plain message sequence on purpose, so each transport adapter can feed it the output of [System\.ComponentModel\.DataAnnotations\.Validator](https://learn.microsoft.com/en-us/dotnet/api/system.componentmodel.dataannotations.validator 'System\.ComponentModel\.DataAnnotations\.Validator') and share one source of truth for "a malformed request becomes invalid\_request"\. ```csharp public static Abblix.Oidc.Server.Common.OidcError InvalidRequest(System.Collections.Generic.IEnumerable messages); ``` #### Parameters ###### `messages` [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') {#Abblix.Oidc.Server.Common.Validation.ErrorFactory.InvalidRequest(System.Collections.Generic.IEnumerable_string_).messages} The human\-readable validation messages collected for the rejected request\. #### Returns [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') An [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') describing the failure in OAuth terms\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.DeclarativeBinding.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ## Abblix\.Oidc\.Server\.DeclarativeBinding Namespace | Classes | | | :--- | :--- | | [AbsoluteUriAttribute](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.DeclarativeBinding.AbsoluteUriAttribute 'Abblix\.Oidc\.Server\.DeclarativeBinding\.AbsoluteUriAttribute') | Marks a [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri')\-typed property, field, or parameter as having to be an absolute URI\. Relative URIs and values that do not parse as absolute are treated as invalid by validators that honor this attribute; null values are not flagged here, leave that to [System\.ComponentModel\.DataAnnotations\.RequiredAttribute](https://learn.microsoft.com/en-us/dotnet/api/system.componentmodel.dataannotations.requiredattribute 'System\.ComponentModel\.DataAnnotations\.RequiredAttribute')\. | | [AllowedValuesAttribute](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.DeclarativeBinding.AllowedValuesAttribute 'Abblix\.Oidc\.Server\.DeclarativeBinding\.AllowedValuesAttribute') | Restricts a string\-valued \(or string\-array\-valued\) property, field, or parameter to a fixed set of allowed values\. Typically used to constrain protocol parameters such as `response_type`, `grant_type`, or `code_challenge_method` to the values defined by the relevant specification\. Validators consuming this attribute should reject any value not present in [AllowedValues](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.DeclarativeBinding.AllowedValuesAttribute#Abblix.Oidc.Server.DeclarativeBinding.AllowedValuesAttribute.AllowedValues 'Abblix\.Oidc\.Server\.DeclarativeBinding\.AllowedValuesAttribute\.AllowedValues'); null values are not flagged here\. | | [AuthorizationHeaderAttribute](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.DeclarativeBinding.AuthorizationHeaderAttribute 'Abblix\.Oidc\.Server\.DeclarativeBinding\.AuthorizationHeaderAttribute') | Declares that the value is the parsed HTTP `Authorization` request header \- the scheme and credentials used by transport\-level client authentication such as `Basic` \(RFC 7617\) or `Bearer` \(RFC 6750\)\. Purely semantic: it names the transport source and leaves the parsing mechanism to the transport layer\. | | [ClientCertificateAttribute](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.DeclarativeBinding.ClientCertificateAttribute 'Abblix\.Oidc\.Server\.DeclarativeBinding\.ClientCertificateAttribute') | Declares that the value is the client X\.509 certificate presented at the transport layer \- via mutual TLS \(RFC 8705\) or forwarded by a trusted reverse proxy\. Purely semantic: it names the transport source and leaves the extraction mechanism to the transport layer\. | | [CultureListAttribute](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.DeclarativeBinding.CultureListAttribute 'Abblix\.Oidc\.Server\.DeclarativeBinding\.CultureListAttribute') | Declares that the value travels on the wire as a space\-separated list of BCP 47 language tags while the model exposes it as an array of cultures \- e\.g\. the OIDC `ui_locales` and `claims_locales` parameters\. Purely semantic: it names the wire format and leaves the parsing mechanism to the transport layer\. | | [ElementsRequiredAttribute](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.DeclarativeBinding.ElementsRequiredAttribute 'Abblix\.Oidc\.Server\.DeclarativeBinding\.ElementsRequiredAttribute') | Applied to an array, collection, or otherwise enumerable property, field, or parameter to declare that the collection itself must be non\-null and contain at least one element, and that no element inside it may be null\. Useful for protocol metadata such as `redirect_uris` where an empty array is invalid\. | | [JsonObjectAttribute](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.DeclarativeBinding.JsonObjectAttribute 'Abblix\.Oidc\.Server\.DeclarativeBinding\.JsonObjectAttribute') | Declares that the value travels on the wire as a JSON document carried inside a single parameter \- e\.g\. the OIDC `claims` parameter or RFC 9396 `authorization_details`\. Purely semantic: it names the wire format and leaves the parsing mechanism to the transport layer\. | | [RequestHeaderAttribute](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.DeclarativeBinding.RequestHeaderAttribute 'Abblix\.Oidc\.Server\.DeclarativeBinding\.RequestHeaderAttribute') | Declares that the value arrives in the named HTTP request header rather than in the request payload \- e\.g\. the compact DPoP proof JWT carried in the `DPoP` header per RFC 9449 §4\.1\. Purely semantic: it names the transport source and leaves the extraction mechanism to the transport layer\. | | [SpaceSeparatedStringAttribute](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.DeclarativeBinding.SpaceSeparatedStringAttribute 'Abblix\.Oidc\.Server\.DeclarativeBinding\.SpaceSeparatedStringAttribute') | Declares that the value travels on the wire as a single space\-separated string while the model exposes it as an array \- e\.g\. the OAuth 2\.0 `scope` and `acr_values` parameters\. Purely semantic: it names the wire format and leaves the parsing mechanism to the transport layer\. | | [TotalSecondsAttribute](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.DeclarativeBinding.TotalSecondsAttribute 'Abblix\.Oidc\.Server\.DeclarativeBinding\.TotalSecondsAttribute') | Declares that the value travels on the wire as an integer number of seconds while the model exposes it as a [System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan') \- e\.g\. the OIDC `max_age` and CIBA `requested_expiry` parameters\. Purely semantic: it names the wire format and leaves the parsing mechanism to the transport layer\. | --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.DeclarativeBinding.AbsoluteUriAttribute.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.DeclarativeBinding](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.DeclarativeBinding 'Abblix\.Oidc\.Server\.DeclarativeBinding') ## AbsoluteUriAttribute Class Marks a [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri')\-typed property, field, or parameter as having to be an absolute URI\. Relative URIs and values that do not parse as absolute are treated as invalid by validators that honor this attribute; null values are not flagged here, leave that to [System\.ComponentModel\.DataAnnotations\.RequiredAttribute](https://learn.microsoft.com/en-us/dotnet/api/system.componentmodel.dataannotations.requiredattribute 'System\.ComponentModel\.DataAnnotations\.RequiredAttribute')\. ```csharp public class AbsoluteUriAttribute : System.Attribute ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [System\.Attribute](https://learn.microsoft.com/en-us/dotnet/api/system.attribute 'System\.Attribute') → AbsoluteUriAttribute ### Constructors ## AbsoluteUriAttribute\(string\) Constructor {#Abblix.Oidc.Server.DeclarativeBinding.AbsoluteUriAttribute.AbsoluteUriAttribute(string)} Creates an [AbsoluteUriAttribute](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.DeclarativeBinding.AbsoluteUriAttribute 'Abblix\.Oidc\.Server\.DeclarativeBinding\.AbsoluteUriAttribute') optionally constrained to a specific scheme\. ```csharp public AbsoluteUriAttribute(string? requireScheme=null); ``` #### Parameters ###### `requireScheme` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.DeclarativeBinding.AbsoluteUriAttribute.AbsoluteUriAttribute(string).requireScheme} When provided, validation additionally requires the URI scheme \(e\.g\. "https"\) to match this value\. ### Properties ## AbsoluteUriAttribute\.RequireScheme Property {#Abblix.Oidc.Server.DeclarativeBinding.AbsoluteUriAttribute.RequireScheme} The required URI scheme \(e\.g\. "https"\), or `null` when any scheme is acceptable as long as the URI is absolute\. ```csharp public string? RequireScheme { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.DeclarativeBinding.AllowedValuesAttribute.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.DeclarativeBinding](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.DeclarativeBinding 'Abblix\.Oidc\.Server\.DeclarativeBinding') ## AllowedValuesAttribute Class Restricts a string\-valued \(or string\-array\-valued\) property, field, or parameter to a fixed set of allowed values\. Typically used to constrain protocol parameters such as `response_type`, `grant_type`, or `code_challenge_method` to the values defined by the relevant specification\. Validators consuming this attribute should reject any value not present in [AllowedValues](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.DeclarativeBinding.AllowedValuesAttribute#Abblix.Oidc.Server.DeclarativeBinding.AllowedValuesAttribute.AllowedValues 'Abblix\.Oidc\.Server\.DeclarativeBinding\.AllowedValuesAttribute\.AllowedValues'); null values are not flagged here\. ```csharp public class AllowedValuesAttribute : System.Attribute ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [System\.Attribute](https://learn.microsoft.com/en-us/dotnet/api/system.attribute 'System\.Attribute') → AllowedValuesAttribute ### Constructors ## AllowedValuesAttribute\(string\[\]\) Constructor {#Abblix.Oidc.Server.DeclarativeBinding.AllowedValuesAttribute.AllowedValuesAttribute(string[])} Creates an [AllowedValuesAttribute](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.DeclarativeBinding.AllowedValuesAttribute 'Abblix\.Oidc\.Server\.DeclarativeBinding\.AllowedValuesAttribute') declaring the set of accepted values\. ```csharp public AllowedValuesAttribute(params string[] allowedValues); ``` #### Parameters ###### `allowedValues` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Oidc.Server.DeclarativeBinding.AllowedValuesAttribute.AllowedValuesAttribute(string[]).allowedValues} The complete set of acceptable string values; comparison is performed using the validator's configured string comparison, typically ordinal\. ### Properties ## AllowedValuesAttribute\.AllowedValues Property {#Abblix.Oidc.Server.DeclarativeBinding.AllowedValuesAttribute.AllowedValues} The set of acceptable string values declared at attribute construction\. ```csharp public string[] AllowedValues { get; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.DeclarativeBinding.AuthorizationHeaderAttribute.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.DeclarativeBinding](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.DeclarativeBinding 'Abblix\.Oidc\.Server\.DeclarativeBinding') ## AuthorizationHeaderAttribute Class Declares that the value is the parsed HTTP `Authorization` request header \- the scheme and credentials used by transport\-level client authentication such as `Basic` \(RFC 7617\) or `Bearer` \(RFC 6750\)\. Purely semantic: it names the transport source and leaves the parsing mechanism to the transport layer\. ```csharp public class AuthorizationHeaderAttribute : System.Attribute ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [System\.Attribute](https://learn.microsoft.com/en-us/dotnet/api/system.attribute 'System\.Attribute') → AuthorizationHeaderAttribute --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.DeclarativeBinding.ClientCertificateAttribute.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.DeclarativeBinding](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.DeclarativeBinding 'Abblix\.Oidc\.Server\.DeclarativeBinding') ## ClientCertificateAttribute Class Declares that the value is the client X\.509 certificate presented at the transport layer \- via mutual TLS \(RFC 8705\) or forwarded by a trusted reverse proxy\. Purely semantic: it names the transport source and leaves the extraction mechanism to the transport layer\. ```csharp public class ClientCertificateAttribute : System.Attribute ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [System\.Attribute](https://learn.microsoft.com/en-us/dotnet/api/system.attribute 'System\.Attribute') → ClientCertificateAttribute --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.DeclarativeBinding.CultureListAttribute.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.DeclarativeBinding](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.DeclarativeBinding 'Abblix\.Oidc\.Server\.DeclarativeBinding') ## CultureListAttribute Class Declares that the value travels on the wire as a space\-separated list of BCP 47 language tags while the model exposes it as an array of cultures \- e\.g\. the OIDC `ui_locales` and `claims_locales` parameters\. Purely semantic: it names the wire format and leaves the parsing mechanism to the transport layer\. ```csharp public class CultureListAttribute : System.Attribute ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [System\.Attribute](https://learn.microsoft.com/en-us/dotnet/api/system.attribute 'System\.Attribute') → CultureListAttribute --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.DeclarativeBinding.ElementsRequiredAttribute.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.DeclarativeBinding](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.DeclarativeBinding 'Abblix\.Oidc\.Server\.DeclarativeBinding') ## ElementsRequiredAttribute Class Applied to an array, collection, or otherwise enumerable property, field, or parameter to declare that the collection itself must be non\-null and contain at least one element, and that no element inside it may be null\. Useful for protocol metadata such as `redirect_uris` where an empty array is invalid\. ```csharp public class ElementsRequiredAttribute : System.Attribute ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [System\.Attribute](https://learn.microsoft.com/en-us/dotnet/api/system.attribute 'System\.Attribute') → ElementsRequiredAttribute --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.DeclarativeBinding.JsonObjectAttribute.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.DeclarativeBinding](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.DeclarativeBinding 'Abblix\.Oidc\.Server\.DeclarativeBinding') ## JsonObjectAttribute Class Declares that the value travels on the wire as a JSON document carried inside a single parameter \- e\.g\. the OIDC `claims` parameter or RFC 9396 `authorization_details`\. Purely semantic: it names the wire format and leaves the parsing mechanism to the transport layer\. ```csharp public class JsonObjectAttribute : System.Attribute ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [System\.Attribute](https://learn.microsoft.com/en-us/dotnet/api/system.attribute 'System\.Attribute') → JsonObjectAttribute --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.DeclarativeBinding.RequestHeaderAttribute.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.DeclarativeBinding](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.DeclarativeBinding 'Abblix\.Oidc\.Server\.DeclarativeBinding') ## RequestHeaderAttribute Class Declares that the value arrives in the named HTTP request header rather than in the request payload \- e\.g\. the compact DPoP proof JWT carried in the `DPoP` header per RFC 9449 §4\.1\. Purely semantic: it names the transport source and leaves the extraction mechanism to the transport layer\. ```csharp public class RequestHeaderAttribute : System.Attribute ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [System\.Attribute](https://learn.microsoft.com/en-us/dotnet/api/system.attribute 'System\.Attribute') → RequestHeaderAttribute ### Constructors ## RequestHeaderAttribute\(string\) Constructor {#Abblix.Oidc.Server.DeclarativeBinding.RequestHeaderAttribute.RequestHeaderAttribute(string)} Declares that the value arrives in the named HTTP request header rather than in the request payload \- e\.g\. the compact DPoP proof JWT carried in the `DPoP` header per RFC 9449 §4\.1\. Purely semantic: it names the transport source and leaves the extraction mechanism to the transport layer\. ```csharp public RequestHeaderAttribute(string headerName); ``` #### Parameters ###### `headerName` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.DeclarativeBinding.RequestHeaderAttribute.RequestHeaderAttribute(string).headerName} The HTTP request header carrying the value\. ### Properties ## RequestHeaderAttribute\.HeaderName Property {#Abblix.Oidc.Server.DeclarativeBinding.RequestHeaderAttribute.HeaderName} The HTTP request header carrying the value\. ```csharp public string HeaderName { get; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.DeclarativeBinding.SpaceSeparatedStringAttribute.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.DeclarativeBinding](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.DeclarativeBinding 'Abblix\.Oidc\.Server\.DeclarativeBinding') ## SpaceSeparatedStringAttribute Class Declares that the value travels on the wire as a single space\-separated string while the model exposes it as an array \- e\.g\. the OAuth 2\.0 `scope` and `acr_values` parameters\. Purely semantic: it names the wire format and leaves the parsing mechanism to the transport layer\. ```csharp public class SpaceSeparatedStringAttribute : System.Attribute ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [System\.Attribute](https://learn.microsoft.com/en-us/dotnet/api/system.attribute 'System\.Attribute') → SpaceSeparatedStringAttribute --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.DeclarativeBinding.TotalSecondsAttribute.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.DeclarativeBinding](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.DeclarativeBinding 'Abblix\.Oidc\.Server\.DeclarativeBinding') ## TotalSecondsAttribute Class Declares that the value travels on the wire as an integer number of seconds while the model exposes it as a [System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan') \- e\.g\. the OIDC `max_age` and CIBA `requested_expiry` parameters\. Purely semantic: it names the wire format and leaves the parsing mechanism to the transport layer\. ```csharp public class TotalSecondsAttribute : System.Attribute ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [System\.Attribute](https://learn.microsoft.com/en-us/dotnet/api/system.attribute 'System\.Attribute') → TotalSecondsAttribute --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ## Abblix\.Oidc\.Server\.Endpoints Namespace | Classes | | | :--- | :--- | | [ServiceCollectionExtensions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.ServiceCollectionExtensions 'Abblix\.Oidc\.Server\.Endpoints\.ServiceCollectionExtensions') | Extension methods that register endpoint pipelines \(handler \+ validator \+ processor \+ per\-step validators / fetchers / grant handlers\) for the OAuth 2\.0 / OpenID Connect endpoints exposed by this library: configuration, authorization \(with PAR\), token, userinfo, revocation, introspection, check\-session, end\-session, dynamic client management, CIBA backchannel and RFC 8628 device authorization\. Use `TryAdd*` so that host pre\-registrations win\. | --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.ServiceCollectionExtensions.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints 'Abblix\.Oidc\.Server\.Endpoints') ## ServiceCollectionExtensions Class Extension methods that register endpoint pipelines \(handler \+ validator \+ processor \+ per\-step validators / fetchers / grant handlers\) for the OAuth 2\.0 / OpenID Connect endpoints exposed by this library: configuration, authorization \(with PAR\), token, userinfo, revocation, introspection, check\-session, end\-session, dynamic client management, CIBA backchannel and RFC 8628 device authorization\. Use `TryAdd*` so that host pre\-registrations win\. ```csharp public static class ServiceCollectionExtensions ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ServiceCollectionExtensions ### Methods ## ServiceCollectionExtensions\.AddAuthorizationCodeGrant\(this IServiceCollection\) Method {#Abblix.Oidc.Server.Endpoints.ServiceCollectionExtensions.AddAuthorizationCodeGrant(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection)} Registers the authorization code grant handler for OAuth 2\.0 authorization code flow\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection AddAuthorizationCodeGrant(this Microsoft.Extensions.DependencyInjection.IServiceCollection services); ``` #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.Oidc.Server.Endpoints.ServiceCollectionExtensions.AddAuthorizationCodeGrant(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).services} The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') to configure\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') The configured [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection')\. ## ServiceCollectionExtensions\.AddAuthorizationContextValidators\(this IServiceCollection\) Method {#Abblix.Oidc.Server.Endpoints.ServiceCollectionExtensions.AddAuthorizationContextValidators(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection)} Adds a series of validators for authorization context as a composite service to ensure comprehensive validation of authorization requests\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection AddAuthorizationContextValidators(this Microsoft.Extensions.DependencyInjection.IServiceCollection services); ``` #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.Oidc.Server.Endpoints.ServiceCollectionExtensions.AddAuthorizationContextValidators(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).services} The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') to configure\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') The configured [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection')\. ### Remarks This method composes a pipeline of validators for various aspects of the authorization context, such as request object validation, client validation, and more\. This composite validator approach enables modular and extensible validation logic, ensuring that authorization requests meet all necessary criteria and standards\. ## ServiceCollectionExtensions\.AddAuthorizationEndpoint\(this IServiceCollection\) Method {#Abblix.Oidc.Server.Endpoints.ServiceCollectionExtensions.AddAuthorizationEndpoint(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection)} Adds services and processors for handling authorization requests to the service collection\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection AddAuthorizationEndpoint(this Microsoft.Extensions.DependencyInjection.IServiceCollection services); ``` #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.Oidc.Server.Endpoints.ServiceCollectionExtensions.AddAuthorizationEndpoint(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).services} The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') to configure\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') The configured [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection')\. ### Remarks This setup is crucial for supporting the OAuth 2\.0 and OpenID Connect authorization flow, ensuring that incoming authorization requests are correctly validated and processed\. ## ServiceCollectionExtensions\.AddAuthorizationGrant\\(this IServiceCollection\) Method {#Abblix.Oidc.Server.Endpoints.ServiceCollectionExtensions.AddAuthorizationGrant_TImpl_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection)} Registers [TImpl](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.ServiceCollectionExtensions#Abblix.Oidc.Server.Endpoints.ServiceCollectionExtensions.AddAuthorizationGrant_TImpl_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).TImpl 'Abblix\.Oidc\.Server\.Endpoints\.ServiceCollectionExtensions\.AddAuthorizationGrant\\(this Microsoft\.Extensions\.DependencyInjection\.IServiceCollection\)\.TImpl') as both [IAuthorizationGrantHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.IAuthorizationGrantHandler') \(for grant\-handling dispatch via [CompositeAuthorizationGrantHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.CompositeAuthorizationGrantHandler 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.CompositeAuthorizationGrantHandler')\) and [IGrantTypeInformer](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IGrantTypeInformer') \(for discovery and registration\-time gates that aggregate the full `grant_types_supported` set across all informers\)\. Every [IAuthorizationGrantHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.IAuthorizationGrantHandler') implementation, both built\-in and host\-supplied, must be registered through this helper so the dual\-presence invariant cannot be silently missed when a new grant handler is added\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection AddAuthorizationGrant(this Microsoft.Extensions.DependencyInjection.IServiceCollection services) where TImpl : class, Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler; ``` #### Type parameters ###### `TImpl` {#Abblix.Oidc.Server.Endpoints.ServiceCollectionExtensions.AddAuthorizationGrant_TImpl_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).TImpl} The concrete grant\-handler implementation to register\. #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.Oidc.Server.Endpoints.ServiceCollectionExtensions.AddAuthorizationGrant_TImpl_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).services} The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') to configure\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') The configured [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection')\. ## ServiceCollectionExtensions\.AddAuthorizationGrants\(this IServiceCollection\) Method {#Abblix.Oidc.Server.Endpoints.ServiceCollectionExtensions.AddAuthorizationGrants(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection)} Composes all registered authorization grant handlers into a composite handler and registers it as the grant type informer\. This method should be called after all individual grant handlers have been registered\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection AddAuthorizationGrants(this Microsoft.Extensions.DependencyInjection.IServiceCollection services); ``` #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.Oidc.Server.Endpoints.ServiceCollectionExtensions.AddAuthorizationGrants(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).services} The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') to configure\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') The configured [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection')\. ## ServiceCollectionExtensions\.AddAuthorizationRequestFetchers\(this IServiceCollection\) Method {#Abblix.Oidc.Server.Endpoints.ServiceCollectionExtensions.AddAuthorizationRequestFetchers(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection)} Registers authorization request fetchers and related services into the provided IServiceCollection\. This method adds implementations for various authorization request fetchers as singletons, ensuring that they are efficiently reused throughout the application\. It also composes these fetchers into a composite fetcher to handle different types of authorization requests seamlessly\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection AddAuthorizationRequestFetchers(this Microsoft.Extensions.DependencyInjection.IServiceCollection services); ``` #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.Oidc.Server.Endpoints.ServiceCollectionExtensions.AddAuthorizationRequestFetchers(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).services} The IServiceCollection to which the services will be added\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') The updated IServiceCollection with the added authorization request fetchers\. ## ServiceCollectionExtensions\.AddAuthorizationResponseProcessor\\(this IServiceCollection, ServiceLifetime\) Method {#Abblix.Oidc.Server.Endpoints.ServiceCollectionExtensions.AddAuthorizationResponseProcessor_TImpl_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,Microsoft.Extensions.DependencyInjection.ServiceLifetime)} Registers [TImpl](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.ServiceCollectionExtensions#Abblix.Oidc.Server.Endpoints.ServiceCollectionExtensions.AddAuthorizationResponseProcessor_TImpl_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,Microsoft.Extensions.DependencyInjection.ServiceLifetime).TImpl 'Abblix\.Oidc\.Server\.Endpoints\.ServiceCollectionExtensions\.AddAuthorizationResponseProcessor\\(this Microsoft\.Extensions\.DependencyInjection\.IServiceCollection, Microsoft\.Extensions\.DependencyInjection\.ServiceLifetime\)\.TImpl') as a Singleton concrete service and aliases the SAME instance under both [IAuthorizationResponseBuilder](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseBuilder 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.IAuthorizationResponseBuilder') \(for response\-type dispatch in the authorization endpoint\) and [IGrantTypeInformer](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IGrantTypeInformer') \(for discovery and registration\-time gates that aggregate `grant_types_supported`\)\. Every [IAuthorizationResponseBuilder](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseBuilder 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.IAuthorizationResponseBuilder') implementation must be registered through this helper so each processor's declared grant type lands in the [IGrantTypeInformer](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IGrantTypeInformer') chain without an extra registration step\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection AddAuthorizationResponseProcessor(this Microsoft.Extensions.DependencyInjection.IServiceCollection services, Microsoft.Extensions.DependencyInjection.ServiceLifetime lifetime=Microsoft.Extensions.DependencyInjection.ServiceLifetime.Singleton) where TImpl : class, Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseBuilder; ``` #### Type parameters ###### `TImpl` {#Abblix.Oidc.Server.Endpoints.ServiceCollectionExtensions.AddAuthorizationResponseProcessor_TImpl_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,Microsoft.Extensions.DependencyInjection.ServiceLifetime).TImpl} The concrete response\-builder implementation to register\. #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.Oidc.Server.Endpoints.ServiceCollectionExtensions.AddAuthorizationResponseProcessor_TImpl_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,Microsoft.Extensions.DependencyInjection.ServiceLifetime).services} The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') to configure\. ###### `lifetime` [Microsoft\.Extensions\.DependencyInjection\.ServiceLifetime](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.servicelifetime 'Microsoft\.Extensions\.DependencyInjection\.ServiceLifetime') {#Abblix.Oidc.Server.Endpoints.ServiceCollectionExtensions.AddAuthorizationResponseProcessor_TImpl_(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,Microsoft.Extensions.DependencyInjection.ServiceLifetime).lifetime} The service lifetime for the processor and its aliases; defaults to [Microsoft\.Extensions\.DependencyInjection\.ServiceLifetime\.Singleton](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.servicelifetime.singleton 'Microsoft\.Extensions\.DependencyInjection\.ServiceLifetime\.Singleton')\. Use [Microsoft\.Extensions\.DependencyInjection\.ServiceLifetime\.Scoped](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.servicelifetime.scoped 'Microsoft\.Extensions\.DependencyInjection\.ServiceLifetime\.Scoped') when the processor has scoped dependencies, to avoid a captive dependency\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') The configured [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection')\. ## ServiceCollectionExtensions\.AddBackChannelAuthenticationContextValidators\(this IServiceCollection\) Method {#Abblix.Oidc.Server.Endpoints.ServiceCollectionExtensions.AddBackChannelAuthenticationContextValidators(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection)} Configures and registers a composite of back\-channel authentication context validators into the service collection\. Validators run in sequence to verify the client, the requested resources and scopes, the user identity hint, the requested expiry, the user code, and the ping\-mode configuration before a CIBA request is accepted\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection AddBackChannelAuthenticationContextValidators(this Microsoft.Extensions.DependencyInjection.IServiceCollection services); ``` #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.Oidc.Server.Endpoints.ServiceCollectionExtensions.AddBackChannelAuthenticationContextValidators(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).services} The service collection to which the back\-channel authentication context validators will be added\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') The modified service collection with the registered back\-channel authentication context validators\. ## ServiceCollectionExtensions\.AddClientCredentialsGrant\(this IServiceCollection\) Method {#Abblix.Oidc.Server.Endpoints.ServiceCollectionExtensions.AddClientCredentialsGrant(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection)} Registers the client credentials grant handler for OAuth 2\.0 client credentials flow\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection AddClientCredentialsGrant(this Microsoft.Extensions.DependencyInjection.IServiceCollection services); ``` #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.Oidc.Server.Endpoints.ServiceCollectionExtensions.AddClientCredentialsGrant(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).services} The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') to configure\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') The configured [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection')\. ## ServiceCollectionExtensions\.AddConfigurationEndpoint\(this IServiceCollection\) Method {#Abblix.Oidc.Server.Endpoints.ServiceCollectionExtensions.AddConfigurationEndpoint(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection)} Adds the configuration handler for OpenID Connect Discovery endpoint\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection AddConfigurationEndpoint(this Microsoft.Extensions.DependencyInjection.IServiceCollection services); ``` #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.Oidc.Server.Endpoints.ServiceCollectionExtensions.AddConfigurationEndpoint(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).services} The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') to configure\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') The configured [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection')\. ### Remarks This handler builds discovery metadata according to OpenID Connect Discovery specification, providing framework\-agnostic metadata about the provider's configuration\. ## ServiceCollectionExtensions\.AddDeviceAuthorizationContextValidators\(this IServiceCollection\) Method {#Abblix.Oidc.Server.Endpoints.ServiceCollectionExtensions.AddDeviceAuthorizationContextValidators(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection)} Configures and registers a composite of device authorization context validators into the service collection\. Validators run in sequence to verify the client, the requested scopes, and the requested resources before a device authorization request \(RFC 8628\) is accepted\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection AddDeviceAuthorizationContextValidators(this Microsoft.Extensions.DependencyInjection.IServiceCollection services); ``` #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.Oidc.Server.Endpoints.ServiceCollectionExtensions.AddDeviceAuthorizationContextValidators(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).services} The service collection to which the device authorization context validators will be added\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') The modified service collection with the registered device authorization context validators\. ## ServiceCollectionExtensions\.AddEndSessionContextValidators\(this IServiceCollection\) Method {#Abblix.Oidc.Server.Endpoints.ServiceCollectionExtensions.AddEndSessionContextValidators(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection)} Configures and registers a composite of end\-session context validators into the service collection\. Validators run in sequence to verify the `id_token_hint`, the client, the post\-logout redirect URI, and the confirmation claim before an end\-session request is accepted\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection AddEndSessionContextValidators(this Microsoft.Extensions.DependencyInjection.IServiceCollection services); ``` #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.Oidc.Server.Endpoints.ServiceCollectionExtensions.AddEndSessionContextValidators(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).services} The service collection to which the end\-session context validators will be added\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') The modified service collection with the registered end\-session context validators\. ## ServiceCollectionExtensions\.AddEndSessionEndpoint\(this IServiceCollection\) Method {#Abblix.Oidc.Server.Endpoints.ServiceCollectionExtensions.AddEndSessionEndpoint(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection)} Adds services for handling end session \(logout\) requests aligning with OpenID Connect session management specifications\. This setup enables the application to handle logout requests effectively, ensuring that user sessions are terminated securely across all involved parties\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection AddEndSessionEndpoint(this Microsoft.Extensions.DependencyInjection.IServiceCollection services); ``` #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.Oidc.Server.Endpoints.ServiceCollectionExtensions.AddEndSessionEndpoint(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).services} The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') to configure\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') The configured [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection')\. ## ServiceCollectionExtensions\.AddJwtBearerGrant\(this IServiceCollection\) Method {#Abblix.Oidc.Server.Endpoints.ServiceCollectionExtensions.AddJwtBearerGrant(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection)} Registers services required for JWT Bearer grant type, including JWT Bearer issuer provider, JWT replay prevention cache, and keyed caching decorator for JWKS fetching\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection AddJwtBearerGrant(this Microsoft.Extensions.DependencyInjection.IServiceCollection services); ``` #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.Oidc.Server.Endpoints.ServiceCollectionExtensions.AddJwtBearerGrant(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).services} The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') to configure\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') The configured [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection')\. ## ServiceCollectionExtensions\.AddPushedAuthorizationEndpoint\(this IServiceCollection\) Method {#Abblix.Oidc.Server.Endpoints.ServiceCollectionExtensions.AddPushedAuthorizationEndpoint(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection)} Registers validators and processors for pushed authorization requests \(PAR\), enhancing the security and efficiency of the authorization process by allowing clients to send requests directly to the authorization server via a back\-channel connection\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection AddPushedAuthorizationEndpoint(this Microsoft.Extensions.DependencyInjection.IServiceCollection services); ``` #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.Oidc.Server.Endpoints.ServiceCollectionExtensions.AddPushedAuthorizationEndpoint(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).services} The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') to configure\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') The configured [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection')\. ## ServiceCollectionExtensions\.AddRefreshTokenGrant\(this IServiceCollection\) Method {#Abblix.Oidc.Server.Endpoints.ServiceCollectionExtensions.AddRefreshTokenGrant(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection)} Registers the refresh token grant handler for OAuth 2\.0 refresh token flow\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection AddRefreshTokenGrant(this Microsoft.Extensions.DependencyInjection.IServiceCollection services); ``` #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.Oidc.Server.Endpoints.ServiceCollectionExtensions.AddRefreshTokenGrant(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).services} The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') to configure\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') The configured [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection')\. ## ServiceCollectionExtensions\.AddTokenContextValidators\(this IServiceCollection\) Method {#Abblix.Oidc.Server.Endpoints.ServiceCollectionExtensions.AddTokenContextValidators(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection)} Configures and registers a composite of token context validators into the service collection\. This method sets up a sequence of validators that perform various checks on token requests, ensuring they comply with the necessary criteria before a token can be issued\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection AddTokenContextValidators(this Microsoft.Extensions.DependencyInjection.IServiceCollection services); ``` #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.Oidc.Server.Endpoints.ServiceCollectionExtensions.AddTokenContextValidators(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).services} The service collection to which the token context validators will be added\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') The modified service collection with the registered token context validators\. ## ServiceCollectionExtensions\.AddTokenEndpoint\(this IServiceCollection\) Method {#Abblix.Oidc.Server.Endpoints.ServiceCollectionExtensions.AddTokenEndpoint(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection)} Adds services for validating and processing token requests according to OAuth 2\.0 and OpenID Connect standards\. This setup supports various grant types, ensuring that token requests are handled securely and efficiently, facilitating the issuance of access tokens, refresh tokens, and ID tokens to clients\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection AddTokenEndpoint(this Microsoft.Extensions.DependencyInjection.IServiceCollection services); ``` #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.Oidc.Server.Endpoints.ServiceCollectionExtensions.AddTokenEndpoint(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).services} The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') to configure\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') The configured [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection')\. ## ServiceCollectionExtensions\.AddTokenExchangeGrant\(this IServiceCollection\) Method {#Abblix.Oidc.Server.Endpoints.ServiceCollectionExtensions.AddTokenExchangeGrant(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection)} Registers the RFC 8693 Token Exchange grant handler together with the per\-type [ISubjectTokenResolver](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.TokenExchange.ISubjectTokenResolver 'Abblix\.Oidc\.Server\.Features\.TokenExchange\.ISubjectTokenResolver') implementations the library ships natively \(JWT\-formatted subject tokens via [JwtSubjectTokenResolver](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.TokenExchange.JwtSubjectTokenResolver 'Abblix\.Oidc\.Server\.Features\.TokenExchange\.JwtSubjectTokenResolver') for the `access_token`/`id_token`/`jwt` type URIs, and [RefreshTokenSubjectTokenResolver](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.TokenExchange.RefreshTokenSubjectTokenResolver 'Abblix\.Oidc\.Server\.Features\.TokenExchange\.RefreshTokenSubjectTokenResolver') for refresh tokens\)\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection AddTokenExchangeGrant(this Microsoft.Extensions.DependencyInjection.IServiceCollection services); ``` #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.Oidc.Server.Endpoints.ServiceCollectionExtensions.AddTokenExchangeGrant(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).services} The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') to configure\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') The configured [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection')\. ### Remarks Opt\-in: unlike the authorization\-code, refresh\-token and client\-credentials grants, this one is not registered by `AddTokenEndpoint`\. Call it explicitly, and call it BEFORE `AddOidcCore` / `AddOidcServices` / `AddOidcMinimalApi`, because `AddAuthorizationGrants()` composes the registered handlers inside them \- a handler added afterwards lands beside the composite and the token endpoint resolves the wrong single [IAuthorizationGrantHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.IAuthorizationGrantHandler')\. A host that does not call this neither serves the grant nor advertises it in `grant_types_supported`\. Subject\-token resolvers are dispatched by keyed DI under the `urn:ietf:params:oauth:token-type:*` URI\. Hosts may register additional resolvers after this call \(e\.g\. SAML 2\.0 assertions in federation scenarios\) \- the handler picks them up automatically\. ## ServiceCollectionExtensions\.AddUserInfoEndpoint\(this IServiceCollection\) Method {#Abblix.Oidc.Server.Endpoints.ServiceCollectionExtensions.AddUserInfoEndpoint(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection)} Adds services for handling user info requests, allowing clients to retrieve claims about the authenticated user in accordance with OpenID Connect standards\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection AddUserInfoEndpoint(this Microsoft.Extensions.DependencyInjection.IServiceCollection services); ``` #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.Oidc.Server.Endpoints.ServiceCollectionExtensions.AddUserInfoEndpoint(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).services} The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') to configure with user info endpoint capabilities\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') The configured [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection'), allowing for further service registration chaining\. ### Remarks Registers scoped validators and processors for user info requests, enabling the secure delivery of claims about the authenticated session user to the client\. This functionality is crucial for OpenID Connect\-compliant applications, providing a standardized method for clients to access user profile information based on the scopes and permissions granted during authentication\. The service setup ensures that user info requests are properly validated and processed, safeguarding sensitive user information while supporting rich client applications\. ## ServiceCollectionExtensions\.EnablePasswordGrant\(this IServiceCollection\) Method {#Abblix.Oidc.Server.Endpoints.ServiceCollectionExtensions.EnablePasswordGrant(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection)} Enables support for the password grant type, acknowledging its security considerations\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection EnablePasswordGrant(this Microsoft.Extensions.DependencyInjection.IServiceCollection services); ``` #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.Oidc.Server.Endpoints.ServiceCollectionExtensions.EnablePasswordGrant(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).services} The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') to add the password grant handler to\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') so additional calls can be chained\. ### Remarks This method is intentionally separated from the standard OIDC core service registration due to the inherent security risks associated with the password grant type\. The password grant type requires the client to handle user credentials directly, which can increase the risk of credential exposure and related security issues\. By isolating this method, we ensure that developers make a deliberate decision to enable this feature, being fully aware of its security implications\. It's recommended to use more secure grant types like authorization code or client credentials whenever possible\. Call this before `AddOidcCore`/`AddOidcServices`: the password grant handler must be registered before the grant handlers are composed, otherwise the registration is rejected at startup\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ## Abblix\.Oidc\.Server\.Endpoints\.Authorization Namespace | Classes | | | :--- | :--- | | [AuthorizationCodeBuilder](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationCodeBuilder 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.AuthorizationCodeBuilder') | Builds the `code` response\-type component of an authorization endpoint success response \- the Authorization Code Flow contributor\. Generates an authorization code via [IAuthorizationCodeService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Storages.IAuthorizationCodeService 'Abblix\.Oidc\.Server\.Features\.Storages\.IAuthorizationCodeService') and stores it on the running [SuccessfullyAuthenticated](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.SuccessfullyAuthenticated') result\. Registered by default through `AddAuthorizationEndpoint()`; covers the OAuth 2\.1 \(draft\) recommended flow\. Declares `authorization_code` in [GrantTypesSupported](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationCodeBuilder#Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationCodeBuilder.GrantTypesSupported 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.AuthorizationCodeBuilder\.GrantTypesSupported') so the discovery endpoint and registration\-time gates aggregate it transparently\. | | [AuthorizationEndpointMetadataFactory](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationEndpointMetadataFactory 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.AuthorizationEndpointMetadataFactory') | Builds the [AuthorizationEndpointMetadata](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationEndpointMetadata 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationEndpointMetadata') advertised in discovery from the registered set of [IAuthorizationResponseBuilder](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseBuilder 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.IAuthorizationResponseBuilder'): each builder declares the response\-type it owns, and the supported response\-type combinations are the canonical OAuth/OIDC combos fully covered by the registered builders\. Kept off the request\-handling path so the discovery endpoint does not resolve the authorization handler \(and its request\-time dependencies, such as the JARM response encoder\) merely to read this metadata\. | | [AuthorizationHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationHandler 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.AuthorizationHandler') | Handles authorization requests by fetching, validating, processing and encoding the response\. | | [AuthorizationRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.AuthorizationRequestProcessor') | Processes authorization requests by coordinating with various services like authentication, consent, and token issuance\. This class handles the logic of determining the appropriate response to an authorization request based on the request's parameters and the current state of the user's session\. | | [AuthorizationRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.AuthorizationRequestValidator') | Implements the Chain of Responsibility design pattern for processing authorization requests\. This class delegates the validation of authorization requests to an [IAuthorizationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.IAuthorizationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.IAuthorizationContextValidator'), allowing a sequence of validators to handle the request in a decoupled manner\. Each validator in the chain processes the request and potentially passes it along to the next validator\. | | [AuthorizationResponseEncoder](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationResponseEncoder 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.AuthorizationResponseEncoder') | Default [IAuthorizationResponseEncoder](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseEncoder 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.IAuthorizationResponseEncoder')\. Applies the `iss` \(RFC 9207\) and implicit/hybrid `scope` gating, and \- for a JARM \(`*.jwt`\) response mode \- packs the response parameters into a signed/encrypted `response` JWT and resolves the delivery mode\. Mutates the response in place; the transport layer only maps the encoded response onto the wire\. | | [ConsentConstraintEnforcer](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.ConsentConstraintEnforcer 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.ConsentConstraintEnforcer') | Default [IConsentConstraintEnforcer](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.IConsentConstraintEnforcer 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.IConsentConstraintEnforcer')\. Asserts `granted ⊆ requested` for scopes, resources \(including their nested scopes\) and RFC 9396 `authorization_details`, throwing when the consent provider returned anything outside the request\. | | Interfaces | | | :--- | :--- | | [IConsentConstraintEnforcer](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.IConsentConstraintEnforcer 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.IConsentConstraintEnforcer') | Defense\-in\-depth backstop that asserts the anti\-escalation invariant on the consent decision: the set granted by [IUserConsentsProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Consents.IUserConsentsProvider 'Abblix\.Oidc\.Server\.Features\.Consents\.IUserConsentsProvider') MUST be a subset of what the authorization request carried\. This mirrors the strictly narrowing\-only [ITokenAuthorizationContextEvaluator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenAuthorizationContextEvaluator 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.ITokenAuthorizationContextEvaluator') at the token endpoint \(RFC 8707 §2\.2\), giving the authorize\-time consent path the same guarantee\. | --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationCodeBuilder.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Authorization](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization 'Abblix\.Oidc\.Server\.Endpoints\.Authorization') ## AuthorizationCodeBuilder Class Builds the `code` response\-type component of an authorization endpoint success response \- the Authorization Code Flow contributor\. Generates an authorization code via [IAuthorizationCodeService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Storages.IAuthorizationCodeService 'Abblix\.Oidc\.Server\.Features\.Storages\.IAuthorizationCodeService') and stores it on the running [SuccessfullyAuthenticated](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.SuccessfullyAuthenticated') result\. Registered by default through `AddAuthorizationEndpoint()`; covers the OAuth 2\.1 \(draft\) recommended flow\. Declares `authorization_code` in [GrantTypesSupported](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationCodeBuilder#Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationCodeBuilder.GrantTypesSupported 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.AuthorizationCodeBuilder\.GrantTypesSupported') so the discovery endpoint and registration\-time gates aggregate it transparently\. ```csharp public class AuthorizationCodeBuilder : Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseBuilder, Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → AuthorizationCodeBuilder Implements [IAuthorizationResponseBuilder](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseBuilder 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.IAuthorizationResponseBuilder'), [IGrantTypeInformer](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IGrantTypeInformer') ### Constructors ## AuthorizationCodeBuilder\(IAuthorizationCodeService, IAuthorizationValueReuseDetector\) Constructor {#Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationCodeBuilder.AuthorizationCodeBuilder(Abblix.Oidc.Server.Features.Storages.IAuthorizationCodeService,Abblix.Oidc.Server.Features.ReusePrevention.IAuthorizationValueReuseDetector)} Builds the `code` response\-type component of an authorization endpoint success response \- the Authorization Code Flow contributor\. Generates an authorization code via [IAuthorizationCodeService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Storages.IAuthorizationCodeService 'Abblix\.Oidc\.Server\.Features\.Storages\.IAuthorizationCodeService') and stores it on the running [SuccessfullyAuthenticated](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.SuccessfullyAuthenticated') result\. Registered by default through `AddAuthorizationEndpoint()`; covers the OAuth 2\.1 \(draft\) recommended flow\. Declares `authorization_code` in [GrantTypesSupported](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationCodeBuilder#Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationCodeBuilder.GrantTypesSupported 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.AuthorizationCodeBuilder\.GrantTypesSupported') so the discovery endpoint and registration\-time gates aggregate it transparently\. ```csharp public AuthorizationCodeBuilder(Abblix.Oidc.Server.Features.Storages.IAuthorizationCodeService authorizationCodeService, Abblix.Oidc.Server.Features.ReusePrevention.IAuthorizationValueReuseDetector reuseDetector); ``` #### Parameters ###### `authorizationCodeService` [IAuthorizationCodeService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Storages.IAuthorizationCodeService 'Abblix\.Oidc\.Server\.Features\.Storages\.IAuthorizationCodeService') {#Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationCodeBuilder.AuthorizationCodeBuilder(Abblix.Oidc.Server.Features.Storages.IAuthorizationCodeService,Abblix.Oidc.Server.Features.ReusePrevention.IAuthorizationValueReuseDetector).authorizationCodeService} ###### `reuseDetector` [IAuthorizationValueReuseDetector](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ReusePrevention.IAuthorizationValueReuseDetector 'Abblix\.Oidc\.Server\.Features\.ReusePrevention\.IAuthorizationValueReuseDetector') {#Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationCodeBuilder.AuthorizationCodeBuilder(Abblix.Oidc.Server.Features.Storages.IAuthorizationCodeService,Abblix.Oidc.Server.Features.ReusePrevention.IAuthorizationValueReuseDetector).reuseDetector} ### Properties ## AuthorizationCodeBuilder\.GrantTypesSupported Property {#Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationCodeBuilder.GrantTypesSupported} The grant types supported by this component, as defined in OAuth 2\.0 and OpenID Connect specifications\. ```csharp public System.Collections.Generic.IEnumerable GrantTypesSupported { get; } ``` Implements [GrantTypesSupported](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer#Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer.GrantTypesSupported 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IGrantTypeInformer\.GrantTypesSupported') #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ### Remarks Common grant types include: - "authorization_code" - Authorization Code Grant - "implicit" - Implicit Grant - "refresh_token" - Refresh Token Grant - "client_credentials" - Client Credentials Grant - "password" - Resource Owner Password Credentials Grant ## AuthorizationCodeBuilder\.ResponseType Property {#Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationCodeBuilder.ResponseType} The single OAuth 2\.0 / OIDC response\-type value this processor is responsible for, matched case\-sensitively against parts of the request's `response_type`\. ```csharp public string ResponseType { get; } ``` Implements [ResponseType](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseBuilder#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseBuilder.ResponseType 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.IAuthorizationResponseBuilder\.ResponseType') #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Methods ## AuthorizationCodeBuilder\.BuildResponseAsync\(ValidAuthorizationRequest, AuthorizedGrant, SuccessfullyAuthenticated\) Method {#Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationCodeBuilder.BuildResponseAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest,Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant,Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated)} Populates the relevant field on [result](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationCodeBuilder#Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationCodeBuilder.BuildResponseAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest,Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant,Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated).result 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.AuthorizationCodeBuilder\.BuildResponseAsync\(Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.ValidAuthorizationRequest, Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.AuthorizedGrant, Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.SuccessfullyAuthenticated\)\.result') for this processor's response type\. Implementations mutate [result](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationCodeBuilder#Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationCodeBuilder.BuildResponseAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest,Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant,Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated).result 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.AuthorizationCodeBuilder\.BuildResponseAsync\(Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.ValidAuthorizationRequest, Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.AuthorizedGrant, Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.SuccessfullyAuthenticated\)\.result') in place and may read fields populated by processors that ran earlier in the canonical iteration order \(`code` before `token` before `id_token`\)\. ```csharp public System.Threading.Tasks.Task BuildResponseAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest request, Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant authorizedGrant, Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated result); ``` #### Parameters ###### `request` [ValidAuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.ValidAuthorizationRequest') {#Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationCodeBuilder.BuildResponseAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest,Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant,Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated).request} ###### `authorizedGrant` [AuthorizedGrant](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.AuthorizedGrant') {#Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationCodeBuilder.BuildResponseAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest,Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant,Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated).authorizedGrant} ###### `result` [SuccessfullyAuthenticated](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.SuccessfullyAuthenticated') {#Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationCodeBuilder.BuildResponseAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest,Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant,Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated).result} Implements [BuildResponseAsync\(ValidAuthorizationRequest, AuthorizedGrant, SuccessfullyAuthenticated\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseBuilder#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseBuilder.BuildResponseAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest,Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant,Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated) 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.IAuthorizationResponseBuilder\.BuildResponseAsync\(Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.ValidAuthorizationRequest, Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.AuthorizedGrant, Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.SuccessfullyAuthenticated\)') #### Returns [System\.Threading\.Tasks\.Task](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task 'System\.Threading\.Tasks\.Task') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationEndpointMetadataFactory.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Authorization](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization 'Abblix\.Oidc\.Server\.Endpoints\.Authorization') ## AuthorizationEndpointMetadataFactory Class Builds the [AuthorizationEndpointMetadata](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationEndpointMetadata 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationEndpointMetadata') advertised in discovery from the registered set of [IAuthorizationResponseBuilder](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseBuilder 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.IAuthorizationResponseBuilder'): each builder declares the response\-type it owns, and the supported response\-type combinations are the canonical OAuth/OIDC combos fully covered by the registered builders\. Kept off the request\-handling path so the discovery endpoint does not resolve the authorization handler \(and its request\-time dependencies, such as the JARM response encoder\) merely to read this metadata\. ```csharp public static class AuthorizationEndpointMetadataFactory ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → AuthorizationEndpointMetadataFactory ### Methods ## AuthorizationEndpointMetadataFactory\.Create\(IEnumerable\\) Method {#Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationEndpointMetadataFactory.Create(System.Collections.Generic.IEnumerable_Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseBuilder_)} Computes the authorization endpoint metadata from the registered response builders\. ```csharp public static Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationEndpointMetadata Create(System.Collections.Generic.IEnumerable responseBuilders); ``` #### Parameters ###### `responseBuilders` [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[IAuthorizationResponseBuilder](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseBuilder 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.IAuthorizationResponseBuilder')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') {#Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationEndpointMetadataFactory.Create(System.Collections.Generic.IEnumerable_Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseBuilder_).responseBuilders} The registered response builders, each declaring the response\-type it owns\. #### Returns [AuthorizationEndpointMetadata](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationEndpointMetadata 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationEndpointMetadata') The metadata advertised at the discovery endpoint\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationHandler.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Authorization](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization 'Abblix\.Oidc\.Server\.Endpoints\.Authorization') ## AuthorizationHandler Class Handles authorization requests by fetching, validating, processing and encoding the response\. ```csharp public class AuthorizationHandler : Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationHandler ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → AuthorizationHandler Implements [IAuthorizationHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationHandler 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.IAuthorizationHandler') ### Constructors ## AuthorizationHandler\(IAuthorizationRequestFetcher, IAuthorizationRequestValidator, IAuthorizationRequestProcessor, IAuthorizationResponseEncoder\) Constructor {#Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationHandler.AuthorizationHandler(Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.IAuthorizationRequestFetcher,Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationRequestValidator,Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationRequestProcessor,Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseEncoder)} Handles authorization requests by fetching, validating, processing and encoding the response\. ```csharp public AuthorizationHandler(Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.IAuthorizationRequestFetcher fetcher, Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationRequestValidator validator, Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationRequestProcessor processor, Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseEncoder responseEncoder); ``` #### Parameters ###### `fetcher` [IAuthorizationRequestFetcher](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.IAuthorizationRequestFetcher 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.RequestFetching\.IAuthorizationRequestFetcher') {#Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationHandler.AuthorizationHandler(Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.IAuthorizationRequestFetcher,Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationRequestValidator,Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationRequestProcessor,Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseEncoder).fetcher} Resolves the effective authorization request, including dereferencing pushed \(RFC 9126\) or request\-object \(OIDC Core §6\) variants\. ###### `validator` [IAuthorizationRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.IAuthorizationRequestValidator') {#Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationHandler.AuthorizationHandler(Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.IAuthorizationRequestFetcher,Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationRequestValidator,Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationRequestProcessor,Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseEncoder).validator} Performs protocol\-level validation of the resolved request prior to processing\. ###### `processor` [IAuthorizationRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.IAuthorizationRequestProcessor') {#Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationHandler.AuthorizationHandler(Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.IAuthorizationRequestFetcher,Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationRequestValidator,Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationRequestProcessor,Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseEncoder).processor} Produces the validated authorization result projected onto the wire\. ###### `responseEncoder` [IAuthorizationResponseEncoder](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseEncoder 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.IAuthorizationResponseEncoder') {#Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationHandler.AuthorizationHandler(Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.IAuthorizationRequestFetcher,Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationRequestValidator,Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationRequestProcessor,Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseEncoder).responseEncoder} Applies iss/scope gating and, for a JARM request, packs the response parameters into the response JWT, at the single convergence point for success and every error variant\. ### Methods ## AuthorizationHandler\.HandleAsync\(AuthorizationRequest\) Method {#Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationHandler.HandleAsync(Abblix.Oidc.Server.Model.AuthorizationRequest)} Asynchronously handles an authorization request by first fetching the request if necessary, validating the request and then processing it to generate an authorization response\. ```csharp public System.Threading.Tasks.Task HandleAsync(Abblix.Oidc.Server.Model.AuthorizationRequest request); ``` #### Parameters ###### `request` [AuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.AuthorizationRequest 'Abblix\.Oidc\.Server\.Model\.AuthorizationRequest') {#Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationHandler.HandleAsync(Abblix.Oidc.Server.Model.AuthorizationRequest).request} The authorization request to be handled\. This can be a direct request or a reference to an external request that needs to be fetched\. Implements [HandleAsync\(AuthorizationRequest\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationHandler#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationHandler.HandleAsync(Abblix.Oidc.Server.Model.AuthorizationRequest) 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.IAuthorizationHandler\.HandleAsync\(Abblix\.Oidc\.Server\.Model\.AuthorizationRequest\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[AuthorizationResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationResponse 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationResponse')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task that returns an [AuthorizationResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationResponse 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationResponse')\. This response can be either an authorization success response or an error response based on the fetching, validation and processing outcomes\. #### Exceptions [UnexpectedTypeException](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Exceptions.UnexpectedTypeException 'Abblix\.Oidc\.Server\.Common\.Exceptions\.UnexpectedTypeException') Thrown if the validation result is of an unexpected type\. ### Remarks The handling process involves three main steps: 1\. Fetching of the authorization request if specified by a request or request\_uri parameter\. 2\. Validation of the authorization request against predefined criteria to ensure its legitimacy and completeness\. 3\. Processing of the validated request to generate an authorization response, which could involve user authentication, consent handling, and token issuance\. This method ensures that only requests meeting the necessary validation criteria are processed, maintaining the integrity and security of the authorization flow\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationRequestProcessor.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Authorization](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization 'Abblix\.Oidc\.Server\.Endpoints\.Authorization') ## AuthorizationRequestProcessor Class Processes authorization requests by coordinating with various services like authentication, consent, and token issuance\. This class handles the logic of determining the appropriate response to an authorization request based on the request's parameters and the current state of the user's session\. ```csharp public class AuthorizationRequestProcessor : Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationRequestProcessor ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → AuthorizationRequestProcessor Implements [IAuthorizationRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.IAuthorizationRequestProcessor') ### Constructors ## AuthorizationRequestProcessor\(IAuthSessionService, IUserConsentsProvider, IRevocationCutoffChecker, ISubjectTypeConverter, TimeProvider, IEnumerable\, IConsentConstraintEnforcer\) Constructor {#Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationRequestProcessor.AuthorizationRequestProcessor(Abblix.Oidc.Server.Features.UserAuthentication.IAuthSessionService,Abblix.Oidc.Server.Features.Consents.IUserConsentsProvider,Abblix.Oidc.Server.Features.Tokens.Revocation.IRevocationCutoffChecker,Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter,System.TimeProvider,System.Collections.Generic.IEnumerable_Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseBuilder_,Abblix.Oidc.Server.Endpoints.Authorization.IConsentConstraintEnforcer)} Processes authorization requests by coordinating with various services like authentication, consent, and token issuance\. This class handles the logic of determining the appropriate response to an authorization request based on the request's parameters and the current state of the user's session\. ```csharp public AuthorizationRequestProcessor(Abblix.Oidc.Server.Features.UserAuthentication.IAuthSessionService authSessionService, Abblix.Oidc.Server.Features.Consents.IUserConsentsProvider consentsProvider, Abblix.Oidc.Server.Features.Tokens.Revocation.IRevocationCutoffChecker cutoffChecker, Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter subjectTypeConverter, System.TimeProvider clock, System.Collections.Generic.IEnumerable responseProcessors, Abblix.Oidc.Server.Endpoints.Authorization.IConsentConstraintEnforcer consentConstraintEnforcer); ``` #### Parameters ###### `authSessionService` [IAuthSessionService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.UserAuthentication.IAuthSessionService 'Abblix\.Oidc\.Server\.Features\.UserAuthentication\.IAuthSessionService') {#Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationRequestProcessor.AuthorizationRequestProcessor(Abblix.Oidc.Server.Features.UserAuthentication.IAuthSessionService,Abblix.Oidc.Server.Features.Consents.IUserConsentsProvider,Abblix.Oidc.Server.Features.Tokens.Revocation.IRevocationCutoffChecker,Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter,System.TimeProvider,System.Collections.Generic.IEnumerable_Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseBuilder_,Abblix.Oidc.Server.Endpoints.Authorization.IConsentConstraintEnforcer).authSessionService} ###### `consentsProvider` [IUserConsentsProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Consents.IUserConsentsProvider 'Abblix\.Oidc\.Server\.Features\.Consents\.IUserConsentsProvider') {#Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationRequestProcessor.AuthorizationRequestProcessor(Abblix.Oidc.Server.Features.UserAuthentication.IAuthSessionService,Abblix.Oidc.Server.Features.Consents.IUserConsentsProvider,Abblix.Oidc.Server.Features.Tokens.Revocation.IRevocationCutoffChecker,Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter,System.TimeProvider,System.Collections.Generic.IEnumerable_Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseBuilder_,Abblix.Oidc.Server.Endpoints.Authorization.IConsentConstraintEnforcer).consentsProvider} ###### `cutoffChecker` [IRevocationCutoffChecker](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.Revocation.IRevocationCutoffChecker 'Abblix\.Oidc\.Server\.Features\.Tokens\.Revocation\.IRevocationCutoffChecker') {#Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationRequestProcessor.AuthorizationRequestProcessor(Abblix.Oidc.Server.Features.UserAuthentication.IAuthSessionService,Abblix.Oidc.Server.Features.Consents.IUserConsentsProvider,Abblix.Oidc.Server.Features.Tokens.Revocation.IRevocationCutoffChecker,Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter,System.TimeProvider,System.Collections.Generic.IEnumerable_Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseBuilder_,Abblix.Oidc.Server.Endpoints.Authorization.IConsentConstraintEnforcer).cutoffChecker} ###### `subjectTypeConverter` [ISubjectTypeConverter](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter 'Abblix\.Oidc\.Server\.Features\.PairwiseIdentifiers\.ISubjectTypeConverter') {#Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationRequestProcessor.AuthorizationRequestProcessor(Abblix.Oidc.Server.Features.UserAuthentication.IAuthSessionService,Abblix.Oidc.Server.Features.Consents.IUserConsentsProvider,Abblix.Oidc.Server.Features.Tokens.Revocation.IRevocationCutoffChecker,Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter,System.TimeProvider,System.Collections.Generic.IEnumerable_Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseBuilder_,Abblix.Oidc.Server.Endpoints.Authorization.IConsentConstraintEnforcer).subjectTypeConverter} ###### `clock` [System\.TimeProvider](https://learn.microsoft.com/en-us/dotnet/api/system.timeprovider 'System\.TimeProvider') {#Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationRequestProcessor.AuthorizationRequestProcessor(Abblix.Oidc.Server.Features.UserAuthentication.IAuthSessionService,Abblix.Oidc.Server.Features.Consents.IUserConsentsProvider,Abblix.Oidc.Server.Features.Tokens.Revocation.IRevocationCutoffChecker,Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter,System.TimeProvider,System.Collections.Generic.IEnumerable_Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseBuilder_,Abblix.Oidc.Server.Endpoints.Authorization.IConsentConstraintEnforcer).clock} ###### `responseProcessors` [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[IAuthorizationResponseBuilder](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseBuilder 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.IAuthorizationResponseBuilder')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') {#Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationRequestProcessor.AuthorizationRequestProcessor(Abblix.Oidc.Server.Features.UserAuthentication.IAuthSessionService,Abblix.Oidc.Server.Features.Consents.IUserConsentsProvider,Abblix.Oidc.Server.Features.Tokens.Revocation.IRevocationCutoffChecker,Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter,System.TimeProvider,System.Collections.Generic.IEnumerable_Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseBuilder_,Abblix.Oidc.Server.Endpoints.Authorization.IConsentConstraintEnforcer).responseProcessors} ###### `consentConstraintEnforcer` [IConsentConstraintEnforcer](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.IConsentConstraintEnforcer 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.IConsentConstraintEnforcer') {#Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationRequestProcessor.AuthorizationRequestProcessor(Abblix.Oidc.Server.Features.UserAuthentication.IAuthSessionService,Abblix.Oidc.Server.Features.Consents.IUserConsentsProvider,Abblix.Oidc.Server.Features.Tokens.Revocation.IRevocationCutoffChecker,Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter,System.TimeProvider,System.Collections.Generic.IEnumerable_Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseBuilder_,Abblix.Oidc.Server.Endpoints.Authorization.IConsentConstraintEnforcer).consentConstraintEnforcer} ### Methods ## AuthorizationRequestProcessor\.ProcessAsync\(ValidAuthorizationRequest\) Method {#Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationRequestProcessor.ProcessAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest)} Orchestrates the flow for handling a valid authorization request, considering the user's session state, the need for user consent, and generating appropriate tokens\. This method serves as the central logic for determining how the system should respond based on the client's request and the user's current state\. ```csharp public System.Threading.Tasks.Task ProcessAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest request); ``` #### Parameters ###### `request` [ValidAuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.ValidAuthorizationRequest') {#Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationRequestProcessor.ProcessAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest).request} A validated authorization request containing parameters required for processing\. Implements [ProcessAsync\(ValidAuthorizationRequest\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationRequestProcessor#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationRequestProcessor.ProcessAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest) 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.IAuthorizationRequestProcessor\.ProcessAsync\(Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.ValidAuthorizationRequest\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[AuthorizationResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationResponse 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationResponse')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') An authorization response object, which can either represent a successful authentication, an error, or a signal that further user interaction is required \(e\.g\., login, consent\)\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationRequestValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Authorization](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization 'Abblix\.Oidc\.Server\.Endpoints\.Authorization') ## AuthorizationRequestValidator Class Implements the Chain of Responsibility design pattern for processing authorization requests\. This class delegates the validation of authorization requests to an [IAuthorizationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.IAuthorizationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.IAuthorizationContextValidator'), allowing a sequence of validators to handle the request in a decoupled manner\. Each validator in the chain processes the request and potentially passes it along to the next validator\. ```csharp public class AuthorizationRequestValidator : Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationRequestValidator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → AuthorizationRequestValidator Implements [IAuthorizationRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.IAuthorizationRequestValidator') ### Constructors ## AuthorizationRequestValidator\(IAuthorizationContextValidator\) Constructor {#Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationRequestValidator.AuthorizationRequestValidator(Abblix.Oidc.Server.Endpoints.Authorization.Validation.IAuthorizationContextValidator)} Implements the Chain of Responsibility design pattern for processing authorization requests\. This class delegates the validation of authorization requests to an [IAuthorizationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.IAuthorizationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.IAuthorizationContextValidator'), allowing a sequence of validators to handle the request in a decoupled manner\. Each validator in the chain processes the request and potentially passes it along to the next validator\. ```csharp public AuthorizationRequestValidator(Abblix.Oidc.Server.Endpoints.Authorization.Validation.IAuthorizationContextValidator validator); ``` #### Parameters ###### `validator` [IAuthorizationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.IAuthorizationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.IAuthorizationContextValidator') {#Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationRequestValidator.AuthorizationRequestValidator(Abblix.Oidc.Server.Endpoints.Authorization.Validation.IAuthorizationContextValidator).validator} The first validator in the chain to handle the authorization context\. ### Methods ## AuthorizationRequestValidator\.ValidateAsync\(AuthorizationRequest\) Method {#Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationRequestValidator.ValidateAsync(Abblix.Oidc.Server.Model.AuthorizationRequest)} Asynchronously validates an [AuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.AuthorizationRequest 'Abblix\.Oidc\.Server\.Model\.AuthorizationRequest') by passing it through a chain of validators\. The method creates a validation context and delegates the validation process to the initial validator in the chain, which can then pass the request to subsequent validators as necessary\. ```csharp public System.Threading.Tasks.Task> ValidateAsync(Abblix.Oidc.Server.Model.AuthorizationRequest request); ``` #### Parameters ###### `request` [AuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.AuthorizationRequest 'Abblix\.Oidc\.Server\.Model\.AuthorizationRequest') {#Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationRequestValidator.ValidateAsync(Abblix.Oidc.Server.Model.AuthorizationRequest).request} The authorization request to validate\. Implements [ValidateAsync\(AuthorizationRequest\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationRequestValidator#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationRequestValidator.ValidateAsync(Abblix.Oidc.Server.Model.AuthorizationRequest) 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.IAuthorizationRequestValidator\.ValidateAsync\(Abblix\.Oidc\.Server\.Model\.AuthorizationRequest\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[ValidAuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.ValidAuthorizationRequest')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[AuthorizationRequestValidationError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationRequestValidationError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A [Result<TSuccess,TFailure>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2') of [ValidAuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.ValidAuthorizationRequest') on success or [AuthorizationRequestValidationError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationRequestValidationError') on failure, representing the outcome of the validation process, which may be the result of processing by one or more validators in the chain\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationResponseEncoder.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Authorization](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization 'Abblix\.Oidc\.Server\.Endpoints\.Authorization') ## AuthorizationResponseEncoder Class Default [IAuthorizationResponseEncoder](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseEncoder 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.IAuthorizationResponseEncoder')\. Applies the `iss` \(RFC 9207\) and implicit/hybrid `scope` gating, and \- for a JARM \(`*.jwt`\) response mode \- packs the response parameters into a signed/encrypted `response` JWT and resolves the delivery mode\. Mutates the response in place; the transport layer only maps the encoded response onto the wire\. ```csharp public class AuthorizationResponseEncoder : Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseEncoder ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → AuthorizationResponseEncoder Implements [IAuthorizationResponseEncoder](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseEncoder 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.IAuthorizationResponseEncoder') ### Constructors ## AuthorizationResponseEncoder\(IIssuerProvider, IAuthorizationMetadataProvider, IResponseJwtBuilder\) Constructor {#Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationResponseEncoder.AuthorizationResponseEncoder(Abblix.Oidc.Server.Features.Issuer.IIssuerProvider,Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IAuthorizationMetadataProvider,Abblix.Oidc.Server.Features.ResponseObject.IResponseJwtBuilder)} Default [IAuthorizationResponseEncoder](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseEncoder 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.IAuthorizationResponseEncoder')\. Applies the `iss` \(RFC 9207\) and implicit/hybrid `scope` gating, and \- for a JARM \(`*.jwt`\) response mode \- packs the response parameters into a signed/encrypted `response` JWT and resolves the delivery mode\. Mutates the response in place; the transport layer only maps the encoded response onto the wire\. ```csharp public AuthorizationResponseEncoder(Abblix.Oidc.Server.Features.Issuer.IIssuerProvider issuerProvider, Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IAuthorizationMetadataProvider authorizationMetadata, Abblix.Oidc.Server.Features.ResponseObject.IResponseJwtBuilder responseJwtBuilder); ``` #### Parameters ###### `issuerProvider` [IIssuerProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Issuer.IIssuerProvider 'Abblix\.Oidc\.Server\.Features\.Issuer\.IIssuerProvider') {#Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationResponseEncoder.AuthorizationResponseEncoder(Abblix.Oidc.Server.Features.Issuer.IIssuerProvider,Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IAuthorizationMetadataProvider,Abblix.Oidc.Server.Features.ResponseObject.IResponseJwtBuilder).issuerProvider} Supplies the `iss` value \(RFC 9207\)\. ###### `authorizationMetadata` [IAuthorizationMetadataProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IAuthorizationMetadataProvider 'Abblix\.Oidc\.Server\.Endpoints\.Configuration\.Interfaces\.IAuthorizationMetadataProvider') {#Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationResponseEncoder.AuthorizationResponseEncoder(Abblix.Oidc.Server.Features.Issuer.IIssuerProvider,Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IAuthorizationMetadataProvider,Abblix.Oidc.Server.Features.ResponseObject.IResponseJwtBuilder).authorizationMetadata} Tells whether `iss` is advertised/emitted\. ###### `responseJwtBuilder` [IResponseJwtBuilder](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ResponseObject.IResponseJwtBuilder 'Abblix\.Oidc\.Server\.Features\.ResponseObject\.IResponseJwtBuilder') {#Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationResponseEncoder.AuthorizationResponseEncoder(Abblix.Oidc.Server.Features.Issuer.IIssuerProvider,Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IAuthorizationMetadataProvider,Abblix.Oidc.Server.Features.ResponseObject.IResponseJwtBuilder).responseJwtBuilder} Builds the JARM `response` JWT\. ### Methods ## AuthorizationResponseEncoder\.EncodeAsync\(AuthorizationResponse\) Method {#Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationResponseEncoder.EncodeAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationResponse)} Encodes the supplied authorization response in place\. No\-op for response types that are not delivered to the client's redirect URI\. ```csharp public System.Threading.Tasks.Task EncodeAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationResponse response); ``` #### Parameters ###### `response` [AuthorizationResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationResponse 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationResponse') {#Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationResponseEncoder.EncodeAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationResponse).response} The processed authorization response to encode\. Implements [EncodeAsync\(AuthorizationResponse\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseEncoder#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseEncoder.EncodeAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationResponse) 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.IAuthorizationResponseEncoder\.EncodeAsync\(Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationResponse\)') #### Returns [System\.Threading\.Tasks\.Task](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task 'System\.Threading\.Tasks\.Task') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.ConsentConstraintEnforcer.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Authorization](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization 'Abblix\.Oidc\.Server\.Endpoints\.Authorization') ## ConsentConstraintEnforcer Class Default [IConsentConstraintEnforcer](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.IConsentConstraintEnforcer 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.IConsentConstraintEnforcer')\. Asserts `granted ⊆ requested` for scopes, resources \(including their nested scopes\) and RFC 9396 `authorization_details`, throwing when the consent provider returned anything outside the request\. ```csharp public class ConsentConstraintEnforcer : Abblix.Oidc.Server.Endpoints.Authorization.IConsentConstraintEnforcer ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ConsentConstraintEnforcer Implements [IConsentConstraintEnforcer](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.IConsentConstraintEnforcer 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.IConsentConstraintEnforcer') ### Constructors ## ConsentConstraintEnforcer\(IAuthorizationDetailsPolicy\) Constructor {#Abblix.Oidc.Server.Endpoints.Authorization.ConsentConstraintEnforcer.ConsentConstraintEnforcer(Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy)} Default [IConsentConstraintEnforcer](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.IConsentConstraintEnforcer 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.IConsentConstraintEnforcer')\. Asserts `granted ⊆ requested` for scopes, resources \(including their nested scopes\) and RFC 9396 `authorization_details`, throwing when the consent provider returned anything outside the request\. ```csharp public ConsentConstraintEnforcer(Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy authorizationDetailsPolicy); ``` #### Parameters ###### `authorizationDetailsPolicy` [IAuthorizationDetailsPolicy](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy 'Abblix\.Oidc\.Server\.Features\.RichAuthorizationRequests\.IAuthorizationDetailsPolicy') {#Abblix.Oidc.Server.Endpoints.Authorization.ConsentConstraintEnforcer.ConsentConstraintEnforcer(Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy).authorizationDetailsPolicy} Re\-runs granted `authorization_details` through the per\-type validators and per\-client allowlist; the per\-type validator owns the "is B a narrowing of A" decision for intra\-entry content \(RFC 9396 §6\.1 has no universal comparator\)\. ### Methods ## ConsentConstraintEnforcer\.EnforceAsync\(ValidAuthorizationRequest, ConsentDefinition, CancellationToken\) Method {#Abblix.Oidc.Server.Endpoints.Authorization.ConsentConstraintEnforcer.EnforceAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest,Abblix.Oidc.Server.Features.Consents.ConsentDefinition,System.Threading.CancellationToken)} Asserts that the granted consent does not exceed the request, and returns the `authorization_details` as the per\-type validators left them\. ```csharp public System.Threading.Tasks.Task EnforceAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest request, Abblix.Oidc.Server.Features.Consents.ConsentDefinition granted, System.Threading.CancellationToken cancellationToken); ``` #### Parameters ###### `request` [ValidAuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.ValidAuthorizationRequest') {#Abblix.Oidc.Server.Endpoints.Authorization.ConsentConstraintEnforcer.EnforceAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest,Abblix.Oidc.Server.Features.Consents.ConsentDefinition,System.Threading.CancellationToken).request} The validated authorization request carrying the requested scopes, resources and `authorization_details`\. ###### `granted` [ConsentDefinition](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Consents.ConsentDefinition 'Abblix\.Oidc\.Server\.Features\.Consents\.ConsentDefinition') {#Abblix.Oidc.Server.Endpoints.Authorization.ConsentConstraintEnforcer.EnforceAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest,Abblix.Oidc.Server.Features.Consents.ConsentDefinition,System.Threading.CancellationToken).granted} The consent decision produced by [IUserConsentsProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Consents.IUserConsentsProvider 'Abblix\.Oidc\.Server\.Features\.Consents\.IUserConsentsProvider')\. ###### `cancellationToken` [System\.Threading\.CancellationToken](https://learn.microsoft.com/en-us/dotnet/api/system.threading.cancellationtoken 'System\.Threading\.CancellationToken') {#Abblix.Oidc.Server.Endpoints.Authorization.ConsentConstraintEnforcer.EnforceAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest,Abblix.Oidc.Server.Features.Consents.ConsentDefinition,System.Threading.CancellationToken).cancellationToken} Cancellation token\. Implements [EnforceAsync\(ValidAuthorizationRequest, ConsentDefinition, CancellationToken\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.IConsentConstraintEnforcer#Abblix.Oidc.Server.Endpoints.Authorization.IConsentConstraintEnforcer.EnforceAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest,Abblix.Oidc.Server.Features.Consents.ConsentDefinition,System.Threading.CancellationToken) 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.IConsentConstraintEnforcer\.EnforceAsync\(Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.ValidAuthorizationRequest, Abblix\.Oidc\.Server\.Features\.Consents\.ConsentDefinition, System\.Threading\.CancellationToken\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[System\.Text\.Json\.Nodes\.JsonArray](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonarray 'System\.Text\.Json\.Nodes\.JsonArray')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') The granted `authorization_details` as re\-validated, or `null` when the consent decision carried none\. A re\-validation that returns nothing leaves the granted set standing, so `null` never means "the validators emptied it"\. #### Exceptions [System\.InvalidOperationException](https://learn.microsoft.com/en-us/dotnet/api/system.invalidoperationexception 'System\.InvalidOperationException') Thrown when the granted set contains a scope, resource, resource scope or `authorization_details` entry absent from \- or broader than \- the request; and equally when the array leaving the per\-type re\-validation does, since that is the one the grant is built from\. Also thrown when an entry cannot be read as a JSON object, when one carries no `type`, and when the re\-validation answers with an empty set, which says every entry was removed and leaves nothing to issue a grant for\. ### Remarks What this bounds is TYPES and shapes, and deliberately not cardinality: a per\-type validator answering with several entries of a type the user did grant is accepted, because RFC 9396 offers no comparator that would say whether three entries of a type narrow one\. A deployment that needs that bound sets it inside the per\-type validator, which is the only place that knows what a second entry of its own type means\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.IConsentConstraintEnforcer.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Authorization](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization 'Abblix\.Oidc\.Server\.Endpoints\.Authorization') ## IConsentConstraintEnforcer Interface Defense\-in\-depth backstop that asserts the anti\-escalation invariant on the consent decision: the set granted by [IUserConsentsProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Consents.IUserConsentsProvider 'Abblix\.Oidc\.Server\.Features\.Consents\.IUserConsentsProvider') MUST be a subset of what the authorization request carried\. This mirrors the strictly narrowing\-only [ITokenAuthorizationContextEvaluator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenAuthorizationContextEvaluator 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.ITokenAuthorizationContextEvaluator') at the token endpoint \(RFC 8707 §2\.2\), giving the authorize\-time consent path the same guarantee\. ```csharp public interface IConsentConstraintEnforcer ``` Derived ↳ [ConsentConstraintEnforcer](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.ConsentConstraintEnforcer 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.ConsentConstraintEnforcer') ### Remarks Violating `granted ⊆ requested` is never a protocol\-level condition: the consent decision frequently originates across the browser trust boundary, and a host whose [IUserConsentsProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Consents.IUserConsentsProvider 'Abblix\.Oidc\.Server\.Features\.Consents\.IUserConsentsProvider') echoes browser\-supplied scopes / resources / `authorization_details` without intersecting against the request would let a user escalate their own grant\. The provider returning anything outside the request is a defect in the host's code \(or browser tampering its provider failed to defend against\), so the enforcer fails loud with an exception rather than masking it as a recoverable OAuth error \- it surfaces in the debugger, fails the host's tests, and is logged as a server error in production while no escalated grant is issued\. ### Methods ## IConsentConstraintEnforcer\.EnforceAsync\(ValidAuthorizationRequest, ConsentDefinition, CancellationToken\) Method {#Abblix.Oidc.Server.Endpoints.Authorization.IConsentConstraintEnforcer.EnforceAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest,Abblix.Oidc.Server.Features.Consents.ConsentDefinition,System.Threading.CancellationToken)} Asserts that the granted consent does not exceed the request, and returns the `authorization_details` as the per\-type validators left them\. ```csharp System.Threading.Tasks.Task EnforceAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest request, Abblix.Oidc.Server.Features.Consents.ConsentDefinition granted, System.Threading.CancellationToken cancellationToken); ``` #### Parameters ###### `request` [ValidAuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.ValidAuthorizationRequest') {#Abblix.Oidc.Server.Endpoints.Authorization.IConsentConstraintEnforcer.EnforceAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest,Abblix.Oidc.Server.Features.Consents.ConsentDefinition,System.Threading.CancellationToken).request} The validated authorization request carrying the requested scopes, resources and `authorization_details`\. ###### `granted` [ConsentDefinition](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Consents.ConsentDefinition 'Abblix\.Oidc\.Server\.Features\.Consents\.ConsentDefinition') {#Abblix.Oidc.Server.Endpoints.Authorization.IConsentConstraintEnforcer.EnforceAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest,Abblix.Oidc.Server.Features.Consents.ConsentDefinition,System.Threading.CancellationToken).granted} The consent decision produced by [IUserConsentsProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Consents.IUserConsentsProvider 'Abblix\.Oidc\.Server\.Features\.Consents\.IUserConsentsProvider')\. ###### `cancellationToken` [System\.Threading\.CancellationToken](https://learn.microsoft.com/en-us/dotnet/api/system.threading.cancellationtoken 'System\.Threading\.CancellationToken') {#Abblix.Oidc.Server.Endpoints.Authorization.IConsentConstraintEnforcer.EnforceAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest,Abblix.Oidc.Server.Features.Consents.ConsentDefinition,System.Threading.CancellationToken).cancellationToken} Cancellation token\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[System\.Text\.Json\.Nodes\.JsonArray](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonarray 'System\.Text\.Json\.Nodes\.JsonArray')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') The granted `authorization_details` as re\-validated, or `null` when the consent decision carried none\. A re\-validation that returns nothing leaves the granted set standing, so `null` never means "the validators emptied it"\. #### Exceptions [System\.InvalidOperationException](https://learn.microsoft.com/en-us/dotnet/api/system.invalidoperationexception 'System\.InvalidOperationException') Thrown when the granted set contains a scope, resource, resource scope or `authorization_details` entry absent from \- or broader than \- the request; and equally when the array leaving the per\-type re\-validation does, since that is the one the grant is built from\. Also thrown when an entry cannot be read as a JSON object, when one carries no `type`, and when the re\-validation answers with an empty set, which says every entry was removed and leaves nothing to issue a grant for\. ### Remarks What this bounds is TYPES and shapes, and deliberately not cardinality: a per\-type validator answering with several entries of a type the user did grant is accepted, because RFC 9396 offers no comparator that would say whether three entries of a type narrow one\. A deployment that needs that bound sets it inside the per\-type validator, which is the only place that knows what a second entry of its own type means\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ## Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces Namespace | Classes | | | :--- | :--- | | [AccountSelectionRequired](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AccountSelectionRequired 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AccountSelectionRequired') | Outcome signalling that more than one active end\-user session matches the request and the host UI must let the user pick one before authorization can continue\. Maps to OpenID Connect Core 1\.0 §3\.1\.2\.6 `account_selection_required` when `prompt=none`; otherwise the host renders an account picker over the supplied [Users](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AccountSelectionRequired#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AccountSelectionRequired.Users 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AccountSelectionRequired\.Users') set\. | | [AuthorizationEndpointMetadata](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationEndpointMetadata 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationEndpointMetadata') | Holds metadata for the authorization endpoint, detailing the capabilities and supported standards\. | | [AuthorizationError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationError 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationError') | Represents an error response for an authorization request, detailing the nature of the error\. | | [AuthorizationRequestValidationError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationRequestValidationError') | Represents a specific type of validation result for an authorization request that has been deemed invalid\. This record details the nature of the validation failure through an error code and description, providing insights into why the request did not pass validation checks\. It also includes the redirect URI to guide the client on where to direct the user for further actions if necessary\. | | [AuthorizationResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationResponse 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationResponse') | Represents the response to an authorization request\. This abstract record serves as a base for specific authorization response implementations\. It should be inherited by classes that define the detailed structure and behavior of different types of authorization responses\. | | [AuthorizationResponse\.Parameters](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationResponse.Parameters 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationResponse\.Parameters') | Wire\-level parameter names returned to the client by the authorization endpoint \(via query, fragment, form\_post, or \- under JARM \- as claims inside the single `response` JWT\)\. Shared by the core response encoder and the MVC serialization DTO so the two never drift\. | | [ClientDeliveredResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ClientDeliveredResponse 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.ClientDeliveredResponse') | Base for the authorization responses that are delivered to the client's `redirect_uri` \([SuccessfullyAuthenticated](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.SuccessfullyAuthenticated') and [AuthorizationError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationError 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationError')\), as opposed to the interaction responses \([LoginRequired](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.LoginRequired 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.LoginRequired'), [ConsentRequired](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ConsentRequired 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.ConsentRequired'), \.\.\.\) that redirect to the authorization server's own UI\. These are the responses the [IAuthorizationResponseEncoder](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseEncoder 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.IAuthorizationResponseEncoder') encodes: it sets the `iss` \(RFC 9207\) value, and for a JARM \(`*.jwt`\) request packs the parameters into [ResponseJwt](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ClientDeliveredResponse#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ClientDeliveredResponse.ResponseJwt 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.ClientDeliveredResponse\.ResponseJwt') and resolves [ResponseMode](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ClientDeliveredResponse#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ClientDeliveredResponse.ResponseMode 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.ClientDeliveredResponse\.ResponseMode') to its plaintext delivery counterpart\. | | [ConsentRequired](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ConsentRequired 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.ConsentRequired') | Outcome signalling that the user is authenticated but has not yet granted every scope or resource the client is asking for, so the host must show its consent UI for the deltas in [RequiredUserConsents](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ConsentRequired#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ConsentRequired.RequiredUserConsents 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.ConsentRequired\.RequiredUserConsents')\. Maps to OpenID Connect Core 1\.0 §3\.1\.2\.6 `consent_required` when `prompt=none`\. | | [InteractionRequired](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.InteractionRequired 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.InteractionRequired') | Outcome signalling that an end\-user is signed in but additional UI interaction \(a step\-up, missing claim, MFA challenge or similar\) must complete before the authorization request can be fulfilled\. Maps to OpenID Connect Core 1\.0 §3\.1\.2\.6 `interaction_required` when `prompt=none`\. | | [LoginRequired](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.LoginRequired 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.LoginRequired') | Outcome signalling that the host must surface its login UI: either no eligible session exists, or the client requested forced reauthentication via `prompt=login` / `max_age`\. Maps to OpenID Connect Core 1\.0 §3\.1\.2\.6 `login_required` when `prompt=none`\. | | [RegistrationRequired](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.RegistrationRequired 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.RegistrationRequired') | Outcome signalling that the host must surface its account\-creation UI: the client requested user registration via `prompt=create` \(Initiating User Registration via OpenID Connect 1\.0\)\. Per that specification the registration experience is shown regardless of whether the user currently has an authenticated session\. | | [SuccessfullyAuthenticated](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.SuccessfullyAuthenticated') | Represents a successful authentication response, encapsulating details about the outcome of an authentication request, including any tokens issued as a result\. | | [ValidAuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.ValidAuthorizationRequest') | Output of [IAuthorizationRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.IAuthorizationRequestValidator') handed to [IAuthorizationRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.IAuthorizationRequestProcessor')\. Snapshot of the data resolved during validation: the wire\-level request, the authenticated client, the negotiated response mode \(per OAuth 2\.0 Multiple Response Types / Form Post\), and the materialized scope and resource definitions ready for consent and token issuance\. | | Interfaces | | | :--- | :--- | | [IAuthorizationHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationHandler 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.IAuthorizationHandler') | Defines a contract for handling authorization requests, ensuring they are processed according to OAuth 2\.0 and OpenID Connect protocol specifications\. | | [IAuthorizationRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.IAuthorizationRequestProcessor') | Defines the interface for processing authorization requests according to OpenID Connect and OAuth 2\.0 specifications\. It handles the end\-user's authentication, authorization decision, and the issuance of authorization codes and tokens\. | | [IAuthorizationRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.IAuthorizationRequestValidator') | Defines the interface for validating authorization requests in accordance with OpenID Connect Core 1\.0 specifications\. It assesses if a request complies with the required parameters and constraints for authentication and authorization processes\. | | [IAuthorizationResponseBuilder](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseBuilder 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.IAuthorizationResponseBuilder') | Contributes one response\-type component to the authorization endpoint's success response\. Each implementation owns a single value of the OAuth 2\.0 / OIDC `response_type` parameter \(for example `code`, `token`, or `id_token`\) and populates the corresponding field on the running [SuccessfullyAuthenticated](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.SuccessfullyAuthenticated') result\. | | [IAuthorizationResponseEncoder](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseEncoder 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.IAuthorizationResponseEncoder') | Applies the protocol\-level encoding of an authorization response in the framework\-agnostic core: the `iss` \(RFC 9207\) and implicit/hybrid `scope` gating, and \- when the client requested a JARM \(`*.jwt`\) response mode \- packing all response parameters into the `response` JWT and resolving the plaintext delivery mode\. | --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AccountSelectionRequired.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces') ## AccountSelectionRequired Class Outcome signalling that more than one active end\-user session matches the request and the host UI must let the user pick one before authorization can continue\. Maps to OpenID Connect Core 1\.0 §3\.1\.2\.6 `account_selection_required` when `prompt=none`; otherwise the host renders an account picker over the supplied [Users](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AccountSelectionRequired#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AccountSelectionRequired.Users 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AccountSelectionRequired\.Users') set\. ```csharp public record AccountSelectionRequired : Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationResponse, System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [AuthorizationResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationResponse 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationResponse') → AccountSelectionRequired Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[AccountSelectionRequired](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AccountSelectionRequired 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AccountSelectionRequired')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Constructors ## AccountSelectionRequired\(AuthorizationRequest, AuthSession\[\]\) Constructor {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AccountSelectionRequired.AccountSelectionRequired(Abblix.Oidc.Server.Model.AuthorizationRequest,Abblix.Oidc.Server.Features.UserAuthentication.AuthSession[])} Outcome signalling that more than one active end\-user session matches the request and the host UI must let the user pick one before authorization can continue\. Maps to OpenID Connect Core 1\.0 §3\.1\.2\.6 `account_selection_required` when `prompt=none`; otherwise the host renders an account picker over the supplied [Users](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AccountSelectionRequired#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AccountSelectionRequired.Users 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AccountSelectionRequired\.Users') set\. ```csharp public AccountSelectionRequired(Abblix.Oidc.Server.Model.AuthorizationRequest Model, Abblix.Oidc.Server.Features.UserAuthentication.AuthSession[] Users); ``` #### Parameters ###### `Model` [AuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.AuthorizationRequest 'Abblix\.Oidc\.Server\.Model\.AuthorizationRequest') {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AccountSelectionRequired.AccountSelectionRequired(Abblix.Oidc.Server.Model.AuthorizationRequest,Abblix.Oidc.Server.Features.UserAuthentication.AuthSession[]).Model} The authorization request that triggered the multi\-account branch\. ###### `Users` [AuthSession](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.UserAuthentication.AuthSession 'Abblix\.Oidc\.Server\.Features\.UserAuthentication\.AuthSession')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AccountSelectionRequired.AccountSelectionRequired(Abblix.Oidc.Server.Model.AuthorizationRequest,Abblix.Oidc.Server.Features.UserAuthentication.AuthSession[]).Users} All authenticated sessions that satisfy the request's filters \(e\.g\. `max_age`, `acr_values`\) and are eligible for selection\. ### Properties ## AccountSelectionRequired\.Users Property {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AccountSelectionRequired.Users} All authenticated sessions that satisfy the request's filters \(e\.g\. `max_age`, `acr_values`\) and are eligible for selection\. ```csharp public Abblix.Oidc.Server.Features.UserAuthentication.AuthSession[] Users { get; init; } ``` #### Property Value [AuthSession](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.UserAuthentication.AuthSession 'Abblix\.Oidc\.Server\.Features\.UserAuthentication\.AuthSession')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationEndpointMetadata.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces') ## AuthorizationEndpointMetadata Class Holds metadata for the authorization endpoint, detailing the capabilities and supported standards\. ```csharp public record AuthorizationEndpointMetadata : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → AuthorizationEndpointMetadata Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[AuthorizationEndpointMetadata](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationEndpointMetadata 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationEndpointMetadata')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Properties ## AuthorizationEndpointMetadata\.ClaimsParameterSupported Property {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationEndpointMetadata.ClaimsParameterSupported} Indicates whether the claims parameter is supported for requesting specific claims\. ```csharp public bool ClaimsParameterSupported { get; init; } ``` #### Property Value [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') ## AuthorizationEndpointMetadata\.CodeChallengeMethodsSupported Property {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationEndpointMetadata.CodeChallengeMethodsSupported} The code challenge methods supported for PKCE \(Proof Key for Code Exchange\)\. Both methods in the IANA "PKCE Code Challenge Methods" registry are advertised because the server genuinely supports both: `S256` always, and `plain` for any client that opts into it via `PlainPkceAllowed`\. The FAPI 2\.0 profile restricts a profiled client to `S256` at request time \(enforced in `PkceValidator`\), but that is a per\-client policy \- a mixed deployment still supports `plain` server\-wide, so dropping it from discovery would understate the actual capability\. The non\-standard `S512` transformation stays accepted at runtime as an undocumented extension but is not advertised, since announcing an unregistered wire value in discovery is a false conformance claim\. ```csharp public System.Collections.Generic.List CodeChallengeMethodsSupported { get; init; } ``` #### Property Value [System\.Collections\.Generic\.List<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.list-1 'System\.Collections\.Generic\.List\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.list-1 'System\.Collections\.Generic\.List\`1') ## AuthorizationEndpointMetadata\.PromptValuesSupported Property {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationEndpointMetadata.PromptValuesSupported} The prompt values the authorization server supports for interaction with the end\-user\. ```csharp public System.Collections.Generic.List PromptValuesSupported { get; init; } ``` #### Property Value [System\.Collections\.Generic\.List<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.list-1 'System\.Collections\.Generic\.List\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.list-1 'System\.Collections\.Generic\.List\`1') ## AuthorizationEndpointMetadata\.RequestParameterSupported Property {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationEndpointMetadata.RequestParameterSupported} Indicates whether the 'request' parameter of an authorization request is supported\. This parameter is used for passing a request object by value\. ```csharp public bool RequestParameterSupported { get; init; } ``` #### Property Value [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') ## AuthorizationEndpointMetadata\.ResponseModesSupported Property {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationEndpointMetadata.ResponseModesSupported} The response modes the authorization server supports for returning parameters from the authorization endpoint\. ```csharp public System.Collections.Generic.List ResponseModesSupported { get; init; } ``` #### Property Value [System\.Collections\.Generic\.List<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.list-1 'System\.Collections\.Generic\.List\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.list-1 'System\.Collections\.Generic\.List\`1') ## AuthorizationEndpointMetadata\.ResponseTypesSupported Property {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationEndpointMetadata.ResponseTypesSupported} The response types the authorization server supports\. ```csharp public System.Collections.Generic.List ResponseTypesSupported { get; init; } ``` #### Property Value [System\.Collections\.Generic\.List<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.list-1 'System\.Collections\.Generic\.List\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.list-1 'System\.Collections\.Generic\.List\`1') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationError.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces') ## AuthorizationError Class Represents an error response for an authorization request, detailing the nature of the error\. ```csharp public record AuthorizationError : Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ClientDeliveredResponse, System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [AuthorizationResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationResponse 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationResponse') → [ClientDeliveredResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ClientDeliveredResponse 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.ClientDeliveredResponse') → AuthorizationError Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[AuthorizationError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationError 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationError')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Remarks This record encapsulates information about errors encountered during the processing of an authorization request\. It includes details that can be returned to the client to indicate what went wrong\. This structure facilitates compliance with OAuth 2\.0 and OpenID Connect specifications by providing a standardized format for error reporting\. This is the response-stage error type, a variant of the [AuthorizationResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationResponse 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationResponse') polymorphic hierarchy alongside [LoginRequired](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.LoginRequired 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.LoginRequired'), [ConsentRequired](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ConsentRequired 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.ConsentRequired'), [SuccessfullyAuthenticated](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.SuccessfullyAuthenticated') etc. The validator pipeline produces the lighter [AuthorizationRequestValidationError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationRequestValidationError'); this type wraps it (via the secondary constructor) with the originating `Model` needed for state propagation through the formatter, plus the optional `error_uri`. Two parallel error types exist because of the layered architecture: the validator pipeline operates on the generic [Result<TSuccess,TFailure>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2') envelope and stays free of response-level concerns. The cost is field duplication (`Error`, `ErrorDescription`, `ResponseMode`, `RedirectUri`) - accepted for the architectural seam. ### Constructors ## AuthorizationError\(AuthorizationRequest, AuthorizationRequestValidationError\) Constructor {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationError.AuthorizationError(Abblix.Oidc.Server.Model.AuthorizationRequest,Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError)} Constructs an instance of [AuthorizationError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationError 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationError') from an [AuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.AuthorizationRequest 'Abblix\.Oidc\.Server\.Model\.AuthorizationRequest') and an [AuthorizationRequestValidationError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationRequestValidationError')\. ```csharp public AuthorizationError(Abblix.Oidc.Server.Model.AuthorizationRequest request, Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError error); ``` #### Parameters ###### `request` [AuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.AuthorizationRequest 'Abblix\.Oidc\.Server\.Model\.AuthorizationRequest') {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationError.AuthorizationError(Abblix.Oidc.Server.Model.AuthorizationRequest,Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError).request} The request that resulted in the error\. ###### `error` [AuthorizationRequestValidationError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationRequestValidationError') {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationError.AuthorizationError(Abblix.Oidc.Server.Model.AuthorizationRequest,Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError).error} The validation error that provides details about what caused the request to fail\. ## AuthorizationError\(AuthorizationRequest, string, string, string, Uri, Uri\) Constructor {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationError.AuthorizationError(Abblix.Oidc.Server.Model.AuthorizationRequest,string,string,string,System.Uri,System.Uri)} Represents an error response for an authorization request, detailing the nature of the error\. ```csharp public AuthorizationError(Abblix.Oidc.Server.Model.AuthorizationRequest Model, string Error, string ErrorDescription, string ResponseMode, System.Uri? RedirectUri, System.Uri? ErrorUri=null); ``` #### Parameters ###### `Model` [AuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.AuthorizationRequest 'Abblix\.Oidc\.Server\.Model\.AuthorizationRequest') {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationError.AuthorizationError(Abblix.Oidc.Server.Model.AuthorizationRequest,string,string,string,System.Uri,System.Uri).Model} The original authorization request model that led to this error\. ###### `Error` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationError.AuthorizationError(Abblix.Oidc.Server.Model.AuthorizationRequest,string,string,string,System.Uri,System.Uri).Error} A single error code from the OAuth 2\.0 specification that describes the error\. ###### `ErrorDescription` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationError.AuthorizationError(Abblix.Oidc.Server.Model.AuthorizationRequest,string,string,string,System.Uri,System.Uri).ErrorDescription} A more detailed description of the error for debugging purposes\. ###### `ResponseMode` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationError.AuthorizationError(Abblix.Oidc.Server.Model.AuthorizationRequest,string,string,string,System.Uri,System.Uri).ResponseMode} The response mode to be used for returning parameters to the client\. This can influence how the error information is transmitted back to the client\. ###### `RedirectUri` [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri') {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationError.AuthorizationError(Abblix.Oidc.Server.Model.AuthorizationRequest,string,string,string,System.Uri,System.Uri).RedirectUri} The URI to which the response should be sent\. This is where the error information will be transmitted if applicable\. ###### `ErrorUri` [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri') {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationError.AuthorizationError(Abblix.Oidc.Server.Model.AuthorizationRequest,string,string,string,System.Uri,System.Uri).ErrorUri} A URI identifying a human\-readable web page with information about the error\. ### Remarks This record encapsulates information about errors encountered during the processing of an authorization request\. It includes details that can be returned to the client to indicate what went wrong\. This structure facilitates compliance with OAuth 2\.0 and OpenID Connect specifications by providing a standardized format for error reporting\. This is the response-stage error type, a variant of the [AuthorizationResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationResponse 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationResponse') polymorphic hierarchy alongside [LoginRequired](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.LoginRequired 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.LoginRequired'), [ConsentRequired](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ConsentRequired 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.ConsentRequired'), [SuccessfullyAuthenticated](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.SuccessfullyAuthenticated') etc. The validator pipeline produces the lighter [AuthorizationRequestValidationError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationRequestValidationError'); this type wraps it (via the secondary constructor) with the originating `Model` needed for state propagation through the formatter, plus the optional `error_uri`. Two parallel error types exist because of the layered architecture: the validator pipeline operates on the generic [Result<TSuccess,TFailure>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2') envelope and stays free of response-level concerns. The cost is field duplication (`Error`, `ErrorDescription`, `ResponseMode`, `RedirectUri`) - accepted for the architectural seam. ### Properties ## AuthorizationError\.Error Property {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationError.Error} A single error code from the OAuth 2\.0 specification that describes the error\. ```csharp public string Error { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## AuthorizationError\.ErrorDescription Property {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationError.ErrorDescription} A more detailed description of the error for debugging purposes\. ```csharp public string ErrorDescription { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## AuthorizationError\.ErrorUri Property {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationError.ErrorUri} A URI identifying a human\-readable web page with information about the error\. ```csharp public System.Uri? ErrorUri { get; init; } ``` #### Property Value [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri') ## AuthorizationError\.RedirectUri Property {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationError.RedirectUri} The URI to which the response should be sent\. This is where the error information will be transmitted if applicable\. ```csharp public System.Uri? RedirectUri { get; init; } ``` #### Property Value [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces') ## AuthorizationRequestValidationError Class Represents a specific type of validation result for an authorization request that has been deemed invalid\. This record details the nature of the validation failure through an error code and description, providing insights into why the request did not pass validation checks\. It also includes the redirect URI to guide the client on where to direct the user for further actions if necessary\. ```csharp public record AuthorizationRequestValidationError : Abblix.Oidc.Server.Common.OidcError, System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') → AuthorizationRequestValidationError Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[AuthorizationRequestValidationError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationRequestValidationError')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Remarks This is the validator\-stage error type, returned by [IAuthorizationRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.IAuthorizationRequestValidator') in the failure leg of [Result<TSuccess,TFailure>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')\. The handler/processor stage wraps it into [AuthorizationError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationError 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationError'), which adds the originating `Model` \(needed for polymorphic dispatch through the [AuthorizationResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationResponse 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationResponse') hierarchy\) and the optional `error_uri`\. Two parallel error types exist because of the layered architecture: the validator pipeline operates on the generic [Result<TSuccess,TFailure>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2') envelope and stays free of response-level concerns; the response hierarchy needs `Model` for state propagation. The cost is duplication of `Error`, `ErrorDescription`, `ResponseMode`, `RedirectUri` across both types - accepted for the architectural seam. ### Constructors ## AuthorizationRequestValidationError\(string, string, Uri, string\) Constructor {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError.AuthorizationRequestValidationError(string,string,System.Uri,string)} Represents a specific type of validation result for an authorization request that has been deemed invalid\. This record details the nature of the validation failure through an error code and description, providing insights into why the request did not pass validation checks\. It also includes the redirect URI to guide the client on where to direct the user for further actions if necessary\. ```csharp public AuthorizationRequestValidationError(string Error, string ErrorDescription, System.Uri? RedirectUri, string ResponseMode); ``` #### Parameters ###### `Error` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError.AuthorizationRequestValidationError(string,string,System.Uri,string).Error} ###### `ErrorDescription` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError.AuthorizationRequestValidationError(string,string,System.Uri,string).ErrorDescription} ###### `RedirectUri` [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri') {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError.AuthorizationRequestValidationError(string,string,System.Uri,string).RedirectUri} ###### `ResponseMode` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError.AuthorizationRequestValidationError(string,string,System.Uri,string).ResponseMode} ### Remarks This is the validator\-stage error type, returned by [IAuthorizationRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.IAuthorizationRequestValidator') in the failure leg of [Result<TSuccess,TFailure>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')\. The handler/processor stage wraps it into [AuthorizationError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationError 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationError'), which adds the originating `Model` \(needed for polymorphic dispatch through the [AuthorizationResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationResponse 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationResponse') hierarchy\) and the optional `error_uri`\. Two parallel error types exist because of the layered architecture: the validator pipeline operates on the generic [Result<TSuccess,TFailure>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2') envelope and stays free of response-level concerns; the response hierarchy needs `Model` for state propagation. The cost is duplication of `Error`, `ErrorDescription`, `ResponseMode`, `RedirectUri` across both types - accepted for the architectural seam. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationResponse.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces') ## AuthorizationResponse Class Represents the response to an authorization request\. This abstract record serves as a base for specific authorization response implementations\. It should be inherited by classes that define the detailed structure and behavior of different types of authorization responses\. ```csharp public abstract record AuthorizationResponse : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → AuthorizationResponse Derived ↳ [AccountSelectionRequired](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AccountSelectionRequired 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AccountSelectionRequired') ↳ [ClientDeliveredResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ClientDeliveredResponse 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.ClientDeliveredResponse') ↳ [ConsentRequired](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ConsentRequired 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.ConsentRequired') ↳ [InteractionRequired](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.InteractionRequired 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.InteractionRequired') ↳ [LoginRequired](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.LoginRequired 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.LoginRequired') ↳ [RegistrationRequired](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.RegistrationRequired 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.RegistrationRequired') ↳ [PushedAuthorizationResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.PushedAuthorization.Interfaces.PushedAuthorizationResponse 'Abblix\.Oidc\.Server\.Endpoints\.PushedAuthorization\.Interfaces\.PushedAuthorizationResponse') Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[AuthorizationResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationResponse 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationResponse')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationResponse.Parameters.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces').[AuthorizationResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationResponse 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationResponse') ## AuthorizationResponse\.Parameters Class Wire\-level parameter names returned to the client by the authorization endpoint \(via query, fragment, form\_post, or \- under JARM \- as claims inside the single `response` JWT\)\. Shared by the core response encoder and the MVC serialization DTO so the two never drift\. ```csharp public static class AuthorizationResponse.Parameters ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → Parameters ### Fields ## AuthorizationResponse\.Parameters\.AccessToken Field {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationResponse.Parameters.AccessToken} The `access_token` issued directly by the Implicit/Hybrid Flow \(OAuth 2\.0 §4\.2\.2\)\. ```csharp public const string AccessToken = "access_token"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## AuthorizationResponse\.Parameters\.Code Field {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationResponse.Parameters.Code} The `code` authorization code returned by the Authorization Code Flow \(OAuth 2\.0 §4\.1\.2\)\. ```csharp public const string Code = "code"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## AuthorizationResponse\.Parameters\.Error Field {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationResponse.Parameters.Error} The `error` code identifying the failure \(OAuth 2\.0 §4\.1\.2\.1\)\. ```csharp public const string Error = "error"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## AuthorizationResponse\.Parameters\.ErrorDescription Field {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationResponse.Parameters.ErrorDescription} The `error_description` human\-readable failure detail \(OAuth 2\.0 §4\.1\.2\.1\)\. ```csharp public const string ErrorDescription = "error_description"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## AuthorizationResponse\.Parameters\.ErrorUri Field {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationResponse.Parameters.ErrorUri} The `error_uri` pointing to documentation about the error \(OAuth 2\.0 §4\.1\.2\.1\)\. ```csharp public const string ErrorUri = "error_uri"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## AuthorizationResponse\.Parameters\.ExpiresIn Field {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationResponse.Parameters.ExpiresIn} The `expires_in` access\-token lifetime in seconds \(OAuth 2\.0 §4\.2\.2\)\. ```csharp public const string ExpiresIn = "expires_in"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## AuthorizationResponse\.Parameters\.IdToken Field {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationResponse.Parameters.IdToken} The `id_token` issued by the Implicit/Hybrid Flow \(OIDC Core §3\.2\.2\.5\)\. ```csharp public const string IdToken = "id_token"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## AuthorizationResponse\.Parameters\.Issuer Field {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationResponse.Parameters.Issuer} The `iss` issuer identifier authenticating the response source \(RFC 9207\)\. ```csharp public const string Issuer = "iss"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## AuthorizationResponse\.Parameters\.Response Field {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationResponse.Parameters.Response} The `response` JWT carrying every other parameter as claims under JARM\. ```csharp public const string Response = "response"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## AuthorizationResponse\.Parameters\.Scope Field {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationResponse.Parameters.Scope} The `scope` granted when it differs from the requested scope \(OAuth 2\.0 §3\.3\)\. ```csharp public const string Scope = "scope"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## AuthorizationResponse\.Parameters\.SessionState Field {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationResponse.Parameters.SessionState} The `session_state` value tracking the End\-User session \(OIDC Session Management §3\)\. ```csharp public const string SessionState = "session_state"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## AuthorizationResponse\.Parameters\.State Field {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationResponse.Parameters.State} The `state` value echoed back verbatim to bind the response to the request \(OAuth 2\.0 §4\.1\.2\)\. ```csharp public const string State = "state"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## AuthorizationResponse\.Parameters\.TokenType Field {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationResponse.Parameters.TokenType} The `token_type` of the issued access token \(OAuth 2\.0 §4\.2\.2\)\. ```csharp public const string TokenType = "token_type"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ClientDeliveredResponse.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces') ## ClientDeliveredResponse Class Base for the authorization responses that are delivered to the client's `redirect_uri` \([SuccessfullyAuthenticated](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.SuccessfullyAuthenticated') and [AuthorizationError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationError 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationError')\), as opposed to the interaction responses \([LoginRequired](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.LoginRequired 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.LoginRequired'), [ConsentRequired](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ConsentRequired 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.ConsentRequired'), \.\.\.\) that redirect to the authorization server's own UI\. These are the responses the [IAuthorizationResponseEncoder](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseEncoder 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.IAuthorizationResponseEncoder') encodes: it sets the `iss` \(RFC 9207\) value, and for a JARM \(`*.jwt`\) request packs the parameters into [ResponseJwt](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ClientDeliveredResponse#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ClientDeliveredResponse.ResponseJwt 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.ClientDeliveredResponse\.ResponseJwt') and resolves [ResponseMode](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ClientDeliveredResponse#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ClientDeliveredResponse.ResponseMode 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.ClientDeliveredResponse\.ResponseMode') to its plaintext delivery counterpart\. ```csharp public abstract record ClientDeliveredResponse : Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationResponse, System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [AuthorizationResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationResponse 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationResponse') → ClientDeliveredResponse Derived ↳ [AuthorizationError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationError 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationError') ↳ [SuccessfullyAuthenticated](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.SuccessfullyAuthenticated') Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[ClientDeliveredResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ClientDeliveredResponse 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.ClientDeliveredResponse')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Properties ## ClientDeliveredResponse\.Issuer Property {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ClientDeliveredResponse.Issuer} The `iss` \(RFC 9207\) value to return on the response, populated by the response encoder when the server advertises it\. `null` when issuer identification is not emitted\. ```csharp public string? Issuer { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ClientDeliveredResponse\.ResponseJwt Property {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ClientDeliveredResponse.ResponseJwt} The JARM \(JWT Secured Authorization Response Mode\) response JWT, populated by the response encoder when the client requested a `*.jwt` response mode\. When set, it is the sole wire parameter and all other response parameters are carried as its claims\. `null` for plaintext response modes\. ```csharp public string? ResponseJwt { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ClientDeliveredResponse\.ResponseMode Property {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ClientDeliveredResponse.ResponseMode} Specifies how the result is returned to the client\. Carries the requested mode \(including a JARM `*.jwt` mode\) until the response encoder resolves it to the plaintext delivery mode\. Settable so the encoder can update it in place after packing the JWT\. ```csharp public string ResponseMode { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ConsentRequired.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces') ## ConsentRequired Class Outcome signalling that the user is authenticated but has not yet granted every scope or resource the client is asking for, so the host must show its consent UI for the deltas in [RequiredUserConsents](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ConsentRequired#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ConsentRequired.RequiredUserConsents 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.ConsentRequired\.RequiredUserConsents')\. Maps to OpenID Connect Core 1\.0 §3\.1\.2\.6 `consent_required` when `prompt=none`\. ```csharp public record ConsentRequired : Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationResponse, System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [AuthorizationResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationResponse 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationResponse') → ConsentRequired Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[ConsentRequired](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ConsentRequired 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.ConsentRequired')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Constructors ## ConsentRequired\(AuthorizationRequest, AuthSession, ConsentDefinition\) Constructor {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ConsentRequired.ConsentRequired(Abblix.Oidc.Server.Model.AuthorizationRequest,Abblix.Oidc.Server.Features.UserAuthentication.AuthSession,Abblix.Oidc.Server.Features.Consents.ConsentDefinition)} Outcome signalling that the user is authenticated but has not yet granted every scope or resource the client is asking for, so the host must show its consent UI for the deltas in [RequiredUserConsents](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ConsentRequired#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ConsentRequired.RequiredUserConsents 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.ConsentRequired\.RequiredUserConsents')\. Maps to OpenID Connect Core 1\.0 §3\.1\.2\.6 `consent_required` when `prompt=none`\. ```csharp public ConsentRequired(Abblix.Oidc.Server.Model.AuthorizationRequest Model, Abblix.Oidc.Server.Features.UserAuthentication.AuthSession AuthSession, Abblix.Oidc.Server.Features.Consents.ConsentDefinition RequiredUserConsents); ``` #### Parameters ###### `Model` [AuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.AuthorizationRequest 'Abblix\.Oidc\.Server\.Model\.AuthorizationRequest') {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ConsentRequired.ConsentRequired(Abblix.Oidc.Server.Model.AuthorizationRequest,Abblix.Oidc.Server.Features.UserAuthentication.AuthSession,Abblix.Oidc.Server.Features.Consents.ConsentDefinition).Model} The authorization request that produced the pending\-consent state\. ###### `AuthSession` [AuthSession](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.UserAuthentication.AuthSession 'Abblix\.Oidc\.Server\.Features\.UserAuthentication\.AuthSession') {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ConsentRequired.ConsentRequired(Abblix.Oidc.Server.Model.AuthorizationRequest,Abblix.Oidc.Server.Features.UserAuthentication.AuthSession,Abblix.Oidc.Server.Features.Consents.ConsentDefinition).AuthSession} The user's current authenticated session\. ###### `RequiredUserConsents` [ConsentDefinition](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Consents.ConsentDefinition 'Abblix\.Oidc\.Server\.Features\.Consents\.ConsentDefinition') {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ConsentRequired.ConsentRequired(Abblix.Oidc.Server.Model.AuthorizationRequest,Abblix.Oidc.Server.Features.UserAuthentication.AuthSession,Abblix.Oidc.Server.Features.Consents.ConsentDefinition).RequiredUserConsents} The scopes and resources that are still missing approval; everything not listed here is already granted\. ### Properties ## ConsentRequired\.AuthSession Property {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ConsentRequired.AuthSession} The user's current authenticated session\. ```csharp public Abblix.Oidc.Server.Features.UserAuthentication.AuthSession AuthSession { get; init; } ``` #### Property Value [AuthSession](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.UserAuthentication.AuthSession 'Abblix\.Oidc\.Server\.Features\.UserAuthentication\.AuthSession') ## ConsentRequired\.RequiredUserConsents Property {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ConsentRequired.RequiredUserConsents} The scopes and resources that are still missing approval; everything not listed here is already granted\. ```csharp public Abblix.Oidc.Server.Features.Consents.ConsentDefinition RequiredUserConsents { get; init; } ``` #### Property Value [ConsentDefinition](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Consents.ConsentDefinition 'Abblix\.Oidc\.Server\.Features\.Consents\.ConsentDefinition') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationHandler.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces') ## IAuthorizationHandler Interface Defines a contract for handling authorization requests, ensuring they are processed according to OAuth 2\.0 and OpenID Connect protocol specifications\. ```csharp public interface IAuthorizationHandler ``` Derived ↳ [AuthorizationHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationHandler 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.AuthorizationHandler') ### Methods ## IAuthorizationHandler\.HandleAsync\(AuthorizationRequest\) Method {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationHandler.HandleAsync(Abblix.Oidc.Server.Model.AuthorizationRequest)} Asynchronously processes an authorization request, validating its parameters and generating an appropriate response that either grants or denies the authorization based on the application's logic and security requirements\. ```csharp System.Threading.Tasks.Task HandleAsync(Abblix.Oidc.Server.Model.AuthorizationRequest request); ``` #### Parameters ###### `request` [AuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.AuthorizationRequest 'Abblix\.Oidc\.Server\.Model\.AuthorizationRequest') {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationHandler.HandleAsync(Abblix.Oidc.Server.Model.AuthorizationRequest).request} The authorization request containing necessary information for processing, such as client ID, requested scopes, redirect URI, and other protocol\-specific parameters\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[AuthorizationResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationResponse 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationResponse')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task that results in an [AuthorizationResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationResponse 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationResponse'), encapsulating either a successful authorization with tokens and additional data or an error response indicating why the authorization failed\. ### Remarks Implementations of this interface are responsible for the core logic associated with the OAuth 2\.0 and OpenID Connect authorization process, including but not limited to, validating request integrity, authenticating the user, obtaining user consent and issuing authorization codes or tokens\. This method is central to the authorization endpoint's functionality\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationRequestProcessor.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces') ## IAuthorizationRequestProcessor Interface Defines the interface for processing authorization requests according to OpenID Connect and OAuth 2\.0 specifications\. It handles the end\-user's authentication, authorization decision, and the issuance of authorization codes and tokens\. ```csharp public interface IAuthorizationRequestProcessor ``` Derived ↳ [AuthorizationRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.AuthorizationRequestProcessor') ↳ [PushedAuthorizationRequestProcessorDecorator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.PushedAuthorization.PushedAuthorizationRequestProcessorDecorator 'Abblix\.Oidc\.Server\.Features\.PushedAuthorization\.PushedAuthorizationRequestProcessorDecorator') ↳ [AuthorizationRequestProcessorDecorator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.SessionManagement.AuthorizationRequestProcessorDecorator 'Abblix\.Oidc\.Server\.Features\.SessionManagement\.AuthorizationRequestProcessorDecorator') ### Remarks The actual authentication methods and the process to obtain the end\-user's authorization decision are implementation\-specific and not defined by this interface\. ### Methods ## IAuthorizationRequestProcessor\.ProcessAsync\(ValidAuthorizationRequest\) Method {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationRequestProcessor.ProcessAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest)} Processes a valid authorization request, authenticates the end\-user, obtains an authorization decision, and issues an authorization code or tokens\. ```csharp System.Threading.Tasks.Task ProcessAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest request); ``` #### Parameters ###### `request` [ValidAuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.ValidAuthorizationRequest') {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationRequestProcessor.ProcessAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest).request} The valid authorization request to process\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[AuthorizationResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationResponse 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationResponse')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task that resolves to an [AuthorizationResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationResponse 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationResponse') containing the outcome of the request processing\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationRequestValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces') ## IAuthorizationRequestValidator Interface Defines the interface for validating authorization requests in accordance with OpenID Connect Core 1\.0 specifications\. It assesses if a request complies with the required parameters and constraints for authentication and authorization processes\. ```csharp public interface IAuthorizationRequestValidator ``` Derived ↳ [AuthorizationRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.AuthorizationRequestValidator') ### Remarks For more details on authorization request validation, refer to the OpenID Connect Core 1\.0 specification\. ### Methods ## IAuthorizationRequestValidator\.ValidateAsync\(AuthorizationRequest\) Method {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationRequestValidator.ValidateAsync(Abblix.Oidc.Server.Model.AuthorizationRequest)} Asynchronously validates an authorization request against the OpenID Connect Core 1\.0 specifications, ensuring it meets the required criteria for processing\. ```csharp System.Threading.Tasks.Task> ValidateAsync(Abblix.Oidc.Server.Model.AuthorizationRequest request); ``` #### Parameters ###### `request` [AuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.AuthorizationRequest 'Abblix\.Oidc\.Server\.Model\.AuthorizationRequest') {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationRequestValidator.ValidateAsync(Abblix.Oidc.Server.Model.AuthorizationRequest).request} The authorization request to validate\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[ValidAuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.ValidAuthorizationRequest')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[AuthorizationRequestValidationError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationRequestValidationError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task that resolves to a validation result indicating the request's compliance with the specifications\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseBuilder.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces') ## IAuthorizationResponseBuilder Interface Contributes one response\-type component to the authorization endpoint's success response\. Each implementation owns a single value of the OAuth 2\.0 / OIDC `response_type` parameter \(for example `code`, `token`, or `id_token`\) and populates the corresponding field on the running [SuccessfullyAuthenticated](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.SuccessfullyAuthenticated') result\. ```csharp public interface IAuthorizationResponseBuilder : Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer ``` Derived ↳ [AuthorizationCodeBuilder](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationCodeBuilder 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.AuthorizationCodeBuilder') ↳ [IdTokenResponseBuilder](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ImplicitFlow.IdTokenResponseBuilder 'Abblix\.Oidc\.Server\.Features\.ImplicitFlow\.IdTokenResponseBuilder') ↳ [TokenResponseBuilder](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ImplicitFlow.TokenResponseBuilder 'Abblix\.Oidc\.Server\.Features\.ImplicitFlow\.TokenResponseBuilder') ↳ [NoneResponseBuilder](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.NoneFlow.NoneResponseBuilder 'Abblix\.Oidc\.Server\.Features\.NoneFlow\.NoneResponseBuilder') Implements [IGrantTypeInformer](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IGrantTypeInformer') ### Remarks The processor \([IAuthorizationRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.IAuthorizationRequestProcessor')\) is a composite over the registered processors: the orchestration logic \(auth\-session selection, consent, scope checks\) lives in the processor; per\-response\-type generation lives here\. Implicit Flow / Hybrid Flow support is expressed by registering `token` and `id_token` processors\. Without those registrations the corresponding response types simply do not exist in the DI graph \- Implicit Flow does not run, matching OAuth 2\.1 \(draft\) default\-off semantics\. ### Properties ## IAuthorizationResponseBuilder\.ResponseType Property {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseBuilder.ResponseType} The single OAuth 2\.0 / OIDC response\-type value this processor is responsible for, matched case\-sensitively against parts of the request's `response_type`\. ```csharp string ResponseType { get; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Methods ## IAuthorizationResponseBuilder\.BuildResponseAsync\(ValidAuthorizationRequest, AuthorizedGrant, SuccessfullyAuthenticated\) Method {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseBuilder.BuildResponseAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest,Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant,Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated)} Populates the relevant field on [result](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseBuilder#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseBuilder.BuildResponseAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest,Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant,Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated).result 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.IAuthorizationResponseBuilder\.BuildResponseAsync\(Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.ValidAuthorizationRequest, Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.AuthorizedGrant, Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.SuccessfullyAuthenticated\)\.result') for this processor's response type\. Implementations mutate [result](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseBuilder#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseBuilder.BuildResponseAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest,Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant,Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated).result 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.IAuthorizationResponseBuilder\.BuildResponseAsync\(Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.ValidAuthorizationRequest, Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.AuthorizedGrant, Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.SuccessfullyAuthenticated\)\.result') in place and may read fields populated by processors that ran earlier in the canonical iteration order \(`code` before `token` before `id_token`\)\. ```csharp System.Threading.Tasks.Task BuildResponseAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest request, Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant authorizedGrant, Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated result); ``` #### Parameters ###### `request` [ValidAuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.ValidAuthorizationRequest') {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseBuilder.BuildResponseAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest,Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant,Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated).request} ###### `authorizedGrant` [AuthorizedGrant](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.AuthorizedGrant') {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseBuilder.BuildResponseAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest,Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant,Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated).authorizedGrant} ###### `result` [SuccessfullyAuthenticated](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.SuccessfullyAuthenticated') {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseBuilder.BuildResponseAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest,Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant,Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated).result} #### Returns [System\.Threading\.Tasks\.Task](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task 'System\.Threading\.Tasks\.Task') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseEncoder.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces') ## IAuthorizationResponseEncoder Interface Applies the protocol\-level encoding of an authorization response in the framework\-agnostic core: the `iss` \(RFC 9207\) and implicit/hybrid `scope` gating, and \- when the client requested a JARM \(`*.jwt`\) response mode \- packing all response parameters into the `response` JWT and resolving the plaintext delivery mode\. ```csharp public interface IAuthorizationResponseEncoder ``` Derived ↳ [AuthorizationResponseEncoder](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationResponseEncoder 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.AuthorizationResponseEncoder') ### Remarks Invoked from [IAuthorizationHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationHandler 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.IAuthorizationHandler') after the full request\-processing chain \(including the session\-management decorator that sets `session_state`\) has completed, so the JWT captures the final parameter set\. It mutates the response in place: [SuccessfullyAuthenticated](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.SuccessfullyAuthenticated') and [AuthorizationError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationError 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationError') gain their `Issuer`/`Scope`/`ResponseJwt` and a resolved `ResponseMode`\. Interaction responses \(login/consent/etc\.\) and non\-redirectable errors are left untouched\. The transport layer then only maps the encoded response onto its wire DTO\. ### Methods ## IAuthorizationResponseEncoder\.EncodeAsync\(AuthorizationResponse\) Method {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseEncoder.EncodeAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationResponse)} Encodes the supplied authorization response in place\. No\-op for response types that are not delivered to the client's redirect URI\. ```csharp System.Threading.Tasks.Task EncodeAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationResponse response); ``` #### Parameters ###### `response` [AuthorizationResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationResponse 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationResponse') {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseEncoder.EncodeAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationResponse).response} The processed authorization response to encode\. #### Returns [System\.Threading\.Tasks\.Task](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task 'System\.Threading\.Tasks\.Task') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.InteractionRequired.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces') ## InteractionRequired Class Outcome signalling that an end\-user is signed in but additional UI interaction \(a step\-up, missing claim, MFA challenge or similar\) must complete before the authorization request can be fulfilled\. Maps to OpenID Connect Core 1\.0 §3\.1\.2\.6 `interaction_required` when `prompt=none`\. ```csharp public record InteractionRequired : Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationResponse, System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [AuthorizationResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationResponse 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationResponse') → InteractionRequired Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[InteractionRequired](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.InteractionRequired 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.InteractionRequired')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Constructors ## InteractionRequired\(AuthorizationRequest, ClaimsPrincipal\) Constructor {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.InteractionRequired.InteractionRequired(Abblix.Oidc.Server.Model.AuthorizationRequest,System.Security.Claims.ClaimsPrincipal)} Outcome signalling that an end\-user is signed in but additional UI interaction \(a step\-up, missing claim, MFA challenge or similar\) must complete before the authorization request can be fulfilled\. Maps to OpenID Connect Core 1\.0 §3\.1\.2\.6 `interaction_required` when `prompt=none`\. ```csharp public InteractionRequired(Abblix.Oidc.Server.Model.AuthorizationRequest Model, System.Security.Claims.ClaimsPrincipal User); ``` #### Parameters ###### `Model` [AuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.AuthorizationRequest 'Abblix\.Oidc\.Server\.Model\.AuthorizationRequest') {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.InteractionRequired.InteractionRequired(Abblix.Oidc.Server.Model.AuthorizationRequest,System.Security.Claims.ClaimsPrincipal).Model} The authorization request that triggered the interaction\. ###### `User` [System\.Security\.Claims\.ClaimsPrincipal](https://learn.microsoft.com/en-us/dotnet/api/system.security.claims.claimsprincipal 'System\.Security\.Claims\.ClaimsPrincipal') {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.InteractionRequired.InteractionRequired(Abblix.Oidc.Server.Model.AuthorizationRequest,System.Security.Claims.ClaimsPrincipal).User} The current user, exposed so the host UI can address the prompt to them\. ### Properties ## InteractionRequired\.User Property {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.InteractionRequired.User} The current user, exposed so the host UI can address the prompt to them\. ```csharp public System.Security.Claims.ClaimsPrincipal User { get; init; } ``` #### Property Value [System\.Security\.Claims\.ClaimsPrincipal](https://learn.microsoft.com/en-us/dotnet/api/system.security.claims.claimsprincipal 'System\.Security\.Claims\.ClaimsPrincipal') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.LoginRequired.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces') ## LoginRequired Class Outcome signalling that the host must surface its login UI: either no eligible session exists, or the client requested forced reauthentication via `prompt=login` / `max_age`\. Maps to OpenID Connect Core 1\.0 §3\.1\.2\.6 `login_required` when `prompt=none`\. ```csharp public record LoginRequired : Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationResponse, System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [AuthorizationResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationResponse 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationResponse') → LoginRequired Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[LoginRequired](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.LoginRequired 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.LoginRequired')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Constructors ## LoginRequired\(AuthorizationRequest\) Constructor {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.LoginRequired.LoginRequired(Abblix.Oidc.Server.Model.AuthorizationRequest)} Outcome signalling that the host must surface its login UI: either no eligible session exists, or the client requested forced reauthentication via `prompt=login` / `max_age`\. Maps to OpenID Connect Core 1\.0 §3\.1\.2\.6 `login_required` when `prompt=none`\. ```csharp public LoginRequired(Abblix.Oidc.Server.Model.AuthorizationRequest Model); ``` #### Parameters `Model` [AuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.AuthorizationRequest 'Abblix\.Oidc\.Server\.Model\.AuthorizationRequest') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.RegistrationRequired.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces') ## RegistrationRequired Class Outcome signalling that the host must surface its account\-creation UI: the client requested user registration via `prompt=create` \(Initiating User Registration via OpenID Connect 1\.0\)\. Per that specification the registration experience is shown regardless of whether the user currently has an authenticated session\. ```csharp public record RegistrationRequired : Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationResponse, System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [AuthorizationResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationResponse 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationResponse') → RegistrationRequired Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[RegistrationRequired](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.RegistrationRequired 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.RegistrationRequired')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Constructors ## RegistrationRequired\(AuthorizationRequest\) Constructor {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.RegistrationRequired.RegistrationRequired(Abblix.Oidc.Server.Model.AuthorizationRequest)} Outcome signalling that the host must surface its account\-creation UI: the client requested user registration via `prompt=create` \(Initiating User Registration via OpenID Connect 1\.0\)\. Per that specification the registration experience is shown regardless of whether the user currently has an authenticated session\. ```csharp public RegistrationRequired(Abblix.Oidc.Server.Model.AuthorizationRequest Model); ``` #### Parameters `Model` [AuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.AuthorizationRequest 'Abblix\.Oidc\.Server\.Model\.AuthorizationRequest') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces') ## SuccessfullyAuthenticated Class Represents a successful authentication response, encapsulating details about the outcome of an authentication request, including any tokens issued as a result\. ```csharp public record SuccessfullyAuthenticated : Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ClientDeliveredResponse, System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [AuthorizationResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationResponse 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationResponse') → [ClientDeliveredResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ClientDeliveredResponse 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.ClientDeliveredResponse') → SuccessfullyAuthenticated Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[SuccessfullyAuthenticated](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.SuccessfullyAuthenticated')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Constructors ## SuccessfullyAuthenticated\(AuthorizationRequest, string, string, ICollection\\) Constructor {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated.SuccessfullyAuthenticated(Abblix.Oidc.Server.Model.AuthorizationRequest,string,string,System.Collections.Generic.ICollection_string_)} Represents a successful authentication response, encapsulating details about the outcome of an authentication request, including any tokens issued as a result\. ```csharp public SuccessfullyAuthenticated(Abblix.Oidc.Server.Model.AuthorizationRequest Model, string ResponseMode, string? SessionId, System.Collections.Generic.ICollection AffectedClientIds); ``` #### Parameters ###### `Model` [AuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.AuthorizationRequest 'Abblix\.Oidc\.Server\.Model\.AuthorizationRequest') {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated.SuccessfullyAuthenticated(Abblix.Oidc.Server.Model.AuthorizationRequest,string,string,System.Collections.Generic.ICollection_string_).Model} The original authorization request that led to this successful authentication\. ###### `ResponseMode` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated.SuccessfullyAuthenticated(Abblix.Oidc.Server.Model.AuthorizationRequest,string,string,System.Collections.Generic.ICollection_string_).ResponseMode} Specifies how the result of the authentication should be returned to the client\. ###### `SessionId` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated.SuccessfullyAuthenticated(Abblix.Oidc.Server.Model.AuthorizationRequest,string,string,System.Collections.Generic.ICollection_string_).SessionId} An optional session identifier that may be used for session management\. ###### `AffectedClientIds` [System\.Collections\.Generic\.ICollection<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.icollection-1 'System\.Collections\.Generic\.ICollection\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.icollection-1 'System\.Collections\.Generic\.ICollection\`1') {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated.SuccessfullyAuthenticated(Abblix.Oidc.Server.Model.AuthorizationRequest,string,string,System.Collections.Generic.ICollection_string_).AffectedClientIds} Identifiers of the clients that are affected by or related to this authentication process\. ### Properties ## SuccessfullyAuthenticated\.AccessToken Property {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated.AccessToken} The access token issued as part of the authentication response, encoded in a format suitable for transmission\. Access tokens are credentials used to access protected resources\. ```csharp public Abblix.Oidc.Server.Features.Tokens.EncodedJsonWebToken? AccessToken { get; set; } ``` #### Property Value [EncodedJsonWebToken](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.EncodedJsonWebToken 'Abblix\.Oidc\.Server\.Features\.Tokens\.EncodedJsonWebToken') ## SuccessfullyAuthenticated\.AffectedClientIds Property {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated.AffectedClientIds} Identifiers of the clients that are affected by or related to this authentication process\. ```csharp public System.Collections.Generic.ICollection AffectedClientIds { get; init; } ``` #### Property Value [System\.Collections\.Generic\.ICollection<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.icollection-1 'System\.Collections\.Generic\.ICollection\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.icollection-1 'System\.Collections\.Generic\.ICollection\`1') ## SuccessfullyAuthenticated\.Code Property {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated.Code} An authorization code that can be exchanged for tokens\. This code is issued only if the authentication request was successful and the response type requested an authorization code\. ```csharp public string? Code { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## SuccessfullyAuthenticated\.GrantedScopes Property {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated.GrantedScopes} The scope actually granted by the user\-consent decision \- the same set the issued access/ID token carries\. Threaded by the authorization request processor so the response encoder advertises it on the front\-channel `scope` parameter\. May be a subset of the requested [Scope](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.AuthorizationRequest#Abblix.Oidc.Server.Model.AuthorizationRequest.Scope 'Abblix\.Oidc\.Server\.Model\.AuthorizationRequest\.Scope') when the host consent provider narrows the grant \(RFC 6749 §3\.3\)\. ```csharp public string[] GrantedScopes { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') ## SuccessfullyAuthenticated\.IdToken Property {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated.IdToken} The ID token issued as part of the authentication response, providing identity information about the user\. Encoded in a format suitable for transmission\. ```csharp public Abblix.Oidc.Server.Features.Tokens.EncodedJsonWebToken? IdToken { get; set; } ``` #### Property Value [EncodedJsonWebToken](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.EncodedJsonWebToken 'Abblix\.Oidc\.Server\.Features\.Tokens\.EncodedJsonWebToken') ## SuccessfullyAuthenticated\.Scope Property {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated.Scope} The granted `scope` as a space\-delimited string, populated by the response encoder for implicit/hybrid flows only \(where the response itself carries tokens\)\. `null` for the code flow\. ```csharp public string? Scope { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## SuccessfullyAuthenticated\.SessionId Property {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated.SessionId} An optional session identifier that may be used for session management\. ```csharp public string? SessionId { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## SuccessfullyAuthenticated\.SessionState Property {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated.SessionState} An optional state parameter reflecting the session state\. This can be used to represent the state of the user's session at the authorization server and may be used for managing session continuity and logout\. ```csharp public string? SessionState { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## SuccessfullyAuthenticated\.TokenType Property {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated.TokenType} The type of token issued, typically "Bearer", indicating how the issued token may be used\. This property is populated if an access token is issued as part of the authentication response\. ```csharp public string? TokenType { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces') ## ValidAuthorizationRequest Class Output of [IAuthorizationRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.IAuthorizationRequestValidator') handed to [IAuthorizationRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.IAuthorizationRequestProcessor')\. Snapshot of the data resolved during validation: the wire\-level request, the authenticated client, the negotiated response mode \(per OAuth 2\.0 Multiple Response Types / Form Post\), and the materialized scope and resource definitions ready for consent and token issuance\. ```csharp public record ValidAuthorizationRequest : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ValidAuthorizationRequest Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[ValidAuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.ValidAuthorizationRequest')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Constructors ## ValidAuthorizationRequest\(AuthorizationValidationContext\) Constructor {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest.ValidAuthorizationRequest(Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext)} Snapshots the validated state from the shared [AuthorizationValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.AuthorizationValidationContext') once the validator pipeline has completed\. ```csharp public ValidAuthorizationRequest(Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext context); ``` #### Parameters ###### `context` [AuthorizationValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.AuthorizationValidationContext') {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest.ValidAuthorizationRequest(Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext).context} ### Properties ## ValidAuthorizationRequest\.AuthorizationDetails Property {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest.AuthorizationDetails} RFC 9396 Rich Authorization Requests array, snapshot from [AuthorizationDetails](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext#Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext.AuthorizationDetails 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.AuthorizationValidationContext\.AuthorizationDetails') at the end of the validator pipeline \-\- i\.e\. post per\-client allowlist filtering and post per\-type validator narrow/extend mutations\. [IUserConsentsProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Consents.IUserConsentsProvider 'Abblix\.Oidc\.Server\.Features\.Consents\.IUserConsentsProvider') reads this slot to render the consent UI; downstream consent emits its \(possibly further\-narrowed\) decision via [AuthorizationDetails](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Consents.ConsentDefinition#Abblix.Oidc.Server.Features.Consents.ConsentDefinition.AuthorizationDetails 'Abblix\.Oidc\.Server\.Features\.Consents\.ConsentDefinition\.AuthorizationDetails')\. `null` when the request did not include `authorization_details`\. ```csharp public System.Text.Json.Nodes.JsonArray? AuthorizationDetails { get; init; } ``` #### Property Value [System\.Text\.Json\.Nodes\.JsonArray](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonarray 'System\.Text\.Json\.Nodes\.JsonArray') ## ValidAuthorizationRequest\.ClientInfo Property {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest.ClientInfo} Information about the client making the request, as determined during validation\. ```csharp public Abblix.Oidc.Server.Features.ClientInformation.ClientInfo ClientInfo { get; init; } ``` #### Property Value [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') ## ValidAuthorizationRequest\.IdTokenHintSubject Property {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest.IdTokenHintSubject} The end user the request's `id_token_hint` names, as that ID token spells it, or `null` when the request carried no hint\. ```csharp public string? IdTokenHintSubject { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks For a pairwise client this is the pseudonym sealed to that client's sector rather than the subject a session carries, so a comparison converts the session forward rather than opening this\. ## ValidAuthorizationRequest\.Model Property {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest.Model} The original or recovered request model that was validated\. ```csharp public Abblix.Oidc.Server.Model.AuthorizationRequest Model { get; init; } ``` #### Property Value [AuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.AuthorizationRequest 'Abblix\.Oidc\.Server\.Model\.AuthorizationRequest') ## ValidAuthorizationRequest\.RequestedSubjects Property {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest.RequestedSubjects} The end users the request's `claims` parameter will accept for `sub`, or `null` when it asked for none in particular\. An empty array accepts nobody\. ```csharp public string[]? RequestedSubjects { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') ### Remarks Independent of [IdTokenHintSubject](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest.IdTokenHintSubject 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.ValidAuthorizationRequest\.IdTokenHintSubject') \- a request may state both, and both bind\. Spelled the way the client wrote them, so a comparison converts the session forward rather than opening these\. ## ValidAuthorizationRequest\.RequestUri Property {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest.RequestUri} The pushed authorization request URN \(RFC 9126\) this request was resolved from, or `null` when the request was not pushed\. Surfaced here so the single\-use decorator can consume it once a code or token has been issued, without reaching into [Model](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest.Model 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.ValidAuthorizationRequest\.Model')\. ```csharp public System.Uri? RequestUri { get; init; } ``` #### Property Value [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri') ## ValidAuthorizationRequest\.Resources Property {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest.Resources} The resources associated with the authorization request, detailing the specific resources the client is requesting access to\. ```csharp public Abblix.Oidc.Server.Common.Constants.ResourceDefinition[] Resources { get; set; } ``` #### Property Value [ResourceDefinition](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ResourceDefinition 'Abblix\.Oidc\.Server\.Common\.Constants\.ResourceDefinition')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') ## ValidAuthorizationRequest\.ResponseMode Property {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest.ResponseMode} The response mode to be used for delivering the authorization response\. ```csharp public string ResponseMode { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ValidAuthorizationRequest\.Scope Property {#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest.Scope} The scope associated with the authorization request, indicating the permissions requested by the client\. ```csharp public Abblix.Oidc.Server.Common.Constants.ScopeDefinition[] Scope { get; set; } ``` #### Property Value [ScopeDefinition](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ScopeDefinition 'Abblix\.Oidc\.Server\.Common\.Constants\.ScopeDefinition')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ## Abblix\.Oidc\.Server\.Endpoints\.Authorization\.RequestFetching Namespace | Classes | | | :--- | :--- | | [CompositeRequestFetcher](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.CompositeRequestFetcher 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.RequestFetching\.CompositeRequestFetcher') | A composite fetcher that combines multiple [IAuthorizationRequestFetcher](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.IAuthorizationRequestFetcher 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.RequestFetching\.IAuthorizationRequestFetcher') instances\. It iterates through each fetcher to process an authorization request, allowing for a flexible and extensible mechanism to fetch and validate authorization requests from different sources or formats\. | | [PushedRequestFetcher](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.PushedRequestFetcher 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.RequestFetching\.PushedRequestFetcher') | Fetches pushed authorization request objects identified by a URN \(Uniform Resource Name\) from a storage system\. | | [RequestObjectFetchAdapter](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.RequestObjectFetchAdapter 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.RequestFetching\.RequestObjectFetchAdapter') | Adapter class that implements [IAuthorizationRequestFetcher](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.IAuthorizationRequestFetcher 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.RequestFetching\.IAuthorizationRequestFetcher') to delegate the fetching and processing of request objects to an instance of [IRequestObjectFetcher](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RequestObject.IRequestObjectFetcher 'Abblix\.Oidc\.Server\.Features\.RequestObject\.IRequestObjectFetcher')\. | | [RequestUriFetcher](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.RequestUriFetcher 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.RequestFetching\.RequestUriFetcher') | Handles fetching of authorization request objects from a specified request URI\. This class is responsible for retrieving pre\-registered request objects from an external location indicated by a URI, ensuring the request is complete and valid\. It enables dynamic request objects, allowing authorization servers to fetch additional data required for processing the authorization request\. | | Interfaces | | | :--- | :--- | | [IAuthorizationRequestFetcher](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.IAuthorizationRequestFetcher 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.RequestFetching\.IAuthorizationRequestFetcher') | Defines an interface for fetching the details of an authorization request, potentially including resolving and validating a request object\. | --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.CompositeRequestFetcher.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Authorization\.RequestFetching](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.RequestFetching') ## CompositeRequestFetcher Class A composite fetcher that combines multiple [IAuthorizationRequestFetcher](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.IAuthorizationRequestFetcher 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.RequestFetching\.IAuthorizationRequestFetcher') instances\. It iterates through each fetcher to process an authorization request, allowing for a flexible and extensible mechanism to fetch and validate authorization requests from different sources or formats\. ```csharp public class CompositeRequestFetcher : Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.IAuthorizationRequestFetcher ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → CompositeRequestFetcher Implements [IAuthorizationRequestFetcher](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.IAuthorizationRequestFetcher 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.RequestFetching\.IAuthorizationRequestFetcher') ### Constructors ## CompositeRequestFetcher\(IAuthorizationRequestFetcher\[\]\) Constructor {#Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.CompositeRequestFetcher.CompositeRequestFetcher(Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.IAuthorizationRequestFetcher[])} A composite fetcher that combines multiple [IAuthorizationRequestFetcher](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.IAuthorizationRequestFetcher 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.RequestFetching\.IAuthorizationRequestFetcher') instances\. It iterates through each fetcher to process an authorization request, allowing for a flexible and extensible mechanism to fetch and validate authorization requests from different sources or formats\. ```csharp public CompositeRequestFetcher(Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.IAuthorizationRequestFetcher[] fetchers); ``` #### Parameters ###### `fetchers` [IAuthorizationRequestFetcher](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.IAuthorizationRequestFetcher 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.RequestFetching\.IAuthorizationRequestFetcher')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.CompositeRequestFetcher.CompositeRequestFetcher(Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.IAuthorizationRequestFetcher[]).fetchers} An array of [IAuthorizationRequestFetcher](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.IAuthorizationRequestFetcher 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.RequestFetching\.IAuthorizationRequestFetcher') instances that will be used to fetch and validate the authorization request\. ### Methods ## CompositeRequestFetcher\.FetchAsync\(AuthorizationRequest\) Method {#Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.CompositeRequestFetcher.FetchAsync(Abblix.Oidc.Server.Model.AuthorizationRequest)} Iterates through the configured fetchers to process the authorization request\. Each fetcher in the array has the opportunity to handle the request\. If a fetcher returns a fault, the process stops and the fault is returned\. If all fetchers succeed, the method returns the final successful result\. ```csharp public System.Threading.Tasks.Task> FetchAsync(Abblix.Oidc.Server.Model.AuthorizationRequest request); ``` #### Parameters ###### `request` [AuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.AuthorizationRequest 'Abblix\.Oidc\.Server\.Model\.AuthorizationRequest') {#Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.CompositeRequestFetcher.FetchAsync(Abblix.Oidc.Server.Model.AuthorizationRequest).request} The authorization request to be processed\. Implements [FetchAsync\(AuthorizationRequest\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.IAuthorizationRequestFetcher#Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.IAuthorizationRequestFetcher.FetchAsync(Abblix.Oidc.Server.Model.AuthorizationRequest) 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.RequestFetching\.IAuthorizationRequestFetcher\.FetchAsync\(Abblix\.Oidc\.Server\.Model\.AuthorizationRequest\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[AuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.AuthorizationRequest 'Abblix\.Oidc\.Server\.Model\.AuthorizationRequest')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[AuthorizationRequestValidationError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationRequestValidationError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A [Result<TSuccess,TFailure>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2') of [AuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.AuthorizationRequest 'Abblix\.Oidc\.Server\.Model\.AuthorizationRequest') on success or [AuthorizationRequestValidationError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationRequestValidationError') on failure, representing the outcome of the fetching process\. If a fetcher returns a fault, that fault is propagated; otherwise the final successful request is returned\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.IAuthorizationRequestFetcher.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Authorization\.RequestFetching](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.RequestFetching') ## IAuthorizationRequestFetcher Interface Defines an interface for fetching the details of an authorization request, potentially including resolving and validating a request object\. ```csharp public interface IAuthorizationRequestFetcher ``` Derived ↳ [CompositeRequestFetcher](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.CompositeRequestFetcher 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.RequestFetching\.CompositeRequestFetcher') ↳ [PushedRequestFetcher](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.PushedRequestFetcher 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.RequestFetching\.PushedRequestFetcher') ↳ [RequestObjectFetchAdapter](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.RequestObjectFetchAdapter 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.RequestFetching\.RequestObjectFetchAdapter') ↳ [RequestUriFetcher](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.RequestUriFetcher 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.RequestFetching\.RequestUriFetcher') ### Methods ## IAuthorizationRequestFetcher\.FetchAsync\(AuthorizationRequest\) Method {#Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.IAuthorizationRequestFetcher.FetchAsync(Abblix.Oidc.Server.Model.AuthorizationRequest)} Asynchronously fetches and processes the authorization request, which may involve resolving a request object from a URI or directly from the request parameters\. ```csharp System.Threading.Tasks.Task> FetchAsync(Abblix.Oidc.Server.Model.AuthorizationRequest request); ``` #### Parameters ###### `request` [AuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.AuthorizationRequest 'Abblix\.Oidc\.Server\.Model\.AuthorizationRequest') {#Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.IAuthorizationRequestFetcher.FetchAsync(Abblix.Oidc.Server.Model.AuthorizationRequest).request} The initial authorization request, which may contain a reference to a request object or inline request parameters\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[AuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.AuthorizationRequest 'Abblix\.Oidc\.Server\.Model\.AuthorizationRequest')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[AuthorizationRequestValidationError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationRequestValidationError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task that returns the processed authorization request details, encapsulated within a [Result<TSuccess,TFailure>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2') of [AuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.AuthorizationRequest 'Abblix\.Oidc\.Server\.Model\.AuthorizationRequest') on success or [AuthorizationRequestValidationError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationRequestValidationError') on failure\. ### Remarks This method is responsible for handling the specifics of fetching and interpreting the authorization request, which may include retrieving a request object from a remote location specified by the 'request\_uri' parameter, or validating the request object provided inline via the 'request' parameter\. It ensures the request adheres to the expected format and validation requirements before further processing\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.PushedRequestFetcher.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Authorization\.RequestFetching](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.RequestFetching') ## PushedRequestFetcher Class Fetches pushed authorization request objects identified by a URN \(Uniform Resource Name\) from a storage system\. ```csharp public class PushedRequestFetcher : Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.IAuthorizationRequestFetcher ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → PushedRequestFetcher Implements [IAuthorizationRequestFetcher](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.IAuthorizationRequestFetcher 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.RequestFetching\.IAuthorizationRequestFetcher') ### Constructors ## PushedRequestFetcher\(IOptionsSnapshot\, IAuthorizationRequestStorage, IClientInfoProvider\) Constructor {#Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.PushedRequestFetcher.PushedRequestFetcher(Microsoft.Extensions.Options.IOptionsSnapshot_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,Abblix.Oidc.Server.Features.Storages.IAuthorizationRequestStorage,Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider)} Fetches pushed authorization request objects identified by a URN \(Uniform Resource Name\) from a storage system\. ```csharp public PushedRequestFetcher(Microsoft.Extensions.Options.IOptionsSnapshot options, Abblix.Oidc.Server.Features.Storages.IAuthorizationRequestStorage authorizationRequestStorage, Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider clientInfoProvider); ``` #### Parameters ###### `options` [Microsoft\.Extensions\.Options\.IOptionsSnapshot<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptionssnapshot-1 'Microsoft\.Extensions\.Options\.IOptionsSnapshot\`1')[OidcOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptionssnapshot-1 'Microsoft\.Extensions\.Options\.IOptionsSnapshot\`1') {#Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.PushedRequestFetcher.PushedRequestFetcher(Microsoft.Extensions.Options.IOptionsSnapshot_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,Abblix.Oidc.Server.Features.Storages.IAuthorizationRequestStorage,Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider).options} Provides configuration options for the OIDC server, such as whether PAR is required\. ###### `authorizationRequestStorage` [IAuthorizationRequestStorage](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Storages.IAuthorizationRequestStorage 'Abblix\.Oidc\.Server\.Features\.Storages\.IAuthorizationRequestStorage') {#Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.PushedRequestFetcher.PushedRequestFetcher(Microsoft.Extensions.Options.IOptionsSnapshot_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,Abblix.Oidc.Server.Features.Storages.IAuthorizationRequestStorage,Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider).authorizationRequestStorage} The storage system used to retrieve pushed authorization request objects\. ###### `clientInfoProvider` [IClientInfoProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.IClientInfoProvider') {#Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.PushedRequestFetcher.PushedRequestFetcher(Microsoft.Extensions.Options.IOptionsSnapshot_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,Abblix.Oidc.Server.Features.Storages.IAuthorizationRequestStorage,Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider).clientInfoProvider} Resolves the requesting client's registration to enforce the per\-client PAR requirement\. ### Methods ## PushedRequestFetcher\.FetchAsync\(AuthorizationRequest\) Method {#Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.PushedRequestFetcher.FetchAsync(Abblix.Oidc.Server.Model.AuthorizationRequest)} Asynchronously retrieves the pushed authorization request object associated with the specified URN\. ```csharp public System.Threading.Tasks.Task> FetchAsync(Abblix.Oidc.Server.Model.AuthorizationRequest request); ``` #### Parameters ###### `request` [AuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.AuthorizationRequest 'Abblix\.Oidc\.Server\.Model\.AuthorizationRequest') {#Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.PushedRequestFetcher.FetchAsync(Abblix.Oidc.Server.Model.AuthorizationRequest).request} The authorization request containing a URN from which to fetch the stored pushed authorization request object\. Implements [FetchAsync\(AuthorizationRequest\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.IAuthorizationRequestFetcher#Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.IAuthorizationRequestFetcher.FetchAsync(Abblix.Oidc.Server.Model.AuthorizationRequest) 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.RequestFetching\.IAuthorizationRequestFetcher\.FetchAsync\(Abblix\.Oidc\.Server\.Model\.AuthorizationRequest\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[AuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.AuthorizationRequest 'Abblix\.Oidc\.Server\.Model\.AuthorizationRequest')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[AuthorizationRequestValidationError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationRequestValidationError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task representing the asynchronous operation\. The task result contains the fetched pushed authorization request object or an error if not found\. ### Remarks This method checks if the provided authorization request contains a URN that references a pushed authorization request stored in the system\. If the URN is valid and corresponds to a stored request, the method retrieves and returns the request object\. If the request object cannot be found or the URN is invalid, an error is returned\. Additionally, it checks the server configuration to enforce the Pushed Authorization Request \(PAR\) requirement\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.RequestObjectFetchAdapter.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Authorization\.RequestFetching](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.RequestFetching') ## RequestObjectFetchAdapter Class Adapter class that implements [IAuthorizationRequestFetcher](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.IAuthorizationRequestFetcher 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.RequestFetching\.IAuthorizationRequestFetcher') to delegate the fetching and processing of request objects to an instance of [IRequestObjectFetcher](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RequestObject.IRequestObjectFetcher 'Abblix\.Oidc\.Server\.Features\.RequestObject\.IRequestObjectFetcher')\. ```csharp public class RequestObjectFetchAdapter : Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.IAuthorizationRequestFetcher ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → RequestObjectFetchAdapter Implements [IAuthorizationRequestFetcher](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.IAuthorizationRequestFetcher 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.RequestFetching\.IAuthorizationRequestFetcher') ### Constructors ## RequestObjectFetchAdapter\(IRequestObjectFetcher\) Constructor {#Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.RequestObjectFetchAdapter.RequestObjectFetchAdapter(Abblix.Oidc.Server.Features.RequestObject.IRequestObjectFetcher)} Adapter class that implements [IAuthorizationRequestFetcher](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.IAuthorizationRequestFetcher 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.RequestFetching\.IAuthorizationRequestFetcher') to delegate the fetching and processing of request objects to an instance of [IRequestObjectFetcher](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RequestObject.IRequestObjectFetcher 'Abblix\.Oidc\.Server\.Features\.RequestObject\.IRequestObjectFetcher')\. ```csharp public RequestObjectFetchAdapter(Abblix.Oidc.Server.Features.RequestObject.IRequestObjectFetcher requestObjectFetcher); ``` #### Parameters ###### `requestObjectFetcher` [IRequestObjectFetcher](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RequestObject.IRequestObjectFetcher 'Abblix\.Oidc\.Server\.Features\.RequestObject\.IRequestObjectFetcher') {#Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.RequestObjectFetchAdapter.RequestObjectFetchAdapter(Abblix.Oidc.Server.Features.RequestObject.IRequestObjectFetcher).requestObjectFetcher} The request object fetcher responsible for fetching and processing the JWT request object\. ### Methods ## RequestObjectFetchAdapter\.FetchAsync\(AuthorizationRequest\) Method {#Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.RequestObjectFetchAdapter.FetchAsync(Abblix.Oidc.Server.Model.AuthorizationRequest)} Fetches and processes the authorization request by delegating to the request object fetcher\. The request object JWT is validated and its claims are merged into the authorization request\. Client identification is performed using the request parameter, JWT issuer claim, or JWT client\_id claim, with validation ensuring all present sources match\. ```csharp public System.Threading.Tasks.Task> FetchAsync(Abblix.Oidc.Server.Model.AuthorizationRequest request); ``` #### Parameters ###### `request` [AuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.AuthorizationRequest 'Abblix\.Oidc\.Server\.Model\.AuthorizationRequest') {#Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.RequestObjectFetchAdapter.FetchAsync(Abblix.Oidc.Server.Model.AuthorizationRequest).request} The authorization request to be processed\. Implements [FetchAsync\(AuthorizationRequest\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.IAuthorizationRequestFetcher#Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.IAuthorizationRequestFetcher.FetchAsync(Abblix.Oidc.Server.Model.AuthorizationRequest) 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.RequestFetching\.IAuthorizationRequestFetcher\.FetchAsync\(Abblix\.Oidc\.Server\.Model\.AuthorizationRequest\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[AuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.AuthorizationRequest 'Abblix\.Oidc\.Server\.Model\.AuthorizationRequest')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[AuthorizationRequestValidationError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationRequestValidationError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task that returns a [Result<TSuccess,TFailure>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2') which either represents a successfully processed request with merged JWT claims or an error indicating issues with the request object validation \(invalid JWT, client identification failure, or claim mismatch\)\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.RequestUriFetcher.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Authorization\.RequestFetching](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.RequestFetching') ## RequestUriFetcher Class Handles fetching of authorization request objects from a specified request URI\. This class is responsible for retrieving pre\-registered request objects from an external location indicated by a URI, ensuring the request is complete and valid\. It enables dynamic request objects, allowing authorization servers to fetch additional data required for processing the authorization request\. ```csharp public class RequestUriFetcher : Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.IAuthorizationRequestFetcher ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → RequestUriFetcher Implements [IAuthorizationRequestFetcher](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.IAuthorizationRequestFetcher 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.RequestFetching\.IAuthorizationRequestFetcher') ### Constructors ## RequestUriFetcher\(ILogger\, IClientInfoProvider, ISecureHttpFetcher\) Constructor {#Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.RequestUriFetcher.RequestUriFetcher(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.RequestUriFetcher_,Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider,Abblix.Oidc.Server.Features.SecureHttpFetch.ISecureHttpFetcher)} Handles fetching of authorization request objects from a specified request URI\. This class is responsible for retrieving pre\-registered request objects from an external location indicated by a URI, ensuring the request is complete and valid\. It enables dynamic request objects, allowing authorization servers to fetch additional data required for processing the authorization request\. ```csharp public RequestUriFetcher(Microsoft.Extensions.Logging.ILogger logger, Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider clientInfoProvider, Abblix.Oidc.Server.Features.SecureHttpFetch.ISecureHttpFetcher secureHttpFetcher); ``` #### Parameters ###### `logger` [Microsoft\.Extensions\.Logging\.ILogger<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1')[RequestUriFetcher](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.RequestUriFetcher 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.RequestFetching\.RequestUriFetcher')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1') {#Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.RequestUriFetcher.RequestUriFetcher(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.RequestUriFetcher_,Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider,Abblix.Oidc.Server.Features.SecureHttpFetch.ISecureHttpFetcher).logger} The logger used for logging warnings when request fetching fails\. ###### `clientInfoProvider` [IClientInfoProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.IClientInfoProvider') {#Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.RequestUriFetcher.RequestUriFetcher(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.RequestUriFetcher_,Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider,Abblix.Oidc.Server.Features.SecureHttpFetch.ISecureHttpFetcher).clientInfoProvider} Service to retrieve client\-specific information for validation\. ###### `secureHttpFetcher` [ISecureHttpFetcher](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.SecureHttpFetch.ISecureHttpFetcher 'Abblix\.Oidc\.Server\.Features\.SecureHttpFetch\.ISecureHttpFetcher') {#Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.RequestUriFetcher.RequestUriFetcher(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.RequestUriFetcher_,Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider,Abblix.Oidc.Server.Features.SecureHttpFetch.ISecureHttpFetcher).secureHttpFetcher} The secure HTTP fetcher for retrieving content from external URIs with SSRF protection\. ### Methods ## RequestUriFetcher\.FetchAsync\(AuthorizationRequest\) Method {#Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.RequestUriFetcher.FetchAsync(Abblix.Oidc.Server.Model.AuthorizationRequest)} Asynchronously fetches the authorization request object from the given request URI\. This method retrieves the request object if the request URI is valid and contains an absolute URL\. It then returns the authorization request object or logs an error if the fetch fails\. ```csharp public System.Threading.Tasks.Task> FetchAsync(Abblix.Oidc.Server.Model.AuthorizationRequest request); ``` #### Parameters ###### `request` [AuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.AuthorizationRequest 'Abblix\.Oidc\.Server\.Model\.AuthorizationRequest') {#Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.RequestUriFetcher.FetchAsync(Abblix.Oidc.Server.Model.AuthorizationRequest).request} The authorization request, which contains the RequestUri\. Implements [FetchAsync\(AuthorizationRequest\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.IAuthorizationRequestFetcher#Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.IAuthorizationRequestFetcher.FetchAsync(Abblix.Oidc.Server.Model.AuthorizationRequest) 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.RequestFetching\.IAuthorizationRequestFetcher\.FetchAsync\(Abblix\.Oidc\.Server\.Model\.AuthorizationRequest\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[AuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.AuthorizationRequest 'Abblix\.Oidc\.Server\.Model\.AuthorizationRequest')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[AuthorizationRequestValidationError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationRequestValidationError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task representing the asynchronous operation, with the result being the fetched request object or an error\. ### Remarks The method checks for conflicts between the \`Request\` and \`RequestUri\` parameters\. If both are present, it returns an error since only one should be used\. Otherwise, it proceeds to fetch the request object from the \`RequestUri\` and returns the result\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ## Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation Namespace | Classes | | | :--- | :--- | | [AuthorizationContextValidatorComposite](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationContextValidatorComposite 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.AuthorizationContextValidatorComposite') | Represents a composite validator for authorization contexts\. This class implements [IAuthorizationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.IAuthorizationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.IAuthorizationContextValidator') and aggregates multiple validation steps into a single validation process\. | | [AuthorizationDetailsRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationDetailsRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.AuthorizationDetailsRequestValidator') | Thin endpoint\-side adapter that delegates the RFC 9396 `authorization_details` validation to [ApplyAsync\(JsonArray, ClientInfo, CancellationToken\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy#Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy.ApplyAsync(System.Text.Json.Nodes.JsonArray,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.Threading.CancellationToken) 'Abblix\.Oidc\.Server\.Features\.RichAuthorizationRequests\.IAuthorizationDetailsPolicy\.ApplyAsync\(System\.Text\.Json\.Nodes\.JsonArray, Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo, System\.Threading\.CancellationToken\)') and converts the returned error description to an [AuthorizationRequestValidationError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationRequestValidationError')\. All actual policy lives on the composite validator so /authorize, /par, CIBA and \(future\) device\-flow endpoints share one source of truth\. | | [AuthorizationValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.AuthorizationValidationContext') | Encapsulates the context necessary for validating an authorization request, including client details, response modes, and the OAuth 2\.0 flow type\. | | [ClientValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.ClientValidator 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.ClientValidator') | Validates the client specified in the authorization request\. This class checks whether the client is registered and authorized to perform the request, as part of the authorization validation process\. It plays a crucial role in ensuring that only valid and authorized clients can initiate authorization requests\. | | [ErrorFactory](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.ErrorFactory 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.ErrorFactory') | Provides a factory for creating standardized authorization request error responses\. This factory simplifies the creation of error responses for various types of validation failures during authorization request processing\. | | [FlowTypeValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.FlowTypeValidator 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.FlowTypeValidator') | Validates the OAuth 2\.0 flow type specified in the authorization request\. This class determines if the requested flow type is supported and matches the expected patterns for authorization requests, as part of the validation process\. | | [IdTokenHintValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.IdTokenHintValidator 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.IdTokenHintValidator') | Validates the `id_token_hint` parameter of an authorization request and records the end user it names, so the endpoint can honour it when it chooses a session\. | | [NonceValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.NonceValidator 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.NonceValidator') | Implements nonce validation for authorization requests in compliance with OAuth 2\.0 and OpenID Connect specifications\. This validator ensures the presence of a nonce parameter when the response type includes an ID token, as by OpenID Connect Core 1\.0 specification\. It extends [SyncAuthorizationContextValidatorBase](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.SyncAuthorizationContextValidatorBase 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.SyncAuthorizationContextValidatorBase') for synchronous validation\. Refer to RFC 6749 and OpenID Connect Core 1\.0 for more details on authorization request parameters\. | | [PkceValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.PkceValidator 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.PkceValidator') | Validates the PKCE \(Proof Key for Code Exchange\) parameters in an authorization request\. PKCE adds another layer of security for the OAuth 2\.0 authorization code flow, particularly in public clients\. It ensures that the authorization request conforms to the standards defined in RFC 7636 \(specifically, see Section 4\.3 for client validation requirements\)\. | | [ProofKeyThumbprintValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.ProofKeyThumbprintValidator 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.ProofKeyThumbprintValidator') | Syntactic validator for the RFC 9449 §10 `dpop_jkt` authorization\-request parameter: surfaces malformed thumbprints at the authorize / PAR endpoint with `invalid_request` instead of letting them slip through to /token where they would surface only as `invalid_dpop_proof` on the live\-proof comparison \- fail\-fast at the binding\-time endpoint\. | | [RedirectUriValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.RedirectUriValidator 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.RedirectUriValidator') | Validates the redirect URI specified in the authorization request\. This class checks whether the provided redirect URI matches one of the client's registered redirect URIs, as part of the authorization validation process\. It is essential for ensuring that redirections only occur to pre\-approved locations, enhancing security in the OAuth 2\.0 flow\. | | [RequestedSubjectValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.RequestedSubjectValidator 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.RequestedSubjectValidator') | Records the end users a `claims` request will accept for `sub`, so the endpoint can honour them when it chooses a session\. | | [ResourceValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.ResourceValidator 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.ResourceValidator') | Validates resources specified in authorization requests to ensure they conform to registered definitions and policies\. This validator checks whether the resources requested in the authorization process are recognized by the system and permitted for the requesting client, extending the base functionality of resource validation by incorporating integration with the authorization context\. | | [ResponseModeValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.ResponseModeValidator 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.ResponseModeValidator') | Verifies that an explicit `response_mode` is compatible with the OAuth 2\.0 flow derived from `response_type` \(OAuth 2\.0 Multiple Response Types §2\.1, OAuth 2\.0 Form Post Response Mode\)\. For the authorization\-code flow any of `query`, `fragment`, `form_post` is allowed; flows that issue tokens at the authorization endpoint \(implicit, hybrid\) refuse `query` because credentials must not appear in the URL query string\. After that flow\-compatibility check, when the client configures an explicit [AllowedResponseModes](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.AllowedResponseModes 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo\.AllowedResponseModes') allow\-list the effective response mode must be a member of it, letting a host pin the delivery channel and close a response\-mode downgrade \(RFC 9700\)\. | | [ScopeValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.ScopeValidator 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.ScopeValidator') | Validates the scopes specified in the OAuth 2\.0 authorization request\. This class checks if the requested scopes are permissible based on the client's configuration and the OAuth flow type in use\. It ensures that only allowed scopes are requested, enhancing security and compliance with the defined authorization policies\. | | [SignedRequestObjectRequirementValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.SignedRequestObjectRequirementValidator 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.SignedRequestObjectRequirementValidator') | Enforces the RFC 9101 §10\.5 `require_signed_request_object` client metadata: a client that committed to it must deliver its authorization parameters as a signed request object\. A request that came neither from a request object nor from a PAR\-stored request is plain parameters and is rejected\. The PAR push itself runs through the same validator pipeline, so a flagged client cannot smuggle plain parameters in via PAR either; the signature itself \(rejecting the `none` algorithm\) is enforced by the request\-object fetcher where the JWT is validated\. | | [SyncAuthorizationContextValidatorBase](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.SyncAuthorizationContextValidatorBase 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.SyncAuthorizationContextValidatorBase') | Provides a base for implementing synchronous authorization request validation steps\. This abstract class allows for creating validators that perform synchronous validation of authorization requests, while adhering to the [IAuthorizationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.IAuthorizationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.IAuthorizationContextValidator') interface for asynchronous operation\. | | Interfaces | | | :--- | :--- | | [IAuthorizationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.IAuthorizationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.IAuthorizationContextValidator') | Defines the contract for a validator in an authorization context\. Implementations of this interface should provide logic for validating authorization requests\. | --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationContextValidatorComposite.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation') ## AuthorizationContextValidatorComposite Class Represents a composite validator for authorization contexts\. This class implements [IAuthorizationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.IAuthorizationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.IAuthorizationContextValidator') and aggregates multiple validation steps into a single validation process\. ```csharp public class AuthorizationContextValidatorComposite : Abblix.Oidc.Server.Endpoints.Authorization.Validation.IAuthorizationContextValidator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → AuthorizationContextValidatorComposite Implements [IAuthorizationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.IAuthorizationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.IAuthorizationContextValidator') ### Constructors ## AuthorizationContextValidatorComposite\(IAuthorizationContextValidator\[\]\) Constructor {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationContextValidatorComposite.AuthorizationContextValidatorComposite(Abblix.Oidc.Server.Endpoints.Authorization.Validation.IAuthorizationContextValidator[])} Represents a composite validator for authorization contexts\. This class implements [IAuthorizationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.IAuthorizationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.IAuthorizationContextValidator') and aggregates multiple validation steps into a single validation process\. ```csharp public AuthorizationContextValidatorComposite(Abblix.Oidc.Server.Endpoints.Authorization.Validation.IAuthorizationContextValidator[] validators); ``` #### Parameters ###### `validators` [IAuthorizationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.IAuthorizationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.IAuthorizationContextValidator')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationContextValidatorComposite.AuthorizationContextValidatorComposite(Abblix.Oidc.Server.Endpoints.Authorization.Validation.IAuthorizationContextValidator[]).validators} An array of validators that define the validation process\. ### Methods ## AuthorizationContextValidatorComposite\.ValidateAsync\(AuthorizationValidationContext\) Method {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationContextValidatorComposite.ValidateAsync(Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext)} Asynchronously validates an [AuthorizationValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.AuthorizationValidationContext')\. Iterates through each validation step, returning the first encountered error, if any\. ```csharp public System.Threading.Tasks.Task ValidateAsync(Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext context); ``` #### Parameters ###### `context` [AuthorizationValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.AuthorizationValidationContext') {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationContextValidatorComposite.ValidateAsync(Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext).context} The authorization validation context to be validated\. Implements [ValidateAsync\(AuthorizationValidationContext\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.IAuthorizationContextValidator#Abblix.Oidc.Server.Endpoints.Authorization.Validation.IAuthorizationContextValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext) 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.IAuthorizationContextValidator\.ValidateAsync\(Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.AuthorizationValidationContext\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[AuthorizationRequestValidationError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationRequestValidationError')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task that represents the asynchronous validation operation\. The task result contains an [AuthorizationRequestValidationError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationRequestValidationError') if a validation error is found, or null if validation succeeds\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationDetailsRequestValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation') ## AuthorizationDetailsRequestValidator Class Thin endpoint\-side adapter that delegates the RFC 9396 `authorization_details` validation to [ApplyAsync\(JsonArray, ClientInfo, CancellationToken\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy#Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy.ApplyAsync(System.Text.Json.Nodes.JsonArray,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.Threading.CancellationToken) 'Abblix\.Oidc\.Server\.Features\.RichAuthorizationRequests\.IAuthorizationDetailsPolicy\.ApplyAsync\(System\.Text\.Json\.Nodes\.JsonArray, Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo, System\.Threading\.CancellationToken\)') and converts the returned error description to an [AuthorizationRequestValidationError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationRequestValidationError')\. All actual policy lives on the composite validator so /authorize, /par, CIBA and \(future\) device\-flow endpoints share one source of truth\. ```csharp public class AuthorizationDetailsRequestValidator : Abblix.Oidc.Server.Endpoints.Authorization.Validation.IAuthorizationContextValidator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → AuthorizationDetailsRequestValidator Implements [IAuthorizationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.IAuthorizationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.IAuthorizationContextValidator') ### Constructors ## AuthorizationDetailsRequestValidator\(IAuthorizationDetailsPolicy\) Constructor {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationDetailsRequestValidator.AuthorizationDetailsRequestValidator(Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy)} Thin endpoint\-side adapter that delegates the RFC 9396 `authorization_details` validation to [ApplyAsync\(JsonArray, ClientInfo, CancellationToken\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy#Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy.ApplyAsync(System.Text.Json.Nodes.JsonArray,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.Threading.CancellationToken) 'Abblix\.Oidc\.Server\.Features\.RichAuthorizationRequests\.IAuthorizationDetailsPolicy\.ApplyAsync\(System\.Text\.Json\.Nodes\.JsonArray, Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo, System\.Threading\.CancellationToken\)') and converts the returned error description to an [AuthorizationRequestValidationError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationRequestValidationError')\. All actual policy lives on the composite validator so /authorize, /par, CIBA and \(future\) device\-flow endpoints share one source of truth\. ```csharp public AuthorizationDetailsRequestValidator(Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy policy); ``` #### Parameters ###### `policy` [IAuthorizationDetailsPolicy](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy 'Abblix\.Oidc\.Server\.Features\.RichAuthorizationRequests\.IAuthorizationDetailsPolicy') {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationDetailsRequestValidator.AuthorizationDetailsRequestValidator(Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy).policy} ### Methods ## AuthorizationDetailsRequestValidator\.ValidateAsync\(AuthorizationValidationContext\) Method {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationDetailsRequestValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext)} Asynchronously validates an authorization request within a given context\. ```csharp public System.Threading.Tasks.Task ValidateAsync(Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext context); ``` #### Parameters ###### `context` [AuthorizationValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.AuthorizationValidationContext') {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationDetailsRequestValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext).context} The [AuthorizationValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.AuthorizationValidationContext') that contains the details of the authorization request to be validated\. Implements [ValidateAsync\(AuthorizationValidationContext\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.IAuthorizationContextValidator#Abblix.Oidc.Server.Endpoints.Authorization.Validation.IAuthorizationContextValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext) 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.IAuthorizationContextValidator\.ValidateAsync\(Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.AuthorizationValidationContext\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[AuthorizationRequestValidationError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationRequestValidationError')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task that represents the asynchronous validation operation\. The task result contains an [AuthorizationRequestValidationError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationRequestValidationError') if a validation error is found, or null if validation is successful\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation') ## AuthorizationValidationContext Class Encapsulates the context necessary for validating an authorization request, including client details, response modes, and the OAuth 2\.0 flow type\. ```csharp public record AuthorizationValidationContext : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → AuthorizationValidationContext Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[AuthorizationValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.AuthorizationValidationContext')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Constructors ## AuthorizationValidationContext\(AuthorizationRequest\) Constructor {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext.AuthorizationValidationContext(Abblix.Oidc.Server.Model.AuthorizationRequest)} Encapsulates the context necessary for validating an authorization request, including client details, response modes, and the OAuth 2\.0 flow type\. ```csharp public AuthorizationValidationContext(Abblix.Oidc.Server.Model.AuthorizationRequest Request); ``` #### Parameters ###### `Request` [AuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.AuthorizationRequest 'Abblix\.Oidc\.Server\.Model\.AuthorizationRequest') {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext.AuthorizationValidationContext(Abblix.Oidc.Server.Model.AuthorizationRequest).Request} ### Properties ## AuthorizationValidationContext\.AuthorizationDetails Property {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext.AuthorizationDetails} The RFC 9396 Rich Authorization Requests array after per\-type and per\-client validation by [IAuthorizationDetailsPolicy](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy 'Abblix\.Oidc\.Server\.Features\.RichAuthorizationRequests\.IAuthorizationDetailsPolicy'), stored as the raw [System\.Text\.Json\.Nodes\.JsonArray](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonarray 'System\.Text\.Json\.Nodes\.JsonArray') so byte\-exact content survives forward to the grant\. `null` when the request did not include `authorization_details`\. ```csharp public System.Text.Json.Nodes.JsonArray? AuthorizationDetails { get; set; } ``` #### Property Value [System\.Text\.Json\.Nodes\.JsonArray](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonarray 'System\.Text\.Json\.Nodes\.JsonArray') ## AuthorizationValidationContext\.ClientInfo Property {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext.ClientInfo} Provides details about the client making the authorization request\. This includes identifying information such as client ID and any other relevant data that has been registered with the authorization server\. ```csharp public Abblix.Oidc.Server.Features.ClientInformation.ClientInfo ClientInfo { get; set; } ``` #### Property Value [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') #### Exceptions [System\.InvalidOperationException](https://learn.microsoft.com/en-us/dotnet/api/system.invalidoperationexception 'System\.InvalidOperationException') Thrown when trying to access this property before it is set\. ## AuthorizationValidationContext\.FlowType Property {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext.FlowType} Identifies the OAuth 2\.0 flow used in the authorization request, such as Authorization Code or Implicit\. ```csharp public Abblix.Oidc.Server.Common.Constants.FlowTypes FlowType { get; set; } ``` #### Property Value [FlowTypes](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.FlowTypes 'Abblix\.Oidc\.Server\.Common\.Constants\.FlowTypes') #### Exceptions [System\.InvalidOperationException](https://learn.microsoft.com/en-us/dotnet/api/system.invalidoperationexception 'System\.InvalidOperationException') Thrown when trying to access this property before it is set\. ## AuthorizationValidationContext\.IdTokenHintSubject Property {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext.IdTokenHintSubject} The end user the request's `id_token_hint` names, as that ID token spells it, or `null` when the request carried no hint\. ```csharp public string? IdTokenHintSubject { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks Spelled as the ID token has it, which for a pairwise client is the pseudonym sealed to that client's sector rather than the subject a session carries\. Whoever compares the two converts the session forward; opening the pseudonym would fail whenever it could not be opened, and a comparison that could not be made must not read as a match\. ## AuthorizationValidationContext\.Request Property {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext.Request} The authorization request to be validated\. This includes all the details provided by the client for the authorization process\. ```csharp public Abblix.Oidc.Server.Model.AuthorizationRequest Request { get; set; } ``` #### Property Value [AuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.AuthorizationRequest 'Abblix\.Oidc\.Server\.Model\.AuthorizationRequest') ## AuthorizationValidationContext\.RequestedSubjects Property {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext.RequestedSubjects} The end users the request's `claims` parameter will accept for `sub`, or `null` when it asked for none in particular\. An empty array accepts nobody\. ```csharp public string[]? RequestedSubjects { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') ### Remarks A second, independent constraint rather than an alternative spelling of [IdTokenHintSubject](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext#Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext.IdTokenHintSubject 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.AuthorizationValidationContext\.IdTokenHintSubject'): a request may carry both, and OpenID Connect Core 1\.0 Section 3\.1\.2\.2 obliges the server to honour whichever are present\. Spelled the way the client wrote them, so the same conversion applies \- a pairwise client names the pseudonym sealed to its own sector\. Empty is a state a request can genuinely reach, by naming a `value` absent from its own `values`. That mismatch is what Section 5.5.1 says "MUST cause the authentication to fail", so it is carried through as a constraint nobody satisfies rather than discarded as nonsense. ## AuthorizationValidationContext\.Resources Property {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext.Resources} A collection of resource definitions that may be requested as part of the authorization process, providing additional control over the accessible resources\. ```csharp public Abblix.Oidc.Server.Common.Constants.ResourceDefinition[] Resources { get; set; } ``` #### Property Value [ResourceDefinition](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ResourceDefinition 'Abblix\.Oidc\.Server\.Common\.Constants\.ResourceDefinition')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') ## AuthorizationValidationContext\.ResponseMode Property {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext.ResponseMode} Specifies how the authorization response should be delivered to the client, e\.g\., via a direct query or fragment\. ```csharp public string ResponseMode { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## AuthorizationValidationContext\.Scope Property {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext.Scope} A collection of scope definitions applicable to the authorization request, determining the permissions granted\. ```csharp public Abblix.Oidc.Server.Common.Constants.ScopeDefinition[] Scope { get; set; } ``` #### Property Value [ScopeDefinition](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ScopeDefinition 'Abblix\.Oidc\.Server\.Common\.Constants\.ScopeDefinition')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') ## AuthorizationValidationContext\.ValidRedirectUri Property {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext.ValidRedirectUri} The redirect URI where the response to the authorization request should be sent\. This URI must be one of the registered URIs for the client to ensure security\. ```csharp public System.Uri? ValidRedirectUri { get; set; } ``` #### Property Value [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.ClientValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation') ## ClientValidator Class Validates the client specified in the authorization request\. This class checks whether the client is registered and authorized to perform the request, as part of the authorization validation process\. It plays a crucial role in ensuring that only valid and authorized clients can initiate authorization requests\. ```csharp public class ClientValidator : Abblix.Oidc.Server.Endpoints.Authorization.Validation.IAuthorizationContextValidator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ClientValidator Implements [IAuthorizationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.IAuthorizationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.IAuthorizationContextValidator') ### Constructors ## ClientValidator\(ILogger\, IClientInfoProvider\) Constructor {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.ClientValidator.ClientValidator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.Authorization.Validation.ClientValidator_,Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider)} Validates the client specified in the authorization request\. This class checks whether the client is registered and authorized to perform the request, as part of the authorization validation process\. It plays a crucial role in ensuring that only valid and authorized clients can initiate authorization requests\. ```csharp public ClientValidator(Microsoft.Extensions.Logging.ILogger logger, Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider clientInfoProvider); ``` #### Parameters ###### `logger` [Microsoft\.Extensions\.Logging\.ILogger<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1')[ClientValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.ClientValidator 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.ClientValidator')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1') {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.ClientValidator.ClientValidator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.Authorization.Validation.ClientValidator_,Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider).logger} The logger to be used for recording validation activities and outcomes\. ###### `clientInfoProvider` [IClientInfoProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.IClientInfoProvider') {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.ClientValidator.ClientValidator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.Authorization.Validation.ClientValidator_,Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider).clientInfoProvider} The provider used to retrieve information about clients\. ### Methods ## ClientValidator\.ValidateAsync\(AuthorizationValidationContext\) Method {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.ClientValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext)} Asynchronously validates the client specified in the authorization request\. Ensures the client is recognized and authorized to make the request\. ```csharp public System.Threading.Tasks.Task ValidateAsync(Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext context); ``` #### Parameters ###### `context` [AuthorizationValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.AuthorizationValidationContext') {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.ClientValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext).context} The validation context containing details of the authorization request and client information\. Implements [ValidateAsync\(AuthorizationValidationContext\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.IAuthorizationContextValidator#Abblix.Oidc.Server.Endpoints.Authorization.Validation.IAuthorizationContextValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext) 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.IAuthorizationContextValidator\.ValidateAsync\(Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.AuthorizationValidationContext\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[AuthorizationRequestValidationError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationRequestValidationError')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') An [AuthorizationRequestValidationError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationRequestValidationError') if the client is not found or not authorized, or null if the client is valid\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.ErrorFactory.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation') ## ErrorFactory Class Provides a factory for creating standardized authorization request error responses\. This factory simplifies the creation of error responses for various types of validation failures during authorization request processing\. ```csharp public static class ErrorFactory ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ErrorFactory ### Methods ## ErrorFactory\.Error\(this AuthorizationValidationContext, string, string\) Method {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.ErrorFactory.Error(thisAbblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext,string,string)} Creates an [AuthorizationRequestValidationError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationRequestValidationError') with a specified error code and description, using the context from an [AuthorizationValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.AuthorizationValidationContext')\. ```csharp public static Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError Error(this Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext context, string error, string description); ``` #### Parameters ###### `context` [AuthorizationValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.AuthorizationValidationContext') {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.ErrorFactory.Error(thisAbblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext,string,string).context} The validation context associated with the authorization request\. ###### `error` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.ErrorFactory.Error(thisAbblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext,string,string).error} The error code as defined by the OpenID Connect and OAuth 2\.0 specifications\. ###### `description` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.ErrorFactory.Error(thisAbblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext,string,string).description} A human\-readable description of the error\. #### Returns [AuthorizationRequestValidationError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationRequestValidationError') An [AuthorizationRequestValidationError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationRequestValidationError') instance encapsulating the error details\. ## ErrorFactory\.InvalidAuthorizationDetails\(this AuthorizationValidationContext, string\) Method {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.ErrorFactory.InvalidAuthorizationDetails(thisAbblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext,string)} Creates an [AuthorizationRequestValidationError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationRequestValidationError') indicating an invalid `authorization_details` array per RFC 9396 §5\. Used when an entry references an unknown `type`, fails per\-type schema validation, or is not in the per\-client allowlist\. ```csharp public static Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError InvalidAuthorizationDetails(this Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext context, string description); ``` #### Parameters ###### `context` [AuthorizationValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.AuthorizationValidationContext') {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.ErrorFactory.InvalidAuthorizationDetails(thisAbblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext,string).context} The validation context associated with the request\. ###### `description` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.ErrorFactory.InvalidAuthorizationDetails(thisAbblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext,string).description} A human\-readable description of the rejection cause\. #### Returns [AuthorizationRequestValidationError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationRequestValidationError') An [AuthorizationRequestValidationError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationRequestValidationError') with the RAR\-specific error code\. ## ErrorFactory\.InvalidClient\(string\) Method {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.ErrorFactory.InvalidClient(string)} Creates an [AuthorizationRequestValidationError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationRequestValidationError') indicating an invalid client error\. This error type is used when the client authentication fails or when the client is not authorized to perform the requested operation\. It may occur due to issues like incorrect client credentials, unauthorized grant types for the client, or the client being unknown to the authorization server\. ```csharp public static Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError InvalidClient(string description); ``` #### Parameters ###### `description` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.ErrorFactory.InvalidClient(string).description} A human\-readable description specifying why the client is considered invalid\. #### Returns [AuthorizationRequestValidationError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationRequestValidationError') An [AuthorizationRequestValidationError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationRequestValidationError') with the specified error details, indicating that the error relates to an invalid client\. ## ErrorFactory\.InvalidRequest\(string\) Method {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.ErrorFactory.InvalidRequest(string)} Creates an [AuthorizationRequestValidationError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationRequestValidationError') for a general invalid request error, without an associated validation context\. ```csharp public static Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError InvalidRequest(string description); ``` #### Parameters ###### `description` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.ErrorFactory.InvalidRequest(string).description} A description of what was invalid about the request\. #### Returns [AuthorizationRequestValidationError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationRequestValidationError') An [AuthorizationRequestValidationError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationRequestValidationError') with the specified error details\. ## ErrorFactory\.InvalidRequest\(this AuthorizationValidationContext, string\) Method {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.ErrorFactory.InvalidRequest(thisAbblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext,string)} Creates an [AuthorizationRequestValidationError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationRequestValidationError') indicating an invalid request\. This error type is commonly used when an authorization request fails due to missing or invalid parameters\. ```csharp public static Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError InvalidRequest(this Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext context, string description); ``` #### Parameters ###### `context` [AuthorizationValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.AuthorizationValidationContext') {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.ErrorFactory.InvalidRequest(thisAbblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext,string).context} The validation context associated with the request, providing additional context for the error response\. ###### `description` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.ErrorFactory.InvalidRequest(thisAbblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext,string).description} A human\-readable explanation detailing what was invalid about the request\. #### Returns [AuthorizationRequestValidationError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationRequestValidationError') An [AuthorizationRequestValidationError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationRequestValidationError') instance encapsulating the error details\. ## ErrorFactory\.InvalidRequestObject\(string\) Method {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.ErrorFactory.InvalidRequestObject(string)} Creates an [AuthorizationRequestValidationError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationRequestValidationError') indicating an invalid request object\. This error is used when the request object \(JWT\) in an authorization request is invalid, such as when signature validation fails or required claims are missing\. ```csharp public static Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError InvalidRequestObject(string description); ``` #### Parameters ###### `description` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.ErrorFactory.InvalidRequestObject(string).description} A description of the issue with the request object\. #### Returns [AuthorizationRequestValidationError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationRequestValidationError') An [AuthorizationRequestValidationError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationRequestValidationError') for the invalid request object\. ## ErrorFactory\.InvalidRequestUri\(string\) Method {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.ErrorFactory.InvalidRequestUri(string)} Creates an [AuthorizationRequestValidationError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationRequestValidationError') indicating an invalid request URI\. This error is used when the request\_uri parameter of an authorization request is invalid or malformed\. ```csharp public static Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError InvalidRequestUri(string description); ``` #### Parameters ###### `description` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.ErrorFactory.InvalidRequestUri(string).description} A description of the issue with the request URI\. #### Returns [AuthorizationRequestValidationError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationRequestValidationError') An [AuthorizationRequestValidationError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationRequestValidationError') for the invalid request URI\. ## ErrorFactory\.InvalidScope\(this AuthorizationValidationContext, string\) Method {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.ErrorFactory.InvalidScope(thisAbblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext,string)} Creates an [AuthorizationRequestValidationError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationRequestValidationError') indicating an invalid scope error\. This error type is used when the scopes requested by the client are not supported or are inappropriate for the requested operation\. ```csharp public static Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError InvalidScope(this Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext context, string description); ``` #### Parameters ###### `context` [AuthorizationValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.AuthorizationValidationContext') {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.ErrorFactory.InvalidScope(thisAbblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext,string).context} The validation context associated with the request, providing additional context for the error response\. ###### `description` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.ErrorFactory.InvalidScope(thisAbblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext,string).description} A human\-readable description of why the requested scopes are invalid\. #### Returns [AuthorizationRequestValidationError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationRequestValidationError') An [AuthorizationRequestValidationError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationRequestValidationError') with details about the scope\-related issue\. ## ErrorFactory\.ValidationError\(string, string\) Method {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.ErrorFactory.ValidationError(string,string)} A private helper method to create an [AuthorizationRequestValidationError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationRequestValidationError') with a specified error code and description\. ```csharp public static Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError ValidationError(string error, string description); ``` #### Parameters ###### `error` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.ErrorFactory.ValidationError(string,string).error} The error code as defined by the OpenID Connect and OAuth 2\.0 specifications\. ###### `description` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.ErrorFactory.ValidationError(string,string).description} A human\-readable description of the error\. #### Returns [AuthorizationRequestValidationError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationRequestValidationError') An [AuthorizationRequestValidationError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationRequestValidationError') instance with the specified error details\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.FlowTypeValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation') ## FlowTypeValidator Class Validates the OAuth 2\.0 flow type specified in the authorization request\. This class determines if the requested flow type is supported and matches the expected patterns for authorization requests, as part of the validation process\. ```csharp public class FlowTypeValidator : Abblix.Oidc.Server.Endpoints.Authorization.Validation.SyncAuthorizationContextValidatorBase ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [SyncAuthorizationContextValidatorBase](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.SyncAuthorizationContextValidatorBase 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.SyncAuthorizationContextValidatorBase') → FlowTypeValidator ### Constructors ## FlowTypeValidator\(ILogger\, IEnumerable\, IOptions\\) Constructor {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.FlowTypeValidator.FlowTypeValidator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.Authorization.Validation.FlowTypeValidator_,System.Collections.Generic.IEnumerable_Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseBuilder_,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_)} Validates the OAuth 2\.0 flow type specified in the authorization request\. This class determines if the requested flow type is supported and matches the expected patterns for authorization requests, as part of the validation process\. ```csharp public FlowTypeValidator(Microsoft.Extensions.Logging.ILogger logger, System.Collections.Generic.IEnumerable processors, Microsoft.Extensions.Options.IOptions options); ``` #### Parameters ###### `logger` [Microsoft\.Extensions\.Logging\.ILogger<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1')[FlowTypeValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.FlowTypeValidator 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.FlowTypeValidator')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1') {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.FlowTypeValidator.FlowTypeValidator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.Authorization.Validation.FlowTypeValidator_,System.Collections.Generic.IEnumerable_Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseBuilder_,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_).logger} The logger to be used for logging purposes\. ###### `processors` [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[IAuthorizationResponseBuilder](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseBuilder 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.IAuthorizationResponseBuilder')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.FlowTypeValidator.FlowTypeValidator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.Authorization.Validation.FlowTypeValidator_,System.Collections.Generic.IEnumerable_Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseBuilder_,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_).processors} The set of registered authorization response processors\. The validator rejects requests whose `response_type` contains a part with no matching registered processor \- this enforces OAuth 2\.1 \(draft\) default\-off Implicit Flow at the validation layer \(without `EnableImplicitFlow()`, no `token` / `id_token` processors exist and any request asking for them gets `unsupported_response_type`\)\. ###### `options` [Microsoft\.Extensions\.Options\.IOptions<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptions-1 'Microsoft\.Extensions\.Options\.IOptions\`1')[OidcOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptions-1 'Microsoft\.Extensions\.Options\.IOptions\`1') {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.FlowTypeValidator.FlowTypeValidator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.Authorization.Validation.FlowTypeValidator_,System.Collections.Generic.IEnumerable_Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseBuilder_,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_).options} Provides the server\-wide default security profile a client inherits when it states none, used to reject implicit and hybrid response types for a client held to a code\-only profile \(FAPI 2\.0\)\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.IAuthorizationContextValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation') ## IAuthorizationContextValidator Interface Defines the contract for a validator in an authorization context\. Implementations of this interface should provide logic for validating authorization requests\. ```csharp public interface IAuthorizationContextValidator ``` Derived ↳ [AuthorizationContextValidatorComposite](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationContextValidatorComposite 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.AuthorizationContextValidatorComposite') ↳ [AuthorizationDetailsRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationDetailsRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.AuthorizationDetailsRequestValidator') ↳ [ClientValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.ClientValidator 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.ClientValidator') ↳ [IdTokenHintValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.IdTokenHintValidator 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.IdTokenHintValidator') ↳ [NonceValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.NonceValidator 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.NonceValidator') ↳ [PkceValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.PkceValidator 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.PkceValidator') ↳ [SyncAuthorizationContextValidatorBase](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.SyncAuthorizationContextValidatorBase 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.SyncAuthorizationContextValidatorBase') ### Methods ## IAuthorizationContextValidator\.ValidateAsync\(AuthorizationValidationContext\) Method {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.IAuthorizationContextValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext)} Asynchronously validates an authorization request within a given context\. ```csharp System.Threading.Tasks.Task ValidateAsync(Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext context); ``` #### Parameters ###### `context` [AuthorizationValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.AuthorizationValidationContext') {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.IAuthorizationContextValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext).context} The [AuthorizationValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.AuthorizationValidationContext') that contains the details of the authorization request to be validated\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[AuthorizationRequestValidationError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationRequestValidationError')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task that represents the asynchronous validation operation\. The task result contains an [AuthorizationRequestValidationError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationRequestValidationError') if a validation error is found, or null if validation is successful\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.IdTokenHintValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation') ## IdTokenHintValidator Class Validates the `id_token_hint` parameter of an authorization request and records the end user it names, so the endpoint can honour it when it chooses a session\. ```csharp public class IdTokenHintValidator : Abblix.Oidc.Server.Endpoints.Authorization.Validation.IAuthorizationContextValidator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → IdTokenHintValidator Implements [IAuthorizationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.IAuthorizationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.IAuthorizationContextValidator') ### Remarks OpenID Connect Core 1\.0 Section 3\.1\.2\.1: "If the End\-User identified by the ID Token is already logged in or is logged in as a result of the request \(with the OP possibly evaluating other information beyond the ID Token in this decision\), then the Authorization Server returns a positive response; otherwise, it MUST return an error, such as `login_required`\." A parameter parsed and read by nobody leaves a request naming one end user answerable for another, which costs nothing while a browser holds one session and stops costing nothing as soon as it holds two\. The subject is recorded as the ID token spells it, which for a pairwise client is the pseudonym sealed to that client's sector rather than the subject a session carries. Whoever compares the two converts the session forward. Runs after the validators that resolve the redirect URI and the response mode, because its refusals are the kind RFC 6749 Section 4.1.2.1 says the client must be told about, and before them there is nowhere to tell it. The [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext#Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext.ClientInfo 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.AuthorizationValidationContext\.ClientInfo') it reads is resolved earlier still. ### Constructors ## IdTokenHintValidator\(IIdTokenHintParser\) Constructor {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.IdTokenHintValidator.IdTokenHintValidator(Abblix.Oidc.Server.Features.Tokens.Validation.IIdTokenHintParser)} Validates the `id_token_hint` parameter of an authorization request and records the end user it names, so the endpoint can honour it when it chooses a session\. ```csharp public IdTokenHintValidator(Abblix.Oidc.Server.Features.Tokens.Validation.IIdTokenHintParser hintParser); ``` #### Parameters ###### `hintParser` [IIdTokenHintParser](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.Validation.IIdTokenHintParser 'Abblix\.Oidc\.Server\.Features\.Tokens\.Validation\.IIdTokenHintParser') {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.IdTokenHintValidator.IdTokenHintValidator(Abblix.Oidc.Server.Features.Tokens.Validation.IIdTokenHintParser).hintParser} Decides whether the hint is an ID token this server issued\. ### Remarks OpenID Connect Core 1\.0 Section 3\.1\.2\.1: "If the End\-User identified by the ID Token is already logged in or is logged in as a result of the request \(with the OP possibly evaluating other information beyond the ID Token in this decision\), then the Authorization Server returns a positive response; otherwise, it MUST return an error, such as `login_required`\." A parameter parsed and read by nobody leaves a request naming one end user answerable for another, which costs nothing while a browser holds one session and stops costing nothing as soon as it holds two\. The subject is recorded as the ID token spells it, which for a pairwise client is the pseudonym sealed to that client's sector rather than the subject a session carries. Whoever compares the two converts the session forward. Runs after the validators that resolve the redirect URI and the response mode, because its refusals are the kind RFC 6749 Section 4.1.2.1 says the client must be told about, and before them there is nowhere to tell it. The [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext#Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext.ClientInfo 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.AuthorizationValidationContext\.ClientInfo') it reads is resolved earlier still. ### Methods ## IdTokenHintValidator\.ValidateAsync\(AuthorizationValidationContext\) Method {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.IdTokenHintValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext)} Asynchronously validates an authorization request within a given context\. ```csharp public System.Threading.Tasks.Task ValidateAsync(Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext context); ``` #### Parameters ###### `context` [AuthorizationValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.AuthorizationValidationContext') {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.IdTokenHintValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext).context} The [AuthorizationValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.AuthorizationValidationContext') that contains the details of the authorization request to be validated\. Implements [ValidateAsync\(AuthorizationValidationContext\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.IAuthorizationContextValidator#Abblix.Oidc.Server.Endpoints.Authorization.Validation.IAuthorizationContextValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext) 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.IAuthorizationContextValidator\.ValidateAsync\(Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.AuthorizationValidationContext\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[AuthorizationRequestValidationError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationRequestValidationError')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task that represents the asynchronous validation operation\. The task result contains an [AuthorizationRequestValidationError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationRequestValidationError') if a validation error is found, or null if validation is successful\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.NonceValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation') ## NonceValidator Class Implements nonce validation for authorization requests in compliance with OAuth 2\.0 and OpenID Connect specifications\. This validator ensures the presence of a nonce parameter when the response type includes an ID token, as by OpenID Connect Core 1\.0 specification\. It extends [SyncAuthorizationContextValidatorBase](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.SyncAuthorizationContextValidatorBase 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.SyncAuthorizationContextValidatorBase') for synchronous validation\. Refer to RFC 6749 and OpenID Connect Core 1\.0 for more details on authorization request parameters\. ```csharp public class NonceValidator : Abblix.Oidc.Server.Endpoints.Authorization.Validation.IAuthorizationContextValidator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → NonceValidator Implements [IAuthorizationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.IAuthorizationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.IAuthorizationContextValidator') ### Constructors ## NonceValidator\(IAuthorizationValueReuseDetector\) Constructor {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.NonceValidator.NonceValidator(Abblix.Oidc.Server.Features.ReusePrevention.IAuthorizationValueReuseDetector)} Implements nonce validation for authorization requests in compliance with OAuth 2\.0 and OpenID Connect specifications\. This validator ensures the presence of a nonce parameter when the response type includes an ID token, as by OpenID Connect Core 1\.0 specification\. It extends [SyncAuthorizationContextValidatorBase](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.SyncAuthorizationContextValidatorBase 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.SyncAuthorizationContextValidatorBase') for synchronous validation\. Refer to RFC 6749 and OpenID Connect Core 1\.0 for more details on authorization request parameters\. ```csharp public NonceValidator(Abblix.Oidc.Server.Features.ReusePrevention.IAuthorizationValueReuseDetector reuseDetector); ``` #### Parameters ###### `reuseDetector` [IAuthorizationValueReuseDetector](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ReusePrevention.IAuthorizationValueReuseDetector 'Abblix\.Oidc\.Server\.Features\.ReusePrevention\.IAuthorizationValueReuseDetector') {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.NonceValidator.NonceValidator(Abblix.Oidc.Server.Features.ReusePrevention.IAuthorizationValueReuseDetector).reuseDetector} ### Methods ## NonceValidator\.ValidateAsync\(AuthorizationValidationContext\) Method {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.NonceValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext)} Validates the nonce in the authorization request as per OpenID Connect Core 1\.0 specifications\. ```csharp public System.Threading.Tasks.Task ValidateAsync(Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext context); ``` #### Parameters ###### `context` [AuthorizationValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.AuthorizationValidationContext') {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.NonceValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext).context} The [AuthorizationValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.AuthorizationValidationContext') containing the authorization request to be validated\. Implements [ValidateAsync\(AuthorizationValidationContext\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.IAuthorizationContextValidator#Abblix.Oidc.Server.Endpoints.Authorization.Validation.IAuthorizationContextValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext) 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.IAuthorizationContextValidator\.ValidateAsync\(Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.AuthorizationValidationContext\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[AuthorizationRequestValidationError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationRequestValidationError')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') An [AuthorizationRequestValidationError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationRequestValidationError') if the validation fails due to a missing nonce when the response type includes an ID token, as by OpenID Connect Core 1\.0; otherwise, null indicating successful validation\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.PkceValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation') ## PkceValidator Class Validates the PKCE \(Proof Key for Code Exchange\) parameters in an authorization request\. PKCE adds another layer of security for the OAuth 2\.0 authorization code flow, particularly in public clients\. It ensures that the authorization request conforms to the standards defined in RFC 7636 \(specifically, see Section 4\.3 for client validation requirements\)\. ```csharp public class PkceValidator : Abblix.Oidc.Server.Endpoints.Authorization.Validation.IAuthorizationContextValidator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → PkceValidator Implements [IAuthorizationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.IAuthorizationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.IAuthorizationContextValidator') ### Constructors ## PkceValidator\(IOptions\, IAuthorizationValueReuseDetector\) Constructor {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.PkceValidator.PkceValidator(Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,Abblix.Oidc.Server.Features.ReusePrevention.IAuthorizationValueReuseDetector)} Validates the PKCE \(Proof Key for Code Exchange\) parameters in an authorization request\. PKCE adds another layer of security for the OAuth 2\.0 authorization code flow, particularly in public clients\. It ensures that the authorization request conforms to the standards defined in RFC 7636 \(specifically, see Section 4\.3 for client validation requirements\)\. ```csharp public PkceValidator(Microsoft.Extensions.Options.IOptions options, Abblix.Oidc.Server.Features.ReusePrevention.IAuthorizationValueReuseDetector reuseDetector); ``` #### Parameters ###### `options` [Microsoft\.Extensions\.Options\.IOptions<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptions-1 'Microsoft\.Extensions\.Options\.IOptions\`1')[OidcOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptions-1 'Microsoft\.Extensions\.Options\.IOptions\`1') {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.PkceValidator.PkceValidator(Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,Abblix.Oidc.Server.Features.ReusePrevention.IAuthorizationValueReuseDetector).options} Provides the server\-wide default security profile a client inherits when it states none, which tightens PKCE enforcement \(mandatory PKCE, S256\-only\) under a profile\. ###### `reuseDetector` [IAuthorizationValueReuseDetector](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ReusePrevention.IAuthorizationValueReuseDetector 'Abblix\.Oidc\.Server\.Features\.ReusePrevention\.IAuthorizationValueReuseDetector') {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.PkceValidator.PkceValidator(Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,Abblix.Oidc.Server.Features.ReusePrevention.IAuthorizationValueReuseDetector).reuseDetector} Detects a client repeating a code\_challenge across authorization requests when reuse detection is enabled \(RFC 9700 Section 2\.1\.1\)\. ### Methods ## PkceValidator\.ValidateAsync\(AuthorizationValidationContext\) Method {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.PkceValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext)} Validates the PKCE\-related parameters in the authorization request against the client's configuration\. This method checks for compliance with PKCE specifications as outlined in RFC 7636, with particular attention to the guidelines in Section 4\.3 of the document\. ```csharp public System.Threading.Tasks.Task ValidateAsync(Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext context); ``` #### Parameters ###### `context` [AuthorizationValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.AuthorizationValidationContext') {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.PkceValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext).context} The validation context containing client information and request details\. Implements [ValidateAsync\(AuthorizationValidationContext\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.IAuthorizationContextValidator#Abblix.Oidc.Server.Endpoints.Authorization.Validation.IAuthorizationContextValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext) 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.IAuthorizationContextValidator\.ValidateAsync\(Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.AuthorizationValidationContext\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[AuthorizationRequestValidationError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationRequestValidationError')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') An AuthorizationRequestValidationError if the validation fails due to non\-compliance with PKCE requirements, or null if the request is valid\. Refer to Section 4\.3 of RFC 7636 for more details\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.ProofKeyThumbprintValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation') ## ProofKeyThumbprintValidator Class Syntactic validator for the RFC 9449 §10 `dpop_jkt` authorization\-request parameter: surfaces malformed thumbprints at the authorize / PAR endpoint with `invalid_request` instead of letting them slip through to /token where they would surface only as `invalid_dpop_proof` on the live\-proof comparison \- fail\-fast at the binding\-time endpoint\. ```csharp public class ProofKeyThumbprintValidator : Abblix.Oidc.Server.Endpoints.Authorization.Validation.SyncAuthorizationContextValidatorBase ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [SyncAuthorizationContextValidatorBase](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.SyncAuthorizationContextValidatorBase 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.SyncAuthorizationContextValidatorBase') → ProofKeyThumbprintValidator ### Remarks Accepts exactly 43 base64url characters \(no padding\) \- the unique encoded length of an RFC 7638 SHA\-256 JWK thumbprint, the only digest algorithm DPoP uses \(RFC 9449 §6\.1\)\. Rejects any other length or non\-base64url character\. The parameter is optional; missing values pass through \(clients that do not pre\-bind don't pay the cost\)\. The actual thumbprint comparison against a presented proof happens at the token endpoint inside `DPoPTokenEndpointValidator`; this step only enforces wire\-format validity\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.RedirectUriValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation') ## RedirectUriValidator Class Validates the redirect URI specified in the authorization request\. This class checks whether the provided redirect URI matches one of the client's registered redirect URIs, as part of the authorization validation process\. It is essential for ensuring that redirections only occur to pre\-approved locations, enhancing security in the OAuth 2\.0 flow\. ```csharp public class RedirectUriValidator : Abblix.Oidc.Server.Endpoints.Authorization.Validation.SyncAuthorizationContextValidatorBase ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [SyncAuthorizationContextValidatorBase](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.SyncAuthorizationContextValidatorBase 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.SyncAuthorizationContextValidatorBase') → RedirectUriValidator ### Constructors ## RedirectUriValidator\(ILogger\\) Constructor {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.RedirectUriValidator.RedirectUriValidator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.Authorization.Validation.RedirectUriValidator_)} Validates the redirect URI specified in the authorization request\. This class checks whether the provided redirect URI matches one of the client's registered redirect URIs, as part of the authorization validation process\. It is essential for ensuring that redirections only occur to pre\-approved locations, enhancing security in the OAuth 2\.0 flow\. ```csharp public RedirectUriValidator(Microsoft.Extensions.Logging.ILogger logger); ``` #### Parameters ###### `logger` [Microsoft\.Extensions\.Logging\.ILogger<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1')[RedirectUriValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.RedirectUriValidator 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.RedirectUriValidator')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1') {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.RedirectUriValidator.RedirectUriValidator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.Authorization.Validation.RedirectUriValidator_).logger} The logger to be used for logging validation process and outcomes\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.RequestedSubjectValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation') ## RequestedSubjectValidator Class Records the end users a `claims` request will accept for `sub`, so the endpoint can honour them when it chooses a session\. ```csharp public class RequestedSubjectValidator : Abblix.Oidc.Server.Endpoints.Authorization.Validation.SyncAuthorizationContextValidatorBase ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [SyncAuthorizationContextValidatorBase](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.SyncAuthorizationContextValidatorBase 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.SyncAuthorizationContextValidatorBase') → RequestedSubjectValidator ### Remarks This is the second way of asking what `id_token_hint` asks, and OpenID Connect Core 1\.0 Section 3\.1\.2\.2 states them as one requirement: "If the `sub` \(subject\) Claim is requested with a specific value for the ID Token, the Authorization Server MUST only send a positive response if the End\-User identified by that `sub` value has an active session with the Authorization Server or has been Authenticated as a result of the request\. The Authorization Server MUST NOT reply with an ID Token or Access Token for a different user, even if they have an active session with the Authorization Server\. Such a request can be made either using an `id_token_hint` parameter or by requesting a specific Claim Value as described in Section 5\.5\.1, if the `claims` parameter is supported by the implementation\." The condition attached to that MUST is met here rather than left open: the discovery document advertises `claims_parameter_supported`, so a client is entitled to expect the parameter to decide something. What makes a request name somebody lives in [RequestedSubjects\(this RequestedClaims\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.RequestedClaimsExtensions#Abblix.Oidc.Server.Model.RequestedClaimsExtensions.RequestedSubjects(thisAbblix.Oidc.Server.Model.RequestedClaims) 'Abblix\.Oidc\.Server\.Model\.RequestedClaimsExtensions\.RequestedSubjects\(this Abblix\.Oidc\.Server\.Model\.RequestedClaims\)'), shared with the decoupled endpoint that accepts the same parameter without a browser. Runs beside [IdTokenHintValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.IdTokenHintValidator 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.IdTokenHintValidator') and after the validators that resolve the redirect URI and the response mode, for the same reason: its refusals are the kind RFC 6749 Section 4.1.2.1 says the client must be told about by redirection, and before those there is nowhere to tell it. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.ResourceValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation') ## ResourceValidator Class Validates resources specified in authorization requests to ensure they conform to registered definitions and policies\. This validator checks whether the resources requested in the authorization process are recognized by the system and permitted for the requesting client, extending the base functionality of resource validation by incorporating integration with the authorization context\. ```csharp public class ResourceValidator : Abblix.Oidc.Server.Endpoints.Authorization.Validation.SyncAuthorizationContextValidatorBase ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [SyncAuthorizationContextValidatorBase](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.SyncAuthorizationContextValidatorBase 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.SyncAuthorizationContextValidatorBase') → ResourceValidator ### Constructors ## ResourceValidator\(IResourceManager\) Constructor {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.ResourceValidator.ResourceValidator(Abblix.Oidc.Server.Features.ResourceIndicators.IResourceManager)} Validates resources specified in authorization requests to ensure they conform to registered definitions and policies\. This validator checks whether the resources requested in the authorization process are recognized by the system and permitted for the requesting client, extending the base functionality of resource validation by incorporating integration with the authorization context\. ```csharp public ResourceValidator(Abblix.Oidc.Server.Features.ResourceIndicators.IResourceManager resourceManager); ``` #### Parameters ###### `resourceManager` [IResourceManager](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ResourceIndicators.IResourceManager 'Abblix\.Oidc\.Server\.Features\.ResourceIndicators\.IResourceManager') {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.ResourceValidator.ResourceValidator(Abblix.Oidc.Server.Features.ResourceIndicators.IResourceManager).resourceManager} The manager responsible for retrieving and validating resource information\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.ResponseModeValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation') ## ResponseModeValidator Class Verifies that an explicit `response_mode` is compatible with the OAuth 2\.0 flow derived from `response_type` \(OAuth 2\.0 Multiple Response Types §2\.1, OAuth 2\.0 Form Post Response Mode\)\. For the authorization\-code flow any of `query`, `fragment`, `form_post` is allowed; flows that issue tokens at the authorization endpoint \(implicit, hybrid\) refuse `query` because credentials must not appear in the URL query string\. After that flow\-compatibility check, when the client configures an explicit [AllowedResponseModes](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.AllowedResponseModes 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo\.AllowedResponseModes') allow\-list the effective response mode must be a member of it, letting a host pin the delivery channel and close a response\-mode downgrade \(RFC 9700\)\. ```csharp public class ResponseModeValidator : Abblix.Oidc.Server.Endpoints.Authorization.Validation.SyncAuthorizationContextValidatorBase ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [SyncAuthorizationContextValidatorBase](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.SyncAuthorizationContextValidatorBase 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.SyncAuthorizationContextValidatorBase') → ResponseModeValidator ### Constructors ## ResponseModeValidator\(ILogger\\) Constructor {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.ResponseModeValidator.ResponseModeValidator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.Authorization.Validation.ResponseModeValidator_)} Verifies that an explicit `response_mode` is compatible with the OAuth 2\.0 flow derived from `response_type` \(OAuth 2\.0 Multiple Response Types §2\.1, OAuth 2\.0 Form Post Response Mode\)\. For the authorization\-code flow any of `query`, `fragment`, `form_post` is allowed; flows that issue tokens at the authorization endpoint \(implicit, hybrid\) refuse `query` because credentials must not appear in the URL query string\. After that flow\-compatibility check, when the client configures an explicit [AllowedResponseModes](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.AllowedResponseModes 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo\.AllowedResponseModes') allow\-list the effective response mode must be a member of it, letting a host pin the delivery channel and close a response\-mode downgrade \(RFC 9700\)\. ```csharp public ResponseModeValidator(Microsoft.Extensions.Logging.ILogger logger); ``` #### Parameters `logger` [Microsoft\.Extensions\.Logging\.ILogger<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1')[ResponseModeValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.ResponseModeValidator 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.ResponseModeValidator')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.ScopeValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation') ## ScopeValidator Class Validates the scopes specified in the OAuth 2\.0 authorization request\. This class checks if the requested scopes are permissible based on the client's configuration and the OAuth flow type in use\. It ensures that only allowed scopes are requested, enhancing security and compliance with the defined authorization policies\. ```csharp public class ScopeValidator : Abblix.Oidc.Server.Endpoints.Authorization.Validation.SyncAuthorizationContextValidatorBase ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [SyncAuthorizationContextValidatorBase](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.SyncAuthorizationContextValidatorBase 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.SyncAuthorizationContextValidatorBase') → ScopeValidator ### Constructors ## ScopeValidator\(IScopeManager\) Constructor {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.ScopeValidator.ScopeValidator(Abblix.Oidc.Server.Features.ScopeManagement.IScopeManager)} Validates the scopes specified in the OAuth 2\.0 authorization request\. This class checks if the requested scopes are permissible based on the client's configuration and the OAuth flow type in use\. It ensures that only allowed scopes are requested, enhancing security and compliance with the defined authorization policies\. ```csharp public ScopeValidator(Abblix.Oidc.Server.Features.ScopeManagement.IScopeManager scopeManager); ``` #### Parameters ###### `scopeManager` [IScopeManager](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ScopeManagement.IScopeManager 'Abblix\.Oidc\.Server\.Features\.ScopeManagement\.IScopeManager') {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.ScopeValidator.ScopeValidator(Abblix.Oidc.Server.Features.ScopeManagement.IScopeManager).scopeManager} The scope manager used to validate scopes\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.SignedRequestObjectRequirementValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation') ## SignedRequestObjectRequirementValidator Class Enforces the RFC 9101 §10\.5 `require_signed_request_object` client metadata: a client that committed to it must deliver its authorization parameters as a signed request object\. A request that came neither from a request object nor from a PAR\-stored request is plain parameters and is rejected\. The PAR push itself runs through the same validator pipeline, so a flagged client cannot smuggle plain parameters in via PAR either; the signature itself \(rejecting the `none` algorithm\) is enforced by the request\-object fetcher where the JWT is validated\. ```csharp public class SignedRequestObjectRequirementValidator : Abblix.Oidc.Server.Endpoints.Authorization.Validation.SyncAuthorizationContextValidatorBase ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [SyncAuthorizationContextValidatorBase](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.SyncAuthorizationContextValidatorBase 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.SyncAuthorizationContextValidatorBase') → SignedRequestObjectRequirementValidator --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.SyncAuthorizationContextValidatorBase.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation') ## SyncAuthorizationContextValidatorBase Class Provides a base for implementing synchronous authorization request validation steps\. This abstract class allows for creating validators that perform synchronous validation of authorization requests, while adhering to the [IAuthorizationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.IAuthorizationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.IAuthorizationContextValidator') interface for asynchronous operation\. ```csharp public abstract class SyncAuthorizationContextValidatorBase : Abblix.Oidc.Server.Endpoints.Authorization.Validation.IAuthorizationContextValidator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → SyncAuthorizationContextValidatorBase Derived ↳ [FlowTypeValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.FlowTypeValidator 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.FlowTypeValidator') ↳ [ProofKeyThumbprintValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.ProofKeyThumbprintValidator 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.ProofKeyThumbprintValidator') ↳ [RedirectUriValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.RedirectUriValidator 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.RedirectUriValidator') ↳ [RequestedSubjectValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.RequestedSubjectValidator 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.RequestedSubjectValidator') ↳ [ResourceValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.ResourceValidator 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.ResourceValidator') ↳ [ResponseModeValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.ResponseModeValidator 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.ResponseModeValidator') ↳ [ScopeValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.ScopeValidator 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.ScopeValidator') ↳ [SignedRequestObjectRequirementValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.SignedRequestObjectRequirementValidator 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.SignedRequestObjectRequirementValidator') Implements [IAuthorizationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.IAuthorizationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.IAuthorizationContextValidator') ### Methods ## SyncAuthorizationContextValidatorBase\.ValidateAsync\(AuthorizationValidationContext\) Method {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.SyncAuthorizationContextValidatorBase.ValidateAsync(Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext)} Synchronously validates the authorization request and wraps the result in a task\. This method implements the [ValidateAsync\(AuthorizationValidationContext\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.IAuthorizationContextValidator#Abblix.Oidc.Server.Endpoints.Authorization.Validation.IAuthorizationContextValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext) 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.IAuthorizationContextValidator\.ValidateAsync\(Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.AuthorizationValidationContext\)') method to allow synchronous validation logic within an asynchronous method signature\. ```csharp public System.Threading.Tasks.Task ValidateAsync(Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext context); ``` #### Parameters ###### `context` [AuthorizationValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.AuthorizationValidationContext') {#Abblix.Oidc.Server.Endpoints.Authorization.Validation.SyncAuthorizationContextValidatorBase.ValidateAsync(Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext).context} The validation context containing client information and request details\. Implements [ValidateAsync\(AuthorizationValidationContext\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.IAuthorizationContextValidator#Abblix.Oidc.Server.Endpoints.Authorization.Validation.IAuthorizationContextValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext) 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.IAuthorizationContextValidator\.ValidateAsync\(Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Validation\.AuthorizationValidationContext\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[AuthorizationRequestValidationError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationRequestValidationError')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task representing the result of the synchronous validation\. The task contains an [AuthorizationRequestValidationError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationRequestValidationError') if the validation fails, or null if the request is valid\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ## Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication Namespace | Classes | | | :--- | :--- | | [BackChannelAuthenticationHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.BackChannelAuthenticationHandler 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.BackChannelAuthenticationHandler') | Default [IBackChannelAuthenticationHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.IBackChannelAuthenticationHandler 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Interfaces\.IBackChannelAuthenticationHandler') implementation that drives the CIBA endpoint pipeline as fetch \(request object resolution\) \-\> validation \-\> processing, short\-circuiting on the first error so that subsequent stages never see invalid input\. | | [BackChannelAuthenticationRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.BackChannelAuthenticationRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.BackChannelAuthenticationRequestProcessor') | Handles the processing of backchannel authentication requests in an OAuth 2\.0/OpenID Connect context\. This class is responsible for managing the lifecycle of a backchannel authentication request, from initiating the user's authentication on their device to storing the request for status polling\. It ensures that the client is authorized, user\-device authentication is initiated, and the request's status is properly stored and can be queried during the authentication process\. The class coordinates various services like authentication storage, options configuration and user\-device interaction, ensuring a seamless backchannel authentication flow\. | | [BackChannelAuthenticationRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.BackChannelAuthenticationRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.BackChannelAuthenticationRequestValidator') | Validates backchannel authentication requests by delegating the context validation to a context validator\. This class is responsible for ensuring that the request meets all necessary criteria for successful authentication within the backchannel authentication flow\. | --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.BackChannelAuthenticationHandler.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication') ## BackChannelAuthenticationHandler Class Default [IBackChannelAuthenticationHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.IBackChannelAuthenticationHandler 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Interfaces\.IBackChannelAuthenticationHandler') implementation that drives the CIBA endpoint pipeline as fetch \(request object resolution\) \-\> validation \-\> processing, short\-circuiting on the first error so that subsequent stages never see invalid input\. ```csharp public class BackChannelAuthenticationHandler : Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.IBackChannelAuthenticationHandler ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → BackChannelAuthenticationHandler Implements [IBackChannelAuthenticationHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.IBackChannelAuthenticationHandler 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Interfaces\.IBackChannelAuthenticationHandler') ### Constructors ## BackChannelAuthenticationHandler\(IBackChannelAuthenticationRequestFetcher, IBackChannelAuthenticationRequestValidator, IBackChannelAuthenticationRequestProcessor\) Constructor {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.BackChannelAuthenticationHandler.BackChannelAuthenticationHandler(Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.RequestFetching.IBackChannelAuthenticationRequestFetcher,Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.IBackChannelAuthenticationRequestValidator,Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.IBackChannelAuthenticationRequestProcessor)} Default [IBackChannelAuthenticationHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.IBackChannelAuthenticationHandler 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Interfaces\.IBackChannelAuthenticationHandler') implementation that drives the CIBA endpoint pipeline as fetch \(request object resolution\) \-\> validation \-\> processing, short\-circuiting on the first error so that subsequent stages never see invalid input\. ```csharp public BackChannelAuthenticationHandler(Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.RequestFetching.IBackChannelAuthenticationRequestFetcher fetcher, Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.IBackChannelAuthenticationRequestValidator validator, Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.IBackChannelAuthenticationRequestProcessor processor); ``` #### Parameters ###### `fetcher` [IBackChannelAuthenticationRequestFetcher](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.RequestFetching.IBackChannelAuthenticationRequestFetcher 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.RequestFetching\.IBackChannelAuthenticationRequestFetcher') {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.BackChannelAuthenticationHandler.BackChannelAuthenticationHandler(Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.RequestFetching.IBackChannelAuthenticationRequestFetcher,Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.IBackChannelAuthenticationRequestValidator,Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.IBackChannelAuthenticationRequestProcessor).fetcher} Resolves the effective request, in particular substituting parameters carried in a signed Request Object per CIBA Core 1\.0 §7\.1\.1\. ###### `validator` [IBackChannelAuthenticationRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.IBackChannelAuthenticationRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Interfaces\.IBackChannelAuthenticationRequestValidator') {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.BackChannelAuthenticationHandler.BackChannelAuthenticationHandler(Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.RequestFetching.IBackChannelAuthenticationRequestFetcher,Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.IBackChannelAuthenticationRequestValidator,Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.IBackChannelAuthenticationRequestProcessor).validator} Validates the resolved request against client metadata and protocol rules\. ###### `processor` [IBackChannelAuthenticationRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.IBackChannelAuthenticationRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Interfaces\.IBackChannelAuthenticationRequestProcessor') {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.BackChannelAuthenticationHandler.BackChannelAuthenticationHandler(Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.RequestFetching.IBackChannelAuthenticationRequestFetcher,Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.IBackChannelAuthenticationRequestValidator,Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.IBackChannelAuthenticationRequestProcessor).processor} Persists the authentication request and produces the `auth_req_id`/`expires_in`/`interval` response\. ### Methods ## BackChannelAuthenticationHandler\.HandleAsync\(BackChannelAuthenticationRequest, ClientRequest\) Method {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.BackChannelAuthenticationHandler.HandleAsync(Abblix.Oidc.Server.Model.BackChannelAuthenticationRequest,Abblix.Oidc.Server.Model.ClientRequest)} Runs the fetch\-validate\-process pipeline for a CIBA request and returns the resulting success payload or an [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') from the first failing stage\. ```csharp public System.Threading.Tasks.Task> HandleAsync(Abblix.Oidc.Server.Model.BackChannelAuthenticationRequest request, Abblix.Oidc.Server.Model.ClientRequest clientRequest); ``` #### Parameters ###### `request` [BackChannelAuthenticationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.BackChannelAuthenticationRequest 'Abblix\.Oidc\.Server\.Model\.BackChannelAuthenticationRequest') {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.BackChannelAuthenticationHandler.HandleAsync(Abblix.Oidc.Server.Model.BackChannelAuthenticationRequest,Abblix.Oidc.Server.Model.ClientRequest).request} The parsed CIBA authentication request as received on the wire\. ###### `clientRequest` [ClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRequest 'Abblix\.Oidc\.Server\.Model\.ClientRequest') {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.BackChannelAuthenticationHandler.HandleAsync(Abblix.Oidc.Server.Model.BackChannelAuthenticationRequest,Abblix.Oidc.Server.Model.ClientRequest).clientRequest} Transport metadata used for client authentication and validation\. Implements [HandleAsync\(BackChannelAuthenticationRequest, ClientRequest\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.IBackChannelAuthenticationHandler#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.IBackChannelAuthenticationHandler.HandleAsync(Abblix.Oidc.Server.Model.BackChannelAuthenticationRequest,Abblix.Oidc.Server.Model.ClientRequest) 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Interfaces\.IBackChannelAuthenticationHandler\.HandleAsync\(Abblix\.Oidc\.Server\.Model\.BackChannelAuthenticationRequest, Abblix\.Oidc\.Server\.Model\.ClientRequest\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[BackChannelAuthenticationSuccess](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.BackChannelAuthenticationSuccess 'Abblix\.Oidc\.Server\.Model\.BackChannelAuthenticationSuccess')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.BackChannelAuthenticationRequestProcessor.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication') ## BackChannelAuthenticationRequestProcessor Class Handles the processing of backchannel authentication requests in an OAuth 2\.0/OpenID Connect context\. This class is responsible for managing the lifecycle of a backchannel authentication request, from initiating the user's authentication on their device to storing the request for status polling\. It ensures that the client is authorized, user\-device authentication is initiated, and the request's status is properly stored and can be queried during the authentication process\. The class coordinates various services like authentication storage, options configuration and user\-device interaction, ensuring a seamless backchannel authentication flow\. ```csharp public class BackChannelAuthenticationRequestProcessor : Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.IBackChannelAuthenticationRequestProcessor ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → BackChannelAuthenticationRequestProcessor Implements [IBackChannelAuthenticationRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.IBackChannelAuthenticationRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Interfaces\.IBackChannelAuthenticationRequestProcessor') ### Constructors ## BackChannelAuthenticationRequestProcessor\(IBackChannelRequestStorage, IOptionsSnapshot\, IUserDeviceAuthenticationHandler, TimeProvider, ISubjectTypeConverter\) Constructor {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.BackChannelAuthenticationRequestProcessor.BackChannelAuthenticationRequestProcessor(Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage,Microsoft.Extensions.Options.IOptionsSnapshot_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IUserDeviceAuthenticationHandler,System.TimeProvider,Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter)} Handles the processing of backchannel authentication requests in an OAuth 2\.0/OpenID Connect context\. This class is responsible for managing the lifecycle of a backchannel authentication request, from initiating the user's authentication on their device to storing the request for status polling\. It ensures that the client is authorized, user\-device authentication is initiated, and the request's status is properly stored and can be queried during the authentication process\. The class coordinates various services like authentication storage, options configuration and user\-device interaction, ensuring a seamless backchannel authentication flow\. ```csharp public BackChannelAuthenticationRequestProcessor(Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage storage, Microsoft.Extensions.Options.IOptionsSnapshot options, Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IUserDeviceAuthenticationHandler userDeviceAuthenticationHandler, System.TimeProvider timeProvider, Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter subjectTypeConverter); ``` #### Parameters ###### `storage` [IBackChannelRequestStorage](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces\.IBackChannelRequestStorage') {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.BackChannelAuthenticationRequestProcessor.BackChannelAuthenticationRequestProcessor(Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage,Microsoft.Extensions.Options.IOptionsSnapshot_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IUserDeviceAuthenticationHandler,System.TimeProvider,Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter).storage} Service for storing and retrieving backchannel authentication requests\. ###### `options` [Microsoft\.Extensions\.Options\.IOptionsSnapshot<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptionssnapshot-1 'Microsoft\.Extensions\.Options\.IOptionsSnapshot\`1')[OidcOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptionssnapshot-1 'Microsoft\.Extensions\.Options\.IOptionsSnapshot\`1') {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.BackChannelAuthenticationRequestProcessor.BackChannelAuthenticationRequestProcessor(Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage,Microsoft.Extensions.Options.IOptionsSnapshot_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IUserDeviceAuthenticationHandler,System.TimeProvider,Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter).options} Configuration options related to backchannel authentication\. ###### `userDeviceAuthenticationHandler` [IUserDeviceAuthenticationHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IUserDeviceAuthenticationHandler 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces\.IUserDeviceAuthenticationHandler') {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.BackChannelAuthenticationRequestProcessor.BackChannelAuthenticationRequestProcessor(Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage,Microsoft.Extensions.Options.IOptionsSnapshot_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IUserDeviceAuthenticationHandler,System.TimeProvider,Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter).userDeviceAuthenticationHandler} Handler for initiating authentication on the user's device\. ###### `timeProvider` [System\.TimeProvider](https://learn.microsoft.com/en-us/dotnet/api/system.timeprovider 'System\.TimeProvider') {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.BackChannelAuthenticationRequestProcessor.BackChannelAuthenticationRequestProcessor(Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage,Microsoft.Extensions.Options.IOptionsSnapshot_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IUserDeviceAuthenticationHandler,System.TimeProvider,Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter).timeProvider} Time provider for managing authentication request expiration\. ###### `subjectTypeConverter` [ISubjectTypeConverter](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter 'Abblix\.Oidc\.Server\.Features\.PairwiseIdentifiers\.ISubjectTypeConverter') {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.BackChannelAuthenticationRequestProcessor.BackChannelAuthenticationRequestProcessor(Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage,Microsoft.Extensions.Options.IOptionsSnapshot_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IUserDeviceAuthenticationHandler,System.TimeProvider,Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter).subjectTypeConverter} Seals a session's subject the way the requesting client sees it, so the session the host authenticated can be compared against the end user an `id_token_hint` named\. ### Methods ## BackChannelAuthenticationRequestProcessor\.ProcessAsync\(ValidBackChannelAuthenticationRequest\) Method {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.BackChannelAuthenticationRequestProcessor.ProcessAsync(Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.ValidBackChannelAuthenticationRequest)} Asynchronously processes a validated backchannel authentication request and generates an appropriate response\. This method handles the business logic required to respond to a backchannel authentication request, including generating tokens, managing session state, and any other necessary operations\. ```csharp public System.Threading.Tasks.Task> ProcessAsync(Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.ValidBackChannelAuthenticationRequest request); ``` #### Parameters ###### `request` [ValidBackChannelAuthenticationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.ValidBackChannelAuthenticationRequest 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Interfaces\.ValidBackChannelAuthenticationRequest') {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.BackChannelAuthenticationRequestProcessor.ProcessAsync(Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.ValidBackChannelAuthenticationRequest).request} The validated backchannel authentication request containing the original request data and associated client information\. Implements [ProcessAsync\(ValidBackChannelAuthenticationRequest\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.IBackChannelAuthenticationRequestProcessor#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.IBackChannelAuthenticationRequestProcessor.ProcessAsync(Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.ValidBackChannelAuthenticationRequest) 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Interfaces\.IBackChannelAuthenticationRequestProcessor\.ProcessAsync\(Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Interfaces\.ValidBackChannelAuthenticationRequest\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[BackChannelAuthenticationSuccess](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.BackChannelAuthenticationSuccess 'Abblix\.Oidc\.Server\.Model\.BackChannelAuthenticationSuccess')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task that returns a [Result<TSuccess,TFailure>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2') that contains the result of the processing, such as an authentication request ID and the expires\_in value\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.BackChannelAuthenticationRequestValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication') ## BackChannelAuthenticationRequestValidator Class Validates backchannel authentication requests by delegating the context validation to a context validator\. This class is responsible for ensuring that the request meets all necessary criteria for successful authentication within the backchannel authentication flow\. ```csharp public class BackChannelAuthenticationRequestValidator : Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.IBackChannelAuthenticationRequestValidator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → BackChannelAuthenticationRequestValidator Implements [IBackChannelAuthenticationRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.IBackChannelAuthenticationRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Interfaces\.IBackChannelAuthenticationRequestValidator') ### Constructors ## BackChannelAuthenticationRequestValidator\(IBackChannelAuthenticationContextValidator\) Constructor {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.BackChannelAuthenticationRequestValidator.BackChannelAuthenticationRequestValidator(Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.IBackChannelAuthenticationContextValidator)} Validates backchannel authentication requests by delegating the context validation to a context validator\. This class is responsible for ensuring that the request meets all necessary criteria for successful authentication within the backchannel authentication flow\. ```csharp public BackChannelAuthenticationRequestValidator(Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.IBackChannelAuthenticationContextValidator contextValidator); ``` #### Parameters ###### `contextValidator` [IBackChannelAuthenticationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.IBackChannelAuthenticationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation\.IBackChannelAuthenticationContextValidator') {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.BackChannelAuthenticationRequestValidator.BackChannelAuthenticationRequestValidator(Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.IBackChannelAuthenticationContextValidator).contextValidator} The context validator responsible for performing detailed validation of the request\. ### Methods ## BackChannelAuthenticationRequestValidator\.ValidateAsync\(BackChannelAuthenticationRequest, ClientRequest\) Method {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.BackChannelAuthenticationRequestValidator.ValidateAsync(Abblix.Oidc.Server.Model.BackChannelAuthenticationRequest,Abblix.Oidc.Server.Model.ClientRequest)} Validates the specified backchannel authentication request\. This method creates a validation context from the request and client information, then uses the context validator to perform the validation\. If validation succeeds, a [ValidBackChannelAuthenticationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.ValidBackChannelAuthenticationRequest 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Interfaces\.ValidBackChannelAuthenticationRequest') is returned; otherwise, the corresponding validation error is returned\. ```csharp public System.Threading.Tasks.Task> ValidateAsync(Abblix.Oidc.Server.Model.BackChannelAuthenticationRequest request, Abblix.Oidc.Server.Model.ClientRequest clientRequest); ``` #### Parameters ###### `request` [BackChannelAuthenticationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.BackChannelAuthenticationRequest 'Abblix\.Oidc\.Server\.Model\.BackChannelAuthenticationRequest') {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.BackChannelAuthenticationRequestValidator.ValidateAsync(Abblix.Oidc.Server.Model.BackChannelAuthenticationRequest,Abblix.Oidc.Server.Model.ClientRequest).request} The backchannel authentication request to be validated\. ###### `clientRequest` [ClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRequest 'Abblix\.Oidc\.Server\.Model\.ClientRequest') {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.BackChannelAuthenticationRequestValidator.ValidateAsync(Abblix.Oidc.Server.Model.BackChannelAuthenticationRequest,Abblix.Oidc.Server.Model.ClientRequest).clientRequest} The client request associated with the backchannel authentication request\. Implements [ValidateAsync\(BackChannelAuthenticationRequest, ClientRequest\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.IBackChannelAuthenticationRequestValidator#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.IBackChannelAuthenticationRequestValidator.ValidateAsync(Abblix.Oidc.Server.Model.BackChannelAuthenticationRequest,Abblix.Oidc.Server.Model.ClientRequest) 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Interfaces\.IBackChannelAuthenticationRequestValidator\.ValidateAsync\(Abblix\.Oidc\.Server\.Model\.BackChannelAuthenticationRequest, Abblix\.Oidc\.Server\.Model\.ClientRequest\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[ValidBackChannelAuthenticationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.ValidBackChannelAuthenticationRequest 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Interfaces\.ValidBackChannelAuthenticationRequest')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task that returns a [Result<TSuccess,TFailure>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2'), which can be either a valid request or an error, depending on the outcome of the validation\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ## Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Interfaces Namespace | Classes | | | :--- | :--- | | [ValidBackChannelAuthenticationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.ValidBackChannelAuthenticationRequest 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Interfaces\.ValidBackChannelAuthenticationRequest') | Represents a validated backchannel authentication request, encapsulating the original request model and the associated client information\. | | Interfaces | | | :--- | :--- | | [IBackChannelAuthenticationHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.IBackChannelAuthenticationHandler 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Interfaces\.IBackChannelAuthenticationHandler') | Endpoint contract for the OpenID Connect CIBA \(Client\-Initiated Backchannel Authentication\) flow, orchestrating fetch, validation and processing of an incoming backchannel authentication request to produce the response defined in CIBA Core 1\.0 §7\. | | [IBackChannelAuthenticationRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.IBackChannelAuthenticationRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Interfaces\.IBackChannelAuthenticationRequestProcessor') | Defines the contract for processing validated backchannel authentication requests, transforming them into a response that includes necessary information for the client to complete the authentication flow\. | | [IBackChannelAuthenticationRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.IBackChannelAuthenticationRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Interfaces\.IBackChannelAuthenticationRequestValidator') | Defines the contract for validating client\-initiated backchannel authentication requests, ensuring that the requests conform to the necessary security and protocol standards\. | --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.IBackChannelAuthenticationHandler.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Interfaces') ## IBackChannelAuthenticationHandler Interface Endpoint contract for the OpenID Connect CIBA \(Client\-Initiated Backchannel Authentication\) flow, orchestrating fetch, validation and processing of an incoming backchannel authentication request to produce the response defined in CIBA Core 1\.0 §7\. ```csharp public interface IBackChannelAuthenticationHandler ``` Derived ↳ [BackChannelAuthenticationHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.BackChannelAuthenticationHandler 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.BackChannelAuthenticationHandler') ### Methods ## IBackChannelAuthenticationHandler\.HandleAsync\(BackChannelAuthenticationRequest, ClientRequest\) Method {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.IBackChannelAuthenticationHandler.HandleAsync(Abblix.Oidc.Server.Model.BackChannelAuthenticationRequest,Abblix.Oidc.Server.Model.ClientRequest)} Processes a backchannel authentication request and returns either a successful response \(containing `auth_req_id`, `expires_in` and the polling `interval`\) or an [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') describing why the request was rejected\. ```csharp System.Threading.Tasks.Task> HandleAsync(Abblix.Oidc.Server.Model.BackChannelAuthenticationRequest request, Abblix.Oidc.Server.Model.ClientRequest clientRequest); ``` #### Parameters ###### `request` [BackChannelAuthenticationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.BackChannelAuthenticationRequest 'Abblix\.Oidc\.Server\.Model\.BackChannelAuthenticationRequest') {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.IBackChannelAuthenticationHandler.HandleAsync(Abblix.Oidc.Server.Model.BackChannelAuthenticationRequest,Abblix.Oidc.Server.Model.ClientRequest).request} The incoming CIBA authentication request, after parsing of standard parameters\. ###### `clientRequest` [ClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRequest 'Abblix\.Oidc\.Server\.Model\.ClientRequest') {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.IBackChannelAuthenticationHandler.HandleAsync(Abblix.Oidc.Server.Model.BackChannelAuthenticationRequest,Abblix.Oidc.Server.Model.ClientRequest).clientRequest} Transport\-level information about the client invocation \(e\.g\. authentication credentials, headers\) used to identify and authorize the calling client\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[BackChannelAuthenticationSuccess](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.BackChannelAuthenticationSuccess 'Abblix\.Oidc\.Server\.Model\.BackChannelAuthenticationSuccess')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A [Result<TSuccess,TFailure>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2') wrapping a [BackChannelAuthenticationSuccess](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.BackChannelAuthenticationSuccess 'Abblix\.Oidc\.Server\.Model\.BackChannelAuthenticationSuccess') or an [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.IBackChannelAuthenticationRequestProcessor.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Interfaces') ## IBackChannelAuthenticationRequestProcessor Interface Defines the contract for processing validated backchannel authentication requests, transforming them into a response that includes necessary information for the client to complete the authentication flow\. ```csharp public interface IBackChannelAuthenticationRequestProcessor ``` Derived ↳ [BackChannelAuthenticationRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.BackChannelAuthenticationRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.BackChannelAuthenticationRequestProcessor') ### Methods ## IBackChannelAuthenticationRequestProcessor\.ProcessAsync\(ValidBackChannelAuthenticationRequest\) Method {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.IBackChannelAuthenticationRequestProcessor.ProcessAsync(Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.ValidBackChannelAuthenticationRequest)} Asynchronously processes a validated backchannel authentication request and generates an appropriate response\. This method handles the business logic required to respond to a backchannel authentication request, including generating tokens, managing session state, and any other necessary operations\. ```csharp System.Threading.Tasks.Task> ProcessAsync(Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.ValidBackChannelAuthenticationRequest request); ``` #### Parameters ###### `request` [ValidBackChannelAuthenticationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.ValidBackChannelAuthenticationRequest 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Interfaces\.ValidBackChannelAuthenticationRequest') {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.IBackChannelAuthenticationRequestProcessor.ProcessAsync(Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.ValidBackChannelAuthenticationRequest).request} The validated backchannel authentication request containing the original request data and associated client information\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[BackChannelAuthenticationSuccess](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.BackChannelAuthenticationSuccess 'Abblix\.Oidc\.Server\.Model\.BackChannelAuthenticationSuccess')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task that returns a [Result<TSuccess,TFailure>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2') that contains the result of the processing, such as an authentication request ID and the expires\_in value\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.IBackChannelAuthenticationRequestValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Interfaces') ## IBackChannelAuthenticationRequestValidator Interface Defines the contract for validating client\-initiated backchannel authentication requests, ensuring that the requests conform to the necessary security and protocol standards\. ```csharp public interface IBackChannelAuthenticationRequestValidator ``` Derived ↳ [BackChannelAuthenticationRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.BackChannelAuthenticationRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.BackChannelAuthenticationRequestValidator') ### Methods ## IBackChannelAuthenticationRequestValidator\.ValidateAsync\(BackChannelAuthenticationRequest, ClientRequest\) Method {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.IBackChannelAuthenticationRequestValidator.ValidateAsync(Abblix.Oidc.Server.Model.BackChannelAuthenticationRequest,Abblix.Oidc.Server.Model.ClientRequest)} Asynchronously validates a backchannel authentication request, checking its conformity with the required standards and client information\. ```csharp System.Threading.Tasks.Task> ValidateAsync(Abblix.Oidc.Server.Model.BackChannelAuthenticationRequest request, Abblix.Oidc.Server.Model.ClientRequest clientRequest); ``` #### Parameters ###### `request` [BackChannelAuthenticationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.BackChannelAuthenticationRequest 'Abblix\.Oidc\.Server\.Model\.BackChannelAuthenticationRequest') {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.IBackChannelAuthenticationRequestValidator.ValidateAsync(Abblix.Oidc.Server.Model.BackChannelAuthenticationRequest,Abblix.Oidc.Server.Model.ClientRequest).request} The backchannel authentication request to validate\. ###### `clientRequest` [ClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRequest 'Abblix\.Oidc\.Server\.Model\.ClientRequest') {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.IBackChannelAuthenticationRequestValidator.ValidateAsync(Abblix.Oidc.Server.Model.BackChannelAuthenticationRequest,Abblix.Oidc.Server.Model.ClientRequest).clientRequest} The client request containing additional client\-related data for validation\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[ValidBackChannelAuthenticationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.ValidBackChannelAuthenticationRequest 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Interfaces\.ValidBackChannelAuthenticationRequest')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task that returns the result of the validation process as a [Result<TSuccess,TFailure>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.ValidBackChannelAuthenticationRequest.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Interfaces') ## ValidBackChannelAuthenticationRequest Class Represents a validated backchannel authentication request, encapsulating the original request model and the associated client information\. ```csharp public record ValidBackChannelAuthenticationRequest : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ValidBackChannelAuthenticationRequest Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[ValidBackChannelAuthenticationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.ValidBackChannelAuthenticationRequest 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Interfaces\.ValidBackChannelAuthenticationRequest')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Constructors ## ValidBackChannelAuthenticationRequest\(BackChannelAuthenticationValidationContext\) Constructor {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.ValidBackChannelAuthenticationRequest.ValidBackChannelAuthenticationRequest(Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext)} Initializes a new instance of the [ValidBackChannelAuthenticationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.ValidBackChannelAuthenticationRequest 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Interfaces\.ValidBackChannelAuthenticationRequest') class using the specified validation context\. ```csharp public ValidBackChannelAuthenticationRequest(Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext context); ``` #### Parameters ###### `context` [BackChannelAuthenticationValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation\.BackChannelAuthenticationValidationContext') {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.ValidBackChannelAuthenticationRequest.ValidBackChannelAuthenticationRequest(Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext).context} The validation context containing the original request and client information\. ## ValidBackChannelAuthenticationRequest\(BackChannelAuthenticationRequest, ClientInfo, TimeSpan, JsonWebToken, JsonWebToken, ScopeDefinition\[\], ResourceDefinition\[\], JsonArray\) Constructor {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.ValidBackChannelAuthenticationRequest.ValidBackChannelAuthenticationRequest(Abblix.Oidc.Server.Model.BackChannelAuthenticationRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.TimeSpan,Abblix.Jwt.JsonWebToken,Abblix.Jwt.JsonWebToken,Abblix.Oidc.Server.Common.Constants.ScopeDefinition[],Abblix.Oidc.Server.Common.Constants.ResourceDefinition[],System.Text.Json.Nodes.JsonArray)} Represents a validated backchannel authentication request, encapsulating the original request model and the associated client information\. ```csharp public ValidBackChannelAuthenticationRequest(Abblix.Oidc.Server.Model.BackChannelAuthenticationRequest Model, Abblix.Oidc.Server.Features.ClientInformation.ClientInfo ClientInfo, System.TimeSpan ExpiresIn, Abblix.Jwt.JsonWebToken? LoginHintToken, Abblix.Jwt.JsonWebToken? IdToken, Abblix.Oidc.Server.Common.Constants.ScopeDefinition[] Scope, Abblix.Oidc.Server.Common.Constants.ResourceDefinition[] Resources, System.Text.Json.Nodes.JsonArray? AuthorizationDetails); ``` #### Parameters ###### `Model` [BackChannelAuthenticationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.BackChannelAuthenticationRequest 'Abblix\.Oidc\.Server\.Model\.BackChannelAuthenticationRequest') {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.ValidBackChannelAuthenticationRequest.ValidBackChannelAuthenticationRequest(Abblix.Oidc.Server.Model.BackChannelAuthenticationRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.TimeSpan,Abblix.Jwt.JsonWebToken,Abblix.Jwt.JsonWebToken,Abblix.Oidc.Server.Common.Constants.ScopeDefinition[],Abblix.Oidc.Server.Common.Constants.ResourceDefinition[],System.Text.Json.Nodes.JsonArray).Model} The original backchannel authentication request that passed validation\. ###### `ClientInfo` [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.ValidBackChannelAuthenticationRequest.ValidBackChannelAuthenticationRequest(Abblix.Oidc.Server.Model.BackChannelAuthenticationRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.TimeSpan,Abblix.Jwt.JsonWebToken,Abblix.Jwt.JsonWebToken,Abblix.Oidc.Server.Common.Constants.ScopeDefinition[],Abblix.Oidc.Server.Common.Constants.ResourceDefinition[],System.Text.Json.Nodes.JsonArray).ClientInfo} The information about the client associated with the request, including credentials and other metadata\. ###### `ExpiresIn` [System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan') {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.ValidBackChannelAuthenticationRequest.ValidBackChannelAuthenticationRequest(Abblix.Oidc.Server.Model.BackChannelAuthenticationRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.TimeSpan,Abblix.Jwt.JsonWebToken,Abblix.Jwt.JsonWebToken,Abblix.Oidc.Server.Common.Constants.ScopeDefinition[],Abblix.Oidc.Server.Common.Constants.ResourceDefinition[],System.Text.Json.Nodes.JsonArray).ExpiresIn} The expiry duration for the backchannel authentication request, defining how long the request remains valid\. ###### `LoginHintToken` [JsonWebToken](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebToken 'Abblix\.Jwt\.JsonWebToken') {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.ValidBackChannelAuthenticationRequest.ValidBackChannelAuthenticationRequest(Abblix.Oidc.Server.Model.BackChannelAuthenticationRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.TimeSpan,Abblix.Jwt.JsonWebToken,Abblix.Jwt.JsonWebToken,Abblix.Oidc.Server.Common.Constants.ScopeDefinition[],Abblix.Oidc.Server.Common.Constants.ResourceDefinition[],System.Text.Json.Nodes.JsonArray).LoginHintToken} The login hint token, if provided, which can be used to identify the user in the request\. ###### `IdToken` [JsonWebToken](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebToken 'Abblix\.Jwt\.JsonWebToken') {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.ValidBackChannelAuthenticationRequest.ValidBackChannelAuthenticationRequest(Abblix.Oidc.Server.Model.BackChannelAuthenticationRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.TimeSpan,Abblix.Jwt.JsonWebToken,Abblix.Jwt.JsonWebToken,Abblix.Oidc.Server.Common.Constants.ScopeDefinition[],Abblix.Oidc.Server.Common.Constants.ResourceDefinition[],System.Text.Json.Nodes.JsonArray).IdToken} The ID token, if provided, used to validate the user's identity in the request\. ###### `Scope` [ScopeDefinition](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ScopeDefinition 'Abblix\.Oidc\.Server\.Common\.Constants\.ScopeDefinition')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.ValidBackChannelAuthenticationRequest.ValidBackChannelAuthenticationRequest(Abblix.Oidc.Server.Model.BackChannelAuthenticationRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.TimeSpan,Abblix.Jwt.JsonWebToken,Abblix.Jwt.JsonWebToken,Abblix.Oidc.Server.Common.Constants.ScopeDefinition[],Abblix.Oidc.Server.Common.Constants.ResourceDefinition[],System.Text.Json.Nodes.JsonArray).Scope} The set of scope definitions applicable to the request, indicating the permissions requested by the client\. ###### `Resources` [ResourceDefinition](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ResourceDefinition 'Abblix\.Oidc\.Server\.Common\.Constants\.ResourceDefinition')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.ValidBackChannelAuthenticationRequest.ValidBackChannelAuthenticationRequest(Abblix.Oidc.Server.Model.BackChannelAuthenticationRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.TimeSpan,Abblix.Jwt.JsonWebToken,Abblix.Jwt.JsonWebToken,Abblix.Oidc.Server.Common.Constants.ScopeDefinition[],Abblix.Oidc.Server.Common.Constants.ResourceDefinition[],System.Text.Json.Nodes.JsonArray).Resources} The set of resources requested as part of the authorization process, specifying the accessible resources for the client\. ###### `AuthorizationDetails` [System\.Text\.Json\.Nodes\.JsonArray](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonarray 'System\.Text\.Json\.Nodes\.JsonArray') {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.ValidBackChannelAuthenticationRequest.ValidBackChannelAuthenticationRequest(Abblix.Oidc.Server.Model.BackChannelAuthenticationRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.TimeSpan,Abblix.Jwt.JsonWebToken,Abblix.Jwt.JsonWebToken,Abblix.Oidc.Server.Common.Constants.ScopeDefinition[],Abblix.Oidc.Server.Common.Constants.ResourceDefinition[],System.Text.Json.Nodes.JsonArray).AuthorizationDetails} RFC 9396 §3 Rich Authorization Requests array \(already passed the per\-client allowlist and per\-type validator dispatch\) which the downstream processor threads onto the issued grant's AuthorizationContext byte\-exact\. ### Properties ## ValidBackChannelAuthenticationRequest\.AuthorizationDetails Property {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.ValidBackChannelAuthenticationRequest.AuthorizationDetails} RFC 9396 §3 Rich Authorization Requests array \(already passed the per\-client allowlist and per\-type validator dispatch\) which the downstream processor threads onto the issued grant's AuthorizationContext byte\-exact\. ```csharp public System.Text.Json.Nodes.JsonArray? AuthorizationDetails { get; init; } ``` #### Property Value [System\.Text\.Json\.Nodes\.JsonArray](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonarray 'System\.Text\.Json\.Nodes\.JsonArray') ## ValidBackChannelAuthenticationRequest\.ClientInfo Property {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.ValidBackChannelAuthenticationRequest.ClientInfo} The information about the client associated with the request, including credentials and other metadata\. ```csharp public Abblix.Oidc.Server.Features.ClientInformation.ClientInfo ClientInfo { get; init; } ``` #### Property Value [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') ## ValidBackChannelAuthenticationRequest\.ExpiresIn Property {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.ValidBackChannelAuthenticationRequest.ExpiresIn} The expiry duration for the backchannel authentication request, defining how long the request remains valid\. ```csharp public System.TimeSpan ExpiresIn { get; init; } ``` #### Property Value [System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan') ## ValidBackChannelAuthenticationRequest\.IdToken Property {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.ValidBackChannelAuthenticationRequest.IdToken} The ID token, if provided, used to validate the user's identity in the request\. ```csharp public Abblix.Jwt.JsonWebToken? IdToken { get; init; } ``` #### Property Value [JsonWebToken](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebToken 'Abblix\.Jwt\.JsonWebToken') ## ValidBackChannelAuthenticationRequest\.LoginHintToken Property {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.ValidBackChannelAuthenticationRequest.LoginHintToken} The login hint token, if provided, which can be used to identify the user in the request\. ```csharp public Abblix.Jwt.JsonWebToken? LoginHintToken { get; init; } ``` #### Property Value [JsonWebToken](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebToken 'Abblix\.Jwt\.JsonWebToken') ## ValidBackChannelAuthenticationRequest\.Model Property {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.ValidBackChannelAuthenticationRequest.Model} The original backchannel authentication request that passed validation\. ```csharp public Abblix.Oidc.Server.Model.BackChannelAuthenticationRequest Model { get; init; } ``` #### Property Value [BackChannelAuthenticationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.BackChannelAuthenticationRequest 'Abblix\.Oidc\.Server\.Model\.BackChannelAuthenticationRequest') ## ValidBackChannelAuthenticationRequest\.Resources Property {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.ValidBackChannelAuthenticationRequest.Resources} The set of resources requested as part of the authorization process, specifying the accessible resources for the client\. ```csharp public Abblix.Oidc.Server.Common.Constants.ResourceDefinition[] Resources { get; init; } ``` #### Property Value [ResourceDefinition](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ResourceDefinition 'Abblix\.Oidc\.Server\.Common\.Constants\.ResourceDefinition')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') ## ValidBackChannelAuthenticationRequest\.Scope Property {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.ValidBackChannelAuthenticationRequest.Scope} The set of scope definitions applicable to the request, indicating the permissions requested by the client\. ```csharp public Abblix.Oidc.Server.Common.Constants.ScopeDefinition[] Scope { get; init; } ``` #### Property Value [ScopeDefinition](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ScopeDefinition 'Abblix\.Oidc\.Server\.Common\.Constants\.ScopeDefinition')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.RequestFetching.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ## Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.RequestFetching Namespace | Classes | | | :--- | :--- | | [CompositeRequestFetcher](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.RequestFetching.CompositeRequestFetcher 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.RequestFetching\.CompositeRequestFetcher') | Chains multiple [IBackChannelAuthenticationRequestFetcher](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.RequestFetching.IBackChannelAuthenticationRequestFetcher 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.RequestFetching\.IBackChannelAuthenticationRequestFetcher') instances, feeding each one's output into the next so that distinct sources or formats \(for example, the signed Request Object\) can progressively enrich the request\. Returns the first failure without invoking the remaining fetchers\. | | [RequestObjectFetchAdapter](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.RequestFetching.RequestObjectFetchAdapter 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.RequestFetching\.RequestObjectFetchAdapter') | Adapts the generic [IRequestObjectFetcher](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RequestObject.IRequestObjectFetcher 'Abblix\.Oidc\.Server\.Features\.RequestObject\.IRequestObjectFetcher') \(signed\-JWT Request Object handling\) to the CIBA\-specific [IBackChannelAuthenticationRequestFetcher](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.RequestFetching.IBackChannelAuthenticationRequestFetcher 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.RequestFetching\.IBackChannelAuthenticationRequestFetcher') contract, passing the request's `request` parameter through unchanged for JWT validation and parameter merging\. | | Interfaces | | | :--- | :--- | | [IBackChannelAuthenticationRequestFetcher](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.RequestFetching.IBackChannelAuthenticationRequestFetcher 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.RequestFetching\.IBackChannelAuthenticationRequestFetcher') | Resolves a CIBA request by enriching the raw incoming model with parameters obtained from out\-of\-band sources, most notably a signed JWT Request Object\. The validation pipeline runs against the resolved request, not the raw one\. | --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.RequestFetching.CompositeRequestFetcher.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.RequestFetching](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.RequestFetching 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.RequestFetching') ## CompositeRequestFetcher Class Chains multiple [IBackChannelAuthenticationRequestFetcher](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.RequestFetching.IBackChannelAuthenticationRequestFetcher 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.RequestFetching\.IBackChannelAuthenticationRequestFetcher') instances, feeding each one's output into the next so that distinct sources or formats \(for example, the signed Request Object\) can progressively enrich the request\. Returns the first failure without invoking the remaining fetchers\. ```csharp public class CompositeRequestFetcher : Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.RequestFetching.IBackChannelAuthenticationRequestFetcher ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → CompositeRequestFetcher Implements [IBackChannelAuthenticationRequestFetcher](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.RequestFetching.IBackChannelAuthenticationRequestFetcher 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.RequestFetching\.IBackChannelAuthenticationRequestFetcher') ### Constructors ## CompositeRequestFetcher\(IBackChannelAuthenticationRequestFetcher\[\]\) Constructor {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.RequestFetching.CompositeRequestFetcher.CompositeRequestFetcher(Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.RequestFetching.IBackChannelAuthenticationRequestFetcher[])} Chains multiple [IBackChannelAuthenticationRequestFetcher](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.RequestFetching.IBackChannelAuthenticationRequestFetcher 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.RequestFetching\.IBackChannelAuthenticationRequestFetcher') instances, feeding each one's output into the next so that distinct sources or formats \(for example, the signed Request Object\) can progressively enrich the request\. Returns the first failure without invoking the remaining fetchers\. ```csharp public CompositeRequestFetcher(Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.RequestFetching.IBackChannelAuthenticationRequestFetcher[] fetchers); ``` #### Parameters ###### `fetchers` [IBackChannelAuthenticationRequestFetcher](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.RequestFetching.IBackChannelAuthenticationRequestFetcher 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.RequestFetching\.IBackChannelAuthenticationRequestFetcher')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.RequestFetching.CompositeRequestFetcher.CompositeRequestFetcher(Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.RequestFetching.IBackChannelAuthenticationRequestFetcher[]).fetchers} ### Methods ## CompositeRequestFetcher\.FetchAsync\(BackChannelAuthenticationRequest\) Method {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.RequestFetching.CompositeRequestFetcher.FetchAsync(Abblix.Oidc.Server.Model.BackChannelAuthenticationRequest)} Iterates through the configured fetchers to process the backchannel authentication request\. Each fetcher in the array has the opportunity to handle the request\. If a fetcher returns a fault, the process stops and the fault is returned\. If all fetchers succeed, the method returns the final successful result\. ```csharp public System.Threading.Tasks.Task> FetchAsync(Abblix.Oidc.Server.Model.BackChannelAuthenticationRequest request); ``` #### Parameters ###### `request` [BackChannelAuthenticationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.BackChannelAuthenticationRequest 'Abblix\.Oidc\.Server\.Model\.BackChannelAuthenticationRequest') {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.RequestFetching.CompositeRequestFetcher.FetchAsync(Abblix.Oidc.Server.Model.BackChannelAuthenticationRequest).request} The backchannel authentication request to be processed\. Implements [FetchAsync\(BackChannelAuthenticationRequest\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.RequestFetching.IBackChannelAuthenticationRequestFetcher#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.RequestFetching.IBackChannelAuthenticationRequestFetcher.FetchAsync(Abblix.Oidc.Server.Model.BackChannelAuthenticationRequest) 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.RequestFetching\.IBackChannelAuthenticationRequestFetcher\.FetchAsync\(Abblix\.Oidc\.Server\.Model\.BackChannelAuthenticationRequest\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[BackChannelAuthenticationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.BackChannelAuthenticationRequest 'Abblix\.Oidc\.Server\.Model\.BackChannelAuthenticationRequest')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A [Result<TSuccess,TFailure>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2') that represents the outcome of the fetching process\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.RequestFetching.IBackChannelAuthenticationRequestFetcher.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.RequestFetching](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.RequestFetching 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.RequestFetching') ## IBackChannelAuthenticationRequestFetcher Interface Resolves a CIBA request by enriching the raw incoming model with parameters obtained from out\-of\-band sources, most notably a signed JWT Request Object\. The validation pipeline runs against the resolved request, not the raw one\. ```csharp public interface IBackChannelAuthenticationRequestFetcher ``` Derived ↳ [CompositeRequestFetcher](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.RequestFetching.CompositeRequestFetcher 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.RequestFetching\.CompositeRequestFetcher') ↳ [RequestObjectFetchAdapter](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.RequestFetching.RequestObjectFetchAdapter 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.RequestFetching\.RequestObjectFetchAdapter') ### Methods ## IBackChannelAuthenticationRequestFetcher\.FetchAsync\(BackChannelAuthenticationRequest\) Method {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.RequestFetching.IBackChannelAuthenticationRequestFetcher.FetchAsync(Abblix.Oidc.Server.Model.BackChannelAuthenticationRequest)} Resolves the effective [BackChannelAuthenticationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.BackChannelAuthenticationRequest 'Abblix\.Oidc\.Server\.Model\.BackChannelAuthenticationRequest'), merging in parameters from any external source the implementation knows how to read\. ```csharp System.Threading.Tasks.Task> FetchAsync(Abblix.Oidc.Server.Model.BackChannelAuthenticationRequest request); ``` #### Parameters ###### `request` [BackChannelAuthenticationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.BackChannelAuthenticationRequest 'Abblix\.Oidc\.Server\.Model\.BackChannelAuthenticationRequest') {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.RequestFetching.IBackChannelAuthenticationRequestFetcher.FetchAsync(Abblix.Oidc.Server.Model.BackChannelAuthenticationRequest).request} The raw backchannel authentication request as parsed from the wire\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[BackChannelAuthenticationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.BackChannelAuthenticationRequest 'Abblix\.Oidc\.Server\.Model\.BackChannelAuthenticationRequest')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') The resolved request on success, or an [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') describing why fetching or signature/structure validation of the external source failed\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.RequestFetching.RequestObjectFetchAdapter.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.RequestFetching](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.RequestFetching 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.RequestFetching') ## RequestObjectFetchAdapter Class Adapts the generic [IRequestObjectFetcher](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RequestObject.IRequestObjectFetcher 'Abblix\.Oidc\.Server\.Features\.RequestObject\.IRequestObjectFetcher') \(signed\-JWT Request Object handling\) to the CIBA\-specific [IBackChannelAuthenticationRequestFetcher](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.RequestFetching.IBackChannelAuthenticationRequestFetcher 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.RequestFetching\.IBackChannelAuthenticationRequestFetcher') contract, passing the request's `request` parameter through unchanged for JWT validation and parameter merging\. ```csharp public class RequestObjectFetchAdapter : Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.RequestFetching.IBackChannelAuthenticationRequestFetcher ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → RequestObjectFetchAdapter Implements [IBackChannelAuthenticationRequestFetcher](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.RequestFetching.IBackChannelAuthenticationRequestFetcher 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.RequestFetching\.IBackChannelAuthenticationRequestFetcher') ### Constructors ## RequestObjectFetchAdapter\(IRequestObjectFetcher\) Constructor {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.RequestFetching.RequestObjectFetchAdapter.RequestObjectFetchAdapter(Abblix.Oidc.Server.Features.RequestObject.IRequestObjectFetcher)} Adapts the generic [IRequestObjectFetcher](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RequestObject.IRequestObjectFetcher 'Abblix\.Oidc\.Server\.Features\.RequestObject\.IRequestObjectFetcher') \(signed\-JWT Request Object handling\) to the CIBA\-specific [IBackChannelAuthenticationRequestFetcher](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.RequestFetching.IBackChannelAuthenticationRequestFetcher 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.RequestFetching\.IBackChannelAuthenticationRequestFetcher') contract, passing the request's `request` parameter through unchanged for JWT validation and parameter merging\. ```csharp public RequestObjectFetchAdapter(Abblix.Oidc.Server.Features.RequestObject.IRequestObjectFetcher requestObjectFetcher); ``` #### Parameters ###### `requestObjectFetcher` [IRequestObjectFetcher](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RequestObject.IRequestObjectFetcher 'Abblix\.Oidc\.Server\.Features\.RequestObject\.IRequestObjectFetcher') {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.RequestFetching.RequestObjectFetchAdapter.RequestObjectFetchAdapter(Abblix.Oidc.Server.Features.RequestObject.IRequestObjectFetcher).requestObjectFetcher} Validates the JWT Request Object and merges its claims into the outer request model\. ### Methods ## RequestObjectFetchAdapter\.FetchAsync\(BackChannelAuthenticationRequest\) Method {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.RequestFetching.RequestObjectFetchAdapter.FetchAsync(Abblix.Oidc.Server.Model.BackChannelAuthenticationRequest)} Delegates to the underlying request\-object fetcher, passing `request.Request` as the JWT to be validated and merged into the outer model\. ```csharp public System.Threading.Tasks.Task> FetchAsync(Abblix.Oidc.Server.Model.BackChannelAuthenticationRequest request); ``` #### Parameters ###### `request` [BackChannelAuthenticationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.BackChannelAuthenticationRequest 'Abblix\.Oidc\.Server\.Model\.BackChannelAuthenticationRequest') {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.RequestFetching.RequestObjectFetchAdapter.FetchAsync(Abblix.Oidc.Server.Model.BackChannelAuthenticationRequest).request} Implements [FetchAsync\(BackChannelAuthenticationRequest\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.RequestFetching.IBackChannelAuthenticationRequestFetcher#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.RequestFetching.IBackChannelAuthenticationRequestFetcher.FetchAsync(Abblix.Oidc.Server.Model.BackChannelAuthenticationRequest) 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.RequestFetching\.IBackChannelAuthenticationRequestFetcher\.FetchAsync\(Abblix\.Oidc\.Server\.Model\.BackChannelAuthenticationRequest\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[BackChannelAuthenticationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.BackChannelAuthenticationRequest 'Abblix\.Oidc\.Server\.Model\.BackChannelAuthenticationRequest')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ## Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation Namespace | Classes | | | :--- | :--- | | [BackChannelAuthenticationValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation\.BackChannelAuthenticationValidationContext') | Represents the context for validating a backchannel authentication request\. This context encapsulates the details of the authentication request, allowing validators to perform the necessary checks and validations according to the backchannel authentication flow\. | | [BackChannelAuthenticationValidatorComposite](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidatorComposite 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation\.BackChannelAuthenticationValidatorComposite') | Represents a composite validator for backchannel authentication contexts, aggregating multiple validation steps into a single validation process\. This class implements [IBackChannelAuthenticationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.IBackChannelAuthenticationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation\.IBackChannelAuthenticationContextValidator') and allows for the combination of multiple validators that are executed sequentially\. | | [BackChannelAuthorizationDetailsValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthorizationDetailsValidator 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation\.BackChannelAuthorizationDetailsValidator') | Thin endpoint\-side adapter that delegates the RFC 9396 §3 CIBA `authorization_details` validation to [ApplyAsync\(JsonArray, ClientInfo, CancellationToken\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy#Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy.ApplyAsync(System.Text.Json.Nodes.JsonArray,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.Threading.CancellationToken) 'Abblix\.Oidc\.Server\.Features\.RichAuthorizationRequests\.IAuthorizationDetailsPolicy\.ApplyAsync\(System\.Text\.Json\.Nodes\.JsonArray, Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo, System\.Threading\.CancellationToken\)')\. The composite already returns an [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') with `error = invalid_authorization_details`, so this adapter just propagates it directly\. All actual policy lives on the composite validator so /authorize, /par, CIBA and \(future\) device\-flow endpoints share one source of truth\. | | [ClientValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.ClientValidator 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation\.ClientValidator') | Validates the client in a backchannel authentication request, ensuring the client is registered and authorized to perform the request as part of the authentication validation process\. | | [PingModeValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.PingModeValidator 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation\.PingModeValidator') | Validates required parameters for CIBA ping mode authentication requests\. Ensures that clients using ping mode have proper configuration and provide necessary tokens\. | | [PushModeValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.PushModeValidator 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation\.PushModeValidator') | Validates required parameters for CIBA push mode authentication requests\. Ensures that clients using push mode have proper HTTPS endpoint configuration\. | | [RequestedExpiryValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.RequestedExpiryValidator 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation\.RequestedExpiryValidator') | Validates the requested expiry time for a backchannel authentication request\. Ensures that the requested expiry is within the allowed range and assigns a valid expiry time to the context\. | | [RequestedSubjectValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.RequestedSubjectValidator 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation\.RequestedSubjectValidator') | Refuses a `claims` request whose `sub` qualifier is not a string\. | | [ResourceValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.ResourceValidator 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation\.ResourceValidator') | Validates resources specified in authorization requests to ensure they conform to registered definitions and policies\. This validator checks whether the resources requested in the authorization process are recognized by the system and permitted for the requesting client, extending the base functionality of resource validation by incorporating integration with the authorization context\. | | [ScopeValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.ScopeValidator 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation\.ScopeValidator') | Validates the scopes in OAuth 2\.0 authorization requests for backchannel authentication\. This validator ensures that the requested scopes are allowed based on the client's configuration and the type of OAuth flow being used\. It checks for scope compatibility and prevents unauthorized or excessive scope requests, reinforcing the security policies and minimizing scope\-related vulnerabilities\. | | [UserCodeValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.UserCodeValidator 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation\.UserCodeValidator') | Validates the presence of a UserCode in backchannel authentication requests, based on the client and provider configuration\. This validator ensures that if the client or provider requires the UserCode parameter for backchannel authentication, it is included in the request\. | | [UserIdentityValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.UserIdentityValidator 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation\.UserIdentityValidator') | Validates the user's identity in a backchannel authentication request, ensuring that valid identity hints \(e\.g\., login hints, tokens\) are provided and correctly processed\. | | Interfaces | | | :--- | :--- | | [IBackChannelAuthenticationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.IBackChannelAuthenticationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation\.IBackChannelAuthenticationContextValidator') | Defines a contract for validating the context of a backchannel authentication request\. Implementations of this interface are responsible for ensuring that the backchannel authentication request meets all necessary validation criteria based on the context, which may include client information, requested scopes, and other parameters\. | --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation') ## BackChannelAuthenticationValidationContext Class Represents the context for validating a backchannel authentication request\. This context encapsulates the details of the authentication request, allowing validators to perform the necessary checks and validations according to the backchannel authentication flow\. ```csharp public record BackChannelAuthenticationValidationContext : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → BackChannelAuthenticationValidationContext Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[BackChannelAuthenticationValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation\.BackChannelAuthenticationValidationContext')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Constructors ## BackChannelAuthenticationValidationContext\(BackChannelAuthenticationRequest, ClientRequest\) Constructor {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext.BackChannelAuthenticationValidationContext(Abblix.Oidc.Server.Model.BackChannelAuthenticationRequest,Abblix.Oidc.Server.Model.ClientRequest)} Represents the context for validating a backchannel authentication request\. This context encapsulates the details of the authentication request, allowing validators to perform the necessary checks and validations according to the backchannel authentication flow\. ```csharp public BackChannelAuthenticationValidationContext(Abblix.Oidc.Server.Model.BackChannelAuthenticationRequest Request, Abblix.Oidc.Server.Model.ClientRequest ClientRequest); ``` #### Parameters ###### `Request` [BackChannelAuthenticationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.BackChannelAuthenticationRequest 'Abblix\.Oidc\.Server\.Model\.BackChannelAuthenticationRequest') {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext.BackChannelAuthenticationValidationContext(Abblix.Oidc.Server.Model.BackChannelAuthenticationRequest,Abblix.Oidc.Server.Model.ClientRequest).Request} The backchannel authentication request that is being validated\. This request contains all the parameters and data needed for the validation process\. ###### `ClientRequest` [ClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRequest 'Abblix\.Oidc\.Server\.Model\.ClientRequest') {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext.BackChannelAuthenticationValidationContext(Abblix.Oidc.Server.Model.BackChannelAuthenticationRequest,Abblix.Oidc.Server.Model.ClientRequest).ClientRequest} The client request associated with the backchannel authentication request\. This contains the details of the client making the request, such as client credentials and other relevant information\. ### Properties ## BackChannelAuthenticationValidationContext\.AuthorizationDetails Property {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext.AuthorizationDetails} RFC 9396 §3 Rich Authorization Requests array, populated after per\-client allowlist and per\-type validator dispatch by [BackChannelAuthorizationDetailsValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthorizationDetailsValidator 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation\.BackChannelAuthorizationDetailsValidator')\. The raw [System\.Text\.Json\.Nodes\.JsonArray](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonarray 'System\.Text\.Json\.Nodes\.JsonArray') survives forward to the grant unchanged\. `null` when the request did not include `authorization_details`\. ```csharp public System.Text.Json.Nodes.JsonArray? AuthorizationDetails { get; set; } ``` #### Property Value [System\.Text\.Json\.Nodes\.JsonArray](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonarray 'System\.Text\.Json\.Nodes\.JsonArray') ## BackChannelAuthenticationValidationContext\.ClientInfo Property {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext.ClientInfo} Provides information about the client associated with the backchannel authentication request\. This includes the client's identity, credentials, and any attributes relevant to the authentication process\. ```csharp public Abblix.Oidc.Server.Features.ClientInformation.ClientInfo ClientInfo { get; set; } ``` #### Property Value [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') #### Exceptions [System\.InvalidOperationException](https://learn.microsoft.com/en-us/dotnet/api/system.invalidoperationexception 'System\.InvalidOperationException') Thrown when attempting to access this property before it has been assigned a value\. ## BackChannelAuthenticationValidationContext\.ClientRequest Property {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext.ClientRequest} The client request associated with the backchannel authentication request\. This contains the details of the client making the request, such as client credentials and other relevant information\. ```csharp public Abblix.Oidc.Server.Model.ClientRequest ClientRequest { get; init; } ``` #### Property Value [ClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRequest 'Abblix\.Oidc\.Server\.Model\.ClientRequest') ## BackChannelAuthenticationValidationContext\.ExpiresIn Property {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext.ExpiresIn} Specifies the expiration time for the backchannel authentication request\. This value indicates how long the request is valid before it expires\. ```csharp public System.TimeSpan ExpiresIn { get; set; } ``` #### Property Value [System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan') ## BackChannelAuthenticationValidationContext\.IdToken Property {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext.IdToken} Represents the ID token associated with the request, typically used to validate the identity of the user\. This token is issued by the authorization server and can be used for user authentication or as a reference during token validation\. ```csharp public Abblix.Jwt.JsonWebToken? IdToken { get; set; } ``` #### Property Value [JsonWebToken](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebToken 'Abblix\.Jwt\.JsonWebToken') ## BackChannelAuthenticationValidationContext\.LoginHintToken Property {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext.LoginHintToken} Represents the login hint token, which is an optional token used to provide hints about the user's identity to streamline the authentication process\. It may contain pre\-validated information, such as a subject identifier\. ```csharp public Abblix.Jwt.JsonWebToken? LoginHintToken { get; set; } ``` #### Property Value [JsonWebToken](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebToken 'Abblix\.Jwt\.JsonWebToken') ## BackChannelAuthenticationValidationContext\.Request Property {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext.Request} The backchannel authentication request that is being validated\. This request contains all the parameters and data needed for the validation process\. ```csharp public Abblix.Oidc.Server.Model.BackChannelAuthenticationRequest Request { get; init; } ``` #### Property Value [BackChannelAuthenticationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.BackChannelAuthenticationRequest 'Abblix\.Oidc\.Server\.Model\.BackChannelAuthenticationRequest') ## BackChannelAuthenticationValidationContext\.Resources Property {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext.Resources} A collection of resource definitions requested as part of the authorization process\. These resources specify the URIs that the client is requesting access to, enhancing the granularity of resource\-level authorization\. ```csharp public Abblix.Oidc.Server.Common.Constants.ResourceDefinition[] Resources { get; set; } ``` #### Property Value [ResourceDefinition](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ResourceDefinition 'Abblix\.Oidc\.Server\.Common\.Constants\.ResourceDefinition')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') ## BackChannelAuthenticationValidationContext\.Scope Property {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext.Scope} Represents the collection of scope definitions applicable to the authorization request\. These scopes define the permissions and access levels that the client is requesting from the authorization server\. ```csharp public Abblix.Oidc.Server.Common.Constants.ScopeDefinition[] Scope { get; set; } ``` #### Property Value [ScopeDefinition](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ScopeDefinition 'Abblix\.Oidc\.Server\.Common\.Constants\.ScopeDefinition')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidatorComposite.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation') ## BackChannelAuthenticationValidatorComposite Class Represents a composite validator for backchannel authentication contexts, aggregating multiple validation steps into a single validation process\. This class implements [IBackChannelAuthenticationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.IBackChannelAuthenticationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation\.IBackChannelAuthenticationContextValidator') and allows for the combination of multiple validators that are executed sequentially\. ```csharp public class BackChannelAuthenticationValidatorComposite : Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.IBackChannelAuthenticationContextValidator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → BackChannelAuthenticationValidatorComposite Implements [IBackChannelAuthenticationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.IBackChannelAuthenticationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation\.IBackChannelAuthenticationContextValidator') ### Constructors ## BackChannelAuthenticationValidatorComposite\(IBackChannelAuthenticationContextValidator\[\]\) Constructor {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidatorComposite.BackChannelAuthenticationValidatorComposite(Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.IBackChannelAuthenticationContextValidator[])} Represents a composite validator for backchannel authentication contexts, aggregating multiple validation steps into a single validation process\. This class implements [IBackChannelAuthenticationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.IBackChannelAuthenticationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation\.IBackChannelAuthenticationContextValidator') and allows for the combination of multiple validators that are executed sequentially\. ```csharp public BackChannelAuthenticationValidatorComposite(Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.IBackChannelAuthenticationContextValidator[] validators); ``` #### Parameters ###### `validators` [IBackChannelAuthenticationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.IBackChannelAuthenticationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation\.IBackChannelAuthenticationContextValidator')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidatorComposite.BackChannelAuthenticationValidatorComposite(Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.IBackChannelAuthenticationContextValidator[]).validators} An array of validators that define the validation process\. ### Methods ## BackChannelAuthenticationValidatorComposite\.ValidateAsync\(BackChannelAuthenticationValidationContext\) Method {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidatorComposite.ValidateAsync(Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext)} Asynchronously validates a [BackChannelAuthenticationValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation\.BackChannelAuthenticationValidationContext')\. Iterates through each validation step, returning the first encountered error, if any\. ```csharp public System.Threading.Tasks.Task ValidateAsync(Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext context); ``` #### Parameters ###### `context` [BackChannelAuthenticationValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation\.BackChannelAuthenticationValidationContext') {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidatorComposite.ValidateAsync(Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext).context} The backchannel authentication validation context to be validated\. Implements [ValidateAsync\(BackChannelAuthenticationValidationContext\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.IBackChannelAuthenticationContextValidator#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.IBackChannelAuthenticationContextValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext) 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation\.IBackChannelAuthenticationContextValidator\.ValidateAsync\(Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation\.BackChannelAuthenticationValidationContext\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task that represents the asynchronous validation operation\. The task result contains a [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') if a validation error is found, or null if validation succeeds\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthorizationDetailsValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation') ## BackChannelAuthorizationDetailsValidator Class Thin endpoint\-side adapter that delegates the RFC 9396 §3 CIBA `authorization_details` validation to [ApplyAsync\(JsonArray, ClientInfo, CancellationToken\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy#Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy.ApplyAsync(System.Text.Json.Nodes.JsonArray,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.Threading.CancellationToken) 'Abblix\.Oidc\.Server\.Features\.RichAuthorizationRequests\.IAuthorizationDetailsPolicy\.ApplyAsync\(System\.Text\.Json\.Nodes\.JsonArray, Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo, System\.Threading\.CancellationToken\)')\. The composite already returns an [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') with `error = invalid_authorization_details`, so this adapter just propagates it directly\. All actual policy lives on the composite validator so /authorize, /par, CIBA and \(future\) device\-flow endpoints share one source of truth\. ```csharp public class BackChannelAuthorizationDetailsValidator : Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.IBackChannelAuthenticationContextValidator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → BackChannelAuthorizationDetailsValidator Implements [IBackChannelAuthenticationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.IBackChannelAuthenticationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation\.IBackChannelAuthenticationContextValidator') ### Constructors ## BackChannelAuthorizationDetailsValidator\(IAuthorizationDetailsPolicy\) Constructor {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthorizationDetailsValidator.BackChannelAuthorizationDetailsValidator(Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy)} Thin endpoint\-side adapter that delegates the RFC 9396 §3 CIBA `authorization_details` validation to [ApplyAsync\(JsonArray, ClientInfo, CancellationToken\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy#Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy.ApplyAsync(System.Text.Json.Nodes.JsonArray,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.Threading.CancellationToken) 'Abblix\.Oidc\.Server\.Features\.RichAuthorizationRequests\.IAuthorizationDetailsPolicy\.ApplyAsync\(System\.Text\.Json\.Nodes\.JsonArray, Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo, System\.Threading\.CancellationToken\)')\. The composite already returns an [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') with `error = invalid_authorization_details`, so this adapter just propagates it directly\. All actual policy lives on the composite validator so /authorize, /par, CIBA and \(future\) device\-flow endpoints share one source of truth\. ```csharp public BackChannelAuthorizationDetailsValidator(Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy policy); ``` #### Parameters ###### `policy` [IAuthorizationDetailsPolicy](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy 'Abblix\.Oidc\.Server\.Features\.RichAuthorizationRequests\.IAuthorizationDetailsPolicy') {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthorizationDetailsValidator.BackChannelAuthorizationDetailsValidator(Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy).policy} ### Methods ## BackChannelAuthorizationDetailsValidator\.ValidateAsync\(BackChannelAuthenticationValidationContext\) Method {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthorizationDetailsValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext)} Asynchronously validates the backchannel authentication request context\. This method checks the context of the request, including client information and requested parameters, to ensure compliance with security and protocol requirements\. ```csharp public System.Threading.Tasks.Task ValidateAsync(Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext context); ``` #### Parameters ###### `context` [BackChannelAuthenticationValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation\.BackChannelAuthenticationValidationContext') {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthorizationDetailsValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext).context} The context of the backchannel authentication request that needs to be validated\. Implements [ValidateAsync\(BackChannelAuthenticationValidationContext\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.IBackChannelAuthenticationContextValidator#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.IBackChannelAuthenticationContextValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext) 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation\.IBackChannelAuthenticationContextValidator\.ValidateAsync\(Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation\.BackChannelAuthenticationValidationContext\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task that represents the asynchronous validation operation\. The task result contains a [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') if validation fails, or null if the context is valid\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.ClientValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation') ## ClientValidator Class Validates the client in a backchannel authentication request, ensuring the client is registered and authorized to perform the request as part of the authentication validation process\. ```csharp public class ClientValidator : Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.IBackChannelAuthenticationContextValidator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ClientValidator Implements [IBackChannelAuthenticationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.IBackChannelAuthenticationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation\.IBackChannelAuthenticationContextValidator') ### Constructors ## ClientValidator\(IClientAuthenticator\) Constructor {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.ClientValidator.ClientValidator(Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator)} Validates the client in a backchannel authentication request, ensuring the client is registered and authorized to perform the request as part of the authentication validation process\. ```csharp public ClientValidator(Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator clientAuthenticator); ``` #### Parameters ###### `clientAuthenticator` [IClientAuthenticator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator 'Abblix\.Oidc\.Server\.Features\.ClientAuthentication\.IClientAuthenticator') {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.ClientValidator.ClientValidator(Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator).clientAuthenticator} The service used to authenticate and retrieve client information\. ### Methods ## ClientValidator\.ValidateAsync\(BackChannelAuthenticationValidationContext\) Method {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.ClientValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext)} Validates the client in the context of a backchannel authentication request\. Ensures that the client is recognized and authorized to make the request\. ```csharp public System.Threading.Tasks.Task ValidateAsync(Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext context); ``` #### Parameters ###### `context` [BackChannelAuthenticationValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation\.BackChannelAuthenticationValidationContext') {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.ClientValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext).context} The validation context containing the backchannel authentication request and client information\. Implements [ValidateAsync\(BackChannelAuthenticationValidationContext\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.IBackChannelAuthenticationContextValidator#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.IBackChannelAuthenticationContextValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext) 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation\.IBackChannelAuthenticationContextValidator\.ValidateAsync\(Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation\.BackChannelAuthenticationValidationContext\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') if the client is not valid, or null if the client is authorized\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.IBackChannelAuthenticationContextValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation') ## IBackChannelAuthenticationContextValidator Interface Defines a contract for validating the context of a backchannel authentication request\. Implementations of this interface are responsible for ensuring that the backchannel authentication request meets all necessary validation criteria based on the context, which may include client information, requested scopes, and other parameters\. ```csharp public interface IBackChannelAuthenticationContextValidator ``` Derived ↳ [BackChannelAuthenticationValidatorComposite](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidatorComposite 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation\.BackChannelAuthenticationValidatorComposite') ↳ [BackChannelAuthorizationDetailsValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthorizationDetailsValidator 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation\.BackChannelAuthorizationDetailsValidator') ↳ [ClientValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.ClientValidator 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation\.ClientValidator') ↳ [PingModeValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.PingModeValidator 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation\.PingModeValidator') ↳ [PushModeValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.PushModeValidator 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation\.PushModeValidator') ↳ [RequestedExpiryValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.RequestedExpiryValidator 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation\.RequestedExpiryValidator') ↳ [RequestedSubjectValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.RequestedSubjectValidator 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation\.RequestedSubjectValidator') ↳ [ResourceValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.ResourceValidator 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation\.ResourceValidator') ↳ [ScopeValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.ScopeValidator 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation\.ScopeValidator') ↳ [UserCodeValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.UserCodeValidator 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation\.UserCodeValidator') ↳ [UserIdentityValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.UserIdentityValidator 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation\.UserIdentityValidator') ### Methods ## IBackChannelAuthenticationContextValidator\.ValidateAsync\(BackChannelAuthenticationValidationContext\) Method {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.IBackChannelAuthenticationContextValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext)} Asynchronously validates the backchannel authentication request context\. This method checks the context of the request, including client information and requested parameters, to ensure compliance with security and protocol requirements\. ```csharp System.Threading.Tasks.Task ValidateAsync(Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext context); ``` #### Parameters ###### `context` [BackChannelAuthenticationValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation\.BackChannelAuthenticationValidationContext') {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.IBackChannelAuthenticationContextValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext).context} The context of the backchannel authentication request that needs to be validated\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task that represents the asynchronous validation operation\. The task result contains a [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') if validation fails, or null if the context is valid\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.PingModeValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation') ## PingModeValidator Class Validates required parameters for CIBA ping mode authentication requests\. Ensures that clients using ping mode have proper configuration and provide necessary tokens\. ```csharp public class PingModeValidator : Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.IBackChannelAuthenticationContextValidator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → PingModeValidator Implements [IBackChannelAuthenticationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.IBackChannelAuthenticationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation\.IBackChannelAuthenticationContextValidator') ### Methods ## PingModeValidator\.ValidateAsync\(BackChannelAuthenticationValidationContext\) Method {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.PingModeValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext)} Validates ping mode specific requirements: client\_notification\_token and backchannel\_client\_notification\_endpoint must be present\. ```csharp public System.Threading.Tasks.Task ValidateAsync(Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext context); ``` #### Parameters ###### `context` [BackChannelAuthenticationValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation\.BackChannelAuthenticationValidationContext') {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.PingModeValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext).context} The validation context containing request and client information\. Implements [ValidateAsync\(BackChannelAuthenticationValidationContext\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.IBackChannelAuthenticationContextValidator#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.IBackChannelAuthenticationContextValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext) 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation\.IBackChannelAuthenticationContextValidator\.ValidateAsync\(Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation\.BackChannelAuthenticationValidationContext\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') An error if validation fails, null if successful\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.PushModeValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation') ## PushModeValidator Class Validates required parameters for CIBA push mode authentication requests\. Ensures that clients using push mode have proper HTTPS endpoint configuration\. ```csharp public class PushModeValidator : Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.IBackChannelAuthenticationContextValidator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → PushModeValidator Implements [IBackChannelAuthenticationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.IBackChannelAuthenticationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation\.IBackChannelAuthenticationContextValidator') ### Methods ## PushModeValidator\.ValidateAsync\(BackChannelAuthenticationValidationContext\) Method {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.PushModeValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext)} Validates push mode specific requirements: backchannel\_client\_notification\_endpoint must be present and use HTTPS\. ```csharp public System.Threading.Tasks.Task ValidateAsync(Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext context); ``` #### Parameters ###### `context` [BackChannelAuthenticationValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation\.BackChannelAuthenticationValidationContext') {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.PushModeValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext).context} The validation context containing request and client information\. Implements [ValidateAsync\(BackChannelAuthenticationValidationContext\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.IBackChannelAuthenticationContextValidator#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.IBackChannelAuthenticationContextValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext) 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation\.IBackChannelAuthenticationContextValidator\.ValidateAsync\(Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation\.BackChannelAuthenticationValidationContext\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') An error if validation fails, null if successful\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.RequestedExpiryValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation') ## RequestedExpiryValidator Class Validates the requested expiry time for a backchannel authentication request\. Ensures that the requested expiry is within the allowed range and assigns a valid expiry time to the context\. ```csharp public class RequestedExpiryValidator : Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.IBackChannelAuthenticationContextValidator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → RequestedExpiryValidator Implements [IBackChannelAuthenticationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.IBackChannelAuthenticationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation\.IBackChannelAuthenticationContextValidator') ### Constructors ## RequestedExpiryValidator\(IOptionsMonitor\\) Constructor {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.RequestedExpiryValidator.RequestedExpiryValidator(Microsoft.Extensions.Options.IOptionsMonitor_Abblix.Oidc.Server.Common.Configuration.OidcOptions_)} Validates the requested expiry time for a backchannel authentication request\. Ensures that the requested expiry is within the allowed range and assigns a valid expiry time to the context\. ```csharp public RequestedExpiryValidator(Microsoft.Extensions.Options.IOptionsMonitor options); ``` #### Parameters ###### `options` [Microsoft\.Extensions\.Options\.IOptionsMonitor<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptionsmonitor-1 'Microsoft\.Extensions\.Options\.IOptionsMonitor\`1')[OidcOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptionsmonitor-1 'Microsoft\.Extensions\.Options\.IOptionsMonitor\`1') {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.RequestedExpiryValidator.RequestedExpiryValidator(Microsoft.Extensions.Options.IOptionsMonitor_Abblix.Oidc.Server.Common.Configuration.OidcOptions_).options} The options containing the default and maximum expiry settings for backchannel authentication\. ### Methods ## RequestedExpiryValidator\.ValidateAsync\(BackChannelAuthenticationValidationContext\) Method {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.RequestedExpiryValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext)} Asynchronously validates the expiry time for the backchannel authentication request\. Ensures that the requested expiry is within the allowed range and assigns an appropriate expiry to the context\. ```csharp public System.Threading.Tasks.Task ValidateAsync(Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext context); ``` #### Parameters ###### `context` [BackChannelAuthenticationValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation\.BackChannelAuthenticationValidationContext') {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.RequestedExpiryValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext).context} The validation context containing the backchannel authentication request and its parameters\. Implements [ValidateAsync\(BackChannelAuthenticationValidationContext\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.IBackChannelAuthenticationContextValidator#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.IBackChannelAuthenticationContextValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext) 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation\.IBackChannelAuthenticationContextValidator\.ValidateAsync\(Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation\.BackChannelAuthenticationValidationContext\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task representing the asynchronous operation, returning an error if validation fails, or null if validation succeeds\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.RequestedSubjectValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation') ## RequestedSubjectValidator Class Refuses a `claims` request whose `sub` qualifier is not a string\. ```csharp public class RequestedSubjectValidator : Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.IBackChannelAuthenticationContextValidator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → RequestedSubjectValidator Implements [IBackChannelAuthenticationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.IBackChannelAuthenticationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation\.IBackChannelAuthenticationContextValidator') ### Remarks This endpoint accepts the same `claims` parameter as the authorization endpoint and honours a `sub` named in it the same way \- OpenID Connect Core 1\.0 Section 3\.1\.2\.2 makes that and `id_token_hint` two ways of stating one requirement\. What differs is only where the comparison happens, since the end user answers on a device long afterwards\. A malformed qualifier is refused here rather than left to the comparison, which would treat it as naming nobody and answer as though the end user were simply unreachable. Section 5.5.1 requires the qualifier to be "a valid value for the Claim being requested" and Section 2 makes `sub` a string, so a number or an object is a request nobody could satisfy, and saying that outright is the difference between a client fixing its request and a client retrying it. ### Methods ## RequestedSubjectValidator\.ValidateAsync\(BackChannelAuthenticationValidationContext\) Method {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.RequestedSubjectValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext)} Asynchronously validates the backchannel authentication request context\. This method checks the context of the request, including client information and requested parameters, to ensure compliance with security and protocol requirements\. ```csharp public System.Threading.Tasks.Task ValidateAsync(Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext context); ``` #### Parameters ###### `context` [BackChannelAuthenticationValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation\.BackChannelAuthenticationValidationContext') {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.RequestedSubjectValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext).context} The context of the backchannel authentication request that needs to be validated\. Implements [ValidateAsync\(BackChannelAuthenticationValidationContext\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.IBackChannelAuthenticationContextValidator#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.IBackChannelAuthenticationContextValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext) 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation\.IBackChannelAuthenticationContextValidator\.ValidateAsync\(Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation\.BackChannelAuthenticationValidationContext\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task that represents the asynchronous validation operation\. The task result contains a [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') if validation fails, or null if the context is valid\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.ResourceValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation') ## ResourceValidator Class Validates resources specified in authorization requests to ensure they conform to registered definitions and policies\. This validator checks whether the resources requested in the authorization process are recognized by the system and permitted for the requesting client, extending the base functionality of resource validation by incorporating integration with the authorization context\. ```csharp public class ResourceValidator : Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.IBackChannelAuthenticationContextValidator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ResourceValidator Implements [IBackChannelAuthenticationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.IBackChannelAuthenticationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation\.IBackChannelAuthenticationContextValidator') ### Constructors ## ResourceValidator\(IResourceManager\) Constructor {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.ResourceValidator.ResourceValidator(Abblix.Oidc.Server.Features.ResourceIndicators.IResourceManager)} Validates resources specified in authorization requests to ensure they conform to registered definitions and policies\. This validator checks whether the resources requested in the authorization process are recognized by the system and permitted for the requesting client, extending the base functionality of resource validation by incorporating integration with the authorization context\. ```csharp public ResourceValidator(Abblix.Oidc.Server.Features.ResourceIndicators.IResourceManager resourceManager); ``` #### Parameters ###### `resourceManager` [IResourceManager](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ResourceIndicators.IResourceManager 'Abblix\.Oidc\.Server\.Features\.ResourceIndicators\.IResourceManager') {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.ResourceValidator.ResourceValidator(Abblix.Oidc.Server.Features.ResourceIndicators.IResourceManager).resourceManager} The manager responsible for retrieving and validating resource information\. ### Methods ## ResourceValidator\.ValidateAsync\(BackChannelAuthenticationValidationContext\) Method {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.ResourceValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext)} Performs the validation of resource identifiers specified in the authorization request against the allowed resource definitions managed by the [IResourceManager](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ResourceIndicators.IResourceManager 'Abblix\.Oidc\.Server\.Features\.ResourceIndicators\.IResourceManager')\. This method ensures that the resources requested are known to the system and align with security and access policies\. ```csharp public System.Threading.Tasks.Task ValidateAsync(Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext context); ``` #### Parameters ###### `context` [BackChannelAuthenticationValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation\.BackChannelAuthenticationValidationContext') {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.ResourceValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext).context} The context containing the authorization request, which includes the resources to be validated\. Implements [ValidateAsync\(BackChannelAuthenticationValidationContext\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.IBackChannelAuthenticationContextValidator#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.IBackChannelAuthenticationContextValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext) 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation\.IBackChannelAuthenticationContextValidator\.ValidateAsync\(Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation\.BackChannelAuthenticationValidationContext\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') An [AuthorizationRequestValidationError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationRequestValidationError') containing error details if validation fails, or null if the validation is successful, indicating that all requested resources are recognized and permissible\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.ScopeValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation') ## ScopeValidator Class Validates the scopes in OAuth 2\.0 authorization requests for backchannel authentication\. This validator ensures that the requested scopes are allowed based on the client's configuration and the type of OAuth flow being used\. It checks for scope compatibility and prevents unauthorized or excessive scope requests, reinforcing the security policies and minimizing scope\-related vulnerabilities\. ```csharp public class ScopeValidator : Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.IBackChannelAuthenticationContextValidator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ScopeValidator Implements [IBackChannelAuthenticationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.IBackChannelAuthenticationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation\.IBackChannelAuthenticationContextValidator') ### Constructors ## ScopeValidator\(IScopeManager\) Constructor {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.ScopeValidator.ScopeValidator(Abblix.Oidc.Server.Features.ScopeManagement.IScopeManager)} Validates the scopes in OAuth 2\.0 authorization requests for backchannel authentication\. This validator ensures that the requested scopes are allowed based on the client's configuration and the type of OAuth flow being used\. It checks for scope compatibility and prevents unauthorized or excessive scope requests, reinforcing the security policies and minimizing scope\-related vulnerabilities\. ```csharp public ScopeValidator(Abblix.Oidc.Server.Features.ScopeManagement.IScopeManager scopeManager); ``` #### Parameters ###### `scopeManager` [IScopeManager](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ScopeManagement.IScopeManager 'Abblix\.Oidc\.Server\.Features\.ScopeManagement\.IScopeManager') {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.ScopeValidator.ScopeValidator(Abblix.Oidc.Server.Features.ScopeManagement.IScopeManager).scopeManager} The scope manager used to validate scopes\. ### Methods ## ScopeValidator\.ValidateAsync\(BackChannelAuthenticationValidationContext\) Method {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.ScopeValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext)} Validates the scopes in the context of the backchannel authentication request, checking if they align with the client's permissions and the OAuth flow\. This method prevents the client from requesting unauthorized scopes, such as offline access, unless explicitly allowed by the client's configuration\. ```csharp public System.Threading.Tasks.Task ValidateAsync(Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext context); ``` #### Parameters ###### `context` [BackChannelAuthenticationValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation\.BackChannelAuthenticationValidationContext') {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.ScopeValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext).context} The validation context that includes details about the request and the client\. Implements [ValidateAsync\(BackChannelAuthenticationValidationContext\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.IBackChannelAuthenticationContextValidator#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.IBackChannelAuthenticationContextValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext) 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation\.IBackChannelAuthenticationContextValidator\.ValidateAsync\(Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation\.BackChannelAuthenticationValidationContext\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') if the scope validation fails, or null if the scopes in the request are valid\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.UserCodeValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation') ## UserCodeValidator Class Validates the presence of a UserCode in backchannel authentication requests, based on the client and provider configuration\. This validator ensures that if the client or provider requires the UserCode parameter for backchannel authentication, it is included in the request\. ```csharp public class UserCodeValidator : Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.IBackChannelAuthenticationContextValidator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → UserCodeValidator Implements [IBackChannelAuthenticationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.IBackChannelAuthenticationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation\.IBackChannelAuthenticationContextValidator') ### Remarks This validator checks \presence\ only\. Verifying the code's \value\ against the user's actual code is the host's responsibility and happens during the device interaction \- see the security contract on [IUserDeviceAuthenticationHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IUserDeviceAuthenticationHandler 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces\.IUserDeviceAuthenticationHandler')\. ### Constructors ## UserCodeValidator\(IOptions\\) Constructor {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.UserCodeValidator.UserCodeValidator(Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_)} Validates the presence of a UserCode in backchannel authentication requests, based on the client and provider configuration\. This validator ensures that if the client or provider requires the UserCode parameter for backchannel authentication, it is included in the request\. ```csharp public UserCodeValidator(Microsoft.Extensions.Options.IOptions options); ``` #### Parameters ###### `options` [Microsoft\.Extensions\.Options\.IOptions<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptions-1 'Microsoft\.Extensions\.Options\.IOptions\`1')[OidcOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptions-1 'Microsoft\.Extensions\.Options\.IOptions\`1') {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.UserCodeValidator.UserCodeValidator(Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_).options} The OIDC options used to configure the behavior of the backchannel authentication process\. ### Remarks This validator checks \presence\ only\. Verifying the code's \value\ against the user's actual code is the host's responsibility and happens during the device interaction \- see the security contract on [IUserDeviceAuthenticationHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IUserDeviceAuthenticationHandler 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces\.IUserDeviceAuthenticationHandler')\. ### Methods ## UserCodeValidator\.ValidateAsync\(BackChannelAuthenticationValidationContext\) Method {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.UserCodeValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext)} Asynchronously validates the UserCode parameter in the context of a backchannel authentication request\. If the UserCode is required but not present, the method returns an error\. Otherwise, it returns null\. ```csharp public System.Threading.Tasks.Task ValidateAsync(Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext context); ``` #### Parameters ###### `context` [BackChannelAuthenticationValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation\.BackChannelAuthenticationValidationContext') {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.UserCodeValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext).context} The validation context containing the authentication request and client information\. Implements [ValidateAsync\(BackChannelAuthenticationValidationContext\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.IBackChannelAuthenticationContextValidator#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.IBackChannelAuthenticationContextValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext) 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation\.IBackChannelAuthenticationContextValidator\.ValidateAsync\(Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation\.BackChannelAuthenticationValidationContext\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task that returns an error if validation fails, or null if successful\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.UserIdentityValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation') ## UserIdentityValidator Class Validates the user's identity in a backchannel authentication request, ensuring that valid identity hints \(e\.g\., login hints, tokens\) are provided and correctly processed\. ```csharp public class UserIdentityValidator : Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.IBackChannelAuthenticationContextValidator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → UserIdentityValidator Implements [IBackChannelAuthenticationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.IBackChannelAuthenticationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation\.IBackChannelAuthenticationContextValidator') ### Constructors ## UserIdentityValidator\(IIdTokenHintParser, IClientJwtValidator\) Constructor {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.UserIdentityValidator.UserIdentityValidator(Abblix.Oidc.Server.Features.Tokens.Validation.IIdTokenHintParser,Abblix.Oidc.Server.Features.Tokens.Validation.IClientJwtValidator)} Validates the user's identity in a backchannel authentication request, ensuring that valid identity hints \(e\.g\., login hints, tokens\) are provided and correctly processed\. ```csharp public UserIdentityValidator(Abblix.Oidc.Server.Features.Tokens.Validation.IIdTokenHintParser hintParser, Abblix.Oidc.Server.Features.Tokens.Validation.IClientJwtValidator clientJwtValidator); ``` #### Parameters ###### `hintParser` [IIdTokenHintParser](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.Validation.IIdTokenHintParser 'Abblix\.Oidc\.Server\.Features\.Tokens\.Validation\.IIdTokenHintParser') {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.UserIdentityValidator.UserIdentityValidator(Abblix.Oidc.Server.Features.Tokens.Validation.IIdTokenHintParser,Abblix.Oidc.Server.Features.Tokens.Validation.IClientJwtValidator).hintParser} Decides whether an `id_token_hint` is an ID token this server issued\. ###### `clientJwtValidator` [IClientJwtValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.Validation.IClientJwtValidator 'Abblix\.Oidc\.Server\.Features\.Tokens\.Validation\.IClientJwtValidator') {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.UserIdentityValidator.UserIdentityValidator(Abblix.Oidc.Server.Features.Tokens.Validation.IIdTokenHintParser,Abblix.Oidc.Server.Features.Tokens.Validation.IClientJwtValidator).clientJwtValidator} Validator for JWTs issued by clients\. ### Methods ## UserIdentityValidator\.ValidateAsync\(BackChannelAuthenticationValidationContext\) Method {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.UserIdentityValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext)} Validates the user's identity based on the provided identity hints, such as login hint, login hint token, or ID token hint\. It ensures that only one identity hint is present and attempts to process the hint to confirm the user's identity\. ```csharp public System.Threading.Tasks.Task ValidateAsync(Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext context); ``` #### Parameters ###### `context` [BackChannelAuthenticationValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation\.BackChannelAuthenticationValidationContext') {#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.UserIdentityValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext).context} Contains the backchannel authentication request and client information\. Implements [ValidateAsync\(BackChannelAuthenticationValidationContext\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.IBackChannelAuthenticationContextValidator#Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.IBackChannelAuthenticationContextValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext) 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation\.IBackChannelAuthenticationContextValidator\.ValidateAsync\(Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation\.BackChannelAuthenticationValidationContext\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') Returns a [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') if the identity validation fails, or null if the identity is successfully validated\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.CheckSession.Interfaces.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ## Abblix\.Oidc\.Server\.Endpoints\.CheckSession\.Interfaces Namespace | Classes | | | :--- | :--- | | [CheckSessionResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.CheckSession.Interfaces.CheckSessionResponse 'Abblix\.Oidc\.Server\.Endpoints\.CheckSession\.Interfaces\.CheckSessionResponse') | Represents the response to a check session request in OpenID Connect Session Management\. This record contains the necessary information to ascertain the current state of a user session\. | | Interfaces | | | :--- | :--- | | [ICheckSessionHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.CheckSession.Interfaces.ICheckSessionHandler 'Abblix\.Oidc\.Server\.Endpoints\.CheckSession\.Interfaces\.ICheckSessionHandler') | Represents an interface for creating a response to build the content of an OpenID Connect check\-session frame \(OP frame\)\. This interface defines a method for asynchronously processing the check session request and generating a response\. | --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.CheckSession.Interfaces.CheckSessionResponse.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.CheckSession\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.CheckSession.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.CheckSession\.Interfaces') ## CheckSessionResponse Class Represents the response to a check session request in OpenID Connect Session Management\. This record contains the necessary information to ascertain the current state of a user session\. ```csharp public record CheckSessionResponse : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → CheckSessionResponse Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[CheckSessionResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.CheckSession.Interfaces.CheckSessionResponse 'Abblix\.Oidc\.Server\.Endpoints\.CheckSession\.Interfaces\.CheckSessionResponse')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Constructors ## CheckSessionResponse\(string, object\) Constructor {#Abblix.Oidc.Server.Endpoints.CheckSession.Interfaces.CheckSessionResponse.CheckSessionResponse(string,object)} Represents the response to a check session request in OpenID Connect Session Management\. This record contains the necessary information to ascertain the current state of a user session\. ```csharp public CheckSessionResponse(string HtmlContent, object CacheKey); ``` #### Parameters ###### `HtmlContent` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Endpoints.CheckSession.Interfaces.CheckSessionResponse.CheckSessionResponse(string,object).HtmlContent} The HTML content to be rendered, typically used in an iframe for session checking\. ###### `CacheKey` [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') {#Abblix.Oidc.Server.Endpoints.CheckSession.Interfaces.CheckSessionResponse.CheckSessionResponse(string,object).CacheKey} An object that represents a cache key, used for optimizing session state checks\. It serves as a key for caching the response to reduce frequent reevaluation when the session state is expected to remain unchanged for an extended period, enhancing performance\. ### Properties ## CheckSessionResponse\.CacheKey Property {#Abblix.Oidc.Server.Endpoints.CheckSession.Interfaces.CheckSessionResponse.CacheKey} An object that represents a cache key, used for optimizing session state checks\. It serves as a key for caching the response to reduce frequent reevaluation when the session state is expected to remain unchanged for an extended period, enhancing performance\. ```csharp public object CacheKey { get; init; } ``` #### Property Value [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') ## CheckSessionResponse\.HtmlContent Property {#Abblix.Oidc.Server.Endpoints.CheckSession.Interfaces.CheckSessionResponse.HtmlContent} The HTML content to be rendered, typically used in an iframe for session checking\. ```csharp public string HtmlContent { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.CheckSession.Interfaces.ICheckSessionHandler.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.CheckSession\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.CheckSession.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.CheckSession\.Interfaces') ## ICheckSessionHandler Interface Represents an interface for creating a response to build the content of an OpenID Connect check\-session frame \(OP frame\)\. This interface defines a method for asynchronously processing the check session request and generating a response\. ```csharp public interface ICheckSessionHandler ``` ### Methods ## ICheckSessionHandler\.HandleAsync\(\) Method {#Abblix.Oidc.Server.Endpoints.CheckSession.Interfaces.ICheckSessionHandler.HandleAsync()} Asynchronously processes the check session request and generates a response containing the content of the OP check\-session frame\. ```csharp System.Threading.Tasks.Task HandleAsync(); ``` #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[CheckSessionResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.CheckSession.Interfaces.CheckSessionResponse 'Abblix\.Oidc\.Server\.Endpoints\.CheckSession\.Interfaces\.CheckSessionResponse')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task representing the response, which includes the HTML content of the check\-session frame\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ## Abblix\.Oidc\.Server\.Endpoints\.Configuration Namespace | Classes | | | :--- | :--- | | [AcrMetadataProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.AcrMetadataProvider 'Abblix\.Oidc\.Server\.Endpoints\.Configuration\.AcrMetadataProvider') | Default implementation of IAcrMetadataProvider that reads ACR values from OidcOptions configuration\. | | [AuthorizationMetadataProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.AuthorizationMetadataProvider 'Abblix\.Oidc\.Server\.Endpoints\.Configuration\.AuthorizationMetadataProvider') | Provides authorization\-endpoint metadata for discovery, computed directly from the registered response builders\. Deliberately does not depend on [IAuthorizationHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationHandler 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.IAuthorizationHandler'): resolving the handler just to read metadata would also construct its request\-time dependencies \(the JARM response encoder and its crypto graph\), which the discovery path must not do\. | | [ConfigurationHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.ConfigurationHandler 'Abblix\.Oidc\.Server\.Endpoints\.Configuration\.ConfigurationHandler') | Handles OpenID Connect discovery configuration requests by building metadata response\. Returns framework\-agnostic discovery metadata without endpoint URLs\. | | [JwtAlgorithmsProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.JwtAlgorithmsProvider 'Abblix\.Oidc\.Server\.Endpoints\.Configuration\.JwtAlgorithmsProvider') | Provides JWT algorithm metadata by delegating to JWT creator and validator\. | | [ScopesAndClaimsProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.ScopesAndClaimsProvider 'Abblix\.Oidc\.Server\.Endpoints\.Configuration\.ScopesAndClaimsProvider') | Aggregates metadata about supported scopes, claims, grants, and subject types\. | | [SignedMetadataProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.SignedMetadataProvider 'Abblix\.Oidc\.Server\.Endpoints\.Configuration\.SignedMetadataProvider') | Signs the discovery document with one of this provider's own signing keys, per RFC 8414 §2\.1\. | --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.AcrMetadataProvider.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Configuration](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration 'Abblix\.Oidc\.Server\.Endpoints\.Configuration') ## AcrMetadataProvider Class Default implementation of IAcrMetadataProvider that reads ACR values from OidcOptions configuration\. ```csharp public sealed class AcrMetadataProvider : Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IAcrMetadataProvider ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → AcrMetadataProvider Implements [IAcrMetadataProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IAcrMetadataProvider 'Abblix\.Oidc\.Server\.Endpoints\.Configuration\.Interfaces\.IAcrMetadataProvider') ### Constructors ## AcrMetadataProvider\(IOptionsSnapshot\\) Constructor {#Abblix.Oidc.Server.Endpoints.Configuration.AcrMetadataProvider.AcrMetadataProvider(Microsoft.Extensions.Options.IOptionsSnapshot_Abblix.Oidc.Server.Common.Configuration.OidcOptions_)} Default implementation of IAcrMetadataProvider that reads ACR values from OidcOptions configuration\. ```csharp public AcrMetadataProvider(Microsoft.Extensions.Options.IOptionsSnapshot options); ``` #### Parameters ###### `options` [Microsoft\.Extensions\.Options\.IOptionsSnapshot<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptionssnapshot-1 'Microsoft\.Extensions\.Options\.IOptionsSnapshot\`1')[OidcOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptionssnapshot-1 'Microsoft\.Extensions\.Options\.IOptionsSnapshot\`1') {#Abblix.Oidc.Server.Endpoints.Configuration.AcrMetadataProvider.AcrMetadataProvider(Microsoft.Extensions.Options.IOptionsSnapshot_Abblix.Oidc.Server.Common.Configuration.OidcOptions_).options} ### Properties ## AcrMetadataProvider\.AcrValuesSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.AcrMetadataProvider.AcrValuesSupported} Lists the ACR \(Authentication Context Class Reference\) values supported by this provider\. These values represent authentication assurance levels that can be requested and achieved\. ```csharp public System.Collections.Generic.IEnumerable? AcrValuesSupported { get; } ``` Implements [AcrValuesSupported](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IAcrMetadataProvider#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IAcrMetadataProvider.AcrValuesSupported 'Abblix\.Oidc\.Server\.Endpoints\.Configuration\.Interfaces\.IAcrMetadataProvider\.AcrValuesSupported') #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.AuthorizationMetadataProvider.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Configuration](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration 'Abblix\.Oidc\.Server\.Endpoints\.Configuration') ## AuthorizationMetadataProvider Class Provides authorization\-endpoint metadata for discovery, computed directly from the registered response builders\. Deliberately does not depend on [IAuthorizationHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationHandler 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.IAuthorizationHandler'): resolving the handler just to read metadata would also construct its request\-time dependencies \(the JARM response encoder and its crypto graph\), which the discovery path must not do\. ```csharp public sealed class AuthorizationMetadataProvider : Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IAuthorizationMetadataProvider ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → AuthorizationMetadataProvider Implements [IAuthorizationMetadataProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IAuthorizationMetadataProvider 'Abblix\.Oidc\.Server\.Endpoints\.Configuration\.Interfaces\.IAuthorizationMetadataProvider') ### Constructors ## AuthorizationMetadataProvider\(IEnumerable\\) Constructor {#Abblix.Oidc.Server.Endpoints.Configuration.AuthorizationMetadataProvider.AuthorizationMetadataProvider(System.Collections.Generic.IEnumerable_Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseBuilder_)} Provides authorization\-endpoint metadata for discovery, computed directly from the registered response builders\. Deliberately does not depend on [IAuthorizationHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationHandler 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.IAuthorizationHandler'): resolving the handler just to read metadata would also construct its request\-time dependencies \(the JARM response encoder and its crypto graph\), which the discovery path must not do\. ```csharp public AuthorizationMetadataProvider(System.Collections.Generic.IEnumerable responseBuilders); ``` #### Parameters ###### `responseBuilders` [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[IAuthorizationResponseBuilder](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseBuilder 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.IAuthorizationResponseBuilder')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') {#Abblix.Oidc.Server.Endpoints.Configuration.AuthorizationMetadataProvider.AuthorizationMetadataProvider(System.Collections.Generic.IEnumerable_Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseBuilder_).responseBuilders} The registered response builders the supported response types are derived from\. ### Properties ## AuthorizationMetadataProvider\.AuthorizationResponseIssParameterSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.AuthorizationMetadataProvider.AuthorizationResponseIssParameterSupported} Indicates whether the server includes the `iss` parameter in authorization responses per RFC 9207\. ```csharp public bool AuthorizationResponseIssParameterSupported { get; init; } ``` Implements [AuthorizationResponseIssParameterSupported](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IAuthorizationMetadataProvider#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IAuthorizationMetadataProvider.AuthorizationResponseIssParameterSupported 'Abblix\.Oidc\.Server\.Endpoints\.Configuration\.Interfaces\.IAuthorizationMetadataProvider\.AuthorizationResponseIssParameterSupported') #### Property Value [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') ## AuthorizationMetadataProvider\.ClaimsParameterSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.AuthorizationMetadataProvider.ClaimsParameterSupported} Indicates whether the claims parameter is supported in authorization requests\. ```csharp public bool ClaimsParameterSupported { get; } ``` Implements [ClaimsParameterSupported](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IAuthorizationMetadataProvider#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IAuthorizationMetadataProvider.ClaimsParameterSupported 'Abblix\.Oidc\.Server\.Endpoints\.Configuration\.Interfaces\.IAuthorizationMetadataProvider\.ClaimsParameterSupported') #### Property Value [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') ## AuthorizationMetadataProvider\.CodeChallengeMethodsSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.AuthorizationMetadataProvider.CodeChallengeMethodsSupported} Lists the code challenge methods supported for PKCE\. ```csharp public System.Collections.Generic.IEnumerable CodeChallengeMethodsSupported { get; } ``` Implements [CodeChallengeMethodsSupported](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IAuthorizationMetadataProvider#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IAuthorizationMetadataProvider.CodeChallengeMethodsSupported 'Abblix\.Oidc\.Server\.Endpoints\.Configuration\.Interfaces\.IAuthorizationMetadataProvider\.CodeChallengeMethodsSupported') #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ## AuthorizationMetadataProvider\.PromptValuesSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.AuthorizationMetadataProvider.PromptValuesSupported} Lists the prompt values supported during authentication\. ```csharp public System.Collections.Generic.IEnumerable PromptValuesSupported { get; } ``` Implements [PromptValuesSupported](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IAuthorizationMetadataProvider#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IAuthorizationMetadataProvider.PromptValuesSupported 'Abblix\.Oidc\.Server\.Endpoints\.Configuration\.Interfaces\.IAuthorizationMetadataProvider\.PromptValuesSupported') #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ## AuthorizationMetadataProvider\.RequestParameterSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.AuthorizationMetadataProvider.RequestParameterSupported} Indicates whether the request parameter is supported in authorization requests\. ```csharp public bool RequestParameterSupported { get; } ``` Implements [RequestParameterSupported](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IAuthorizationMetadataProvider#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IAuthorizationMetadataProvider.RequestParameterSupported 'Abblix\.Oidc\.Server\.Endpoints\.Configuration\.Interfaces\.IAuthorizationMetadataProvider\.RequestParameterSupported') #### Property Value [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') ## AuthorizationMetadataProvider\.ResponseModesSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.AuthorizationMetadataProvider.ResponseModesSupported} Lists the response modes supported by the authorization endpoint\. ```csharp public System.Collections.Generic.IEnumerable ResponseModesSupported { get; } ``` Implements [ResponseModesSupported](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IAuthorizationMetadataProvider#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IAuthorizationMetadataProvider.ResponseModesSupported 'Abblix\.Oidc\.Server\.Endpoints\.Configuration\.Interfaces\.IAuthorizationMetadataProvider\.ResponseModesSupported') #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ## AuthorizationMetadataProvider\.ResponseTypesSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.AuthorizationMetadataProvider.ResponseTypesSupported} Lists the response types supported by the authorization endpoint\. ```csharp public System.Collections.Generic.IEnumerable ResponseTypesSupported { get; } ``` Implements [ResponseTypesSupported](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IAuthorizationMetadataProvider#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IAuthorizationMetadataProvider.ResponseTypesSupported 'Abblix\.Oidc\.Server\.Endpoints\.Configuration\.Interfaces\.IAuthorizationMetadataProvider\.ResponseTypesSupported') #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.ConfigurationHandler.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Configuration](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration 'Abblix\.Oidc\.Server\.Endpoints\.Configuration') ## ConfigurationHandler Class Handles OpenID Connect discovery configuration requests by building metadata response\. Returns framework\-agnostic discovery metadata without endpoint URLs\. ```csharp public sealed class ConfigurationHandler : Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IConfigurationHandler ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ConfigurationHandler Implements [IConfigurationHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IConfigurationHandler 'Abblix\.Oidc\.Server\.Endpoints\.Configuration\.Interfaces\.IConfigurationHandler') ### Constructors ## ConfigurationHandler\(IOptionsSnapshot\, IIssuerProvider, ILogoutNotifier, IClientAuthenticator, IAuthorizationMetadataProvider, IScopesAndClaimsProvider, IJwtAlgorithmsProvider, IEnumerable\, IAcrMetadataProvider, IAuthorizationDetailsMetadataProvider\) Constructor {#Abblix.Oidc.Server.Endpoints.Configuration.ConfigurationHandler.ConfigurationHandler(Microsoft.Extensions.Options.IOptionsSnapshot_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,Abblix.Oidc.Server.Features.Issuer.IIssuerProvider,Abblix.Oidc.Server.Features.LogoutNotification.ILogoutNotifier,Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator,Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IAuthorizationMetadataProvider,Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IScopesAndClaimsProvider,Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IJwtAlgorithmsProvider,System.Collections.Generic.IEnumerable_Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IAuthenticationCompletionHandler_,Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IAcrMetadataProvider,Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsMetadataProvider)} Handles OpenID Connect discovery configuration requests by building metadata response\. Returns framework\-agnostic discovery metadata without endpoint URLs\. ```csharp public ConfigurationHandler(Microsoft.Extensions.Options.IOptionsSnapshot options, Abblix.Oidc.Server.Features.Issuer.IIssuerProvider issuerProvider, Abblix.Oidc.Server.Features.LogoutNotification.ILogoutNotifier logoutNotifier, Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator clientAuthenticator, Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IAuthorizationMetadataProvider authorizationMetadata, Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IScopesAndClaimsProvider scopesAndClaims, Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IJwtAlgorithmsProvider jwtAlgorithms, System.Collections.Generic.IEnumerable cibaCompletionHandlers, Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IAcrMetadataProvider acrMetadata, Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsMetadataProvider authorizationDetailsMetadata); ``` #### Parameters ###### `options` [Microsoft\.Extensions\.Options\.IOptionsSnapshot<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptionssnapshot-1 'Microsoft\.Extensions\.Options\.IOptionsSnapshot\`1')[OidcOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptionssnapshot-1 'Microsoft\.Extensions\.Options\.IOptionsSnapshot\`1') {#Abblix.Oidc.Server.Endpoints.Configuration.ConfigurationHandler.ConfigurationHandler(Microsoft.Extensions.Options.IOptionsSnapshot_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,Abblix.Oidc.Server.Features.Issuer.IIssuerProvider,Abblix.Oidc.Server.Features.LogoutNotification.ILogoutNotifier,Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator,Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IAuthorizationMetadataProvider,Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IScopesAndClaimsProvider,Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IJwtAlgorithmsProvider,System.Collections.Generic.IEnumerable_Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IAuthenticationCompletionHandler_,Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IAcrMetadataProvider,Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsMetadataProvider).options} ###### `issuerProvider` [IIssuerProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Issuer.IIssuerProvider 'Abblix\.Oidc\.Server\.Features\.Issuer\.IIssuerProvider') {#Abblix.Oidc.Server.Endpoints.Configuration.ConfigurationHandler.ConfigurationHandler(Microsoft.Extensions.Options.IOptionsSnapshot_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,Abblix.Oidc.Server.Features.Issuer.IIssuerProvider,Abblix.Oidc.Server.Features.LogoutNotification.ILogoutNotifier,Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator,Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IAuthorizationMetadataProvider,Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IScopesAndClaimsProvider,Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IJwtAlgorithmsProvider,System.Collections.Generic.IEnumerable_Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IAuthenticationCompletionHandler_,Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IAcrMetadataProvider,Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsMetadataProvider).issuerProvider} ###### `logoutNotifier` [ILogoutNotifier](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.ILogoutNotifier 'Abblix\.Oidc\.Server\.Features\.LogoutNotification\.ILogoutNotifier') {#Abblix.Oidc.Server.Endpoints.Configuration.ConfigurationHandler.ConfigurationHandler(Microsoft.Extensions.Options.IOptionsSnapshot_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,Abblix.Oidc.Server.Features.Issuer.IIssuerProvider,Abblix.Oidc.Server.Features.LogoutNotification.ILogoutNotifier,Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator,Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IAuthorizationMetadataProvider,Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IScopesAndClaimsProvider,Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IJwtAlgorithmsProvider,System.Collections.Generic.IEnumerable_Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IAuthenticationCompletionHandler_,Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IAcrMetadataProvider,Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsMetadataProvider).logoutNotifier} ###### `clientAuthenticator` [IClientAuthenticator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator 'Abblix\.Oidc\.Server\.Features\.ClientAuthentication\.IClientAuthenticator') {#Abblix.Oidc.Server.Endpoints.Configuration.ConfigurationHandler.ConfigurationHandler(Microsoft.Extensions.Options.IOptionsSnapshot_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,Abblix.Oidc.Server.Features.Issuer.IIssuerProvider,Abblix.Oidc.Server.Features.LogoutNotification.ILogoutNotifier,Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator,Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IAuthorizationMetadataProvider,Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IScopesAndClaimsProvider,Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IJwtAlgorithmsProvider,System.Collections.Generic.IEnumerable_Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IAuthenticationCompletionHandler_,Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IAcrMetadataProvider,Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsMetadataProvider).clientAuthenticator} ###### `authorizationMetadata` [IAuthorizationMetadataProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IAuthorizationMetadataProvider 'Abblix\.Oidc\.Server\.Endpoints\.Configuration\.Interfaces\.IAuthorizationMetadataProvider') {#Abblix.Oidc.Server.Endpoints.Configuration.ConfigurationHandler.ConfigurationHandler(Microsoft.Extensions.Options.IOptionsSnapshot_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,Abblix.Oidc.Server.Features.Issuer.IIssuerProvider,Abblix.Oidc.Server.Features.LogoutNotification.ILogoutNotifier,Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator,Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IAuthorizationMetadataProvider,Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IScopesAndClaimsProvider,Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IJwtAlgorithmsProvider,System.Collections.Generic.IEnumerable_Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IAuthenticationCompletionHandler_,Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IAcrMetadataProvider,Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsMetadataProvider).authorizationMetadata} ###### `scopesAndClaims` [IScopesAndClaimsProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IScopesAndClaimsProvider 'Abblix\.Oidc\.Server\.Endpoints\.Configuration\.Interfaces\.IScopesAndClaimsProvider') {#Abblix.Oidc.Server.Endpoints.Configuration.ConfigurationHandler.ConfigurationHandler(Microsoft.Extensions.Options.IOptionsSnapshot_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,Abblix.Oidc.Server.Features.Issuer.IIssuerProvider,Abblix.Oidc.Server.Features.LogoutNotification.ILogoutNotifier,Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator,Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IAuthorizationMetadataProvider,Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IScopesAndClaimsProvider,Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IJwtAlgorithmsProvider,System.Collections.Generic.IEnumerable_Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IAuthenticationCompletionHandler_,Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IAcrMetadataProvider,Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsMetadataProvider).scopesAndClaims} ###### `jwtAlgorithms` [IJwtAlgorithmsProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IJwtAlgorithmsProvider 'Abblix\.Oidc\.Server\.Endpoints\.Configuration\.Interfaces\.IJwtAlgorithmsProvider') {#Abblix.Oidc.Server.Endpoints.Configuration.ConfigurationHandler.ConfigurationHandler(Microsoft.Extensions.Options.IOptionsSnapshot_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,Abblix.Oidc.Server.Features.Issuer.IIssuerProvider,Abblix.Oidc.Server.Features.LogoutNotification.ILogoutNotifier,Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator,Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IAuthorizationMetadataProvider,Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IScopesAndClaimsProvider,Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IJwtAlgorithmsProvider,System.Collections.Generic.IEnumerable_Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IAuthenticationCompletionHandler_,Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IAcrMetadataProvider,Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsMetadataProvider).jwtAlgorithms} ###### `cibaCompletionHandlers` [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[IAuthenticationCompletionHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IAuthenticationCompletionHandler 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces\.IAuthenticationCompletionHandler')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') {#Abblix.Oidc.Server.Endpoints.Configuration.ConfigurationHandler.ConfigurationHandler(Microsoft.Extensions.Options.IOptionsSnapshot_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,Abblix.Oidc.Server.Features.Issuer.IIssuerProvider,Abblix.Oidc.Server.Features.LogoutNotification.ILogoutNotifier,Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator,Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IAuthorizationMetadataProvider,Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IScopesAndClaimsProvider,Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IJwtAlgorithmsProvider,System.Collections.Generic.IEnumerable_Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IAuthenticationCompletionHandler_,Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IAcrMetadataProvider,Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsMetadataProvider).cibaCompletionHandlers} ###### `acrMetadata` [IAcrMetadataProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IAcrMetadataProvider 'Abblix\.Oidc\.Server\.Endpoints\.Configuration\.Interfaces\.IAcrMetadataProvider') {#Abblix.Oidc.Server.Endpoints.Configuration.ConfigurationHandler.ConfigurationHandler(Microsoft.Extensions.Options.IOptionsSnapshot_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,Abblix.Oidc.Server.Features.Issuer.IIssuerProvider,Abblix.Oidc.Server.Features.LogoutNotification.ILogoutNotifier,Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator,Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IAuthorizationMetadataProvider,Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IScopesAndClaimsProvider,Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IJwtAlgorithmsProvider,System.Collections.Generic.IEnumerable_Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IAuthenticationCompletionHandler_,Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IAcrMetadataProvider,Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsMetadataProvider).acrMetadata} ###### `authorizationDetailsMetadata` [IAuthorizationDetailsMetadataProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsMetadataProvider 'Abblix\.Oidc\.Server\.Features\.RichAuthorizationRequests\.IAuthorizationDetailsMetadataProvider') {#Abblix.Oidc.Server.Endpoints.Configuration.ConfigurationHandler.ConfigurationHandler(Microsoft.Extensions.Options.IOptionsSnapshot_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,Abblix.Oidc.Server.Features.Issuer.IIssuerProvider,Abblix.Oidc.Server.Features.LogoutNotification.ILogoutNotifier,Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator,Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IAuthorizationMetadataProvider,Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IScopesAndClaimsProvider,Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IJwtAlgorithmsProvider,System.Collections.Generic.IEnumerable_Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IAuthenticationCompletionHandler_,Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IAcrMetadataProvider,Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsMetadataProvider).authorizationDetailsMetadata} ### Methods ## ConfigurationHandler\.HandleAsync\(\) Method {#Abblix.Oidc.Server.Endpoints.Configuration.ConfigurationHandler.HandleAsync()} Handles the configuration request by building discovery metadata\. ```csharp public System.Threading.Tasks.Task HandleAsync(); ``` Implements [HandleAsync\(\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IConfigurationHandler#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IConfigurationHandler.HandleAsync() 'Abblix\.Oidc\.Server\.Endpoints\.Configuration\.Interfaces\.IConfigurationHandler\.HandleAsync\(\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[ConfigurationResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.ConfigurationResponse 'Abblix\.Oidc\.Server\.Endpoints\.Configuration\.Interfaces\.ConfigurationResponse')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') Configuration response with metadata but without resolved endpoint URLs\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.JwtAlgorithmsProvider.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Configuration](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration 'Abblix\.Oidc\.Server\.Endpoints\.Configuration') ## JwtAlgorithmsProvider Class Provides JWT algorithm metadata by delegating to JWT creator and validator\. ```csharp public sealed class JwtAlgorithmsProvider : Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IJwtAlgorithmsProvider ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → JwtAlgorithmsProvider Implements [IJwtAlgorithmsProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IJwtAlgorithmsProvider 'Abblix\.Oidc\.Server\.Endpoints\.Configuration\.Interfaces\.IJwtAlgorithmsProvider') ### Constructors ## JwtAlgorithmsProvider\(IJsonWebTokenCreator, IJsonWebTokenValidator\) Constructor {#Abblix.Oidc.Server.Endpoints.Configuration.JwtAlgorithmsProvider.JwtAlgorithmsProvider(Abblix.Jwt.IJsonWebTokenCreator,Abblix.Jwt.IJsonWebTokenValidator)} Provides JWT algorithm metadata by delegating to JWT creator and validator\. ```csharp public JwtAlgorithmsProvider(Abblix.Jwt.IJsonWebTokenCreator jwtCreator, Abblix.Jwt.IJsonWebTokenValidator jwtValidator); ``` #### Parameters ###### `jwtCreator` [IJsonWebTokenCreator](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.IJsonWebTokenCreator 'Abblix\.Jwt\.IJsonWebTokenCreator') {#Abblix.Oidc.Server.Endpoints.Configuration.JwtAlgorithmsProvider.JwtAlgorithmsProvider(Abblix.Jwt.IJsonWebTokenCreator,Abblix.Jwt.IJsonWebTokenValidator).jwtCreator} ###### `jwtValidator` [IJsonWebTokenValidator](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.IJsonWebTokenValidator 'Abblix\.Jwt\.IJsonWebTokenValidator') {#Abblix.Oidc.Server.Endpoints.Configuration.JwtAlgorithmsProvider.JwtAlgorithmsProvider(Abblix.Jwt.IJsonWebTokenCreator,Abblix.Jwt.IJsonWebTokenValidator).jwtValidator} ### Properties ## JwtAlgorithmsProvider\.AuthorizationEncryptionAlgValuesSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.JwtAlgorithmsProvider.AuthorizationEncryptionAlgValuesSupported} Lists the JWE key\-management algorithms \(the `alg` values\) the authorization server can use to encrypt JARM authorization responses, advertised via `authorization_encryption_alg_values_supported` \(JARM §4\)\. ```csharp public System.Collections.Generic.IEnumerable AuthorizationEncryptionAlgValuesSupported { get; } ``` Implements [AuthorizationEncryptionAlgValuesSupported](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IJwtAlgorithmsProvider#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IJwtAlgorithmsProvider.AuthorizationEncryptionAlgValuesSupported 'Abblix\.Oidc\.Server\.Endpoints\.Configuration\.Interfaces\.IJwtAlgorithmsProvider\.AuthorizationEncryptionAlgValuesSupported') #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ## JwtAlgorithmsProvider\.AuthorizationEncryptionEncValuesSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.JwtAlgorithmsProvider.AuthorizationEncryptionEncValuesSupported} Lists the JWE content\-encryption algorithms \(the `enc` values\) the authorization server can use to encrypt JARM authorization responses, advertised via `authorization_encryption_enc_values_supported` \(JARM §4\)\. ```csharp public System.Collections.Generic.IEnumerable AuthorizationEncryptionEncValuesSupported { get; } ``` Implements [AuthorizationEncryptionEncValuesSupported](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IJwtAlgorithmsProvider#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IJwtAlgorithmsProvider.AuthorizationEncryptionEncValuesSupported 'Abblix\.Oidc\.Server\.Endpoints\.Configuration\.Interfaces\.IJwtAlgorithmsProvider\.AuthorizationEncryptionEncValuesSupported') #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ## JwtAlgorithmsProvider\.AuthorizationSigningAlgValuesSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.JwtAlgorithmsProvider.AuthorizationSigningAlgValuesSupported} Lists the JWS algorithms the authorization server uses to sign JARM authorization responses, advertised via `authorization_signing_alg_values_supported` \(JARM §4\)\. ```csharp public System.Collections.Generic.IEnumerable AuthorizationSigningAlgValuesSupported { get; } ``` Implements [AuthorizationSigningAlgValuesSupported](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IJwtAlgorithmsProvider#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IJwtAlgorithmsProvider.AuthorizationSigningAlgValuesSupported 'Abblix\.Oidc\.Server\.Endpoints\.Configuration\.Interfaces\.IJwtAlgorithmsProvider\.AuthorizationSigningAlgValuesSupported') #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ## JwtAlgorithmsProvider\.BackChannelAuthenticationRequestSigningAlgValuesSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.JwtAlgorithmsProvider.BackChannelAuthenticationRequestSigningAlgValuesSupported} CIBA Core §7\.1\.1 requires the signed backchannel authentication request to use an asymmetric algorithm, so both "none" and the symmetric HS\* algorithms are excluded here\. ```csharp public System.Collections.Generic.IEnumerable BackChannelAuthenticationRequestSigningAlgValuesSupported { get; } ``` Implements [BackChannelAuthenticationRequestSigningAlgValuesSupported](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IJwtAlgorithmsProvider#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IJwtAlgorithmsProvider.BackChannelAuthenticationRequestSigningAlgValuesSupported 'Abblix\.Oidc\.Server\.Endpoints\.Configuration\.Interfaces\.IJwtAlgorithmsProvider\.BackChannelAuthenticationRequestSigningAlgValuesSupported') #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ## JwtAlgorithmsProvider\.DpopSigningAlgorithmsSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.JwtAlgorithmsProvider.DpopSigningAlgorithmsSupported} Lists the JWS signing algorithms the authorization server accepts on inbound DPoP proofs \(RFC 9449 §5\.1 `dpop_signing_alg_values_supported`\): the intersection of [SigningAlgorithmsSupported](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IJwtAlgorithmsProvider#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IJwtAlgorithmsProvider.SigningAlgorithmsSupported 'Abblix\.Oidc\.Server\.Endpoints\.Configuration\.Interfaces\.IJwtAlgorithmsProvider\.SigningAlgorithmsSupported') with the static DPoP\-compatible whitelist\. The validator\-side set is the source \- the AS verifies proofs the client signs, it does not issue them\. ```csharp public System.Collections.Generic.IEnumerable DpopSigningAlgorithmsSupported { get; } ``` Implements [DpopSigningAlgorithmsSupported](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IJwtAlgorithmsProvider#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IJwtAlgorithmsProvider.DpopSigningAlgorithmsSupported 'Abblix\.Oidc\.Server\.Endpoints\.Configuration\.Interfaces\.IJwtAlgorithmsProvider\.DpopSigningAlgorithmsSupported') #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ## JwtAlgorithmsProvider\.IntrospectionEncryptionAlgValuesSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.JwtAlgorithmsProvider.IntrospectionEncryptionAlgValuesSupported} Lists the JWE key\-management algorithms \(the `alg` values\) the authorization server can use to encrypt JWT introspection responses, advertised via `introspection_encryption_alg_values_supported` \(RFC 9701 §7\)\. ```csharp public System.Collections.Generic.IEnumerable IntrospectionEncryptionAlgValuesSupported { get; } ``` Implements [IntrospectionEncryptionAlgValuesSupported](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IJwtAlgorithmsProvider#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IJwtAlgorithmsProvider.IntrospectionEncryptionAlgValuesSupported 'Abblix\.Oidc\.Server\.Endpoints\.Configuration\.Interfaces\.IJwtAlgorithmsProvider\.IntrospectionEncryptionAlgValuesSupported') #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ## JwtAlgorithmsProvider\.IntrospectionEncryptionEncValuesSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.JwtAlgorithmsProvider.IntrospectionEncryptionEncValuesSupported} Lists the JWE content\-encryption algorithms \(the `enc` values\) the authorization server can use to encrypt JWT introspection responses, advertised via `introspection_encryption_enc_values_supported` \(RFC 9701 §7\)\. ```csharp public System.Collections.Generic.IEnumerable IntrospectionEncryptionEncValuesSupported { get; } ``` Implements [IntrospectionEncryptionEncValuesSupported](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IJwtAlgorithmsProvider#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IJwtAlgorithmsProvider.IntrospectionEncryptionEncValuesSupported 'Abblix\.Oidc\.Server\.Endpoints\.Configuration\.Interfaces\.IJwtAlgorithmsProvider\.IntrospectionEncryptionEncValuesSupported') #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ## JwtAlgorithmsProvider\.IntrospectionSigningAlgValuesSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.JwtAlgorithmsProvider.IntrospectionSigningAlgValuesSupported} Lists the JWS algorithms the authorization server uses to sign JWT introspection responses, advertised via `introspection_signing_alg_values_supported` \(RFC 9701 §7\)\. ```csharp public System.Collections.Generic.IEnumerable IntrospectionSigningAlgValuesSupported { get; } ``` Implements [IntrospectionSigningAlgValuesSupported](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IJwtAlgorithmsProvider#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IJwtAlgorithmsProvider.IntrospectionSigningAlgValuesSupported 'Abblix\.Oidc\.Server\.Endpoints\.Configuration\.Interfaces\.IJwtAlgorithmsProvider\.IntrospectionSigningAlgValuesSupported') #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ## JwtAlgorithmsProvider\.RequestObjectEncryptionAlgValuesSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.JwtAlgorithmsProvider.RequestObjectEncryptionAlgValuesSupported} Lists the JWE key\-management algorithms \(the `alg` values\) the authorization server accepts when a client encrypts a request object to the server \(RFC 9101 §6\.1\), advertised via `request_object_encryption_alg_values_supported`\. ```csharp public System.Collections.Generic.IEnumerable RequestObjectEncryptionAlgValuesSupported { get; } ``` Implements [RequestObjectEncryptionAlgValuesSupported](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IJwtAlgorithmsProvider#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IJwtAlgorithmsProvider.RequestObjectEncryptionAlgValuesSupported 'Abblix\.Oidc\.Server\.Endpoints\.Configuration\.Interfaces\.IJwtAlgorithmsProvider\.RequestObjectEncryptionAlgValuesSupported') #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ## JwtAlgorithmsProvider\.RequestObjectEncryptionEncValuesSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.JwtAlgorithmsProvider.RequestObjectEncryptionEncValuesSupported} Lists the JWE content\-encryption algorithms \(the `enc` values\) the authorization server accepts when a client encrypts a request object to the server \(RFC 9101 §6\.1\), advertised via `request_object_encryption_enc_values_supported`\. ```csharp public System.Collections.Generic.IEnumerable RequestObjectEncryptionEncValuesSupported { get; } ``` Implements [RequestObjectEncryptionEncValuesSupported](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IJwtAlgorithmsProvider#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IJwtAlgorithmsProvider.RequestObjectEncryptionEncValuesSupported 'Abblix\.Oidc\.Server\.Endpoints\.Configuration\.Interfaces\.IJwtAlgorithmsProvider\.RequestObjectEncryptionEncValuesSupported') #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ## JwtAlgorithmsProvider\.SignedResponseAlgorithmsSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.JwtAlgorithmsProvider.SignedResponseAlgorithmsSupported} Lists the signing algorithms supported for ID tokens and UserInfo responses\. ```csharp public System.Collections.Generic.IEnumerable SignedResponseAlgorithmsSupported { get; } ``` Implements [SignedResponseAlgorithmsSupported](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IJwtAlgorithmsProvider#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IJwtAlgorithmsProvider.SignedResponseAlgorithmsSupported 'Abblix\.Oidc\.Server\.Endpoints\.Configuration\.Interfaces\.IJwtAlgorithmsProvider\.SignedResponseAlgorithmsSupported') #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ## JwtAlgorithmsProvider\.SigningAlgorithmsSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.JwtAlgorithmsProvider.SigningAlgorithmsSupported} Lists the signing algorithms supported for validating signed requests and authentication\. ```csharp public System.Collections.Generic.IEnumerable SigningAlgorithmsSupported { get; } ``` Implements [SigningAlgorithmsSupported](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IJwtAlgorithmsProvider#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IJwtAlgorithmsProvider.SigningAlgorithmsSupported 'Abblix\.Oidc\.Server\.Endpoints\.Configuration\.Interfaces\.IJwtAlgorithmsProvider\.SigningAlgorithmsSupported') #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ## JwtAlgorithmsProvider\.TokenEndpointAuthSigningAlgValuesSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.JwtAlgorithmsProvider.TokenEndpointAuthSigningAlgValuesSupported} RFC 8414 §2 and OpenID Connect Discovery 1\.0 §3 both state the value "none" MUST NOT appear in token\_endpoint\_auth\_signing\_alg\_values\_supported \- a client authenticates by signing a JWT assertion, so an unsecured assertion would prove nothing\. HS\* stay because client\_secret\_jwt legitimately keys on the shared client secret\. ```csharp public System.Collections.Generic.IEnumerable TokenEndpointAuthSigningAlgValuesSupported { get; } ``` Implements [TokenEndpointAuthSigningAlgValuesSupported](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IJwtAlgorithmsProvider#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IJwtAlgorithmsProvider.TokenEndpointAuthSigningAlgValuesSupported 'Abblix\.Oidc\.Server\.Endpoints\.Configuration\.Interfaces\.IJwtAlgorithmsProvider\.TokenEndpointAuthSigningAlgValuesSupported') #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.ScopesAndClaimsProvider.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Configuration](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration 'Abblix\.Oidc\.Server\.Endpoints\.Configuration') ## ScopesAndClaimsProvider Class Aggregates metadata about supported scopes, claims, grants, and subject types\. ```csharp public sealed class ScopesAndClaimsProvider : Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IScopesAndClaimsProvider ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ScopesAndClaimsProvider Implements [IScopesAndClaimsProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IScopesAndClaimsProvider 'Abblix\.Oidc\.Server\.Endpoints\.Configuration\.Interfaces\.IScopesAndClaimsProvider') ### Constructors ## ScopesAndClaimsProvider\(IScopeClaimsProvider, IEnumerable\, ISubjectTypeConverter\) Constructor {#Abblix.Oidc.Server.Endpoints.Configuration.ScopesAndClaimsProvider.ScopesAndClaimsProvider(Abblix.Oidc.Server.Features.UserInfo.IScopeClaimsProvider,System.Collections.Generic.IEnumerable_Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer_,Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter)} Aggregates metadata about supported scopes, claims, grants, and subject types\. ```csharp public ScopesAndClaimsProvider(Abblix.Oidc.Server.Features.UserInfo.IScopeClaimsProvider scopeClaimsProvider, System.Collections.Generic.IEnumerable grantTypeProviders, Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter subjectTypeConverter); ``` #### Parameters ###### `scopeClaimsProvider` [IScopeClaimsProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.UserInfo.IScopeClaimsProvider 'Abblix\.Oidc\.Server\.Features\.UserInfo\.IScopeClaimsProvider') {#Abblix.Oidc.Server.Endpoints.Configuration.ScopesAndClaimsProvider.ScopesAndClaimsProvider(Abblix.Oidc.Server.Features.UserInfo.IScopeClaimsProvider,System.Collections.Generic.IEnumerable_Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer_,Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter).scopeClaimsProvider} ###### `grantTypeProviders` [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[IGrantTypeInformer](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IGrantTypeInformer')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') {#Abblix.Oidc.Server.Endpoints.Configuration.ScopesAndClaimsProvider.ScopesAndClaimsProvider(Abblix.Oidc.Server.Features.UserInfo.IScopeClaimsProvider,System.Collections.Generic.IEnumerable_Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer_,Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter).grantTypeProviders} ###### `subjectTypeConverter` [ISubjectTypeConverter](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter 'Abblix\.Oidc\.Server\.Features\.PairwiseIdentifiers\.ISubjectTypeConverter') {#Abblix.Oidc.Server.Endpoints.Configuration.ScopesAndClaimsProvider.ScopesAndClaimsProvider(Abblix.Oidc.Server.Features.UserInfo.IScopeClaimsProvider,System.Collections.Generic.IEnumerable_Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer_,Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter).subjectTypeConverter} ### Properties ## ScopesAndClaimsProvider\.ClaimsSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.ScopesAndClaimsProvider.ClaimsSupported} Lists the claims supported by the OpenID Provider\. ```csharp public System.Collections.Generic.IEnumerable ClaimsSupported { get; } ``` Implements [ClaimsSupported](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IScopesAndClaimsProvider#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IScopesAndClaimsProvider.ClaimsSupported 'Abblix\.Oidc\.Server\.Endpoints\.Configuration\.Interfaces\.IScopesAndClaimsProvider\.ClaimsSupported') #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ## ScopesAndClaimsProvider\.GrantTypesSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.ScopesAndClaimsProvider.GrantTypesSupported} Lists the grant types supported by the OpenID Provider\. ```csharp public System.Collections.Generic.IEnumerable GrantTypesSupported { get; } ``` Implements [GrantTypesSupported](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IScopesAndClaimsProvider#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IScopesAndClaimsProvider.GrantTypesSupported 'Abblix\.Oidc\.Server\.Endpoints\.Configuration\.Interfaces\.IScopesAndClaimsProvider\.GrantTypesSupported') #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ## ScopesAndClaimsProvider\.ScopesSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.ScopesAndClaimsProvider.ScopesSupported} Lists the scopes supported by the OpenID Provider\. ```csharp public System.Collections.Generic.IEnumerable ScopesSupported { get; } ``` Implements [ScopesSupported](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IScopesAndClaimsProvider#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IScopesAndClaimsProvider.ScopesSupported 'Abblix\.Oidc\.Server\.Endpoints\.Configuration\.Interfaces\.IScopesAndClaimsProvider\.ScopesSupported') #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ## ScopesAndClaimsProvider\.SubjectTypesSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.ScopesAndClaimsProvider.SubjectTypesSupported} Lists the subject types supported by the OpenID Provider\. ```csharp public System.Collections.Generic.IEnumerable SubjectTypesSupported { get; } ``` Implements [SubjectTypesSupported](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IScopesAndClaimsProvider#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IScopesAndClaimsProvider.SubjectTypesSupported 'Abblix\.Oidc\.Server\.Endpoints\.Configuration\.Interfaces\.IScopesAndClaimsProvider\.SubjectTypesSupported') #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.SignedMetadataProvider.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Configuration](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration 'Abblix\.Oidc\.Server\.Endpoints\.Configuration') ## SignedMetadataProvider Class Signs the discovery document with one of this provider's own signing keys, per RFC 8414 §2\.1\. ```csharp public class SignedMetadataProvider : Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.ISignedMetadataProvider ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → SignedMetadataProvider Implements [ISignedMetadataProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.ISignedMetadataProvider 'Abblix\.Oidc\.Server\.Endpoints\.Configuration\.Interfaces\.ISignedMetadataProvider') ### Constructors ## SignedMetadataProvider\(IJsonWebTokenCreator, IAuthServiceKeysProvider, TimeProvider\) Constructor {#Abblix.Oidc.Server.Endpoints.Configuration.SignedMetadataProvider.SignedMetadataProvider(Abblix.Jwt.IJsonWebTokenCreator,Abblix.Oidc.Server.Common.Interfaces.IAuthServiceKeysProvider,System.TimeProvider)} Signs the discovery document with one of this provider's own signing keys, per RFC 8414 §2\.1\. ```csharp public SignedMetadataProvider(Abblix.Jwt.IJsonWebTokenCreator jwtCreator, Abblix.Oidc.Server.Common.Interfaces.IAuthServiceKeysProvider serviceKeysProvider, System.TimeProvider clock); ``` #### Parameters ###### `jwtCreator` [IJsonWebTokenCreator](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.IJsonWebTokenCreator 'Abblix\.Jwt\.IJsonWebTokenCreator') {#Abblix.Oidc.Server.Endpoints.Configuration.SignedMetadataProvider.SignedMetadataProvider(Abblix.Jwt.IJsonWebTokenCreator,Abblix.Oidc.Server.Common.Interfaces.IAuthServiceKeysProvider,System.TimeProvider).jwtCreator} Issues the JWS\. ###### `serviceKeysProvider` [IAuthServiceKeysProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IAuthServiceKeysProvider 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IAuthServiceKeysProvider') {#Abblix.Oidc.Server.Endpoints.Configuration.SignedMetadataProvider.SignedMetadataProvider(Abblix.Jwt.IJsonWebTokenCreator,Abblix.Oidc.Server.Common.Interfaces.IAuthServiceKeysProvider,System.TimeProvider).serviceKeysProvider} Supplies this provider's signing keys\. ###### `clock` [System\.TimeProvider](https://learn.microsoft.com/en-us/dotnet/api/system.timeprovider 'System\.TimeProvider') {#Abblix.Oidc.Server.Endpoints.Configuration.SignedMetadataProvider.SignedMetadataProvider(Abblix.Jwt.IJsonWebTokenCreator,Abblix.Oidc.Server.Common.Interfaces.IAuthServiceKeysProvider,System.TimeProvider).clock} Stamps `iat`\. ### Methods ## SignedMetadataProvider\.SignAsync\(ConfigurationResponse\) Method {#Abblix.Oidc.Server.Endpoints.Configuration.SignedMetadataProvider.SignAsync(Abblix.Oidc.Server.Model.ConfigurationResponse)} Signs [metadata](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.SignedMetadataProvider#Abblix.Oidc.Server.Endpoints.Configuration.SignedMetadataProvider.SignAsync(Abblix.Oidc.Server.Model.ConfigurationResponse).metadata 'Abblix\.Oidc\.Server\.Endpoints\.Configuration\.SignedMetadataProvider\.SignAsync\(Abblix\.Oidc\.Server\.Model\.ConfigurationResponse\)\.metadata') and returns the compact JWS\. ```csharp public System.Threading.Tasks.Task SignAsync(Abblix.Oidc.Server.Model.ConfigurationResponse metadata); ``` #### Parameters ###### `metadata` [ConfigurationResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ConfigurationResponse 'Abblix\.Oidc\.Server\.Model\.ConfigurationResponse') {#Abblix.Oidc.Server.Endpoints.Configuration.SignedMetadataProvider.SignAsync(Abblix.Oidc.Server.Model.ConfigurationResponse).metadata} The fully assembled metadata, including resolved endpoint URLs and any mTLS aliases, and without `signed_metadata` itself: RFC 8414 §2\.1 has the bundle assert the metadata, not restate its own signature\. Implements [SignAsync\(ConfigurationResponse\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.ISignedMetadataProvider#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.ISignedMetadataProvider.SignAsync(Abblix.Oidc.Server.Model.ConfigurationResponse) 'Abblix\.Oidc\.Server\.Endpoints\.Configuration\.Interfaces\.ISignedMetadataProvider\.SignAsync\(Abblix\.Oidc\.Server\.Model\.ConfigurationResponse\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') The compact\-serialized JWS\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ## Abblix\.Oidc\.Server\.Endpoints\.Configuration\.Interfaces Namespace | Classes | | | :--- | :--- | | [ConfigurationResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.ConfigurationResponse 'Abblix\.Oidc\.Server\.Endpoints\.Configuration\.Interfaces\.ConfigurationResponse') | Framework\-agnostic OpenID Connect discovery metadata response\. Contains provider capabilities, supported features, and cryptographic algorithms, but excludes endpoint URLs which are framework\-specific\. | | Interfaces | | | :--- | :--- | | [IAcrMetadataProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IAcrMetadataProvider 'Abblix\.Oidc\.Server\.Endpoints\.Configuration\.Interfaces\.IAcrMetadataProvider') | Provides metadata about supported ACR \(Authentication Context Class Reference\) values for OpenID Connect discovery document\. | | [IAuthorizationMetadataProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IAuthorizationMetadataProvider 'Abblix\.Oidc\.Server\.Endpoints\.Configuration\.Interfaces\.IAuthorizationMetadataProvider') | Provides authorization\-related metadata for OpenID Connect discovery\. | | [IConfigurationHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IConfigurationHandler 'Abblix\.Oidc\.Server\.Endpoints\.Configuration\.Interfaces\.IConfigurationHandler') | Builds the discovery document served at `/.well-known/openid-configuration` per OpenID Connect Discovery 1\.0 §3 and RFC 8414 \(OAuth 2\.0 Authorization Server Metadata\)\. | | [IJwtAlgorithmsProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IJwtAlgorithmsProvider 'Abblix\.Oidc\.Server\.Endpoints\.Configuration\.Interfaces\.IJwtAlgorithmsProvider') | Provides metadata about supported JWT signing and validation algorithms for OpenID Connect discovery\. | | [IScopesAndClaimsProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IScopesAndClaimsProvider 'Abblix\.Oidc\.Server\.Endpoints\.Configuration\.Interfaces\.IScopesAndClaimsProvider') | Provides metadata about supported scopes, claims, grants, and subject types for OpenID Connect discovery\. | | [ISignedMetadataProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.ISignedMetadataProvider 'Abblix\.Oidc\.Server\.Endpoints\.Configuration\.Interfaces\.ISignedMetadataProvider') | Produces the RFC 8414 §2\.1 `signed_metadata` value for a discovery document\. | --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.ConfigurationResponse.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Configuration\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.Configuration\.Interfaces') ## ConfigurationResponse Class Framework\-agnostic OpenID Connect discovery metadata response\. Contains provider capabilities, supported features, and cryptographic algorithms, but excludes endpoint URLs which are framework\-specific\. ```csharp public record ConfigurationResponse : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ConfigurationResponse Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[ConfigurationResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.ConfigurationResponse 'Abblix\.Oidc\.Server\.Endpoints\.Configuration\.Interfaces\.ConfigurationResponse')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Remarks Each member's C\# nullability mirrors what OpenID Connect Discovery 1\.0 section 3 says about the corresponding metadata field, so that the compiler asks of a handler exactly what the specification asks of a provider\. The four fields that section marks REQUIRED are `required` here; everything else is nullable, because RECOMMENDED and OPTIONAL fields are legitimately absent and `null` is how this type says "not stated" \(the wire model omits nulls entirely\)\. Several of the optional ones carry a default that applies precisely when the field is omitted, so omission is an answer rather than a gap: `grant_types_supported` defaults to authorization code and implicit, `response_modes_supported` to query and fragment, and `token_endpoint_auth_methods_supported` to client\_secret\_basic\. Before this, all eleven were declared non\-nullable with a null\-forgiving initialiser, which swore they were always present while nothing enforced it\. A custom [IConfigurationHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IConfigurationHandler 'Abblix\.Oidc\.Server\.Endpoints\.Configuration\.Interfaces\.IConfigurationHandler') that left one out produced no error at all: the null travelled into the wire model, whose null\-omitting serialisation dropped the field, so a discovery document could silently ship without a REQUIRED member and answer 200\. ### Properties ## ConfigurationResponse\.AcrValuesSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.ConfigurationResponse.AcrValuesSupported} Lists the ACR \(Authentication Context Class Reference\) values supported by the OpenID Provider\. ```csharp public System.Collections.Generic.IEnumerable? AcrValuesSupported { get; init; } ``` #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ## ConfigurationResponse\.AuthorizationDetailsTypesSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.ConfigurationResponse.AuthorizationDetailsTypesSupported} RFC 9396 §10: the authorization\-detail `type` values this server's host has registered validators for\. Sourced from the same keyed\-DI registry that request\-time dispatch uses; emitted as `authorization_details_types_supported` on the wire, or omitted when null \(no per\-type validators registered\)\. ```csharp public System.Collections.Generic.IEnumerable? AuthorizationDetailsTypesSupported { get; init; } ``` #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ## ConfigurationResponse\.AuthorizationEncryptionAlgValuesSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.ConfigurationResponse.AuthorizationEncryptionAlgValuesSupported} Specifies the JWE key\-management algorithms \(the `alg` values\) supported for encrypting JARM authorization responses \(JARM §4\)\. ```csharp public System.Collections.Generic.IEnumerable? AuthorizationEncryptionAlgValuesSupported { get; init; } ``` #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ## ConfigurationResponse\.AuthorizationEncryptionEncValuesSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.ConfigurationResponse.AuthorizationEncryptionEncValuesSupported} Specifies the JWE content\-encryption algorithms \(the `enc` values\) supported for encrypting JARM authorization responses \(JARM §4\)\. ```csharp public System.Collections.Generic.IEnumerable? AuthorizationEncryptionEncValuesSupported { get; init; } ``` #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ## ConfigurationResponse\.AuthorizationResponseIssParameterSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.ConfigurationResponse.AuthorizationResponseIssParameterSupported} Indicates whether the server includes the `iss` parameter in authorization responses per RFC 9207\. ```csharp public System.Nullable AuthorizationResponseIssParameterSupported { get; init; } ``` #### Property Value [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') ## ConfigurationResponse\.AuthorizationSigningAlgValuesSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.ConfigurationResponse.AuthorizationSigningAlgValuesSupported} Specifies the JWS algorithms supported for signing JARM authorization responses \(JARM §4\)\. ```csharp public System.Collections.Generic.IEnumerable? AuthorizationSigningAlgValuesSupported { get; init; } ``` #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ## ConfigurationResponse\.BackChannelAuthenticationRequestSigningAlgValuesSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.ConfigurationResponse.BackChannelAuthenticationRequestSigningAlgValuesSupported} Lists the supported signing algorithms for backchannel authentication requests\. ```csharp public System.Collections.Generic.IEnumerable? BackChannelAuthenticationRequestSigningAlgValuesSupported { get; init; } ``` #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ## ConfigurationResponse\.BackChannelLogoutSessionSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.ConfigurationResponse.BackChannelLogoutSessionSupported} Indicates whether the OpenID Provider supports session management for back channel logout\. ```csharp public System.Nullable BackChannelLogoutSessionSupported { get; init; } ``` #### Property Value [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') ## ConfigurationResponse\.BackChannelLogoutSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.ConfigurationResponse.BackChannelLogoutSupported} Indicates whether the OpenID Provider supports back channel logout\. ```csharp public System.Nullable BackChannelLogoutSupported { get; init; } ``` #### Property Value [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') ## ConfigurationResponse\.BackChannelTokenDeliveryModesSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.ConfigurationResponse.BackChannelTokenDeliveryModesSupported} Lists the supported backchannel token delivery modes for CIBA\. ```csharp public System.Collections.Generic.IEnumerable? BackChannelTokenDeliveryModesSupported { get; init; } ``` #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ## ConfigurationResponse\.BackChannelUserCodeParameterSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.ConfigurationResponse.BackChannelUserCodeParameterSupported} Indicates whether the OpenID Provider supports the backchannel user code parameter for CIBA\. ```csharp public System.Nullable BackChannelUserCodeParameterSupported { get; init; } ``` #### Property Value [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') ## ConfigurationResponse\.ClaimsParameterSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.ConfigurationResponse.ClaimsParameterSupported} Indicates whether the OpenID Provider supports the use of the claims parameter\. ```csharp public System.Nullable ClaimsParameterSupported { get; init; } ``` #### Property Value [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') ## ConfigurationResponse\.ClaimsSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.ConfigurationResponse.ClaimsSupported} Lists the claims supported by the OpenID Provider\. RECOMMENDED by OpenID Connect Discovery 1\.0 section 3\. ```csharp public System.Collections.Generic.IEnumerable? ClaimsSupported { get; init; } ``` #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ## ConfigurationResponse\.CodeChallengeMethodsSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.ConfigurationResponse.CodeChallengeMethodsSupported} Lists the code challenge methods supported for PKCE\. OPTIONAL per RFC 8414 section 2\. ```csharp public System.Collections.Generic.IEnumerable? CodeChallengeMethodsSupported { get; init; } ``` #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ## ConfigurationResponse\.DpopSigningAlgValuesSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.ConfigurationResponse.DpopSigningAlgValuesSupported} Specifies the JWS signing algorithms accepted on inbound DPoP proofs per RFC 9449 §5\.1 \(`dpop_signing_alg_values_supported`\): the intersection of the algorithms the AS validator can verify with the static DPoP\-compatible whitelist\. ```csharp public System.Collections.Generic.IEnumerable? DpopSigningAlgValuesSupported { get; init; } ``` #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ## ConfigurationResponse\.FrontChannelLogoutSessionSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.ConfigurationResponse.FrontChannelLogoutSessionSupported} Indicates whether the OpenID Provider supports session management for front channel logout\. ```csharp public System.Nullable FrontChannelLogoutSessionSupported { get; init; } ``` #### Property Value [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') ## ConfigurationResponse\.FrontChannelLogoutSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.ConfigurationResponse.FrontChannelLogoutSupported} Indicates whether the OpenID Provider supports front channel logout\. ```csharp public System.Nullable FrontChannelLogoutSupported { get; init; } ``` #### Property Value [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') ## ConfigurationResponse\.GrantTypesSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.ConfigurationResponse.GrantTypesSupported} Lists the grant types supported by the OpenID Provider\. OPTIONAL per OpenID Connect Discovery 1\.0 section 3, which defines the omitted case as authorization code and implicit\. ```csharp public System.Collections.Generic.IEnumerable? GrantTypesSupported { get; init; } ``` #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ## ConfigurationResponse\.IdTokenSigningAlgValuesSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.ConfigurationResponse.IdTokenSigningAlgValuesSupported} Lists the ID token signing algorithm values supported by the OpenID Provider\. REQUIRED by OpenID Connect Discovery 1\.0 section 3\. ```csharp public System.Collections.Generic.IEnumerable IdTokenSigningAlgValuesSupported { get; init; } ``` #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ## ConfigurationResponse\.IntrospectionEncryptionAlgValuesSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.ConfigurationResponse.IntrospectionEncryptionAlgValuesSupported} Specifies the JWE key\-management algorithms \(the `alg` values\) supported for encrypting JWT introspection responses \(RFC 9701 §7\)\. ```csharp public System.Collections.Generic.IEnumerable? IntrospectionEncryptionAlgValuesSupported { get; init; } ``` #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ## ConfigurationResponse\.IntrospectionEncryptionEncValuesSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.ConfigurationResponse.IntrospectionEncryptionEncValuesSupported} Specifies the JWE content\-encryption algorithms \(the `enc` values\) supported for encrypting JWT introspection responses \(RFC 9701 §7\)\. ```csharp public System.Collections.Generic.IEnumerable? IntrospectionEncryptionEncValuesSupported { get; init; } ``` #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ## ConfigurationResponse\.IntrospectionSigningAlgValuesSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.ConfigurationResponse.IntrospectionSigningAlgValuesSupported} Specifies the JWS algorithms supported for signing JWT introspection responses \(RFC 9701 §7\)\. ```csharp public System.Collections.Generic.IEnumerable? IntrospectionSigningAlgValuesSupported { get; init; } ``` #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ## ConfigurationResponse\.Issuer Property {#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.ConfigurationResponse.Issuer} The issuer identifier, which uniquely identifies the OpenID Provider\. REQUIRED by OpenID Connect Discovery 1\.0 section 3\. ```csharp public string Issuer { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ConfigurationResponse\.PromptValuesSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.ConfigurationResponse.PromptValuesSupported} Lists the prompt values supported by the OpenID Provider\. OPTIONAL per Initiating User Registration via OpenID Connect 1\.0 section 4\.2, which defines the field outside the core metadata list\. That section also states the obligation that follows from stating it at all: a provider listing this element must list every prompt value it supports, not only `create`\. ```csharp public System.Collections.Generic.IEnumerable? PromptValuesSupported { get; init; } ``` #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ## ConfigurationResponse\.RequestObjectEncryptionAlgValuesSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.ConfigurationResponse.RequestObjectEncryptionAlgValuesSupported} Specifies the JWE key\-management algorithms \(the `alg` values\) supported for encrypted request objects\. ```csharp public System.Collections.Generic.IEnumerable? RequestObjectEncryptionAlgValuesSupported { get; init; } ``` #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ## ConfigurationResponse\.RequestObjectEncryptionEncValuesSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.ConfigurationResponse.RequestObjectEncryptionEncValuesSupported} Specifies the JWE content\-encryption algorithms \(the `enc` values\) supported for encrypted request objects\. ```csharp public System.Collections.Generic.IEnumerable? RequestObjectEncryptionEncValuesSupported { get; init; } ``` #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ## ConfigurationResponse\.RequestObjectSigningAlgValuesSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.ConfigurationResponse.RequestObjectSigningAlgValuesSupported} Specifies the signing algorithms supported for request objects\. ```csharp public System.Collections.Generic.IEnumerable? RequestObjectSigningAlgValuesSupported { get; init; } ``` #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ## ConfigurationResponse\.RequestParameterSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.ConfigurationResponse.RequestParameterSupported} Indicates whether the OpenID Provider supports the use of the request parameter\. ```csharp public bool RequestParameterSupported { get; init; } ``` #### Property Value [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') ## ConfigurationResponse\.RequirePushedAuthorizationRequests Property {#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.ConfigurationResponse.RequirePushedAuthorizationRequests} Indicates whether the OpenID Provider requires clients to use Pushed Authorization Requests \(PAR\) only\. ```csharp public System.Nullable RequirePushedAuthorizationRequests { get; set; } ``` #### Property Value [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') ## ConfigurationResponse\.RequireSignedRequestObject Property {#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.ConfigurationResponse.RequireSignedRequestObject} Indicates whether the OpenID Provider mandates that all request objects must be signed\. ```csharp public System.Nullable RequireSignedRequestObject { get; init; } ``` #### Property Value [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') ## ConfigurationResponse\.ResponseModesSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.ConfigurationResponse.ResponseModesSupported} Lists the response modes supported by the OpenID Provider\. OPTIONAL per OpenID Connect Discovery 1\.0 section 3, which defines the omitted case as query and fragment\. ```csharp public System.Collections.Generic.IEnumerable? ResponseModesSupported { get; init; } ``` #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ## ConfigurationResponse\.ResponseTypesSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.ConfigurationResponse.ResponseTypesSupported} Lists the response types supported by the OpenID Provider\. REQUIRED by OpenID Connect Discovery 1\.0 section 3\. ```csharp public System.Collections.Generic.IEnumerable ResponseTypesSupported { get; init; } ``` #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ## ConfigurationResponse\.ScopesSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.ConfigurationResponse.ScopesSupported} Lists the scopes supported by the OpenID Provider\. RECOMMENDED by OpenID Connect Discovery 1\.0 section 3\. ```csharp public System.Collections.Generic.IEnumerable? ScopesSupported { get; init; } ``` #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ## ConfigurationResponse\.SubjectTypesSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.ConfigurationResponse.SubjectTypesSupported} Lists the subject types supported by the OpenID Provider\. REQUIRED by OpenID Connect Discovery 1\.0 section 3\. ```csharp public System.Collections.Generic.IEnumerable SubjectTypesSupported { get; init; } ``` #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ## ConfigurationResponse\.TlsClientCertificateBoundAccessTokens Property {#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.ConfigurationResponse.TlsClientCertificateBoundAccessTokens} Indicates support for mutual\-TLS client certificate\-bound access tokens \(`tls_client_certificate_bound_access_tokens`, RFC 8705 §3\.3\)\. `true` when the provider both issues such tokens and enforces the binding at its protected resources; `null` \(omitted\) otherwise\. ```csharp public System.Nullable TlsClientCertificateBoundAccessTokens { get; init; } ``` #### Property Value [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') ## ConfigurationResponse\.TokenEndpointAuthMethodsSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.ConfigurationResponse.TokenEndpointAuthMethodsSupported} Lists the token endpoint authentication methods supported by the OpenID Provider\. OPTIONAL per OpenID Connect Discovery 1\.0 section 3, which defines the omitted case as client\_secret\_basic\. ```csharp public System.Collections.Generic.IEnumerable? TokenEndpointAuthMethodsSupported { get; init; } ``` #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ## ConfigurationResponse\.TokenEndpointAuthSigningAlgValuesSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.ConfigurationResponse.TokenEndpointAuthSigningAlgValuesSupported} Lists the signing algorithms supported for authenticating clients at the token endpoint\. ```csharp public System.Collections.Generic.IEnumerable? TokenEndpointAuthSigningAlgValuesSupported { get; init; } ``` #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ## ConfigurationResponse\.UserInfoSigningAlgValuesSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.ConfigurationResponse.UserInfoSigningAlgValuesSupported} Specifies the signing algorithms supported for user information endpoints\. ```csharp public System.Collections.Generic.IEnumerable? UserInfoSigningAlgValuesSupported { get; init; } ``` #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IAcrMetadataProvider.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Configuration\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.Configuration\.Interfaces') ## IAcrMetadataProvider Interface Provides metadata about supported ACR \(Authentication Context Class Reference\) values for OpenID Connect discovery document\. ```csharp public interface IAcrMetadataProvider ``` Derived ↳ [AcrMetadataProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.AcrMetadataProvider 'Abblix\.Oidc\.Server\.Endpoints\.Configuration\.AcrMetadataProvider') ### Properties ## IAcrMetadataProvider\.AcrValuesSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IAcrMetadataProvider.AcrValuesSupported} Lists the ACR \(Authentication Context Class Reference\) values supported by this provider\. These values represent authentication assurance levels that can be requested and achieved\. ```csharp System.Collections.Generic.IEnumerable? AcrValuesSupported { get; } ``` #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IAuthorizationMetadataProvider.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Configuration\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.Configuration\.Interfaces') ## IAuthorizationMetadataProvider Interface Provides authorization\-related metadata for OpenID Connect discovery\. ```csharp public interface IAuthorizationMetadataProvider ``` Derived ↳ [AuthorizationMetadataProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.AuthorizationMetadataProvider 'Abblix\.Oidc\.Server\.Endpoints\.Configuration\.AuthorizationMetadataProvider') ### Properties ## IAuthorizationMetadataProvider\.AuthorizationResponseIssParameterSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IAuthorizationMetadataProvider.AuthorizationResponseIssParameterSupported} Indicates whether the server includes the `iss` parameter in authorization responses per RFC 9207\. ```csharp bool AuthorizationResponseIssParameterSupported { get; } ``` #### Property Value [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') ## IAuthorizationMetadataProvider\.ClaimsParameterSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IAuthorizationMetadataProvider.ClaimsParameterSupported} Indicates whether the claims parameter is supported in authorization requests\. ```csharp bool ClaimsParameterSupported { get; } ``` #### Property Value [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') ## IAuthorizationMetadataProvider\.CodeChallengeMethodsSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IAuthorizationMetadataProvider.CodeChallengeMethodsSupported} Lists the code challenge methods supported for PKCE\. ```csharp System.Collections.Generic.IEnumerable CodeChallengeMethodsSupported { get; } ``` #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ## IAuthorizationMetadataProvider\.PromptValuesSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IAuthorizationMetadataProvider.PromptValuesSupported} Lists the prompt values supported during authentication\. ```csharp System.Collections.Generic.IEnumerable PromptValuesSupported { get; } ``` #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ## IAuthorizationMetadataProvider\.RequestParameterSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IAuthorizationMetadataProvider.RequestParameterSupported} Indicates whether the request parameter is supported in authorization requests\. ```csharp bool RequestParameterSupported { get; } ``` #### Property Value [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') ## IAuthorizationMetadataProvider\.ResponseModesSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IAuthorizationMetadataProvider.ResponseModesSupported} Lists the response modes supported by the authorization endpoint\. ```csharp System.Collections.Generic.IEnumerable ResponseModesSupported { get; } ``` #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ## IAuthorizationMetadataProvider\.ResponseTypesSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IAuthorizationMetadataProvider.ResponseTypesSupported} Lists the response types supported by the authorization endpoint\. ```csharp System.Collections.Generic.IEnumerable ResponseTypesSupported { get; } ``` #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IConfigurationHandler.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Configuration\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.Configuration\.Interfaces') ## IConfigurationHandler Interface Builds the discovery document served at `/.well-known/openid-configuration` per OpenID Connect Discovery 1\.0 §3 and RFC 8414 \(OAuth 2\.0 Authorization Server Metadata\)\. ```csharp public interface IConfigurationHandler ``` Derived ↳ [ConfigurationHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.ConfigurationHandler 'Abblix\.Oidc\.Server\.Endpoints\.Configuration\.ConfigurationHandler') ### Methods ## IConfigurationHandler\.HandleAsync\(\) Method {#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IConfigurationHandler.HandleAsync()} Builds the framework\-agnostic discovery payload\. Endpoint URLs are filled in by the hosting layer because they depend on routing\. ```csharp System.Threading.Tasks.Task HandleAsync(); ``` #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[ConfigurationResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.ConfigurationResponse 'Abblix\.Oidc\.Server\.Endpoints\.Configuration\.Interfaces\.ConfigurationResponse')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IJwtAlgorithmsProvider.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Configuration\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.Configuration\.Interfaces') ## IJwtAlgorithmsProvider Interface Provides metadata about supported JWT signing and validation algorithms for OpenID Connect discovery\. ```csharp public interface IJwtAlgorithmsProvider ``` Derived ↳ [JwtAlgorithmsProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.JwtAlgorithmsProvider 'Abblix\.Oidc\.Server\.Endpoints\.Configuration\.JwtAlgorithmsProvider') ### Properties ## IJwtAlgorithmsProvider\.AuthorizationEncryptionAlgValuesSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IJwtAlgorithmsProvider.AuthorizationEncryptionAlgValuesSupported} Lists the JWE key\-management algorithms \(the `alg` values\) the authorization server can use to encrypt JARM authorization responses, advertised via `authorization_encryption_alg_values_supported` \(JARM §4\)\. ```csharp System.Collections.Generic.IEnumerable AuthorizationEncryptionAlgValuesSupported { get; } ``` #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ## IJwtAlgorithmsProvider\.AuthorizationEncryptionEncValuesSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IJwtAlgorithmsProvider.AuthorizationEncryptionEncValuesSupported} Lists the JWE content\-encryption algorithms \(the `enc` values\) the authorization server can use to encrypt JARM authorization responses, advertised via `authorization_encryption_enc_values_supported` \(JARM §4\)\. ```csharp System.Collections.Generic.IEnumerable AuthorizationEncryptionEncValuesSupported { get; } ``` #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ## IJwtAlgorithmsProvider\.AuthorizationSigningAlgValuesSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IJwtAlgorithmsProvider.AuthorizationSigningAlgValuesSupported} Lists the JWS algorithms the authorization server uses to sign JARM authorization responses, advertised via `authorization_signing_alg_values_supported` \(JARM §4\)\. ```csharp System.Collections.Generic.IEnumerable AuthorizationSigningAlgValuesSupported { get; } ``` #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ## IJwtAlgorithmsProvider\.BackChannelAuthenticationRequestSigningAlgValuesSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IJwtAlgorithmsProvider.BackChannelAuthenticationRequestSigningAlgValuesSupported} Lists the JWS algorithms a client may use to sign a CIBA backchannel authentication request, advertised via `backchannel_authentication_request_signing_alg_values_supported`\. CIBA Core §7\.1\.1 mandates an asymmetric signature, so both `none` and the symmetric HS\* algorithms are excluded from the underlying verification set\. ```csharp System.Collections.Generic.IEnumerable BackChannelAuthenticationRequestSigningAlgValuesSupported { get; } ``` #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ## IJwtAlgorithmsProvider\.DpopSigningAlgorithmsSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IJwtAlgorithmsProvider.DpopSigningAlgorithmsSupported} Lists the JWS signing algorithms the authorization server accepts on inbound DPoP proofs \(RFC 9449 §5\.1 `dpop_signing_alg_values_supported`\): the intersection of [SigningAlgorithmsSupported](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IJwtAlgorithmsProvider#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IJwtAlgorithmsProvider.SigningAlgorithmsSupported 'Abblix\.Oidc\.Server\.Endpoints\.Configuration\.Interfaces\.IJwtAlgorithmsProvider\.SigningAlgorithmsSupported') with the static DPoP\-compatible whitelist\. The validator\-side set is the source \- the AS verifies proofs the client signs, it does not issue them\. ```csharp System.Collections.Generic.IEnumerable DpopSigningAlgorithmsSupported { get; } ``` #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ## IJwtAlgorithmsProvider\.IntrospectionEncryptionAlgValuesSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IJwtAlgorithmsProvider.IntrospectionEncryptionAlgValuesSupported} Lists the JWE key\-management algorithms \(the `alg` values\) the authorization server can use to encrypt JWT introspection responses, advertised via `introspection_encryption_alg_values_supported` \(RFC 9701 §7\)\. ```csharp System.Collections.Generic.IEnumerable IntrospectionEncryptionAlgValuesSupported { get; } ``` #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ## IJwtAlgorithmsProvider\.IntrospectionEncryptionEncValuesSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IJwtAlgorithmsProvider.IntrospectionEncryptionEncValuesSupported} Lists the JWE content\-encryption algorithms \(the `enc` values\) the authorization server can use to encrypt JWT introspection responses, advertised via `introspection_encryption_enc_values_supported` \(RFC 9701 §7\)\. ```csharp System.Collections.Generic.IEnumerable IntrospectionEncryptionEncValuesSupported { get; } ``` #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ## IJwtAlgorithmsProvider\.IntrospectionSigningAlgValuesSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IJwtAlgorithmsProvider.IntrospectionSigningAlgValuesSupported} Lists the JWS algorithms the authorization server uses to sign JWT introspection responses, advertised via `introspection_signing_alg_values_supported` \(RFC 9701 §7\)\. ```csharp System.Collections.Generic.IEnumerable IntrospectionSigningAlgValuesSupported { get; } ``` #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ## IJwtAlgorithmsProvider\.RequestObjectEncryptionAlgValuesSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IJwtAlgorithmsProvider.RequestObjectEncryptionAlgValuesSupported} Lists the JWE key\-management algorithms \(the `alg` values\) the authorization server accepts when a client encrypts a request object to the server \(RFC 9101 §6\.1\), advertised via `request_object_encryption_alg_values_supported`\. ```csharp System.Collections.Generic.IEnumerable RequestObjectEncryptionAlgValuesSupported { get; } ``` #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ## IJwtAlgorithmsProvider\.RequestObjectEncryptionEncValuesSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IJwtAlgorithmsProvider.RequestObjectEncryptionEncValuesSupported} Lists the JWE content\-encryption algorithms \(the `enc` values\) the authorization server accepts when a client encrypts a request object to the server \(RFC 9101 §6\.1\), advertised via `request_object_encryption_enc_values_supported`\. ```csharp System.Collections.Generic.IEnumerable RequestObjectEncryptionEncValuesSupported { get; } ``` #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ## IJwtAlgorithmsProvider\.SignedResponseAlgorithmsSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IJwtAlgorithmsProvider.SignedResponseAlgorithmsSupported} Lists the signing algorithms supported for ID tokens and UserInfo responses\. ```csharp System.Collections.Generic.IEnumerable SignedResponseAlgorithmsSupported { get; } ``` #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ## IJwtAlgorithmsProvider\.SigningAlgorithmsSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IJwtAlgorithmsProvider.SigningAlgorithmsSupported} Lists the signing algorithms supported for validating signed requests and authentication\. ```csharp System.Collections.Generic.IEnumerable SigningAlgorithmsSupported { get; } ``` #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ## IJwtAlgorithmsProvider\.TokenEndpointAuthSigningAlgValuesSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IJwtAlgorithmsProvider.TokenEndpointAuthSigningAlgValuesSupported} Lists the JWS algorithms a client may use to sign a JWT client\-authentication assertion \(`client_secret_jwt` / `private_key_jwt`\), advertised via `token_endpoint_auth_signing_alg_values_supported`\. RFC 8414 §2 and OpenID Connect Discovery 1\.0 §3 both state the value `none` MUST NOT appear here, so it is excluded from the underlying verification set\. ```csharp System.Collections.Generic.IEnumerable TokenEndpointAuthSigningAlgValuesSupported { get; } ``` #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IScopesAndClaimsProvider.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Configuration\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.Configuration\.Interfaces') ## IScopesAndClaimsProvider Interface Provides metadata about supported scopes, claims, grants, and subject types for OpenID Connect discovery\. ```csharp public interface IScopesAndClaimsProvider ``` Derived ↳ [ScopesAndClaimsProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.ScopesAndClaimsProvider 'Abblix\.Oidc\.Server\.Endpoints\.Configuration\.ScopesAndClaimsProvider') ### Properties ## IScopesAndClaimsProvider\.ClaimsSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IScopesAndClaimsProvider.ClaimsSupported} Lists the claims supported by the OpenID Provider\. ```csharp System.Collections.Generic.IEnumerable ClaimsSupported { get; } ``` #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ## IScopesAndClaimsProvider\.GrantTypesSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IScopesAndClaimsProvider.GrantTypesSupported} Lists the grant types supported by the OpenID Provider\. ```csharp System.Collections.Generic.IEnumerable GrantTypesSupported { get; } ``` #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ## IScopesAndClaimsProvider\.ScopesSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IScopesAndClaimsProvider.ScopesSupported} Lists the scopes supported by the OpenID Provider\. ```csharp System.Collections.Generic.IEnumerable ScopesSupported { get; } ``` #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ## IScopesAndClaimsProvider\.SubjectTypesSupported Property {#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IScopesAndClaimsProvider.SubjectTypesSupported} Lists the subject types supported by the OpenID Provider\. ```csharp System.Collections.Generic.IEnumerable SubjectTypesSupported { get; } ``` #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.ISignedMetadataProvider.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Configuration\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.Configuration\.Interfaces') ## ISignedMetadataProvider Interface Produces the RFC 8414 §2\.1 `signed_metadata` value for a discovery document\. ```csharp public interface ISignedMetadataProvider ``` Derived ↳ [SignedMetadataProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.SignedMetadataProvider 'Abblix\.Oidc\.Server\.Endpoints\.Configuration\.SignedMetadataProvider') ### Remarks Lives in the core rather than in an adapter because the value is a property of the metadata, not of the framework that serves it: both the MVC and the Minimal API adapters assemble the same [ConfigurationResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ConfigurationResponse 'Abblix\.Oidc\.Server\.Model\.ConfigurationResponse') and owe their clients the same signature over it\. ### Methods ## ISignedMetadataProvider\.SignAsync\(ConfigurationResponse\) Method {#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.ISignedMetadataProvider.SignAsync(Abblix.Oidc.Server.Model.ConfigurationResponse)} Signs [metadata](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.ISignedMetadataProvider#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.ISignedMetadataProvider.SignAsync(Abblix.Oidc.Server.Model.ConfigurationResponse).metadata 'Abblix\.Oidc\.Server\.Endpoints\.Configuration\.Interfaces\.ISignedMetadataProvider\.SignAsync\(Abblix\.Oidc\.Server\.Model\.ConfigurationResponse\)\.metadata') and returns the compact JWS\. ```csharp System.Threading.Tasks.Task SignAsync(Abblix.Oidc.Server.Model.ConfigurationResponse metadata); ``` #### Parameters ###### `metadata` [ConfigurationResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ConfigurationResponse 'Abblix\.Oidc\.Server\.Model\.ConfigurationResponse') {#Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.ISignedMetadataProvider.SignAsync(Abblix.Oidc.Server.Model.ConfigurationResponse).metadata} The fully assembled metadata, including resolved endpoint URLs and any mTLS aliases, and without `signed_metadata` itself: RFC 8414 §2\.1 has the bundle assert the metadata, not restate its own signature\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') The compact\-serialized JWS\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ## Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization Namespace | Classes | | | :--- | :--- | | [DeviceAuthorizationHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.DeviceAuthorizationHandler 'Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.DeviceAuthorizationHandler') | Handles device authorization requests as defined in RFC 8628\. Coordinates validation and processing of requests to generate device\_code and user\_code\. | | [DeviceAuthorizationOptionsValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.DeviceAuthorizationOptionsValidator 'Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.DeviceAuthorizationOptionsValidator') | Fails loudly the first time [OidcOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions') is resolved when the device authorization endpoint is enabled but its settings are absent, instead of letting the contradiction surface as an unhandled HTTP 500 on the first request\. The endpoint is off in the default [Base](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcEndpoints#Abblix.Oidc.Server.Common.Configuration.OidcEndpoints.Base 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcEndpoints\.Base') set and is turned on only by an explicit `AddDeviceAuthorization()` opt\-in \(or a host that sets the [DeviceAuthorization](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcEndpoints#Abblix.Oidc.Server.Common.Configuration.OidcEndpoints.DeviceAuthorization 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcEndpoints\.DeviceAuthorization') flag itself\), yet [DeviceAuthorization](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions#Abblix.Oidc.Server.Common.Configuration.OidcOptions.DeviceAuthorization 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions\.DeviceAuthorization') has no default \- so a host that enables it without configuring it has an internally inconsistent configuration this validator turns into a clear startup error\. A no\-op when the endpoint is disabled or the settings are present\. | | [DeviceAuthorizationRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.DeviceAuthorizationRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.DeviceAuthorizationRequestProcessor') | Processes validated device authorization requests, generating codes and storing the request\. | | [DeviceAuthorizationRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.DeviceAuthorizationRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.DeviceAuthorizationRequestValidator') | Validates device authorization requests by delegating to a context validator\. | --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.DeviceAuthorizationHandler.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization 'Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization') ## DeviceAuthorizationHandler Class Handles device authorization requests as defined in RFC 8628\. Coordinates validation and processing of requests to generate device\_code and user\_code\. ```csharp public class DeviceAuthorizationHandler : Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Interfaces.IDeviceAuthorizationHandler ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → DeviceAuthorizationHandler Implements [IDeviceAuthorizationHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Interfaces.IDeviceAuthorizationHandler 'Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Interfaces\.IDeviceAuthorizationHandler') ### Constructors ## DeviceAuthorizationHandler\(IDeviceAuthorizationRequestValidator, IDeviceAuthorizationRequestProcessor\) Constructor {#Abblix.Oidc.Server.Endpoints.DeviceAuthorization.DeviceAuthorizationHandler.DeviceAuthorizationHandler(Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Interfaces.IDeviceAuthorizationRequestValidator,Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Interfaces.IDeviceAuthorizationRequestProcessor)} Handles device authorization requests as defined in RFC 8628\. Coordinates validation and processing of requests to generate device\_code and user\_code\. ```csharp public DeviceAuthorizationHandler(Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Interfaces.IDeviceAuthorizationRequestValidator validator, Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Interfaces.IDeviceAuthorizationRequestProcessor processor); ``` #### Parameters ###### `validator` [IDeviceAuthorizationRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Interfaces.IDeviceAuthorizationRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Interfaces\.IDeviceAuthorizationRequestValidator') {#Abblix.Oidc.Server.Endpoints.DeviceAuthorization.DeviceAuthorizationHandler.DeviceAuthorizationHandler(Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Interfaces.IDeviceAuthorizationRequestValidator,Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Interfaces.IDeviceAuthorizationRequestProcessor).validator} The service responsible for validating device authorization requests\. ###### `processor` [IDeviceAuthorizationRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Interfaces.IDeviceAuthorizationRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Interfaces\.IDeviceAuthorizationRequestProcessor') {#Abblix.Oidc.Server.Endpoints.DeviceAuthorization.DeviceAuthorizationHandler.DeviceAuthorizationHandler(Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Interfaces.IDeviceAuthorizationRequestValidator,Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Interfaces.IDeviceAuthorizationRequestProcessor).processor} The service responsible for processing validated requests\. ### Methods ## DeviceAuthorizationHandler\.HandleAsync\(DeviceAuthorizationRequest, ClientRequest\) Method {#Abblix.Oidc.Server.Endpoints.DeviceAuthorization.DeviceAuthorizationHandler.HandleAsync(Abblix.Oidc.Server.Model.DeviceAuthorizationRequest,Abblix.Oidc.Server.Model.ClientRequest)} Handles a device authorization request, validating and processing it to generate device\_code and user\_code for the client\. ```csharp public System.Threading.Tasks.Task> HandleAsync(Abblix.Oidc.Server.Model.DeviceAuthorizationRequest request, Abblix.Oidc.Server.Model.ClientRequest clientRequest); ``` #### Parameters ###### `request` [DeviceAuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.DeviceAuthorizationRequest 'Abblix\.Oidc\.Server\.Model\.DeviceAuthorizationRequest') {#Abblix.Oidc.Server.Endpoints.DeviceAuthorization.DeviceAuthorizationHandler.HandleAsync(Abblix.Oidc.Server.Model.DeviceAuthorizationRequest,Abblix.Oidc.Server.Model.ClientRequest).request} The device authorization request from the client\. ###### `clientRequest` [ClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRequest 'Abblix\.Oidc\.Server\.Model\.ClientRequest') {#Abblix.Oidc.Server.Endpoints.DeviceAuthorization.DeviceAuthorizationHandler.HandleAsync(Abblix.Oidc.Server.Model.DeviceAuthorizationRequest,Abblix.Oidc.Server.Model.ClientRequest).clientRequest} The client authentication information\. Implements [HandleAsync\(DeviceAuthorizationRequest, ClientRequest\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Interfaces.IDeviceAuthorizationHandler#Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Interfaces.IDeviceAuthorizationHandler.HandleAsync(Abblix.Oidc.Server.Model.DeviceAuthorizationRequest,Abblix.Oidc.Server.Model.ClientRequest) 'Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Interfaces\.IDeviceAuthorizationHandler\.HandleAsync\(Abblix\.Oidc\.Server\.Model\.DeviceAuthorizationRequest, Abblix\.Oidc\.Server\.Model\.ClientRequest\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[DeviceAuthorizationResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.DeviceAuthorizationResponse 'Abblix\.Oidc\.Server\.Model\.DeviceAuthorizationResponse')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task that returns a result containing either a successful device authorization response with device\_code and user\_code, or an OIDC error\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.DeviceAuthorizationOptionsValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization 'Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization') ## DeviceAuthorizationOptionsValidator Class Fails loudly the first time [OidcOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions') is resolved when the device authorization endpoint is enabled but its settings are absent, instead of letting the contradiction surface as an unhandled HTTP 500 on the first request\. The endpoint is off in the default [Base](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcEndpoints#Abblix.Oidc.Server.Common.Configuration.OidcEndpoints.Base 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcEndpoints\.Base') set and is turned on only by an explicit `AddDeviceAuthorization()` opt\-in \(or a host that sets the [DeviceAuthorization](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcEndpoints#Abblix.Oidc.Server.Common.Configuration.OidcEndpoints.DeviceAuthorization 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcEndpoints\.DeviceAuthorization') flag itself\), yet [DeviceAuthorization](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions#Abblix.Oidc.Server.Common.Configuration.OidcOptions.DeviceAuthorization 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions\.DeviceAuthorization') has no default \- so a host that enables it without configuring it has an internally inconsistent configuration this validator turns into a clear startup error\. A no\-op when the endpoint is disabled or the settings are present\. ```csharp public class DeviceAuthorizationOptionsValidator : Microsoft.Extensions.Options.IValidateOptions ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → DeviceAuthorizationOptionsValidator Implements [Microsoft\.Extensions\.Options\.IValidateOptions<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ivalidateoptions-1 'Microsoft\.Extensions\.Options\.IValidateOptions\`1')[OidcOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ivalidateoptions-1 'Microsoft\.Extensions\.Options\.IValidateOptions\`1') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.DeviceAuthorizationRequestProcessor.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization 'Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization') ## DeviceAuthorizationRequestProcessor Class Processes validated device authorization requests, generating codes and storing the request\. ```csharp public class DeviceAuthorizationRequestProcessor : Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Interfaces.IDeviceAuthorizationRequestProcessor ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → DeviceAuthorizationRequestProcessor Implements [IDeviceAuthorizationRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Interfaces.IDeviceAuthorizationRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Interfaces\.IDeviceAuthorizationRequestProcessor') ### Constructors ## DeviceAuthorizationRequestProcessor\(IDeviceAuthorizationStorage, IDeviceCodeGenerator, IUserCodeGenerator, IOptionsSnapshot\, TimeProvider\) Constructor {#Abblix.Oidc.Server.Endpoints.DeviceAuthorization.DeviceAuthorizationRequestProcessor.DeviceAuthorizationRequestProcessor(Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IDeviceAuthorizationStorage,Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IDeviceCodeGenerator,Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeGenerator,Microsoft.Extensions.Options.IOptionsSnapshot_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,System.TimeProvider)} Processes validated device authorization requests, generating codes and storing the request\. ```csharp public DeviceAuthorizationRequestProcessor(Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IDeviceAuthorizationStorage storage, Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IDeviceCodeGenerator deviceCodeGenerator, Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeGenerator userCodeGenerator, Microsoft.Extensions.Options.IOptionsSnapshot options, System.TimeProvider timeProvider); ``` #### Parameters ###### `storage` [IDeviceAuthorizationStorage](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IDeviceAuthorizationStorage 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.Interfaces\.IDeviceAuthorizationStorage') {#Abblix.Oidc.Server.Endpoints.DeviceAuthorization.DeviceAuthorizationRequestProcessor.DeviceAuthorizationRequestProcessor(Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IDeviceAuthorizationStorage,Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IDeviceCodeGenerator,Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeGenerator,Microsoft.Extensions.Options.IOptionsSnapshot_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,System.TimeProvider).storage} Storage for persisting device authorization requests\. ###### `deviceCodeGenerator` [IDeviceCodeGenerator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IDeviceCodeGenerator 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.Interfaces\.IDeviceCodeGenerator') {#Abblix.Oidc.Server.Endpoints.DeviceAuthorization.DeviceAuthorizationRequestProcessor.DeviceAuthorizationRequestProcessor(Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IDeviceAuthorizationStorage,Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IDeviceCodeGenerator,Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeGenerator,Microsoft.Extensions.Options.IOptionsSnapshot_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,System.TimeProvider).deviceCodeGenerator} Generator for high\-entropy device codes\. ###### `userCodeGenerator` [IUserCodeGenerator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeGenerator 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.Interfaces\.IUserCodeGenerator') {#Abblix.Oidc.Server.Endpoints.DeviceAuthorization.DeviceAuthorizationRequestProcessor.DeviceAuthorizationRequestProcessor(Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IDeviceAuthorizationStorage,Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IDeviceCodeGenerator,Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeGenerator,Microsoft.Extensions.Options.IOptionsSnapshot_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,System.TimeProvider).userCodeGenerator} Generator for user\-friendly verification codes\. ###### `options` [Microsoft\.Extensions\.Options\.IOptionsSnapshot<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptionssnapshot-1 'Microsoft\.Extensions\.Options\.IOptionsSnapshot\`1')[OidcOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptionssnapshot-1 'Microsoft\.Extensions\.Options\.IOptionsSnapshot\`1') {#Abblix.Oidc.Server.Endpoints.DeviceAuthorization.DeviceAuthorizationRequestProcessor.DeviceAuthorizationRequestProcessor(Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IDeviceAuthorizationStorage,Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IDeviceCodeGenerator,Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeGenerator,Microsoft.Extensions.Options.IOptionsSnapshot_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,System.TimeProvider).options} Configuration options for device authorization\. ###### `timeProvider` [System\.TimeProvider](https://learn.microsoft.com/en-us/dotnet/api/system.timeprovider 'System\.TimeProvider') {#Abblix.Oidc.Server.Endpoints.DeviceAuthorization.DeviceAuthorizationRequestProcessor.DeviceAuthorizationRequestProcessor(Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IDeviceAuthorizationStorage,Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IDeviceCodeGenerator,Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeGenerator,Microsoft.Extensions.Options.IOptionsSnapshot_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,System.TimeProvider).timeProvider} Provider for current time\. ### Methods ## DeviceAuthorizationRequestProcessor\.ProcessAsync\(ValidDeviceAuthorizationRequest\) Method {#Abblix.Oidc.Server.Endpoints.DeviceAuthorization.DeviceAuthorizationRequestProcessor.ProcessAsync(Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Interfaces.ValidDeviceAuthorizationRequest)} Processes a validated device authorization request, generating device\_code and user\_code, and storing the request for later verification\. ```csharp public System.Threading.Tasks.Task> ProcessAsync(Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Interfaces.ValidDeviceAuthorizationRequest request); ``` #### Parameters ###### `request` [ValidDeviceAuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Interfaces.ValidDeviceAuthorizationRequest 'Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Interfaces\.ValidDeviceAuthorizationRequest') {#Abblix.Oidc.Server.Endpoints.DeviceAuthorization.DeviceAuthorizationRequestProcessor.ProcessAsync(Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Interfaces.ValidDeviceAuthorizationRequest).request} The validated device authorization request\. Implements [ProcessAsync\(ValidDeviceAuthorizationRequest\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Interfaces.IDeviceAuthorizationRequestProcessor#Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Interfaces.IDeviceAuthorizationRequestProcessor.ProcessAsync(Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Interfaces.ValidDeviceAuthorizationRequest) 'Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Interfaces\.IDeviceAuthorizationRequestProcessor\.ProcessAsync\(Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Interfaces\.ValidDeviceAuthorizationRequest\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[DeviceAuthorizationResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.DeviceAuthorizationResponse 'Abblix\.Oidc\.Server\.Model\.DeviceAuthorizationResponse')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task that returns a result containing either a successful device authorization response or an OIDC error\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.DeviceAuthorizationRequestValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization 'Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization') ## DeviceAuthorizationRequestValidator Class Validates device authorization requests by delegating to a context validator\. ```csharp public class DeviceAuthorizationRequestValidator : Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Interfaces.IDeviceAuthorizationRequestValidator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → DeviceAuthorizationRequestValidator Implements [IDeviceAuthorizationRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Interfaces.IDeviceAuthorizationRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Interfaces\.IDeviceAuthorizationRequestValidator') ### Constructors ## DeviceAuthorizationRequestValidator\(IDeviceAuthorizationContextValidator\) Constructor {#Abblix.Oidc.Server.Endpoints.DeviceAuthorization.DeviceAuthorizationRequestValidator.DeviceAuthorizationRequestValidator(Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.IDeviceAuthorizationContextValidator)} Validates device authorization requests by delegating to a context validator\. ```csharp public DeviceAuthorizationRequestValidator(Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.IDeviceAuthorizationContextValidator contextValidator); ``` #### Parameters ###### `contextValidator` [IDeviceAuthorizationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.IDeviceAuthorizationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Validation\.IDeviceAuthorizationContextValidator') {#Abblix.Oidc.Server.Endpoints.DeviceAuthorization.DeviceAuthorizationRequestValidator.DeviceAuthorizationRequestValidator(Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.IDeviceAuthorizationContextValidator).contextValidator} The validator for performing detailed validation\. ### Methods ## DeviceAuthorizationRequestValidator\.ValidateAsync\(DeviceAuthorizationRequest, ClientRequest\) Method {#Abblix.Oidc.Server.Endpoints.DeviceAuthorization.DeviceAuthorizationRequestValidator.ValidateAsync(Abblix.Oidc.Server.Model.DeviceAuthorizationRequest,Abblix.Oidc.Server.Model.ClientRequest)} Validates a device authorization request, verifying client credentials and request parameters\. ```csharp public System.Threading.Tasks.Task> ValidateAsync(Abblix.Oidc.Server.Model.DeviceAuthorizationRequest request, Abblix.Oidc.Server.Model.ClientRequest clientRequest); ``` #### Parameters ###### `request` [DeviceAuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.DeviceAuthorizationRequest 'Abblix\.Oidc\.Server\.Model\.DeviceAuthorizationRequest') {#Abblix.Oidc.Server.Endpoints.DeviceAuthorization.DeviceAuthorizationRequestValidator.ValidateAsync(Abblix.Oidc.Server.Model.DeviceAuthorizationRequest,Abblix.Oidc.Server.Model.ClientRequest).request} The device authorization request to validate\. ###### `clientRequest` [ClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRequest 'Abblix\.Oidc\.Server\.Model\.ClientRequest') {#Abblix.Oidc.Server.Endpoints.DeviceAuthorization.DeviceAuthorizationRequestValidator.ValidateAsync(Abblix.Oidc.Server.Model.DeviceAuthorizationRequest,Abblix.Oidc.Server.Model.ClientRequest).clientRequest} The client authentication information\. Implements [ValidateAsync\(DeviceAuthorizationRequest, ClientRequest\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Interfaces.IDeviceAuthorizationRequestValidator#Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Interfaces.IDeviceAuthorizationRequestValidator.ValidateAsync(Abblix.Oidc.Server.Model.DeviceAuthorizationRequest,Abblix.Oidc.Server.Model.ClientRequest) 'Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Interfaces\.IDeviceAuthorizationRequestValidator\.ValidateAsync\(Abblix\.Oidc\.Server\.Model\.DeviceAuthorizationRequest, Abblix\.Oidc\.Server\.Model\.ClientRequest\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[ValidDeviceAuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Interfaces.ValidDeviceAuthorizationRequest 'Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Interfaces\.ValidDeviceAuthorizationRequest')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task that returns a result containing either a valid device authorization request with resolved client information, or an OIDC error\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Interfaces.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ## Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Interfaces Namespace | Classes | | | :--- | :--- | | [ValidDeviceAuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Interfaces.ValidDeviceAuthorizationRequest 'Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Interfaces\.ValidDeviceAuthorizationRequest') | A device authorization request \(RFC 8628 §3\.1\) that has passed all validators, paired with the authenticated client and the scope/resource sets resolved against the provider's catalog\. | | Interfaces | | | :--- | :--- | | [IDeviceAuthorizationHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Interfaces.IDeviceAuthorizationHandler 'Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Interfaces\.IDeviceAuthorizationHandler') | Defines the contract for handling device authorization requests as specified in RFC 8628\. | | [IDeviceAuthorizationRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Interfaces.IDeviceAuthorizationRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Interfaces\.IDeviceAuthorizationRequestProcessor') | Defines the contract for processing validated device authorization requests\. | | [IDeviceAuthorizationRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Interfaces.IDeviceAuthorizationRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Interfaces\.IDeviceAuthorizationRequestValidator') | Defines the contract for validating device authorization requests\. | --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Interfaces.IDeviceAuthorizationHandler.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Interfaces') ## IDeviceAuthorizationHandler Interface Defines the contract for handling device authorization requests as specified in RFC 8628\. ```csharp public interface IDeviceAuthorizationHandler ``` Derived ↳ [DeviceAuthorizationHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.DeviceAuthorizationHandler 'Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.DeviceAuthorizationHandler') ### Methods ## IDeviceAuthorizationHandler\.HandleAsync\(DeviceAuthorizationRequest, ClientRequest\) Method {#Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Interfaces.IDeviceAuthorizationHandler.HandleAsync(Abblix.Oidc.Server.Model.DeviceAuthorizationRequest,Abblix.Oidc.Server.Model.ClientRequest)} Handles a device authorization request, validating and processing it to generate device\_code and user\_code for the client\. ```csharp System.Threading.Tasks.Task> HandleAsync(Abblix.Oidc.Server.Model.DeviceAuthorizationRequest request, Abblix.Oidc.Server.Model.ClientRequest clientRequest); ``` #### Parameters ###### `request` [DeviceAuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.DeviceAuthorizationRequest 'Abblix\.Oidc\.Server\.Model\.DeviceAuthorizationRequest') {#Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Interfaces.IDeviceAuthorizationHandler.HandleAsync(Abblix.Oidc.Server.Model.DeviceAuthorizationRequest,Abblix.Oidc.Server.Model.ClientRequest).request} The device authorization request from the client\. ###### `clientRequest` [ClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRequest 'Abblix\.Oidc\.Server\.Model\.ClientRequest') {#Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Interfaces.IDeviceAuthorizationHandler.HandleAsync(Abblix.Oidc.Server.Model.DeviceAuthorizationRequest,Abblix.Oidc.Server.Model.ClientRequest).clientRequest} The client authentication information\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[DeviceAuthorizationResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.DeviceAuthorizationResponse 'Abblix\.Oidc\.Server\.Model\.DeviceAuthorizationResponse')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task that returns a result containing either a successful device authorization response with device\_code and user\_code, or an OIDC error\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Interfaces.IDeviceAuthorizationRequestProcessor.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Interfaces') ## IDeviceAuthorizationRequestProcessor Interface Defines the contract for processing validated device authorization requests\. ```csharp public interface IDeviceAuthorizationRequestProcessor ``` Derived ↳ [DeviceAuthorizationRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.DeviceAuthorizationRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.DeviceAuthorizationRequestProcessor') ### Methods ## IDeviceAuthorizationRequestProcessor\.ProcessAsync\(ValidDeviceAuthorizationRequest\) Method {#Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Interfaces.IDeviceAuthorizationRequestProcessor.ProcessAsync(Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Interfaces.ValidDeviceAuthorizationRequest)} Processes a validated device authorization request, generating device\_code and user\_code, and storing the request for later verification\. ```csharp System.Threading.Tasks.Task> ProcessAsync(Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Interfaces.ValidDeviceAuthorizationRequest request); ``` #### Parameters ###### `request` [ValidDeviceAuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Interfaces.ValidDeviceAuthorizationRequest 'Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Interfaces\.ValidDeviceAuthorizationRequest') {#Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Interfaces.IDeviceAuthorizationRequestProcessor.ProcessAsync(Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Interfaces.ValidDeviceAuthorizationRequest).request} The validated device authorization request\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[DeviceAuthorizationResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.DeviceAuthorizationResponse 'Abblix\.Oidc\.Server\.Model\.DeviceAuthorizationResponse')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task that returns a result containing either a successful device authorization response or an OIDC error\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Interfaces.IDeviceAuthorizationRequestValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Interfaces') ## IDeviceAuthorizationRequestValidator Interface Defines the contract for validating device authorization requests\. ```csharp public interface IDeviceAuthorizationRequestValidator ``` Derived ↳ [DeviceAuthorizationRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.DeviceAuthorizationRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.DeviceAuthorizationRequestValidator') ### Methods ## IDeviceAuthorizationRequestValidator\.ValidateAsync\(DeviceAuthorizationRequest, ClientRequest\) Method {#Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Interfaces.IDeviceAuthorizationRequestValidator.ValidateAsync(Abblix.Oidc.Server.Model.DeviceAuthorizationRequest,Abblix.Oidc.Server.Model.ClientRequest)} Validates a device authorization request, verifying client credentials and request parameters\. ```csharp System.Threading.Tasks.Task> ValidateAsync(Abblix.Oidc.Server.Model.DeviceAuthorizationRequest request, Abblix.Oidc.Server.Model.ClientRequest clientRequest); ``` #### Parameters ###### `request` [DeviceAuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.DeviceAuthorizationRequest 'Abblix\.Oidc\.Server\.Model\.DeviceAuthorizationRequest') {#Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Interfaces.IDeviceAuthorizationRequestValidator.ValidateAsync(Abblix.Oidc.Server.Model.DeviceAuthorizationRequest,Abblix.Oidc.Server.Model.ClientRequest).request} The device authorization request to validate\. ###### `clientRequest` [ClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRequest 'Abblix\.Oidc\.Server\.Model\.ClientRequest') {#Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Interfaces.IDeviceAuthorizationRequestValidator.ValidateAsync(Abblix.Oidc.Server.Model.DeviceAuthorizationRequest,Abblix.Oidc.Server.Model.ClientRequest).clientRequest} The client authentication information\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[ValidDeviceAuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Interfaces.ValidDeviceAuthorizationRequest 'Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Interfaces\.ValidDeviceAuthorizationRequest')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task that returns a result containing either a valid device authorization request with resolved client information, or an OIDC error\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Interfaces.ValidDeviceAuthorizationRequest.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Interfaces') ## ValidDeviceAuthorizationRequest Class A device authorization request \(RFC 8628 §3\.1\) that has passed all validators, paired with the authenticated client and the scope/resource sets resolved against the provider's catalog\. ```csharp public record ValidDeviceAuthorizationRequest : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ValidDeviceAuthorizationRequest Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[ValidDeviceAuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Interfaces.ValidDeviceAuthorizationRequest 'Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Interfaces\.ValidDeviceAuthorizationRequest')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Constructors ## ValidDeviceAuthorizationRequest\(DeviceAuthorizationValidationContext\) Constructor {#Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Interfaces.ValidDeviceAuthorizationRequest.ValidDeviceAuthorizationRequest(Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.DeviceAuthorizationValidationContext)} Builds the validated request snapshot from a populated [DeviceAuthorizationValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.DeviceAuthorizationValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Validation\.DeviceAuthorizationValidationContext'), flattening scope and resource definitions to their wire\-form identifiers\. ```csharp public ValidDeviceAuthorizationRequest(Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.DeviceAuthorizationValidationContext context); ``` #### Parameters ###### `context` [DeviceAuthorizationValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.DeviceAuthorizationValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Validation\.DeviceAuthorizationValidationContext') {#Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Interfaces.ValidDeviceAuthorizationRequest.ValidDeviceAuthorizationRequest(Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.DeviceAuthorizationValidationContext).context} ### Properties ## ValidDeviceAuthorizationRequest\.AuthorizationDetails Property {#Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Interfaces.ValidDeviceAuthorizationRequest.AuthorizationDetails} RFC 9396 §3 Rich Authorization Requests array \(post\-validation\), which the downstream processor stashes on the persisted `DeviceAuthorizationRequest` so the user\-verification step can carry it onto the eventual `AuthorizedGrant`\. ```csharp public System.Text.Json.Nodes.JsonArray? AuthorizationDetails { get; } ``` #### Property Value [System\.Text\.Json\.Nodes\.JsonArray](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonarray 'System\.Text\.Json\.Nodes\.JsonArray') ## ValidDeviceAuthorizationRequest\.ClientInfo Property {#Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Interfaces.ValidDeviceAuthorizationRequest.ClientInfo} The authenticated client information\. ```csharp public Abblix.Oidc.Server.Features.ClientInformation.ClientInfo ClientInfo { get; } ``` #### Property Value [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') ## ValidDeviceAuthorizationRequest\.Model Property {#Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Interfaces.ValidDeviceAuthorizationRequest.Model} The original device authorization request model\. ```csharp public Abblix.Oidc.Server.Model.DeviceAuthorizationRequest Model { get; } ``` #### Property Value [DeviceAuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.DeviceAuthorizationRequest 'Abblix\.Oidc\.Server\.Model\.DeviceAuthorizationRequest') ## ValidDeviceAuthorizationRequest\.Resources Property {#Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Interfaces.ValidDeviceAuthorizationRequest.Resources} The validated and resolved resources for the request\. ```csharp public System.Uri[]? Resources { get; } ``` #### Property Value [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') ## ValidDeviceAuthorizationRequest\.Scope Property {#Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Interfaces.ValidDeviceAuthorizationRequest.Scope} The validated and resolved scopes for the request\. ```csharp public string[] Scope { get; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ## Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Validation Namespace | Classes | | | :--- | :--- | | [ClientValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.ClientValidator 'Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Validation\.ClientValidator') | Validates the client in a device authorization request\. | | [DeviceAuthorizationDetailsValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.DeviceAuthorizationDetailsValidator 'Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Validation\.DeviceAuthorizationDetailsValidator') | Thin endpoint\-side adapter that delegates the RFC 9396 §3 device\-flow `authorization_details` validation to [ApplyAsync\(JsonArray, ClientInfo, CancellationToken\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy#Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy.ApplyAsync(System.Text.Json.Nodes.JsonArray,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.Threading.CancellationToken) 'Abblix\.Oidc\.Server\.Features\.RichAuthorizationRequests\.IAuthorizationDetailsPolicy\.ApplyAsync\(System\.Text\.Json\.Nodes\.JsonArray, Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo, System\.Threading\.CancellationToken\)') and propagates the [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') as\-is\. All actual policy lives on the composite so /authorize, /par, CIBA and device\-flow endpoints share one source of truth\. | | [DeviceAuthorizationValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.DeviceAuthorizationValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Validation\.DeviceAuthorizationValidationContext') | Represents the context for validating a device authorization request\. | | [DeviceAuthorizationValidatorComposite](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.DeviceAuthorizationValidatorComposite 'Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Validation\.DeviceAuthorizationValidatorComposite') | Composes multiple device authorization context validators into a single validator\. Executes validators in sequence until one returns an error or all pass\. | | [ResourceValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.ResourceValidator 'Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Validation\.ResourceValidator') | Validates the resources requested in a device authorization request\. | | [ScopeValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.ScopeValidator 'Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Validation\.ScopeValidator') | Validates the scopes requested in a device authorization request\. | | Interfaces | | | :--- | :--- | | [IDeviceAuthorizationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.IDeviceAuthorizationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Validation\.IDeviceAuthorizationContextValidator') | Defines the contract for validating device authorization request contexts\. | --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.ClientValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation 'Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Validation') ## ClientValidator Class Validates the client in a device authorization request\. ```csharp public class ClientValidator : Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.IDeviceAuthorizationContextValidator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ClientValidator Implements [IDeviceAuthorizationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.IDeviceAuthorizationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Validation\.IDeviceAuthorizationContextValidator') ### Constructors ## ClientValidator\(IClientAuthenticator\) Constructor {#Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.ClientValidator.ClientValidator(Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator)} Validates the client in a device authorization request\. ```csharp public ClientValidator(Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator clientAuthenticator); ``` #### Parameters ###### `clientAuthenticator` [IClientAuthenticator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator 'Abblix\.Oidc\.Server\.Features\.ClientAuthentication\.IClientAuthenticator') {#Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.ClientValidator.ClientValidator(Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator).clientAuthenticator} The service used to authenticate clients\. ### Methods ## ClientValidator\.ValidateAsync\(DeviceAuthorizationValidationContext\) Method {#Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.ClientValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.DeviceAuthorizationValidationContext)} Validates the device authorization request context\. ```csharp public System.Threading.Tasks.Task ValidateAsync(Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.DeviceAuthorizationValidationContext context); ``` #### Parameters ###### `context` [DeviceAuthorizationValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.DeviceAuthorizationValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Validation\.DeviceAuthorizationValidationContext') {#Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.ClientValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.DeviceAuthorizationValidationContext).context} The validation context containing the request and client information\. Implements [ValidateAsync\(DeviceAuthorizationValidationContext\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.IDeviceAuthorizationContextValidator#Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.IDeviceAuthorizationContextValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.DeviceAuthorizationValidationContext) 'Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Validation\.IDeviceAuthorizationContextValidator\.ValidateAsync\(Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Validation\.DeviceAuthorizationValidationContext\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') An OIDC error if validation fails, or null if validation succeeds\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.DeviceAuthorizationDetailsValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation 'Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Validation') ## DeviceAuthorizationDetailsValidator Class Thin endpoint\-side adapter that delegates the RFC 9396 §3 device\-flow `authorization_details` validation to [ApplyAsync\(JsonArray, ClientInfo, CancellationToken\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy#Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy.ApplyAsync(System.Text.Json.Nodes.JsonArray,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.Threading.CancellationToken) 'Abblix\.Oidc\.Server\.Features\.RichAuthorizationRequests\.IAuthorizationDetailsPolicy\.ApplyAsync\(System\.Text\.Json\.Nodes\.JsonArray, Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo, System\.Threading\.CancellationToken\)') and propagates the [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') as\-is\. All actual policy lives on the composite so /authorize, /par, CIBA and device\-flow endpoints share one source of truth\. ```csharp public class DeviceAuthorizationDetailsValidator : Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.IDeviceAuthorizationContextValidator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → DeviceAuthorizationDetailsValidator Implements [IDeviceAuthorizationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.IDeviceAuthorizationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Validation\.IDeviceAuthorizationContextValidator') ### Constructors ## DeviceAuthorizationDetailsValidator\(IAuthorizationDetailsPolicy\) Constructor {#Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.DeviceAuthorizationDetailsValidator.DeviceAuthorizationDetailsValidator(Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy)} Thin endpoint\-side adapter that delegates the RFC 9396 §3 device\-flow `authorization_details` validation to [ApplyAsync\(JsonArray, ClientInfo, CancellationToken\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy#Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy.ApplyAsync(System.Text.Json.Nodes.JsonArray,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.Threading.CancellationToken) 'Abblix\.Oidc\.Server\.Features\.RichAuthorizationRequests\.IAuthorizationDetailsPolicy\.ApplyAsync\(System\.Text\.Json\.Nodes\.JsonArray, Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo, System\.Threading\.CancellationToken\)') and propagates the [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') as\-is\. All actual policy lives on the composite so /authorize, /par, CIBA and device\-flow endpoints share one source of truth\. ```csharp public DeviceAuthorizationDetailsValidator(Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy policy); ``` #### Parameters ###### `policy` [IAuthorizationDetailsPolicy](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy 'Abblix\.Oidc\.Server\.Features\.RichAuthorizationRequests\.IAuthorizationDetailsPolicy') {#Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.DeviceAuthorizationDetailsValidator.DeviceAuthorizationDetailsValidator(Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy).policy} ### Methods ## DeviceAuthorizationDetailsValidator\.ValidateAsync\(DeviceAuthorizationValidationContext\) Method {#Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.DeviceAuthorizationDetailsValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.DeviceAuthorizationValidationContext)} Validates the device authorization request context\. ```csharp public System.Threading.Tasks.Task ValidateAsync(Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.DeviceAuthorizationValidationContext context); ``` #### Parameters ###### `context` [DeviceAuthorizationValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.DeviceAuthorizationValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Validation\.DeviceAuthorizationValidationContext') {#Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.DeviceAuthorizationDetailsValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.DeviceAuthorizationValidationContext).context} The validation context containing the request and client information\. Implements [ValidateAsync\(DeviceAuthorizationValidationContext\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.IDeviceAuthorizationContextValidator#Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.IDeviceAuthorizationContextValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.DeviceAuthorizationValidationContext) 'Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Validation\.IDeviceAuthorizationContextValidator\.ValidateAsync\(Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Validation\.DeviceAuthorizationValidationContext\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') An OIDC error if validation fails, or null if validation succeeds\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.DeviceAuthorizationValidationContext.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation 'Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Validation') ## DeviceAuthorizationValidationContext Class Represents the context for validating a device authorization request\. ```csharp public record DeviceAuthorizationValidationContext : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → DeviceAuthorizationValidationContext Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[DeviceAuthorizationValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.DeviceAuthorizationValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Validation\.DeviceAuthorizationValidationContext')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Constructors ## DeviceAuthorizationValidationContext\(DeviceAuthorizationRequest, ClientRequest\) Constructor {#Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.DeviceAuthorizationValidationContext.DeviceAuthorizationValidationContext(Abblix.Oidc.Server.Model.DeviceAuthorizationRequest,Abblix.Oidc.Server.Model.ClientRequest)} Represents the context for validating a device authorization request\. ```csharp public DeviceAuthorizationValidationContext(Abblix.Oidc.Server.Model.DeviceAuthorizationRequest Request, Abblix.Oidc.Server.Model.ClientRequest ClientRequest); ``` #### Parameters ###### `Request` [DeviceAuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.DeviceAuthorizationRequest 'Abblix\.Oidc\.Server\.Model\.DeviceAuthorizationRequest') {#Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.DeviceAuthorizationValidationContext.DeviceAuthorizationValidationContext(Abblix.Oidc.Server.Model.DeviceAuthorizationRequest,Abblix.Oidc.Server.Model.ClientRequest).Request} The device authorization request being validated\. ###### `ClientRequest` [ClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRequest 'Abblix\.Oidc\.Server\.Model\.ClientRequest') {#Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.DeviceAuthorizationValidationContext.DeviceAuthorizationValidationContext(Abblix.Oidc.Server.Model.DeviceAuthorizationRequest,Abblix.Oidc.Server.Model.ClientRequest).ClientRequest} The client request with authentication information\. ### Properties ## DeviceAuthorizationValidationContext\.AuthorizationDetails Property {#Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.DeviceAuthorizationValidationContext.AuthorizationDetails} RFC 9396 §3 Rich Authorization Requests array, populated after per\-client allowlist and per\-type validator dispatch by [DeviceAuthorizationDetailsValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.DeviceAuthorizationDetailsValidator 'Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Validation\.DeviceAuthorizationDetailsValidator')\. `null` when the request did not include `authorization_details`\. ```csharp public System.Text.Json.Nodes.JsonArray? AuthorizationDetails { get; set; } ``` #### Property Value [System\.Text\.Json\.Nodes\.JsonArray](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonarray 'System\.Text\.Json\.Nodes\.JsonArray') ## DeviceAuthorizationValidationContext\.ClientInfo Property {#Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.DeviceAuthorizationValidationContext.ClientInfo} The authenticated client information\. ```csharp public Abblix.Oidc.Server.Features.ClientInformation.ClientInfo ClientInfo { get; set; } ``` #### Property Value [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') ## DeviceAuthorizationValidationContext\.ClientRequest Property {#Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.DeviceAuthorizationValidationContext.ClientRequest} The client request with authentication information\. ```csharp public Abblix.Oidc.Server.Model.ClientRequest ClientRequest { get; init; } ``` #### Property Value [ClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRequest 'Abblix\.Oidc\.Server\.Model\.ClientRequest') ## DeviceAuthorizationValidationContext\.Request Property {#Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.DeviceAuthorizationValidationContext.Request} The device authorization request being validated\. ```csharp public Abblix.Oidc.Server.Model.DeviceAuthorizationRequest Request { get; init; } ``` #### Property Value [DeviceAuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.DeviceAuthorizationRequest 'Abblix\.Oidc\.Server\.Model\.DeviceAuthorizationRequest') ## DeviceAuthorizationValidationContext\.Resources Property {#Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.DeviceAuthorizationValidationContext.Resources} The validated resource definitions for the request\. ```csharp public Abblix.Oidc.Server.Common.Constants.ResourceDefinition[] Resources { get; set; } ``` #### Property Value [ResourceDefinition](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ResourceDefinition 'Abblix\.Oidc\.Server\.Common\.Constants\.ResourceDefinition')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') ## DeviceAuthorizationValidationContext\.Scope Property {#Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.DeviceAuthorizationValidationContext.Scope} The validated scope definitions for the request\. ```csharp public Abblix.Oidc.Server.Common.Constants.ScopeDefinition[] Scope { get; set; } ``` #### Property Value [ScopeDefinition](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ScopeDefinition 'Abblix\.Oidc\.Server\.Common\.Constants\.ScopeDefinition')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.DeviceAuthorizationValidatorComposite.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation 'Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Validation') ## DeviceAuthorizationValidatorComposite Class Composes multiple device authorization context validators into a single validator\. Executes validators in sequence until one returns an error or all pass\. ```csharp public class DeviceAuthorizationValidatorComposite : Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.IDeviceAuthorizationContextValidator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → DeviceAuthorizationValidatorComposite Implements [IDeviceAuthorizationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.IDeviceAuthorizationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Validation\.IDeviceAuthorizationContextValidator') ### Constructors ## DeviceAuthorizationValidatorComposite\(IEnumerable\\) Constructor {#Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.DeviceAuthorizationValidatorComposite.DeviceAuthorizationValidatorComposite(System.Collections.Generic.IEnumerable_Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.IDeviceAuthorizationContextValidator_)} Composes multiple device authorization context validators into a single validator\. Executes validators in sequence until one returns an error or all pass\. ```csharp public DeviceAuthorizationValidatorComposite(System.Collections.Generic.IEnumerable validators); ``` #### Parameters ###### `validators` [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[IDeviceAuthorizationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.IDeviceAuthorizationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Validation\.IDeviceAuthorizationContextValidator')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') {#Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.DeviceAuthorizationValidatorComposite.DeviceAuthorizationValidatorComposite(System.Collections.Generic.IEnumerable_Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.IDeviceAuthorizationContextValidator_).validators} The collection of validators to execute\. ### Methods ## DeviceAuthorizationValidatorComposite\.ValidateAsync\(DeviceAuthorizationValidationContext\) Method {#Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.DeviceAuthorizationValidatorComposite.ValidateAsync(Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.DeviceAuthorizationValidationContext)} Validates the device authorization request context\. ```csharp public System.Threading.Tasks.Task ValidateAsync(Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.DeviceAuthorizationValidationContext context); ``` #### Parameters ###### `context` [DeviceAuthorizationValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.DeviceAuthorizationValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Validation\.DeviceAuthorizationValidationContext') {#Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.DeviceAuthorizationValidatorComposite.ValidateAsync(Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.DeviceAuthorizationValidationContext).context} The validation context containing the request and client information\. Implements [ValidateAsync\(DeviceAuthorizationValidationContext\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.IDeviceAuthorizationContextValidator#Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.IDeviceAuthorizationContextValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.DeviceAuthorizationValidationContext) 'Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Validation\.IDeviceAuthorizationContextValidator\.ValidateAsync\(Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Validation\.DeviceAuthorizationValidationContext\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') An OIDC error if validation fails, or null if validation succeeds\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.IDeviceAuthorizationContextValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation 'Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Validation') ## IDeviceAuthorizationContextValidator Interface Defines the contract for validating device authorization request contexts\. ```csharp public interface IDeviceAuthorizationContextValidator ``` Derived ↳ [ClientValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.ClientValidator 'Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Validation\.ClientValidator') ↳ [DeviceAuthorizationDetailsValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.DeviceAuthorizationDetailsValidator 'Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Validation\.DeviceAuthorizationDetailsValidator') ↳ [DeviceAuthorizationValidatorComposite](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.DeviceAuthorizationValidatorComposite 'Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Validation\.DeviceAuthorizationValidatorComposite') ↳ [ResourceValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.ResourceValidator 'Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Validation\.ResourceValidator') ↳ [ScopeValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.ScopeValidator 'Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Validation\.ScopeValidator') ### Methods ## IDeviceAuthorizationContextValidator\.ValidateAsync\(DeviceAuthorizationValidationContext\) Method {#Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.IDeviceAuthorizationContextValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.DeviceAuthorizationValidationContext)} Validates the device authorization request context\. ```csharp System.Threading.Tasks.Task ValidateAsync(Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.DeviceAuthorizationValidationContext context); ``` #### Parameters ###### `context` [DeviceAuthorizationValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.DeviceAuthorizationValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Validation\.DeviceAuthorizationValidationContext') {#Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.IDeviceAuthorizationContextValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.DeviceAuthorizationValidationContext).context} The validation context containing the request and client information\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') An OIDC error if validation fails, or null if validation succeeds\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.ResourceValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation 'Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Validation') ## ResourceValidator Class Validates the resources requested in a device authorization request\. ```csharp public class ResourceValidator : Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.IDeviceAuthorizationContextValidator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ResourceValidator Implements [IDeviceAuthorizationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.IDeviceAuthorizationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Validation\.IDeviceAuthorizationContextValidator') ### Constructors ## ResourceValidator\(IResourceManager\) Constructor {#Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.ResourceValidator.ResourceValidator(Abblix.Oidc.Server.Features.ResourceIndicators.IResourceManager)} Validates the resources requested in a device authorization request\. ```csharp public ResourceValidator(Abblix.Oidc.Server.Features.ResourceIndicators.IResourceManager resourceManager); ``` #### Parameters ###### `resourceManager` [IResourceManager](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ResourceIndicators.IResourceManager 'Abblix\.Oidc\.Server\.Features\.ResourceIndicators\.IResourceManager') {#Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.ResourceValidator.ResourceValidator(Abblix.Oidc.Server.Features.ResourceIndicators.IResourceManager).resourceManager} The service for managing and validating resources\. ### Methods ## ResourceValidator\.ValidateAsync\(DeviceAuthorizationValidationContext\) Method {#Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.ResourceValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.DeviceAuthorizationValidationContext)} Validates the device authorization request context\. ```csharp public System.Threading.Tasks.Task ValidateAsync(Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.DeviceAuthorizationValidationContext context); ``` #### Parameters ###### `context` [DeviceAuthorizationValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.DeviceAuthorizationValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Validation\.DeviceAuthorizationValidationContext') {#Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.ResourceValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.DeviceAuthorizationValidationContext).context} The validation context containing the request and client information\. Implements [ValidateAsync\(DeviceAuthorizationValidationContext\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.IDeviceAuthorizationContextValidator#Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.IDeviceAuthorizationContextValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.DeviceAuthorizationValidationContext) 'Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Validation\.IDeviceAuthorizationContextValidator\.ValidateAsync\(Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Validation\.DeviceAuthorizationValidationContext\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') An OIDC error if validation fails, or null if validation succeeds\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.ScopeValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation 'Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Validation') ## ScopeValidator Class Validates the scopes requested in a device authorization request\. ```csharp public class ScopeValidator : Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.IDeviceAuthorizationContextValidator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ScopeValidator Implements [IDeviceAuthorizationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.IDeviceAuthorizationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Validation\.IDeviceAuthorizationContextValidator') ### Constructors ## ScopeValidator\(IScopeManager\) Constructor {#Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.ScopeValidator.ScopeValidator(Abblix.Oidc.Server.Features.ScopeManagement.IScopeManager)} Validates the scopes requested in a device authorization request\. ```csharp public ScopeValidator(Abblix.Oidc.Server.Features.ScopeManagement.IScopeManager scopeManager); ``` #### Parameters ###### `scopeManager` [IScopeManager](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ScopeManagement.IScopeManager 'Abblix\.Oidc\.Server\.Features\.ScopeManagement\.IScopeManager') {#Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.ScopeValidator.ScopeValidator(Abblix.Oidc.Server.Features.ScopeManagement.IScopeManager).scopeManager} The service for managing and validating scopes\. ### Methods ## ScopeValidator\.ValidateAsync\(DeviceAuthorizationValidationContext\) Method {#Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.ScopeValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.DeviceAuthorizationValidationContext)} Validates the device authorization request context\. ```csharp public System.Threading.Tasks.Task ValidateAsync(Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.DeviceAuthorizationValidationContext context); ``` #### Parameters ###### `context` [DeviceAuthorizationValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.DeviceAuthorizationValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Validation\.DeviceAuthorizationValidationContext') {#Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.ScopeValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.DeviceAuthorizationValidationContext).context} The validation context containing the request and client information\. Implements [ValidateAsync\(DeviceAuthorizationValidationContext\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.IDeviceAuthorizationContextValidator#Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.IDeviceAuthorizationContextValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.DeviceAuthorizationValidationContext) 'Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Validation\.IDeviceAuthorizationContextValidator\.ValidateAsync\(Abblix\.Oidc\.Server\.Endpoints\.DeviceAuthorization\.Validation\.DeviceAuthorizationValidationContext\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') An OIDC error if validation fails, or null if validation succeeds\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ## Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement Namespace | Classes | | | :--- | :--- | | [ClientCredentialFactory](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.ClientCredentialFactory 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.ClientCredentialFactory') | Coordinates credential generation by composing ID generation, secret generation, hashing, and expiration calculation\. Uses SHA\-512 for strong cryptographic hashing while maintaining configurable secret length and expiration policies\. | | [ClientRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.ClientRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.ClientRequestValidator') | Default [IClientRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IClientRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IClientRequestValidator') for the RFC 7592 client configuration endpoint\. First verifies the registration access token is bound to the requested `client_id`, then loads the corresponding [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') from storage and rejects the request when no record exists\. | | [InitialAccessTokenRevocationProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.InitialAccessTokenRevocationProvider 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.InitialAccessTokenRevocationProvider') | Default implementation that checks revocation against [RevokedInitialAccessTokenSubjects](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions#Abblix.Oidc.Server.Common.Configuration.OidcOptions.RevokedInitialAccessTokenSubjects 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions\.RevokedInitialAccessTokenSubjects')\. For production use with large or dynamic revocation lists, replace with a database\- or cache\-backed implementation\. | | [InitialAccessTokenService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.InitialAccessTokenService 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.InitialAccessTokenService') | Issues initial access tokens for authorizing client registration per RFC 7591 Section 3\. | | [ReadClientHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.ReadClientHandler 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.ReadClientHandler') | Handles client configuration retrieval requests in OAuth 2\.0 Dynamic Client Registration protocol\. Coordinates validation and processing to securely fetch registered client information\. | | [ReadClientRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.ReadClientRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.ReadClientRequestProcessor') | Builds the RFC 7592 §2\.1 read\-client response from stored client metadata\. The `client_secret` is intentionally omitted because secrets are persisted only as hashes; a registration access token bearing the client's current jti is re\-issued so the client can keep using the management endpoint after the read, without invalidating the token it presented \(read stays idempotent \- only update rotates the jti\)\. | | [RegisterClientHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RegisterClientHandler 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.RegisterClientHandler') | Default implementation of [IRegisterClientHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegisterClientHandler 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IRegisterClientHandler') that runs validation \(RFC 7591 §2 metadata \+ OIDC DCR 1\.0\) followed by processing \(credential issuance, persistence, and registration access token generation per RFC 7591 §3\.2\.1 / RFC 7592 §3\)\. | | [RegisterClientRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RegisterClientRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.RegisterClientRequestProcessor') | Handles the registration of new clients by generating the necessary credentials and adding client information to the system\. Ensures the secure and compliant registration of clients as per OAuth 2\.0 and OpenID Connect standards\. | | [RegisterClientRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RegisterClientRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.RegisterClientRequestValidator') | Default validator for new\-client registration \(POST\), wrapping the request in a [ClientRegistrationValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientRegistrationValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.ClientRegistrationValidationContext') with [Register](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.DynamicClientOperation#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.DynamicClientOperation.Register 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.DynamicClientOperation\.Register') and delegating to the configured [IClientRegistrationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.IClientRegistrationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.IClientRegistrationContextValidator') pipeline\. | | [RegistrationAccessTokenService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RegistrationAccessTokenService 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.RegistrationAccessTokenService') | Issues registration access tokens for managing registered clients per RFC 7592 Section 3\. | | [RegistrationAccessTokenStore](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RegistrationAccessTokenStore 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.RegistrationAccessTokenStore') | Default [IRegistrationAccessTokenStore](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenStore 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IRegistrationAccessTokenStore') backed by the distributed [IEntityStorage](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Storages.IEntityStorage 'Abblix\.Oidc\.Server\.Features\.Storages\.IEntityStorage'), so the client\-to\-token\-jti binding is shared across all server replicas\. The entry is stored without expiration \- it lives as long as the client is registered \- and is removed when the client is deregistered\. | | [RegistrationAccessTokenValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RegistrationAccessTokenValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.RegistrationAccessTokenValidator') | Default implementation of [IRegistrationAccessTokenValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IRegistrationAccessTokenValidator')\. Requires a `Bearer` scheme, validates the JWT signature and lifetime via [IAuthServiceJwtValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.Validation.IAuthServiceJwtValidator 'Abblix\.Oidc\.Server\.Features\.Tokens\.Validation\.IAuthServiceJwtValidator') \(which requires the audience to name this server, the party that reads the token\), then enforces that the token's `typ` is `registration_access_token` and that its `sub` equals the requested `client_id` \- the claim carrying the association RFC 7592 Section 1\.2 describes\. | | [RemoveClientHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RemoveClientHandler 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.RemoveClientHandler') | Default implementation of [IRemoveClientHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRemoveClientHandler 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IRemoveClientHandler') that authenticates the registration access token via [IClientRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IClientRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IClientRequestValidator') and, on success, delegates to the processor to delete the client per RFC 7592 §2\.3\. | | [RemoveClientRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RemoveClientRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.RemoveClientRequestProcessor') | Performs the storage\-level deregistration of a client through the configured [IClientInfoManager](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.IClientInfoManager 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.IClientInfoManager') per RFC 7592 §2\.3\. | | [UpdateClientHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.UpdateClientHandler 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.UpdateClientHandler') | Handles client configuration update requests in OAuth 2\.0 Dynamic Client Registration Management protocol per RFC 7592\. Coordinates validation and processing to securely update registered client information\. | | [UpdateClientRegistrationValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.UpdateClientRegistrationValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.UpdateClientRegistrationValidator') | Variant of [RegisterClientRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RegisterClientRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.RegisterClientRequestValidator') used by the RFC 7592 §2\.2 update flow\. Wraps the request in a [ClientRegistrationValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientRegistrationValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.ClientRegistrationValidationContext') with [Update](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.DynamicClientOperation#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.DynamicClientOperation.Update 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.DynamicClientOperation\.Update') so steps such as `ClientIdValidator` require the client to already exist instead of forbidding it\. | | [UpdateClientRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.UpdateClientRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.UpdateClientRequestProcessor') | Processes requests to update existing client configurations per RFC 7592 Section 2\.2\. Updates client metadata while preserving credentials and system\-managed fields\. | | [UpdateClientRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.UpdateClientRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.UpdateClientRequestValidator') | Validates an RFC 7592 §2\.2 update request: authenticates the registration access token and confirms the client exists, then validates the supplied replacement metadata via the update\-specific keyed [IRegisterClientRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegisterClientRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IRegisterClientRequestValidator')\. Also enforces the RFC 7592 §2\.2 rule that the request body's `client_id` must match the authenticated client\. | --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.ClientCredentialFactory.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement') ## ClientCredentialFactory Class Coordinates credential generation by composing ID generation, secret generation, hashing, and expiration calculation\. Uses SHA\-512 for strong cryptographic hashing while maintaining configurable secret length and expiration policies\. ```csharp public class ClientCredentialFactory : Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IClientCredentialFactory ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ClientCredentialFactory Implements [IClientCredentialFactory](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IClientCredentialFactory 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IClientCredentialFactory') ### Constructors ## ClientCredentialFactory\(IClientIdGenerator, IClientSecretGenerator, IHashService, NewClientOptions, TimeProvider\) Constructor {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.ClientCredentialFactory.ClientCredentialFactory(Abblix.Oidc.Server.Features.RandomGenerators.IClientIdGenerator,Abblix.Oidc.Server.Features.RandomGenerators.IClientSecretGenerator,Abblix.Oidc.Server.Features.Hashing.IHashService,Abblix.Oidc.Server.Common.Configuration.NewClientOptions,System.TimeProvider)} Coordinates credential generation by composing ID generation, secret generation, hashing, and expiration calculation\. Uses SHA\-512 for strong cryptographic hashing while maintaining configurable secret length and expiration policies\. ```csharp public ClientCredentialFactory(Abblix.Oidc.Server.Features.RandomGenerators.IClientIdGenerator clientIdGenerator, Abblix.Oidc.Server.Features.RandomGenerators.IClientSecretGenerator clientSecretGenerator, Abblix.Oidc.Server.Features.Hashing.IHashService hashService, Abblix.Oidc.Server.Common.Configuration.NewClientOptions options, System.TimeProvider clock); ``` #### Parameters ###### `clientIdGenerator` [IClientIdGenerator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.IClientIdGenerator 'Abblix\.Oidc\.Server\.Features\.RandomGenerators\.IClientIdGenerator') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.ClientCredentialFactory.ClientCredentialFactory(Abblix.Oidc.Server.Features.RandomGenerators.IClientIdGenerator,Abblix.Oidc.Server.Features.RandomGenerators.IClientSecretGenerator,Abblix.Oidc.Server.Features.Hashing.IHashService,Abblix.Oidc.Server.Common.Configuration.NewClientOptions,System.TimeProvider).clientIdGenerator} ###### `clientSecretGenerator` [IClientSecretGenerator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.IClientSecretGenerator 'Abblix\.Oidc\.Server\.Features\.RandomGenerators\.IClientSecretGenerator') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.ClientCredentialFactory.ClientCredentialFactory(Abblix.Oidc.Server.Features.RandomGenerators.IClientIdGenerator,Abblix.Oidc.Server.Features.RandomGenerators.IClientSecretGenerator,Abblix.Oidc.Server.Features.Hashing.IHashService,Abblix.Oidc.Server.Common.Configuration.NewClientOptions,System.TimeProvider).clientSecretGenerator} ###### `hashService` [IHashService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Hashing.IHashService 'Abblix\.Oidc\.Server\.Features\.Hashing\.IHashService') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.ClientCredentialFactory.ClientCredentialFactory(Abblix.Oidc.Server.Features.RandomGenerators.IClientIdGenerator,Abblix.Oidc.Server.Features.RandomGenerators.IClientSecretGenerator,Abblix.Oidc.Server.Features.Hashing.IHashService,Abblix.Oidc.Server.Common.Configuration.NewClientOptions,System.TimeProvider).hashService} ###### `options` [NewClientOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.NewClientOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.NewClientOptions') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.ClientCredentialFactory.ClientCredentialFactory(Abblix.Oidc.Server.Features.RandomGenerators.IClientIdGenerator,Abblix.Oidc.Server.Features.RandomGenerators.IClientSecretGenerator,Abblix.Oidc.Server.Features.Hashing.IHashService,Abblix.Oidc.Server.Common.Configuration.NewClientOptions,System.TimeProvider).options} ###### `clock` [System\.TimeProvider](https://learn.microsoft.com/en-us/dotnet/api/system.timeprovider 'System\.TimeProvider') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.ClientCredentialFactory.ClientCredentialFactory(Abblix.Oidc.Server.Features.RandomGenerators.IClientIdGenerator,Abblix.Oidc.Server.Features.RandomGenerators.IClientSecretGenerator,Abblix.Oidc.Server.Features.Hashing.IHashService,Abblix.Oidc.Server.Common.Configuration.NewClientOptions,System.TimeProvider).clock} ### Methods ## ClientCredentialFactory\.Create\(string, string\) Method {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.ClientCredentialFactory.Create(string,string)} Generates secrets conditionally based on authentication method to avoid unnecessary secret generation for public clients\. Uses time\-based expiration to enforce secret rotation policies\. SHA\-512 provides cryptographic strength while remaining compatible with HMAC\-based client\_secret\_jwt\. ```csharp public Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ClientCredentials Create(string tokenEndpointAuthMethod, string? clientId=null); ``` #### Parameters ###### `tokenEndpointAuthMethod` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.ClientCredentialFactory.Create(string,string).tokenEndpointAuthMethod} Determines whether secret generation is required\. ###### `clientId` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.ClientCredentialFactory.Create(string,string).clientId} Allows external client ID assignment for pre\-registration scenarios\. Implements [Create\(string, string\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IClientCredentialFactory#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IClientCredentialFactory.Create(string,string) 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IClientCredentialFactory\.Create\(string, string\)') #### Returns [ClientCredentials](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ClientCredentials 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.ClientCredentials') Credentials containing both plain\-text \(for transmission\) and hashed \(for storage\) secret formats, along with calculated expiration timestamp\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.ClientRequestValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement') ## ClientRequestValidator Class Default [IClientRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IClientRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IClientRequestValidator') for the RFC 7592 client configuration endpoint\. First verifies the registration access token is bound to the requested `client_id`, then loads the corresponding [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') from storage and rejects the request when no record exists\. ```csharp public class ClientRequestValidator : Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IClientRequestValidator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ClientRequestValidator Implements [IClientRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IClientRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IClientRequestValidator') ### Constructors ## ClientRequestValidator\(IClientInfoProvider, IRegistrationAccessTokenValidator, IRegistrationAccessTokenStore\) Constructor {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.ClientRequestValidator.ClientRequestValidator(Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider,Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenValidator,Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenStore)} Default [IClientRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IClientRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IClientRequestValidator') for the RFC 7592 client configuration endpoint\. First verifies the registration access token is bound to the requested `client_id`, then loads the corresponding [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') from storage and rejects the request when no record exists\. ```csharp public ClientRequestValidator(Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider clientInfoProvider, Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenValidator registrationAccessTokenValidator, Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenStore registrationAccessTokenStore); ``` #### Parameters ###### `clientInfoProvider` [IClientInfoProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.IClientInfoProvider') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.ClientRequestValidator.ClientRequestValidator(Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider,Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenValidator,Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenStore).clientInfoProvider} Store consulted for the addressed client\. ###### `registrationAccessTokenValidator` [IRegistrationAccessTokenValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IRegistrationAccessTokenValidator') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.ClientRequestValidator.ClientRequestValidator(Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider,Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenValidator,Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenStore).registrationAccessTokenValidator} Validator for the bearer registration access token\. ###### `registrationAccessTokenStore` [IRegistrationAccessTokenStore](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenStore 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IRegistrationAccessTokenStore') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.ClientRequestValidator.ClientRequestValidator(Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider,Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenValidator,Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenStore).registrationAccessTokenStore} Store holding the jti of each client's current token\. ### Methods ## ClientRequestValidator\.ValidateAsync\(ClientRequest\) Method {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.ClientRequestValidator.ValidateAsync(Abblix.Oidc.Server.Model.ClientRequest)} Validates the request, returning the resolved [ValidClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidClientRequest 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.ValidClientRequest') on success or an [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') describing the rejection\. ```csharp public System.Threading.Tasks.Task> ValidateAsync(Abblix.Oidc.Server.Model.ClientRequest request); ``` #### Parameters ###### `request` [ClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRequest 'Abblix\.Oidc\.Server\.Model\.ClientRequest') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.ClientRequestValidator.ValidateAsync(Abblix.Oidc.Server.Model.ClientRequest).request} The client management request to validate\. Implements [ValidateAsync\(ClientRequest\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IClientRequestValidator#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IClientRequestValidator.ValidateAsync(Abblix.Oidc.Server.Model.ClientRequest) 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IClientRequestValidator\.ValidateAsync\(Abblix\.Oidc\.Server\.Model\.ClientRequest\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[ValidClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidClientRequest 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.ValidClientRequest')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.InitialAccessTokenRevocationProvider.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement') ## InitialAccessTokenRevocationProvider Class Default implementation that checks revocation against [RevokedInitialAccessTokenSubjects](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions#Abblix.Oidc.Server.Common.Configuration.OidcOptions.RevokedInitialAccessTokenSubjects 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions\.RevokedInitialAccessTokenSubjects')\. For production use with large or dynamic revocation lists, replace with a database\- or cache\-backed implementation\. ```csharp public class InitialAccessTokenRevocationProvider : Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IInitialAccessTokenRevocationProvider ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → InitialAccessTokenRevocationProvider Implements [IInitialAccessTokenRevocationProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IInitialAccessTokenRevocationProvider 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IInitialAccessTokenRevocationProvider') ### Constructors ## InitialAccessTokenRevocationProvider\(IOptionsMonitor\\) Constructor {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.InitialAccessTokenRevocationProvider.InitialAccessTokenRevocationProvider(Microsoft.Extensions.Options.IOptionsMonitor_Abblix.Oidc.Server.Common.Configuration.OidcOptions_)} Default implementation that checks revocation against [RevokedInitialAccessTokenSubjects](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions#Abblix.Oidc.Server.Common.Configuration.OidcOptions.RevokedInitialAccessTokenSubjects 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions\.RevokedInitialAccessTokenSubjects')\. For production use with large or dynamic revocation lists, replace with a database\- or cache\-backed implementation\. ```csharp public InitialAccessTokenRevocationProvider(Microsoft.Extensions.Options.IOptionsMonitor options); ``` #### Parameters ###### `options` [Microsoft\.Extensions\.Options\.IOptionsMonitor<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptionsmonitor-1 'Microsoft\.Extensions\.Options\.IOptionsMonitor\`1')[OidcOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptionsmonitor-1 'Microsoft\.Extensions\.Options\.IOptionsMonitor\`1') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.InitialAccessTokenRevocationProvider.InitialAccessTokenRevocationProvider(Microsoft.Extensions.Options.IOptionsMonitor_Abblix.Oidc.Server.Common.Configuration.OidcOptions_).options} OIDC configuration containing the set of revoked token identifiers\. ### Methods ## InitialAccessTokenRevocationProvider\.IsRevokedAsync\(string\) Method {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.InitialAccessTokenRevocationProvider.IsRevokedAsync(string)} Determines whether the initial access token with the specified identifier has been revoked\. ```csharp public System.Threading.Tasks.Task IsRevokedAsync(string subject); ``` #### Parameters ###### `subject` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.InitialAccessTokenRevocationProvider.IsRevokedAsync(string).subject} The unique identifier of the token \(from the JWT subject claim\)\. Implements [IsRevokedAsync\(string\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IInitialAccessTokenRevocationProvider#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IInitialAccessTokenRevocationProvider.IsRevokedAsync(string) 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IInitialAccessTokenRevocationProvider\.IsRevokedAsync\(string\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task that results in `true` if the token has been revoked, `false` otherwise\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.InitialAccessTokenService.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement') ## InitialAccessTokenService Class Issues initial access tokens for authorizing client registration per RFC 7591 Section 3\. ```csharp public class InitialAccessTokenService : Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IInitialAccessTokenService ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → InitialAccessTokenService Implements [IInitialAccessTokenService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IInitialAccessTokenService 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IInitialAccessTokenService') ### Constructors ## InitialAccessTokenService\(IAuthServiceJwtFormatter, IIssuerProvider, IOptions\\) Constructor {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.InitialAccessTokenService.InitialAccessTokenService(Abblix.Oidc.Server.Features.Tokens.Formatters.IAuthServiceJwtFormatter,Abblix.Oidc.Server.Features.Issuer.IIssuerProvider,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_)} Issues initial access tokens for authorizing client registration per RFC 7591 Section 3\. ```csharp public InitialAccessTokenService(Abblix.Oidc.Server.Features.Tokens.Formatters.IAuthServiceJwtFormatter serviceJwtFormatter, Abblix.Oidc.Server.Features.Issuer.IIssuerProvider issuerProvider, Microsoft.Extensions.Options.IOptions options); ``` #### Parameters ###### `serviceJwtFormatter` [IAuthServiceJwtFormatter](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.Formatters.IAuthServiceJwtFormatter 'Abblix\.Oidc\.Server\.Features\.Tokens\.Formatters\.IAuthServiceJwtFormatter') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.InitialAccessTokenService.InitialAccessTokenService(Abblix.Oidc.Server.Features.Tokens.Formatters.IAuthServiceJwtFormatter,Abblix.Oidc.Server.Features.Issuer.IIssuerProvider,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_).serviceJwtFormatter} ###### `issuerProvider` [IIssuerProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Issuer.IIssuerProvider 'Abblix\.Oidc\.Server\.Features\.Issuer\.IIssuerProvider') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.InitialAccessTokenService.InitialAccessTokenService(Abblix.Oidc.Server.Features.Tokens.Formatters.IAuthServiceJwtFormatter,Abblix.Oidc.Server.Features.Issuer.IIssuerProvider,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_).issuerProvider} ###### `options` [Microsoft\.Extensions\.Options\.IOptions<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptions-1 'Microsoft\.Extensions\.Options\.IOptions\`1')[OidcOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptions-1 'Microsoft\.Extensions\.Options\.IOptions\`1') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.InitialAccessTokenService.InitialAccessTokenService(Abblix.Oidc.Server.Features.Tokens.Formatters.IAuthServiceJwtFormatter,Abblix.Oidc.Server.Features.Issuer.IIssuerProvider,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_).options} ### Methods ## InitialAccessTokenService\.IssueTokenAsync\(string, DateTimeOffset, Nullable\\) Method {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.InitialAccessTokenService.IssueTokenAsync(string,System.DateTimeOffset,System.Nullable_System.TimeSpan_)} Issues an initial access token for authorizing client registration\. ```csharp public System.Threading.Tasks.Task IssueTokenAsync(string subject, System.DateTimeOffset issuedAt, System.Nullable expiresIn); ``` #### Parameters ###### `subject` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.InitialAccessTokenService.IssueTokenAsync(string,System.DateTimeOffset,System.Nullable_System.TimeSpan_).subject} A unique identifier for the token, used as the JWT subject for revocation tracking\. ###### `issuedAt` [System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.InitialAccessTokenService.IssueTokenAsync(string,System.DateTimeOffset,System.Nullable_System.TimeSpan_).issuedAt} The timestamp when the token is issued\. ###### `expiresIn` [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.InitialAccessTokenService.IssueTokenAsync(string,System.DateTimeOffset,System.Nullable_System.TimeSpan_).expiresIn} The optional duration after which the token expires\. Implements [IssueTokenAsync\(string, DateTimeOffset, Nullable<TimeSpan>\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IInitialAccessTokenService#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IInitialAccessTokenService.IssueTokenAsync(string,System.DateTimeOffset,System.Nullable_System.TimeSpan_) 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IInitialAccessTokenService\.IssueTokenAsync\(string, System\.DateTimeOffset, System\.Nullable\\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task that results in the encoded initial access token\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.ReadClientHandler.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement') ## ReadClientHandler Class Handles client configuration retrieval requests in OAuth 2\.0 Dynamic Client Registration protocol\. Coordinates validation and processing to securely fetch registered client information\. ```csharp public class ReadClientHandler : Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IReadClientHandler ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ReadClientHandler Implements [IReadClientHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IReadClientHandler 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IReadClientHandler') ### Constructors ## ReadClientHandler\(IClientRequestValidator, IReadClientRequestProcessor\) Constructor {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.ReadClientHandler.ReadClientHandler(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IClientRequestValidator,Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IReadClientRequestProcessor)} Handles client configuration retrieval requests in OAuth 2\.0 Dynamic Client Registration protocol\. Coordinates validation and processing to securely fetch registered client information\. ```csharp public ReadClientHandler(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IClientRequestValidator validator, Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IReadClientRequestProcessor processor); ``` #### Parameters ###### `validator` [IClientRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IClientRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IClientRequestValidator') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.ReadClientHandler.ReadClientHandler(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IClientRequestValidator,Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IReadClientRequestProcessor).validator} Validates client authentication and authorization for configuration access\. ###### `processor` [IReadClientRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IReadClientRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IReadClientRequestProcessor') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.ReadClientHandler.ReadClientHandler(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IClientRequestValidator,Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IReadClientRequestProcessor).processor} Retrieves and formats client configuration data\. ### Methods ## ReadClientHandler\.HandleAsync\(ClientRequest\) Method {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.ReadClientHandler.HandleAsync(Abblix.Oidc.Server.Model.ClientRequest)} Validates the registration access token and resolves the addressed client, then delegates to the processor to build the read\-client response per RFC 7592 §2\.1\. ```csharp public System.Threading.Tasks.Task> HandleAsync(Abblix.Oidc.Server.Model.ClientRequest clientRequest); ``` #### Parameters ###### `clientRequest` [ClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRequest 'Abblix\.Oidc\.Server\.Model\.ClientRequest') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.ReadClientHandler.HandleAsync(Abblix.Oidc.Server.Model.ClientRequest).clientRequest} The incoming RFC 7592 read request\. Implements [HandleAsync\(ClientRequest\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IReadClientHandler#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IReadClientHandler.HandleAsync(Abblix.Oidc.Server.Model.ClientRequest) 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IReadClientHandler\.HandleAsync\(Abblix\.Oidc\.Server\.Model\.ClientRequest\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[ReadClientSuccessfulResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ReadClientSuccessfulResponse 'Abblix\.Oidc\.Server\.Model\.ReadClientSuccessfulResponse')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') The current client metadata or an error result\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.ReadClientRequestProcessor.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement') ## ReadClientRequestProcessor Class Builds the RFC 7592 §2\.1 read\-client response from stored client metadata\. The `client_secret` is intentionally omitted because secrets are persisted only as hashes; a registration access token bearing the client's current jti is re\-issued so the client can keep using the management endpoint after the read, without invalidating the token it presented \(read stays idempotent \- only update rotates the jti\)\. ```csharp public class ReadClientRequestProcessor : Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IReadClientRequestProcessor ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ReadClientRequestProcessor Implements [IReadClientRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IReadClientRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IReadClientRequestProcessor') ### Constructors ## ReadClientRequestProcessor\(IRegistrationAccessTokenService, IRegistrationAccessTokenStore, ITokenIdGenerator, TimeProvider\) Constructor {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.ReadClientRequestProcessor.ReadClientRequestProcessor(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenService,Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenStore,Abblix.Oidc.Server.Features.RandomGenerators.ITokenIdGenerator,System.TimeProvider)} Builds the RFC 7592 §2\.1 read\-client response from stored client metadata\. The `client_secret` is intentionally omitted because secrets are persisted only as hashes; a registration access token bearing the client's current jti is re\-issued so the client can keep using the management endpoint after the read, without invalidating the token it presented \(read stays idempotent \- only update rotates the jti\)\. ```csharp public ReadClientRequestProcessor(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenService registrationAccessTokenService, Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenStore registrationAccessTokenStore, Abblix.Oidc.Server.Features.RandomGenerators.ITokenIdGenerator tokenIdGenerator, System.TimeProvider clock); ``` #### Parameters ###### `registrationAccessTokenService` [IRegistrationAccessTokenService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenService 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IRegistrationAccessTokenService') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.ReadClientRequestProcessor.ReadClientRequestProcessor(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenService,Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenStore,Abblix.Oidc.Server.Features.RandomGenerators.ITokenIdGenerator,System.TimeProvider).registrationAccessTokenService} ###### `registrationAccessTokenStore` [IRegistrationAccessTokenStore](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenStore 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IRegistrationAccessTokenStore') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.ReadClientRequestProcessor.ReadClientRequestProcessor(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenService,Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenStore,Abblix.Oidc.Server.Features.RandomGenerators.ITokenIdGenerator,System.TimeProvider).registrationAccessTokenStore} ###### `tokenIdGenerator` [ITokenIdGenerator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.ITokenIdGenerator 'Abblix\.Oidc\.Server\.Features\.RandomGenerators\.ITokenIdGenerator') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.ReadClientRequestProcessor.ReadClientRequestProcessor(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenService,Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenStore,Abblix.Oidc.Server.Features.RandomGenerators.ITokenIdGenerator,System.TimeProvider).tokenIdGenerator} ###### `clock` [System\.TimeProvider](https://learn.microsoft.com/en-us/dotnet/api/system.timeprovider 'System\.TimeProvider') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.ReadClientRequestProcessor.ReadClientRequestProcessor(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenService,Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenStore,Abblix.Oidc.Server.Features.RandomGenerators.ITokenIdGenerator,System.TimeProvider).clock} ### Methods ## ReadClientRequestProcessor\.ProcessAsync\(ValidClientRequest\) Method {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.ReadClientRequestProcessor.ProcessAsync(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidClientRequest)} Produces the response payload for the addressed client, including its current metadata and a refreshed registration access token\. ```csharp public System.Threading.Tasks.Task> ProcessAsync(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidClientRequest request); ``` #### Parameters ###### `request` [ValidClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidClientRequest 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.ValidClientRequest') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.ReadClientRequestProcessor.ProcessAsync(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidClientRequest).request} A request whose authentication and target client have been validated\. Implements [ProcessAsync\(ValidClientRequest\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IReadClientRequestProcessor#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IReadClientRequestProcessor.ProcessAsync(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidClientRequest) 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IReadClientRequestProcessor\.ProcessAsync\(Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.ValidClientRequest\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[ReadClientSuccessfulResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ReadClientSuccessfulResponse 'Abblix\.Oidc\.Server\.Model\.ReadClientSuccessfulResponse')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RegisterClientHandler.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement') ## RegisterClientHandler Class Default implementation of [IRegisterClientHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegisterClientHandler 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IRegisterClientHandler') that runs validation \(RFC 7591 §2 metadata \+ OIDC DCR 1\.0\) followed by processing \(credential issuance, persistence, and registration access token generation per RFC 7591 §3\.2\.1 / RFC 7592 §3\)\. ```csharp public class RegisterClientHandler : Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegisterClientHandler ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → RegisterClientHandler Implements [IRegisterClientHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegisterClientHandler 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IRegisterClientHandler') ### Constructors ## RegisterClientHandler\(IRegisterClientRequestValidator, IRegisterClientRequestProcessor\) Constructor {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RegisterClientHandler.RegisterClientHandler(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegisterClientRequestValidator,Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegisterClientRequestProcessor)} Default implementation of [IRegisterClientHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegisterClientHandler 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IRegisterClientHandler') that runs validation \(RFC 7591 §2 metadata \+ OIDC DCR 1\.0\) followed by processing \(credential issuance, persistence, and registration access token generation per RFC 7591 §3\.2\.1 / RFC 7592 §3\)\. ```csharp public RegisterClientHandler(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegisterClientRequestValidator validator, Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegisterClientRequestProcessor processor); ``` #### Parameters ###### `validator` [IRegisterClientRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegisterClientRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IRegisterClientRequestValidator') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RegisterClientHandler.RegisterClientHandler(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegisterClientRequestValidator,Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegisterClientRequestProcessor).validator} Validator for the raw registration metadata\. ###### `processor` [IRegisterClientRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegisterClientRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IRegisterClientRequestProcessor') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RegisterClientHandler.RegisterClientHandler(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegisterClientRequestValidator,Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegisterClientRequestProcessor).processor} Processor that persists the client and constructs the response\. ### Methods ## RegisterClientHandler\.HandleAsync\(ClientRegistrationRequest\) Method {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RegisterClientHandler.HandleAsync(Abblix.Oidc.Server.Model.ClientRegistrationRequest)} Validates the registration metadata, then provisions the client and returns the RFC 7591 §3\.2\.1 success response or an error per §3\.2\.2\. ```csharp public System.Threading.Tasks.Task> HandleAsync(Abblix.Oidc.Server.Model.ClientRegistrationRequest clientRegistrationRequest); ``` #### Parameters ###### `clientRegistrationRequest` [ClientRegistrationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRegistrationRequest 'Abblix\.Oidc\.Server\.Model\.ClientRegistrationRequest') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RegisterClientHandler.HandleAsync(Abblix.Oidc.Server.Model.ClientRegistrationRequest).clientRegistrationRequest} The client metadata payload\. Implements [HandleAsync\(ClientRegistrationRequest\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegisterClientHandler#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegisterClientHandler.HandleAsync(Abblix.Oidc.Server.Model.ClientRegistrationRequest) 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IRegisterClientHandler\.HandleAsync\(Abblix\.Oidc\.Server\.Model\.ClientRegistrationRequest\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[ClientRegistrationSuccessResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ClientRegistrationSuccessResponse 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.ClientRegistrationSuccessResponse')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RegisterClientRequestProcessor.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement') ## RegisterClientRequestProcessor Class Handles the registration of new clients by generating the necessary credentials and adding client information to the system\. Ensures the secure and compliant registration of clients as per OAuth 2\.0 and OpenID Connect standards\. ```csharp public class RegisterClientRequestProcessor : Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegisterClientRequestProcessor ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → RegisterClientRequestProcessor Implements [IRegisterClientRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegisterClientRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IRegisterClientRequestProcessor') ### Constructors ## RegisterClientRequestProcessor\(IClientCredentialFactory, IClientInfoManager, TimeProvider, ITokenIdGenerator, IRegistrationAccessTokenService, IRegistrationAccessTokenStore\) Constructor {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RegisterClientRequestProcessor.RegisterClientRequestProcessor(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IClientCredentialFactory,Abblix.Oidc.Server.Features.ClientInformation.IClientInfoManager,System.TimeProvider,Abblix.Oidc.Server.Features.RandomGenerators.ITokenIdGenerator,Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenService,Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenStore)} Handles the registration of new clients by generating the necessary credentials and adding client information to the system\. Ensures the secure and compliant registration of clients as per OAuth 2\.0 and OpenID Connect standards\. ```csharp public RegisterClientRequestProcessor(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IClientCredentialFactory credentialFactory, Abblix.Oidc.Server.Features.ClientInformation.IClientInfoManager clientInfoManager, System.TimeProvider clock, Abblix.Oidc.Server.Features.RandomGenerators.ITokenIdGenerator tokenIdGenerator, Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenService registrationAccessTokenService, Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenStore registrationAccessTokenStore); ``` #### Parameters ###### `credentialFactory` [IClientCredentialFactory](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IClientCredentialFactory 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IClientCredentialFactory') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RegisterClientRequestProcessor.RegisterClientRequestProcessor(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IClientCredentialFactory,Abblix.Oidc.Server.Features.ClientInformation.IClientInfoManager,System.TimeProvider,Abblix.Oidc.Server.Features.RandomGenerators.ITokenIdGenerator,Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenService,Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenStore).credentialFactory} ###### `clientInfoManager` [IClientInfoManager](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.IClientInfoManager 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.IClientInfoManager') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RegisterClientRequestProcessor.RegisterClientRequestProcessor(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IClientCredentialFactory,Abblix.Oidc.Server.Features.ClientInformation.IClientInfoManager,System.TimeProvider,Abblix.Oidc.Server.Features.RandomGenerators.ITokenIdGenerator,Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenService,Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenStore).clientInfoManager} ###### `clock` [System\.TimeProvider](https://learn.microsoft.com/en-us/dotnet/api/system.timeprovider 'System\.TimeProvider') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RegisterClientRequestProcessor.RegisterClientRequestProcessor(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IClientCredentialFactory,Abblix.Oidc.Server.Features.ClientInformation.IClientInfoManager,System.TimeProvider,Abblix.Oidc.Server.Features.RandomGenerators.ITokenIdGenerator,Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenService,Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenStore).clock} ###### `tokenIdGenerator` [ITokenIdGenerator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.ITokenIdGenerator 'Abblix\.Oidc\.Server\.Features\.RandomGenerators\.ITokenIdGenerator') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RegisterClientRequestProcessor.RegisterClientRequestProcessor(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IClientCredentialFactory,Abblix.Oidc.Server.Features.ClientInformation.IClientInfoManager,System.TimeProvider,Abblix.Oidc.Server.Features.RandomGenerators.ITokenIdGenerator,Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenService,Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenStore).tokenIdGenerator} ###### `registrationAccessTokenService` [IRegistrationAccessTokenService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenService 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IRegistrationAccessTokenService') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RegisterClientRequestProcessor.RegisterClientRequestProcessor(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IClientCredentialFactory,Abblix.Oidc.Server.Features.ClientInformation.IClientInfoManager,System.TimeProvider,Abblix.Oidc.Server.Features.RandomGenerators.ITokenIdGenerator,Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenService,Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenStore).registrationAccessTokenService} ###### `registrationAccessTokenStore` [IRegistrationAccessTokenStore](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenStore 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IRegistrationAccessTokenStore') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RegisterClientRequestProcessor.RegisterClientRequestProcessor(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IClientCredentialFactory,Abblix.Oidc.Server.Features.ClientInformation.IClientInfoManager,System.TimeProvider,Abblix.Oidc.Server.Features.RandomGenerators.ITokenIdGenerator,Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenService,Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenStore).registrationAccessTokenStore} ### Methods ## RegisterClientRequestProcessor\.ProcessAsync\(ValidClientRegistrationRequest\) Method {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RegisterClientRequestProcessor.ProcessAsync(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidClientRegistrationRequest)} Processes a valid client registration request, generating and storing the client's credentials and configuration\. ```csharp public System.Threading.Tasks.Task> ProcessAsync(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidClientRegistrationRequest request); ``` #### Parameters ###### `request` [ValidClientRegistrationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidClientRegistrationRequest 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.ValidClientRegistrationRequest') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RegisterClientRequestProcessor.ProcessAsync(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidClientRegistrationRequest).request} The client registration request containing the necessary details for registering a new client\. Implements [ProcessAsync\(ValidClientRegistrationRequest\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegisterClientRequestProcessor#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegisterClientRequestProcessor.ProcessAsync(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidClientRegistrationRequest) 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IRegisterClientRequestProcessor\.ProcessAsync\(Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.ValidClientRegistrationRequest\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[ClientRegistrationSuccessResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ClientRegistrationSuccessResponse 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.ClientRegistrationSuccessResponse')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task that results in a Result containing the client ID, client secret and registration access token, along with other registration details\. ### Remarks This method orchestrates the client registration process, starting from generating a unique client ID and secret \(if required\) to issuing a registration access token\. It ensures that all registered clients are compliant with the system's security standards and the OAuth 2\.0 and OpenID Connect protocols\. The method also handles the storage of client information, facilitating future authentication and authorization processes\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RegisterClientRequestValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement') ## RegisterClientRequestValidator Class Default validator for new\-client registration \(POST\), wrapping the request in a [ClientRegistrationValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientRegistrationValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.ClientRegistrationValidationContext') with [Register](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.DynamicClientOperation#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.DynamicClientOperation.Register 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.DynamicClientOperation\.Register') and delegating to the configured [IClientRegistrationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.IClientRegistrationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.IClientRegistrationContextValidator') pipeline\. ```csharp public class RegisterClientRequestValidator : Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegisterClientRequestValidator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → RegisterClientRequestValidator Implements [IRegisterClientRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegisterClientRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IRegisterClientRequestValidator') ### Constructors ## RegisterClientRequestValidator\(IClientRegistrationContextValidator\) Constructor {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RegisterClientRequestValidator.RegisterClientRequestValidator(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.IClientRegistrationContextValidator)} Default validator for new\-client registration \(POST\), wrapping the request in a [ClientRegistrationValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientRegistrationValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.ClientRegistrationValidationContext') with [Register](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.DynamicClientOperation#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.DynamicClientOperation.Register 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.DynamicClientOperation\.Register') and delegating to the configured [IClientRegistrationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.IClientRegistrationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.IClientRegistrationContextValidator') pipeline\. ```csharp public RegisterClientRequestValidator(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.IClientRegistrationContextValidator validator); ``` #### Parameters ###### `validator` [IClientRegistrationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.IClientRegistrationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.IClientRegistrationContextValidator') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RegisterClientRequestValidator.RegisterClientRequestValidator(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.IClientRegistrationContextValidator).validator} Composite validator that runs the individual metadata checks\. ### Methods ## RegisterClientRequestValidator\.ValidateAsync\(ClientRegistrationRequest\) Method {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RegisterClientRequestValidator.ValidateAsync(Abblix.Oidc.Server.Model.ClientRegistrationRequest)} Runs the validator pipeline and, on success, returns the typed valid request together with the resolved sector identifier\. ```csharp public System.Threading.Tasks.Task> ValidateAsync(Abblix.Oidc.Server.Model.ClientRegistrationRequest request); ``` #### Parameters ###### `request` [ClientRegistrationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRegistrationRequest 'Abblix\.Oidc\.Server\.Model\.ClientRegistrationRequest') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RegisterClientRequestValidator.ValidateAsync(Abblix.Oidc.Server.Model.ClientRegistrationRequest).request} The raw registration request\. Implements [ValidateAsync\(ClientRegistrationRequest\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegisterClientRequestValidator#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegisterClientRequestValidator.ValidateAsync(Abblix.Oidc.Server.Model.ClientRegistrationRequest) 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IRegisterClientRequestValidator\.ValidateAsync\(Abblix\.Oidc\.Server\.Model\.ClientRegistrationRequest\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[ValidClientRegistrationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidClientRegistrationRequest 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.ValidClientRegistrationRequest')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RegistrationAccessTokenService.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement') ## RegistrationAccessTokenService Class Issues registration access tokens for managing registered clients per RFC 7592 Section 3\. ```csharp public class RegistrationAccessTokenService : Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenService ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → RegistrationAccessTokenService Implements [IRegistrationAccessTokenService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenService 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IRegistrationAccessTokenService') ### Constructors ## RegistrationAccessTokenService\(IAuthServiceJwtFormatter, IIssuerProvider, IOptions\\) Constructor {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RegistrationAccessTokenService.RegistrationAccessTokenService(Abblix.Oidc.Server.Features.Tokens.Formatters.IAuthServiceJwtFormatter,Abblix.Oidc.Server.Features.Issuer.IIssuerProvider,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_)} Issues registration access tokens for managing registered clients per RFC 7592 Section 3\. ```csharp public RegistrationAccessTokenService(Abblix.Oidc.Server.Features.Tokens.Formatters.IAuthServiceJwtFormatter serviceJwtFormatter, Abblix.Oidc.Server.Features.Issuer.IIssuerProvider issuerProvider, Microsoft.Extensions.Options.IOptions options); ``` #### Parameters ###### `serviceJwtFormatter` [IAuthServiceJwtFormatter](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.Formatters.IAuthServiceJwtFormatter 'Abblix\.Oidc\.Server\.Features\.Tokens\.Formatters\.IAuthServiceJwtFormatter') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RegistrationAccessTokenService.RegistrationAccessTokenService(Abblix.Oidc.Server.Features.Tokens.Formatters.IAuthServiceJwtFormatter,Abblix.Oidc.Server.Features.Issuer.IIssuerProvider,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_).serviceJwtFormatter} ###### `issuerProvider` [IIssuerProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Issuer.IIssuerProvider 'Abblix\.Oidc\.Server\.Features\.Issuer\.IIssuerProvider') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RegistrationAccessTokenService.RegistrationAccessTokenService(Abblix.Oidc.Server.Features.Tokens.Formatters.IAuthServiceJwtFormatter,Abblix.Oidc.Server.Features.Issuer.IIssuerProvider,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_).issuerProvider} ###### `options` [Microsoft\.Extensions\.Options\.IOptions<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptions-1 'Microsoft\.Extensions\.Options\.IOptions\`1')[OidcOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptions-1 'Microsoft\.Extensions\.Options\.IOptions\`1') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RegistrationAccessTokenService.RegistrationAccessTokenService(Abblix.Oidc.Server.Features.Tokens.Formatters.IAuthServiceJwtFormatter,Abblix.Oidc.Server.Features.Issuer.IIssuerProvider,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_).options} ### Methods ## RegistrationAccessTokenService\.IssueTokenAsync\(string, DateTimeOffset, Nullable\, string\) Method {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RegistrationAccessTokenService.IssueTokenAsync(string,System.DateTimeOffset,System.Nullable_System.TimeSpan_,string)} Issues a registration access token for a registered client\. ```csharp public System.Threading.Tasks.Task IssueTokenAsync(string clientId, System.DateTimeOffset issuedAt, System.Nullable expiresIn, string tokenId); ``` #### Parameters ###### `clientId` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RegistrationAccessTokenService.IssueTokenAsync(string,System.DateTimeOffset,System.Nullable_System.TimeSpan_,string).clientId} The unique identifier of the registered client\. ###### `issuedAt` [System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RegistrationAccessTokenService.IssueTokenAsync(string,System.DateTimeOffset,System.Nullable_System.TimeSpan_,string).issuedAt} The timestamp when the token is issued\. ###### `expiresIn` [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RegistrationAccessTokenService.IssueTokenAsync(string,System.DateTimeOffset,System.Nullable_System.TimeSpan_,string).expiresIn} The optional duration after which the token expires\. ###### `tokenId` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RegistrationAccessTokenService.IssueTokenAsync(string,System.DateTimeOffset,System.Nullable_System.TimeSpan_,string).tokenId} The identifier \(jti\) embedded in the token and bound to the client\. Implements [IssueTokenAsync\(string, DateTimeOffset, Nullable<TimeSpan>, string\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenService#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenService.IssueTokenAsync(string,System.DateTimeOffset,System.Nullable_System.TimeSpan_,string) 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IRegistrationAccessTokenService\.IssueTokenAsync\(string, System\.DateTimeOffset, System\.Nullable\, string\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task that results in the encoded registration access token\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RegistrationAccessTokenStore.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement') ## RegistrationAccessTokenStore Class Default [IRegistrationAccessTokenStore](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenStore 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IRegistrationAccessTokenStore') backed by the distributed [IEntityStorage](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Storages.IEntityStorage 'Abblix\.Oidc\.Server\.Features\.Storages\.IEntityStorage'), so the client\-to\-token\-jti binding is shared across all server replicas\. The entry is stored without expiration \- it lives as long as the client is registered \- and is removed when the client is deregistered\. ```csharp public class RegistrationAccessTokenStore : Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenStore ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → RegistrationAccessTokenStore Implements [IRegistrationAccessTokenStore](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenStore 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IRegistrationAccessTokenStore') ### Constructors ## RegistrationAccessTokenStore\(IEntityStorage, IEntityStorageKeyFactory\) Constructor {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RegistrationAccessTokenStore.RegistrationAccessTokenStore(Abblix.Oidc.Server.Features.Storages.IEntityStorage,Abblix.Oidc.Server.Features.Storages.IEntityStorageKeyFactory)} Default [IRegistrationAccessTokenStore](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenStore 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IRegistrationAccessTokenStore') backed by the distributed [IEntityStorage](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Storages.IEntityStorage 'Abblix\.Oidc\.Server\.Features\.Storages\.IEntityStorage'), so the client\-to\-token\-jti binding is shared across all server replicas\. The entry is stored without expiration \- it lives as long as the client is registered \- and is removed when the client is deregistered\. ```csharp public RegistrationAccessTokenStore(Abblix.Oidc.Server.Features.Storages.IEntityStorage storage, Abblix.Oidc.Server.Features.Storages.IEntityStorageKeyFactory keyFactory); ``` #### Parameters ###### `storage` [IEntityStorage](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Storages.IEntityStorage 'Abblix\.Oidc\.Server\.Features\.Storages\.IEntityStorage') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RegistrationAccessTokenStore.RegistrationAccessTokenStore(Abblix.Oidc.Server.Features.Storages.IEntityStorage,Abblix.Oidc.Server.Features.Storages.IEntityStorageKeyFactory).storage} The distributed entity storage holding the bindings\. ###### `keyFactory` [IEntityStorageKeyFactory](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Storages.IEntityStorageKeyFactory 'Abblix\.Oidc\.Server\.Features\.Storages\.IEntityStorageKeyFactory') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RegistrationAccessTokenStore.RegistrationAccessTokenStore(Abblix.Oidc.Server.Features.Storages.IEntityStorage,Abblix.Oidc.Server.Features.Storages.IEntityStorageKeyFactory).keyFactory} The factory that builds the storage key for each client\. ### Methods ## RegistrationAccessTokenStore\.GetTokenIdAsync\(string\) Method {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RegistrationAccessTokenStore.GetTokenIdAsync(string)} Retrieves the jti of the client's current registration access token\. ```csharp public System.Threading.Tasks.Task GetTokenIdAsync(string clientId); ``` #### Parameters ###### `clientId` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RegistrationAccessTokenStore.GetTokenIdAsync(string).clientId} The identifier of the client\. Implements [GetTokenIdAsync\(string\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenStore#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenStore.GetTokenIdAsync(string) 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IRegistrationAccessTokenStore\.GetTokenIdAsync\(string\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') The stored jti, or `null` when no binding is recorded \(a statically configured client, or one registered before the binding existed\) \- in which case the validator does not enforce the binding\. ## RegistrationAccessTokenStore\.RemoveAsync\(string\) Method {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RegistrationAccessTokenStore.RemoveAsync(string)} Removes the binding for a deregistered client\. ```csharp public System.Threading.Tasks.Task RemoveAsync(string clientId); ``` #### Parameters ###### `clientId` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RegistrationAccessTokenStore.RemoveAsync(string).clientId} The identifier of the client being removed\. Implements [RemoveAsync\(string\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenStore#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenStore.RemoveAsync(string) 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IRegistrationAccessTokenStore\.RemoveAsync\(string\)') #### Returns [System\.Threading\.Tasks\.Task](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task 'System\.Threading\.Tasks\.Task') ## RegistrationAccessTokenStore\.SetTokenIdAsync\(string, string\) Method {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RegistrationAccessTokenStore.SetTokenIdAsync(string,string)} Records [tokenId](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RegistrationAccessTokenStore#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RegistrationAccessTokenStore.SetTokenIdAsync(string,string).tokenId 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.RegistrationAccessTokenStore\.SetTokenIdAsync\(string, string\)\.tokenId') as the jti of the client's current registration access token, replacing any previously stored value \(which thereby becomes invalid\)\. ```csharp public System.Threading.Tasks.Task SetTokenIdAsync(string clientId, string tokenId); ``` #### Parameters ###### `clientId` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RegistrationAccessTokenStore.SetTokenIdAsync(string,string).clientId} The identifier of the client the token manages\. ###### `tokenId` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RegistrationAccessTokenStore.SetTokenIdAsync(string,string).tokenId} The jti embedded in the newly issued registration access token\. Implements [SetTokenIdAsync\(string, string\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenStore#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenStore.SetTokenIdAsync(string,string) 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IRegistrationAccessTokenStore\.SetTokenIdAsync\(string, string\)') #### Returns [System\.Threading\.Tasks\.Task](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task 'System\.Threading\.Tasks\.Task') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RegistrationAccessTokenValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement') ## RegistrationAccessTokenValidator Class Default implementation of [IRegistrationAccessTokenValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IRegistrationAccessTokenValidator')\. Requires a `Bearer` scheme, validates the JWT signature and lifetime via [IAuthServiceJwtValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.Validation.IAuthServiceJwtValidator 'Abblix\.Oidc\.Server\.Features\.Tokens\.Validation\.IAuthServiceJwtValidator') \(which requires the audience to name this server, the party that reads the token\), then enforces that the token's `typ` is `registration_access_token` and that its `sub` equals the requested `client_id` \- the claim carrying the association RFC 7592 Section 1\.2 describes\. ```csharp public class RegistrationAccessTokenValidator : Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenValidator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → RegistrationAccessTokenValidator Implements [IRegistrationAccessTokenValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IRegistrationAccessTokenValidator') ### Constructors ## RegistrationAccessTokenValidator\(IAuthServiceJwtValidator\) Constructor {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RegistrationAccessTokenValidator.RegistrationAccessTokenValidator(Abblix.Oidc.Server.Features.Tokens.Validation.IAuthServiceJwtValidator)} Default implementation of [IRegistrationAccessTokenValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IRegistrationAccessTokenValidator')\. Requires a `Bearer` scheme, validates the JWT signature and lifetime via [IAuthServiceJwtValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.Validation.IAuthServiceJwtValidator 'Abblix\.Oidc\.Server\.Features\.Tokens\.Validation\.IAuthServiceJwtValidator') \(which requires the audience to name this server, the party that reads the token\), then enforces that the token's `typ` is `registration_access_token` and that its `sub` equals the requested `client_id` \- the claim carrying the association RFC 7592 Section 1\.2 describes\. ```csharp public RegistrationAccessTokenValidator(Abblix.Oidc.Server.Features.Tokens.Validation.IAuthServiceJwtValidator jwtValidator); ``` #### Parameters ###### `jwtValidator` [IAuthServiceJwtValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.Validation.IAuthServiceJwtValidator 'Abblix\.Oidc\.Server\.Features\.Tokens\.Validation\.IAuthServiceJwtValidator') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RegistrationAccessTokenValidator.RegistrationAccessTokenValidator(Abblix.Oidc.Server.Features.Tokens.Validation.IAuthServiceJwtValidator).jwtValidator} JWT validator used for signature and lifetime checks\. ### Methods ## RegistrationAccessTokenValidator\.ValidateAsync\(AuthenticationHeaderValue, string, string\) Method {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RegistrationAccessTokenValidator.ValidateAsync(System.Net.Http.Headers.AuthenticationHeaderValue,string,string)} Validates the bearer token, ensuring it is well\-formed, of the expected type, and authorized to manage the specified client\. ```csharp public System.Threading.Tasks.Task ValidateAsync(System.Net.Http.Headers.AuthenticationHeaderValue? header, string clientId, string? expectedTokenId); ``` #### Parameters ###### `header` [System\.Net\.Http\.Headers\.AuthenticationHeaderValue](https://learn.microsoft.com/en-us/dotnet/api/system.net.http.headers.authenticationheadervalue 'System\.Net\.Http\.Headers\.AuthenticationHeaderValue') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RegistrationAccessTokenValidator.ValidateAsync(System.Net.Http.Headers.AuthenticationHeaderValue,string,string).header} The HTTP `Authorization` header carrying the bearer token\. ###### `clientId` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RegistrationAccessTokenValidator.ValidateAsync(System.Net.Http.Headers.AuthenticationHeaderValue,string,string).clientId} The `client_id` targeted by the management request\. ###### `expectedTokenId` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RegistrationAccessTokenValidator.ValidateAsync(System.Net.Http.Headers.AuthenticationHeaderValue,string,string).expectedTokenId} The jti the token must carry to be accepted \- the value stored on the client when its current registration access token was issued\. When `null` the binding is not enforced \(statically configured client, or a record predating the stored id\) and only signature, type and audience are checked\. Implements [ValidateAsync\(AuthenticationHeaderValue, string, string\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenValidator#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenValidator.ValidateAsync(System.Net.Http.Headers.AuthenticationHeaderValue,string,string) 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IRegistrationAccessTokenValidator\.ValidateAsync\(System\.Net\.Http\.Headers\.AuthenticationHeaderValue, string, string\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') `null` when the token is valid for the client; otherwise a human\-readable description of the validation failure\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RemoveClientHandler.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement') ## RemoveClientHandler Class Default implementation of [IRemoveClientHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRemoveClientHandler 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IRemoveClientHandler') that authenticates the registration access token via [IClientRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IClientRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IClientRequestValidator') and, on success, delegates to the processor to delete the client per RFC 7592 §2\.3\. ```csharp public class RemoveClientHandler : Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRemoveClientHandler ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → RemoveClientHandler Implements [IRemoveClientHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRemoveClientHandler 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IRemoveClientHandler') ### Constructors ## RemoveClientHandler\(IClientRequestValidator, IRemoveClientRequestProcessor\) Constructor {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RemoveClientHandler.RemoveClientHandler(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IClientRequestValidator,Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRemoveClientRequestProcessor)} Default implementation of [IRemoveClientHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRemoveClientHandler 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IRemoveClientHandler') that authenticates the registration access token via [IClientRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IClientRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IClientRequestValidator') and, on success, delegates to the processor to delete the client per RFC 7592 §2\.3\. ```csharp public RemoveClientHandler(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IClientRequestValidator validator, Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRemoveClientRequestProcessor processor); ``` #### Parameters ###### `validator` [IClientRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IClientRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IClientRequestValidator') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RemoveClientHandler.RemoveClientHandler(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IClientRequestValidator,Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRemoveClientRequestProcessor).validator} Validator for the registration access token and target client\. ###### `processor` [IRemoveClientRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRemoveClientRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IRemoveClientRequestProcessor') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RemoveClientHandler.RemoveClientHandler(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IClientRequestValidator,Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRemoveClientRequestProcessor).processor} Processor that performs the actual deletion\. ### Methods ## RemoveClientHandler\.HandleAsync\(ClientRequest\) Method {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RemoveClientHandler.HandleAsync(Abblix.Oidc.Server.Model.ClientRequest)} Validates the request, then deletes the addressed client per RFC 7592 §2\.3\. ```csharp public System.Threading.Tasks.Task> HandleAsync(Abblix.Oidc.Server.Model.ClientRequest clientRequest); ``` #### Parameters ###### `clientRequest` [ClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRequest 'Abblix\.Oidc\.Server\.Model\.ClientRequest') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RemoveClientHandler.HandleAsync(Abblix.Oidc.Server.Model.ClientRequest).clientRequest} The DELETE request authenticated by a registration access token\. Implements [HandleAsync\(ClientRequest\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRemoveClientHandler#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRemoveClientHandler.HandleAsync(Abblix.Oidc.Server.Model.ClientRequest) 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IRemoveClientHandler\.HandleAsync\(Abblix\.Oidc\.Server\.Model\.ClientRequest\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[RemoveClientSuccessfulResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.RemoveClientSuccessfulResponse 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.RemoveClientSuccessfulResponse')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RemoveClientRequestProcessor.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement') ## RemoveClientRequestProcessor Class Performs the storage\-level deregistration of a client through the configured [IClientInfoManager](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.IClientInfoManager 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.IClientInfoManager') per RFC 7592 §2\.3\. ```csharp public class RemoveClientRequestProcessor : Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRemoveClientRequestProcessor ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → RemoveClientRequestProcessor Implements [IRemoveClientRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRemoveClientRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IRemoveClientRequestProcessor') ### Constructors ## RemoveClientRequestProcessor\(IClientInfoManager, IRegistrationAccessTokenStore, TimeProvider\) Constructor {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RemoveClientRequestProcessor.RemoveClientRequestProcessor(Abblix.Oidc.Server.Features.ClientInformation.IClientInfoManager,Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenStore,System.TimeProvider)} Performs the storage\-level deregistration of a client through the configured [IClientInfoManager](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.IClientInfoManager 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.IClientInfoManager') per RFC 7592 §2\.3\. ```csharp public RemoveClientRequestProcessor(Abblix.Oidc.Server.Features.ClientInformation.IClientInfoManager clientInfoManager, Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenStore registrationAccessTokenStore, System.TimeProvider clock); ``` #### Parameters ###### `clientInfoManager` [IClientInfoManager](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.IClientInfoManager 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.IClientInfoManager') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RemoveClientRequestProcessor.RemoveClientRequestProcessor(Abblix.Oidc.Server.Features.ClientInformation.IClientInfoManager,Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenStore,System.TimeProvider).clientInfoManager} Store used to remove the client record\. ###### `registrationAccessTokenStore` [IRegistrationAccessTokenStore](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenStore 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IRegistrationAccessTokenStore') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RemoveClientRequestProcessor.RemoveClientRequestProcessor(Abblix.Oidc.Server.Features.ClientInformation.IClientInfoManager,Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenStore,System.TimeProvider).registrationAccessTokenStore} Store holding the client's registration\-token binding\. ###### `clock` [System\.TimeProvider](https://learn.microsoft.com/en-us/dotnet/api/system.timeprovider 'System\.TimeProvider') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RemoveClientRequestProcessor.RemoveClientRequestProcessor(Abblix.Oidc.Server.Features.ClientInformation.IClientInfoManager,Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenStore,System.TimeProvider).clock} Source for the deletion timestamp recorded in the response\. ### Methods ## RemoveClientRequestProcessor\.ProcessAsync\(ValidClientRequest\) Method {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RemoveClientRequestProcessor.ProcessAsync(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidClientRequest)} Deletes the addressed client and returns the recorded removal timestamp\. ```csharp public System.Threading.Tasks.Task> ProcessAsync(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidClientRequest request); ``` #### Parameters ###### `request` [ValidClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidClientRequest 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.ValidClientRequest') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RemoveClientRequestProcessor.ProcessAsync(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidClientRequest).request} A request whose authentication and target client have been validated\. Implements [ProcessAsync\(ValidClientRequest\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRemoveClientRequestProcessor#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRemoveClientRequestProcessor.ProcessAsync(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidClientRequest) 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IRemoveClientRequestProcessor\.ProcessAsync\(Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.ValidClientRequest\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[RemoveClientSuccessfulResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.RemoveClientSuccessfulResponse 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.RemoveClientSuccessfulResponse')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.UpdateClientHandler.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement') ## UpdateClientHandler Class Handles client configuration update requests in OAuth 2\.0 Dynamic Client Registration Management protocol per RFC 7592\. Coordinates validation and processing to securely update registered client information\. ```csharp public class UpdateClientHandler : Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IUpdateClientHandler ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → UpdateClientHandler Implements [IUpdateClientHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IUpdateClientHandler 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IUpdateClientHandler') ### Constructors ## UpdateClientHandler\(IUpdateClientRequestValidator, IUpdateClientRequestProcessor\) Constructor {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.UpdateClientHandler.UpdateClientHandler(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IUpdateClientRequestValidator,Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IUpdateClientRequestProcessor)} Handles client configuration update requests in OAuth 2\.0 Dynamic Client Registration Management protocol per RFC 7592\. Coordinates validation and processing to securely update registered client information\. ```csharp public UpdateClientHandler(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IUpdateClientRequestValidator validator, Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IUpdateClientRequestProcessor processor); ``` #### Parameters ###### `validator` [IUpdateClientRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IUpdateClientRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IUpdateClientRequestValidator') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.UpdateClientHandler.UpdateClientHandler(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IUpdateClientRequestValidator,Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IUpdateClientRequestProcessor).validator} Validates client authentication and authorization for configuration updates\. ###### `processor` [IUpdateClientRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IUpdateClientRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IUpdateClientRequestProcessor') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.UpdateClientHandler.UpdateClientHandler(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IUpdateClientRequestValidator,Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IUpdateClientRequestProcessor).processor} Updates and formats client configuration data\. ### Methods ## UpdateClientHandler\.HandleAsync\(UpdateClientRequest\) Method {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.UpdateClientHandler.HandleAsync(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.UpdateClientRequest)} Processes a client configuration update request per RFC 7592 Section 2\.2\. ```csharp public System.Threading.Tasks.Task> HandleAsync(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.UpdateClientRequest request); ``` #### Parameters ###### `request` [UpdateClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.UpdateClientRequest 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.UpdateClientRequest') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.UpdateClientHandler.HandleAsync(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.UpdateClientRequest).request} The update request containing client authentication and updated metadata\. Implements [HandleAsync\(UpdateClientRequest\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IUpdateClientHandler#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IUpdateClientHandler.HandleAsync(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.UpdateClientRequest) 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IUpdateClientHandler\.HandleAsync\(Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.UpdateClientRequest\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[ReadClientSuccessfulResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ReadClientSuccessfulResponse 'Abblix\.Oidc\.Server\.Model\.ReadClientSuccessfulResponse')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task that results in updated client configuration or an error response\. #### Exceptions [UnexpectedTypeException](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Exceptions.UnexpectedTypeException 'Abblix\.Oidc\.Server\.Common\.Exceptions\.UnexpectedTypeException') Thrown if the validation result does not match expected types\. ### Remarks This method serves as a critical part of dynamic client management, allowing for the secure update of client configurations\. It ensures that only valid and authorized requests are processed, safeguarding against unauthorized modifications to client information\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.UpdateClientRegistrationValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement') ## UpdateClientRegistrationValidator Class Variant of [RegisterClientRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RegisterClientRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.RegisterClientRequestValidator') used by the RFC 7592 §2\.2 update flow\. Wraps the request in a [ClientRegistrationValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientRegistrationValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.ClientRegistrationValidationContext') with [Update](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.DynamicClientOperation#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.DynamicClientOperation.Update 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.DynamicClientOperation\.Update') so steps such as `ClientIdValidator` require the client to already exist instead of forbidding it\. ```csharp public class UpdateClientRegistrationValidator : Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegisterClientRequestValidator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → UpdateClientRegistrationValidator Implements [IRegisterClientRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegisterClientRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IRegisterClientRequestValidator') ### Constructors ## UpdateClientRegistrationValidator\(IClientRegistrationContextValidator\) Constructor {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.UpdateClientRegistrationValidator.UpdateClientRegistrationValidator(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.IClientRegistrationContextValidator)} Variant of [RegisterClientRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RegisterClientRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.RegisterClientRequestValidator') used by the RFC 7592 §2\.2 update flow\. Wraps the request in a [ClientRegistrationValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientRegistrationValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.ClientRegistrationValidationContext') with [Update](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.DynamicClientOperation#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.DynamicClientOperation.Update 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.DynamicClientOperation\.Update') so steps such as `ClientIdValidator` require the client to already exist instead of forbidding it\. ```csharp public UpdateClientRegistrationValidator(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.IClientRegistrationContextValidator validator); ``` #### Parameters ###### `validator` [IClientRegistrationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.IClientRegistrationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.IClientRegistrationContextValidator') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.UpdateClientRegistrationValidator.UpdateClientRegistrationValidator(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.IClientRegistrationContextValidator).validator} Composite validator for the metadata pipeline\. ### Methods ## UpdateClientRegistrationValidator\.ValidateAsync\(ClientRegistrationRequest\) Method {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.UpdateClientRegistrationValidator.ValidateAsync(Abblix.Oidc.Server.Model.ClientRegistrationRequest)} Validates the request and returns either the typed valid form or the first error encountered\. ```csharp public System.Threading.Tasks.Task> ValidateAsync(Abblix.Oidc.Server.Model.ClientRegistrationRequest request); ``` #### Parameters ###### `request` [ClientRegistrationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRegistrationRequest 'Abblix\.Oidc\.Server\.Model\.ClientRegistrationRequest') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.UpdateClientRegistrationValidator.ValidateAsync(Abblix.Oidc.Server.Model.ClientRegistrationRequest).request} The raw registration request to validate\. Implements [ValidateAsync\(ClientRegistrationRequest\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegisterClientRequestValidator#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegisterClientRequestValidator.ValidateAsync(Abblix.Oidc.Server.Model.ClientRegistrationRequest) 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IRegisterClientRequestValidator\.ValidateAsync\(Abblix\.Oidc\.Server\.Model\.ClientRegistrationRequest\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[ValidClientRegistrationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidClientRegistrationRequest 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.ValidClientRegistrationRequest')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.UpdateClientRequestProcessor.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement') ## UpdateClientRequestProcessor Class Processes requests to update existing client configurations per RFC 7592 Section 2\.2\. Updates client metadata while preserving credentials and system\-managed fields\. ```csharp public class UpdateClientRequestProcessor : Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IUpdateClientRequestProcessor ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → UpdateClientRequestProcessor Implements [IUpdateClientRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IUpdateClientRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IUpdateClientRequestProcessor') ### Constructors ## UpdateClientRequestProcessor\(IClientInfoManager, IRegistrationAccessTokenService, IRegistrationAccessTokenStore, ITokenIdGenerator, TimeProvider\) Constructor {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.UpdateClientRequestProcessor.UpdateClientRequestProcessor(Abblix.Oidc.Server.Features.ClientInformation.IClientInfoManager,Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenService,Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenStore,Abblix.Oidc.Server.Features.RandomGenerators.ITokenIdGenerator,System.TimeProvider)} Processes requests to update existing client configurations per RFC 7592 Section 2\.2\. Updates client metadata while preserving credentials and system\-managed fields\. ```csharp public UpdateClientRequestProcessor(Abblix.Oidc.Server.Features.ClientInformation.IClientInfoManager clientInfoManager, Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenService registrationAccessTokenService, Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenStore registrationAccessTokenStore, Abblix.Oidc.Server.Features.RandomGenerators.ITokenIdGenerator tokenIdGenerator, System.TimeProvider clock); ``` #### Parameters ###### `clientInfoManager` [IClientInfoManager](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.IClientInfoManager 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.IClientInfoManager') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.UpdateClientRequestProcessor.UpdateClientRequestProcessor(Abblix.Oidc.Server.Features.ClientInformation.IClientInfoManager,Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenService,Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenStore,Abblix.Oidc.Server.Features.RandomGenerators.ITokenIdGenerator,System.TimeProvider).clientInfoManager} ###### `registrationAccessTokenService` [IRegistrationAccessTokenService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenService 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IRegistrationAccessTokenService') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.UpdateClientRequestProcessor.UpdateClientRequestProcessor(Abblix.Oidc.Server.Features.ClientInformation.IClientInfoManager,Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenService,Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenStore,Abblix.Oidc.Server.Features.RandomGenerators.ITokenIdGenerator,System.TimeProvider).registrationAccessTokenService} ###### `registrationAccessTokenStore` [IRegistrationAccessTokenStore](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenStore 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IRegistrationAccessTokenStore') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.UpdateClientRequestProcessor.UpdateClientRequestProcessor(Abblix.Oidc.Server.Features.ClientInformation.IClientInfoManager,Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenService,Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenStore,Abblix.Oidc.Server.Features.RandomGenerators.ITokenIdGenerator,System.TimeProvider).registrationAccessTokenStore} ###### `tokenIdGenerator` [ITokenIdGenerator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.ITokenIdGenerator 'Abblix\.Oidc\.Server\.Features\.RandomGenerators\.ITokenIdGenerator') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.UpdateClientRequestProcessor.UpdateClientRequestProcessor(Abblix.Oidc.Server.Features.ClientInformation.IClientInfoManager,Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenService,Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenStore,Abblix.Oidc.Server.Features.RandomGenerators.ITokenIdGenerator,System.TimeProvider).tokenIdGenerator} ###### `clock` [System\.TimeProvider](https://learn.microsoft.com/en-us/dotnet/api/system.timeprovider 'System\.TimeProvider') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.UpdateClientRequestProcessor.UpdateClientRequestProcessor(Abblix.Oidc.Server.Features.ClientInformation.IClientInfoManager,Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenService,Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenStore,Abblix.Oidc.Server.Features.RandomGenerators.ITokenIdGenerator,System.TimeProvider).clock} ### Methods ## UpdateClientRequestProcessor\.ProcessAsync\(ValidUpdateClientRequest\) Method {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.UpdateClientRequestProcessor.ProcessAsync(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidUpdateClientRequest)} Processes a valid update client request, updating client metadata and returning updated configuration\. ```csharp public System.Threading.Tasks.Task> ProcessAsync(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidUpdateClientRequest request); ``` #### Parameters ###### `request` [ValidUpdateClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidUpdateClientRequest 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.ValidUpdateClientRequest') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.UpdateClientRequestProcessor.ProcessAsync(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidUpdateClientRequest).request} The validated update request containing new client metadata\. Implements [ProcessAsync\(ValidUpdateClientRequest\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IUpdateClientRequestProcessor#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IUpdateClientRequestProcessor.ProcessAsync(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidUpdateClientRequest) 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IUpdateClientRequestProcessor\.ProcessAsync\(Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.ValidUpdateClientRequest\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[ReadClientSuccessfulResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ReadClientSuccessfulResponse 'Abblix\.Oidc\.Server\.Model\.ReadClientSuccessfulResponse')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task that results in updated client configuration or an error response\. ### Remarks Per RFC 7592: \- All client metadata can be updated except client\_id, client\_secret, and issuance timestamps \- Omitted fields are treated as null/empty \- A new registration\_access\_token may be issued \- Client secrets cannot be updated via this endpoint \(they're stored as hashes\) --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.UpdateClientRequestValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement') ## UpdateClientRequestValidator Class Validates an RFC 7592 §2\.2 update request: authenticates the registration access token and confirms the client exists, then validates the supplied replacement metadata via the update\-specific keyed [IRegisterClientRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegisterClientRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IRegisterClientRequestValidator')\. Also enforces the RFC 7592 §2\.2 rule that the request body's `client_id` must match the authenticated client\. ```csharp public class UpdateClientRequestValidator : Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IUpdateClientRequestValidator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → UpdateClientRequestValidator Implements [IUpdateClientRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IUpdateClientRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IUpdateClientRequestValidator') ### Constructors ## UpdateClientRequestValidator\(IClientRequestValidator, IRegisterClientRequestValidator\) Constructor {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.UpdateClientRequestValidator.UpdateClientRequestValidator(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IClientRequestValidator,Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegisterClientRequestValidator)} Validates an RFC 7592 §2\.2 update request: authenticates the registration access token and confirms the client exists, then validates the supplied replacement metadata via the update\-specific keyed [IRegisterClientRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegisterClientRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IRegisterClientRequestValidator')\. Also enforces the RFC 7592 §2\.2 rule that the request body's `client_id` must match the authenticated client\. ```csharp public UpdateClientRequestValidator(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IClientRequestValidator clientRequestValidator, Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegisterClientRequestValidator registrationRequestValidator); ``` #### Parameters ###### `clientRequestValidator` [IClientRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IClientRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IClientRequestValidator') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.UpdateClientRequestValidator.UpdateClientRequestValidator(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IClientRequestValidator,Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegisterClientRequestValidator).clientRequestValidator} Validator for the registration access token\. ###### `registrationRequestValidator` [IRegisterClientRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegisterClientRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IRegisterClientRequestValidator') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.UpdateClientRequestValidator.UpdateClientRequestValidator(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IClientRequestValidator,Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegisterClientRequestValidator).registrationRequestValidator} Update\-flow metadata validator \(keyed by [RegistrationKey](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.UpdateClientRequestValidator#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.UpdateClientRequestValidator.RegistrationKey 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.UpdateClientRequestValidator\.RegistrationKey')\)\. ### Fields ## UpdateClientRequestValidator\.RegistrationKey Field {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.UpdateClientRequestValidator.RegistrationKey} DI service key under which the update\-specific [IRegisterClientRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegisterClientRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IRegisterClientRequestValidator') is registered, allowing the same validator interface to be used for both register and update flows\. ```csharp public const string RegistrationKey = "UpdateClientRequestValidator"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Methods ## UpdateClientRequestValidator\.ValidateAsync\(UpdateClientRequest\) Method {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.UpdateClientRequestValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.UpdateClientRequest)} Validates an update client request asynchronously\. ```csharp public System.Threading.Tasks.Task> ValidateAsync(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.UpdateClientRequest request); ``` #### Parameters ###### `request` [UpdateClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.UpdateClientRequest 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.UpdateClientRequest') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.UpdateClientRequestValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.UpdateClientRequest).request} The update client request to validate\. Implements [ValidateAsync\(UpdateClientRequest\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IUpdateClientRequestValidator#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IUpdateClientRequestValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.UpdateClientRequest) 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IUpdateClientRequestValidator\.ValidateAsync\(Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.UpdateClientRequest\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[ValidUpdateClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidUpdateClientRequest 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.ValidUpdateClientRequest')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task representing the validation result\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ## Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces Namespace | Classes | | | :--- | :--- | | [ClientCredentials](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ClientCredentials 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.ClientCredentials') | Encapsulates both transmission and storage formats of client credentials\. Maintains plain\-text secret for immediate transmission in registration response, while also providing SHA\-512 hash for secure persistence\. | | [ClientRegistrationSuccessResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ClientRegistrationSuccessResponse 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.ClientRegistrationSuccessResponse') | Represents a successful response for a client registration in the context of OpenID Connect\. Per RFC 7591 §3\.2\.1, the authorization server returns all registered metadata about the client \(including server\-assigned defaults for omitted fields\) so the client can confirm what was registered without a separate read round\-trip\. The shape mirrors [ReadClientSuccessfulResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ReadClientSuccessfulResponse 'Abblix\.Oidc\.Server\.Model\.ReadClientSuccessfulResponse') by design \- register and read responses carry the same metadata surface, differing only in registration\-specific timing \([ClientIdIssuedAt](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ClientRegistrationSuccessResponse#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ClientRegistrationSuccessResponse.ClientIdIssuedAt 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.ClientRegistrationSuccessResponse\.ClientIdIssuedAt')\) the read endpoint does not regenerate\. | | [RemoveClientSuccessfulResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.RemoveClientSuccessfulResponse 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.RemoveClientSuccessfulResponse') | Represents the internal result of a successful client deletion operation\. | | [UpdateClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.UpdateClientRequest 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.UpdateClientRequest') | Represents a request to update an existing client's configuration per RFC 7592 Section 2\.2\. Combines client authentication \(ClientRequest\) with updated metadata \(ClientRegistrationRequest\)\. | | [ValidClientRegistrationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidClientRegistrationRequest 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.ValidClientRegistrationRequest') | A registration request whose metadata has passed all validators, paired with the resolved `sector_identifier` \- derived from `sector_identifier_uri`, from the registered redirect URIs, or for a backchannel client that registered none from the URI its delivery mode names \(used for pairwise PPID computation per OIDC Core Section 8\.1 and CIBA Core 1\.0 Section 4\)\. | | [ValidClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidClientRequest 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.ValidClientRequest') | A client configuration endpoint request \(RFC 7592\) that has been authenticated via the registration access token, paired with the resolved [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidClientRequest#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidClientRequest.ClientInfo 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.ValidClientRequest\.ClientInfo') from storage\. | | [ValidUpdateClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidUpdateClientRequest 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.ValidUpdateClientRequest') | Represents a validated request to update a client's configuration per RFC 7592\. Contains the original request, validated client info, and registration request\. | | Interfaces | | | :--- | :--- | | [IClientCredentialFactory](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IClientCredentialFactory 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IClientCredentialFactory') | Encapsulates client credential generation to maintain single responsibility and reduce constructor complexity\. Separates credential\-specific concerns \(ID generation, secret generation, hashing, expiration\) from the broader client registration process\. | | [IClientRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IClientRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IClientRequestValidator') | Validates a request against the client configuration endpoint \(RFC 7592 §2\-§4\)\. Confirms that the bearer registration access token authorizes the operation on the referenced `client_id` and that the client still exists\. | | [IInitialAccessTokenRevocationProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IInitialAccessTokenRevocationProvider 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IInitialAccessTokenRevocationProvider') | Checks whether an initial access token has been revoked\. Implementations may use a database, distributed cache, or other store\. | | [IInitialAccessTokenService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IInitialAccessTokenService 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IInitialAccessTokenService') | Issues initial access tokens that authorize calls to the client registration endpoint per RFC 7591 Section 3\. | | [IReadClientHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IReadClientHandler 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IReadClientHandler') | Handles `GET` requests to the client configuration endpoint per RFC 7592 §2\.1, returning the registered metadata of the authenticated client\. | | [IReadClientRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IReadClientRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IReadClientRequestProcessor') | Builds the RFC 7592 §2\.1 read\-client response from a request that has already been validated\. Reads stored metadata, formats it for the wire, and issues a fresh `registration_access_token` as recommended by RFC 7592 §3\. | | [IRegisterClientHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegisterClientHandler 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IRegisterClientHandler') | Handles `POST` requests to the registration endpoint per RFC 7591 §3 and the OpenID Connect Dynamic Client Registration 1\.0 specification, validating supplied metadata and provisioning a new client\. | | [IRegisterClientRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegisterClientRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IRegisterClientRequestProcessor') | Persists a new client and constructs the RFC 7591 §3\.2\.1 success response from a request whose metadata has already been validated\. Generates credentials and the `registration_access_token` bound to the new `client_id`\. | | [IRegisterClientRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegisterClientRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IRegisterClientRequestValidator') | Validates client metadata supplied to the registration endpoint per RFC 7591 §2 and OpenID Connect Dynamic Client Registration 1\.0\. Produces a typed [ValidClientRegistrationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidClientRegistrationRequest 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.ValidClientRegistrationRequest') on success or an [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') describing the rejected metadata field\. | | [IRegistrationAccessTokenService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenService 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IRegistrationAccessTokenService') | Provides functionality to issue registration access tokens for managing registered clients\. Per RFC 7592 Section 3, the registration access token is used to authenticate subsequent operations on the client configuration endpoint\. | | [IRegistrationAccessTokenStore](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenStore 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IRegistrationAccessTokenStore') | Records, for each registered client, the identifier \(jti\) of the registration access token currently authorized to manage it via the RFC 7592 client configuration endpoint\. The token validator accepts only a token whose jti matches the stored value, so rotating the token on update \(storing a fresh jti\) invalidates every previously issued token \(RFC 7592 §5\)\. | | [IRegistrationAccessTokenValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IRegistrationAccessTokenValidator') | Validates the registration access token presented on calls to the client configuration endpoint per RFC 7592 §3\. Verifies the bearer token from the `Authorization` header is bound to the requested `client_id`\. | | [IRemoveClientHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRemoveClientHandler 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IRemoveClientHandler') | Handles `DELETE` requests to the client configuration endpoint per RFC 7592 §2\.3, deregistering an existing client after verifying its registration access token\. A successful deletion invalidates the client's `client_id`, `client_secret`, the registration access token, and any outstanding grants and tokens\. | | [IRemoveClientRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRemoveClientRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IRemoveClientRequestProcessor') | Performs the storage\-level deregistration of a client whose request has already been validated for authentication and existence per RFC 7592 §2\.3\. | | [IUpdateClientHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IUpdateClientHandler 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IUpdateClientHandler') | Defines a contract for handling requests to update client configurations, as part of client management in OAuth 2\.0 and OpenID Connect frameworks per RFC 7592 Section 2\.2\. | | [IUpdateClientRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IUpdateClientRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IUpdateClientRequestProcessor') | Represents an interface for processing update client requests in the context of OpenID Connect per RFC 7592\. | | [IUpdateClientRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IUpdateClientRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IUpdateClientRequestValidator') | Represents an interface for validating update client requests in the context of OpenID Connect per RFC 7592\. | --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ClientCredentials.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces') ## ClientCredentials Class Encapsulates both transmission and storage formats of client credentials\. Maintains plain\-text secret for immediate transmission in registration response, while also providing SHA\-512 hash for secure persistence\. ```csharp public record ClientCredentials : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ClientCredentials Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[ClientCredentials](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ClientCredentials 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.ClientCredentials')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Constructors ## ClientCredentials\(string, string, byte\[\], Nullable\\) Constructor {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ClientCredentials.ClientCredentials(string,string,byte[],System.Nullable_System.DateTimeOffset_)} Encapsulates both transmission and storage formats of client credentials\. Maintains plain\-text secret for immediate transmission in registration response, while also providing SHA\-512 hash for secure persistence\. ```csharp public ClientCredentials(string ClientId, string? ClientSecret, byte[]? Sha512Hash, System.Nullable ExpiresAt); ``` #### Parameters ###### `ClientId` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ClientCredentials.ClientCredentials(string,string,byte[],System.Nullable_System.DateTimeOffset_).ClientId} Generated or provided identifier for the OAuth 2\.0 client\. ###### `ClientSecret` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ClientCredentials.ClientCredentials(string,string,byte[],System.Nullable_System.DateTimeOffset_).ClientSecret} Plain\-text secret sent to client in registration response; null for public clients or private\_key\_jwt\. ###### `Sha512Hash` [System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ClientCredentials.ClientCredentials(string,string,byte[],System.Nullable_System.DateTimeOffset_).Sha512Hash} SHA\-512 hash for secure storage; prevents storing plain\-text secrets in database\. ###### `ExpiresAt` [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ClientCredentials.ClientCredentials(string,string,byte[],System.Nullable_System.DateTimeOffset_).ExpiresAt} Enables secret rotation by enforcing time\-limited validity; null indicates no expiration\. ### Properties ## ClientCredentials\.ClientId Property {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ClientCredentials.ClientId} Generated or provided identifier for the OAuth 2\.0 client\. ```csharp public string ClientId { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ClientCredentials\.ClientSecret Property {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ClientCredentials.ClientSecret} Plain\-text secret sent to client in registration response; null for public clients or private\_key\_jwt\. ```csharp public string? ClientSecret { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ClientCredentials\.ExpiresAt Property {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ClientCredentials.ExpiresAt} Enables secret rotation by enforcing time\-limited validity; null indicates no expiration\. ```csharp public System.Nullable ExpiresAt { get; init; } ``` #### Property Value [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') ## ClientCredentials\.Sha512Hash Property {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ClientCredentials.Sha512Hash} SHA\-512 hash for secure storage; prevents storing plain\-text secrets in database\. ```csharp public byte[]? Sha512Hash { get; init; } ``` #### Property Value [System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ClientRegistrationSuccessResponse.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces') ## ClientRegistrationSuccessResponse Class Represents a successful response for a client registration in the context of OpenID Connect\. Per RFC 7591 §3\.2\.1, the authorization server returns all registered metadata about the client \(including server\-assigned defaults for omitted fields\) so the client can confirm what was registered without a separate read round\-trip\. The shape mirrors [ReadClientSuccessfulResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ReadClientSuccessfulResponse 'Abblix\.Oidc\.Server\.Model\.ReadClientSuccessfulResponse') by design \- register and read responses carry the same metadata surface, differing only in registration\-specific timing \([ClientIdIssuedAt](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ClientRegistrationSuccessResponse#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ClientRegistrationSuccessResponse.ClientIdIssuedAt 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.ClientRegistrationSuccessResponse\.ClientIdIssuedAt')\) the read endpoint does not regenerate\. ```csharp public record ClientRegistrationSuccessResponse : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ClientRegistrationSuccessResponse Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[ClientRegistrationSuccessResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ClientRegistrationSuccessResponse 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.ClientRegistrationSuccessResponse')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Remarks The response includes the client identifier, credentials, registration endpoint information, and all registered client metadata so the client can use the registration API for subsequent operations on the client configuration\. ### Constructors ## ClientRegistrationSuccessResponse\(string, Nullable\, string\) Constructor {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ClientRegistrationSuccessResponse.ClientRegistrationSuccessResponse(string,System.Nullable_System.DateTimeOffset_,string)} Represents a successful response for a client registration in the context of OpenID Connect\. Per RFC 7591 §3\.2\.1, the authorization server returns all registered metadata about the client \(including server\-assigned defaults for omitted fields\) so the client can confirm what was registered without a separate read round\-trip\. The shape mirrors [ReadClientSuccessfulResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ReadClientSuccessfulResponse 'Abblix\.Oidc\.Server\.Model\.ReadClientSuccessfulResponse') by design \- register and read responses carry the same metadata surface, differing only in registration\-specific timing \([ClientIdIssuedAt](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ClientRegistrationSuccessResponse#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ClientRegistrationSuccessResponse.ClientIdIssuedAt 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.ClientRegistrationSuccessResponse\.ClientIdIssuedAt')\) the read endpoint does not regenerate\. ```csharp public ClientRegistrationSuccessResponse(string ClientId, System.Nullable ClientIdIssuedAt, string RegistrationAccessToken); ``` #### Parameters ###### `ClientId` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ClientRegistrationSuccessResponse.ClientRegistrationSuccessResponse(string,System.Nullable_System.DateTimeOffset_,string).ClientId} The unique identifier assigned to the registered client\. Required per RFC 7591 §3\.2\.1\. ###### `ClientIdIssuedAt` [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ClientRegistrationSuccessResponse.ClientRegistrationSuccessResponse(string,System.Nullable_System.DateTimeOffset_,string).ClientIdIssuedAt} Time at which the client identifier was issued\. Optional per RFC 7591 §3\.2\.1\. ###### `RegistrationAccessToken` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ClientRegistrationSuccessResponse.ClientRegistrationSuccessResponse(string,System.Nullable_System.DateTimeOffset_,string).RegistrationAccessToken} The access token for subsequent operations on the client configuration endpoint\. Required per RFC 7592 §3\. ### Remarks The response includes the client identifier, credentials, registration endpoint information, and all registered client metadata so the client can use the registration API for subsequent operations on the client configuration\. ### Properties ## ClientRegistrationSuccessResponse\.ApplicationType Property {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ClientRegistrationSuccessResponse.ApplicationType} The type of application for which the client is registered \(e\.g\. `web`, `native`\)\. Optional \- server may assign a default\. Per RFC 7591 §2\. ```csharp public string? ApplicationType { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ClientRegistrationSuccessResponse\.AuthorizationDetailsTypes Property {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ClientRegistrationSuccessResponse.AuthorizationDetailsTypes} The per\-client allowlist of authorization\-detail `type` values this client may use in RFC 9396 Rich Authorization Requests \(`authorization_details_types`, RFC 9396 §10\)\. Echoes the registered value of `ClientInfo.AuthorizationDetailsTypes`\. ```csharp public string[]? AuthorizationDetailsTypes { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') ## ClientRegistrationSuccessResponse\.ClientId Property {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ClientRegistrationSuccessResponse.ClientId} The unique identifier assigned to the registered client\. Required per RFC 7591 §3\.2\.1\. ```csharp public string ClientId { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ClientRegistrationSuccessResponse\.ClientIdIssuedAt Property {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ClientRegistrationSuccessResponse.ClientIdIssuedAt} Time at which the client identifier was issued\. Optional per RFC 7591 §3\.2\.1\. ```csharp public System.Nullable ClientIdIssuedAt { get; init; } ``` #### Property Value [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') ## ClientRegistrationSuccessResponse\.ClientName Property {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ClientRegistrationSuccessResponse.ClientName} The human\-readable name of the client\. Optional client metadata\. Per RFC 7591 §2\. ```csharp public string? ClientName { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ClientRegistrationSuccessResponse\.ClientSecret Property {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ClientRegistrationSuccessResponse.ClientSecret} The client secret assigned to the registered client\. Optional \- only present for confidential clients\. Per RFC 7591 §3\.2\.1\. ```csharp public string? ClientSecret { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ClientRegistrationSuccessResponse\.ClientSecretExpiresAt Property {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ClientRegistrationSuccessResponse.ClientSecretExpiresAt} The expiration time of the client secret\. Required if `client_secret` is issued\. Per RFC 7591 §3\.2\.1\. A value of 0 indicates the secret does not expire\. ```csharp public System.Nullable ClientSecretExpiresAt { get; init; } ``` #### Property Value [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') ## ClientRegistrationSuccessResponse\.Contacts Property {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ClientRegistrationSuccessResponse.Contacts} Array of contact email addresses for people responsible for this client\. Optional client metadata\. Per RFC 7591 §2\. ```csharp public string[]? Contacts { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') ## ClientRegistrationSuccessResponse\.DpopBoundAccessTokens Property {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ClientRegistrationSuccessResponse.DpopBoundAccessTokens} Whether access tokens issued to this client are sender\-constrained via DPoP per RFC 9449 §5\.2 \(`dpop_bound_access_tokens`\)\. Echoes the registered value of `ClientInfo.RequireDPoP`\. ```csharp public System.Nullable DpopBoundAccessTokens { get; init; } ``` #### Property Value [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') ## ClientRegistrationSuccessResponse\.GrantTypes Property {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ClientRegistrationSuccessResponse.GrantTypes} The grant types the client is registered to use at the token endpoint, including the server\-assigned default when the request omitted them\. Per RFC 7591 §2/§3\.2\.1\. ```csharp public string[]? GrantTypes { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') ## ClientRegistrationSuccessResponse\.InitiateLoginUri Property {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ClientRegistrationSuccessResponse.InitiateLoginUri} URL the authorization server can call to initiate a login at the client\. Optional\. Per OpenID Connect Core §4\. ```csharp public System.Uri? InitiateLoginUri { get; init; } ``` #### Property Value [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri') ## ClientRegistrationSuccessResponse\.IntrospectionEncryptedResponseAlg Property {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ClientRegistrationSuccessResponse.IntrospectionEncryptedResponseAlg} JWE `alg` algorithm for encrypting introspection responses\. Optional\. Per RFC 9701 §6\. ```csharp public string? IntrospectionEncryptedResponseAlg { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ClientRegistrationSuccessResponse\.IntrospectionEncryptedResponseEnc Property {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ClientRegistrationSuccessResponse.IntrospectionEncryptedResponseEnc} JWE `enc` algorithm for encrypting introspection responses\. Optional\. Per RFC 9701 §6\. ```csharp public string? IntrospectionEncryptedResponseEnc { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ClientRegistrationSuccessResponse\.IntrospectionSignedResponseAlg Property {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ClientRegistrationSuccessResponse.IntrospectionSignedResponseAlg} JWS algorithm for signing introspection responses\. Optional\. Per RFC 9701 §6\. ```csharp public string? IntrospectionSignedResponseAlg { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ClientRegistrationSuccessResponse\.JwksUri Property {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ClientRegistrationSuccessResponse.JwksUri} URL for the client's JSON Web Key Set document\. Optional \- alternative to providing keys directly\. Per RFC 7591 §2\. ```csharp public System.Uri? JwksUri { get; init; } ``` #### Property Value [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri') ## ClientRegistrationSuccessResponse\.LogoUri Property {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ClientRegistrationSuccessResponse.LogoUri} URL that references a logo for the client\. Optional client metadata\. Per RFC 7591 §2\. ```csharp public System.Uri? LogoUri { get; init; } ``` #### Property Value [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri') ## ClientRegistrationSuccessResponse\.RedirectUris Property {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ClientRegistrationSuccessResponse.RedirectUris} The URIs where the client expects to receive responses after user authentication\. Required for most grant types\. Per RFC 7591 §2\. ```csharp public System.Uri[]? RedirectUris { get; init; } ``` #### Property Value [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') ## ClientRegistrationSuccessResponse\.RegistrationAccessToken Property {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ClientRegistrationSuccessResponse.RegistrationAccessToken} The access token for subsequent operations on the client configuration endpoint\. Required per RFC 7592 §3\. ```csharp public string RegistrationAccessToken { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ClientRegistrationSuccessResponse\.RegistrationClientUri Property {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ClientRegistrationSuccessResponse.RegistrationClientUri} The fully qualified URL of the client configuration endpoint for this client\. Required per RFC 7592 §3\. ```csharp public System.Uri? RegistrationClientUri { get; init; } ``` #### Property Value [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri') ## ClientRegistrationSuccessResponse\.RequestUris Property {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ClientRegistrationSuccessResponse.RequestUris} Array of `request_uri` values pre\-registered by the client\. Optional\. Per OpenID Connect Core §6\.2\. ```csharp public System.Uri[]? RequestUris { get; init; } ``` #### Property Value [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') ## ClientRegistrationSuccessResponse\.RequirePushedAuthorizationRequests Property {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ClientRegistrationSuccessResponse.RequirePushedAuthorizationRequests} Whether PAR is the only way this client may start an authorization flow per RFC 9126 §6\. Echoes `ClientInfo.RequirePushedAuthorizationRequests`\. ```csharp public System.Nullable RequirePushedAuthorizationRequests { get; init; } ``` #### Property Value [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') ## ClientRegistrationSuccessResponse\.RequireSignedRequestObject Property {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ClientRegistrationSuccessResponse.RequireSignedRequestObject} Whether this client must deliver authorization parameters as a signed request object per RFC 9101 §10\.5\. Echoes `ClientInfo.RequireSignedRequestObject`\. ```csharp public System.Nullable RequireSignedRequestObject { get; init; } ``` #### Property Value [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') ## ClientRegistrationSuccessResponse\.ResponseTypes Property {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ClientRegistrationSuccessResponse.ResponseTypes} The response type combinations the client is registered to use at the authorization endpoint, including the server\-assigned default when the request omitted them\. Each entry is a space\-separated combination, mirroring the request shape\. Per RFC 7591 §2/§3\.2\.1\. ```csharp public string[][]? ResponseTypes { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') ## ClientRegistrationSuccessResponse\.Scope Property {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ClientRegistrationSuccessResponse.Scope} The scope values the client is registered to request, serialized as a space\-separated string\. Per RFC 7591 §2/§3\.2\.1\. ```csharp public string[]? Scope { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') ## ClientRegistrationSuccessResponse\.SectorIdentifierUri Property {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ClientRegistrationSuccessResponse.SectorIdentifierUri} URL using the `https` scheme used in calculating pseudonymous identifiers for pairwise subject type\. Optional \- only relevant for pairwise\. Per OpenID Connect Core §8\.1\. ```csharp public System.Uri? SectorIdentifierUri { get; init; } ``` #### Property Value [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri') ## ClientRegistrationSuccessResponse\.SubjectType Property {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ClientRegistrationSuccessResponse.SubjectType} The type of subject identifier used \(e\.g\. `public`, `pairwise`\)\. Optional \- server may assign a default\. Per OpenID Connect Core §8\. ```csharp public string? SubjectType { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ClientRegistrationSuccessResponse\.TlsClientAuthSanDns Property {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ClientRegistrationSuccessResponse.TlsClientAuthSanDns} Required DNS Subject Alternative Names for `tls_client_auth` per RFC 8705\. ```csharp public string[]? TlsClientAuthSanDns { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') ## ClientRegistrationSuccessResponse\.TlsClientAuthSanEmail Property {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ClientRegistrationSuccessResponse.TlsClientAuthSanEmail} Required email Subject Alternative Names for `tls_client_auth` per RFC 8705\. ```csharp public string[]? TlsClientAuthSanEmail { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') ## ClientRegistrationSuccessResponse\.TlsClientAuthSanIp Property {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ClientRegistrationSuccessResponse.TlsClientAuthSanIp} Required IP Subject Alternative Names for `tls_client_auth` per RFC 8705\. ```csharp public string[]? TlsClientAuthSanIp { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') ## ClientRegistrationSuccessResponse\.TlsClientAuthSanUri Property {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ClientRegistrationSuccessResponse.TlsClientAuthSanUri} Required URI Subject Alternative Names for `tls_client_auth` per RFC 8705\. ```csharp public System.Uri[]? TlsClientAuthSanUri { get; init; } ``` #### Property Value [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') ## ClientRegistrationSuccessResponse\.TlsClientAuthSubjectDn Property {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ClientRegistrationSuccessResponse.TlsClientAuthSubjectDn} Exact Subject Distinguished Name required when using `tls_client_auth` per RFC 8705\. ```csharp public string? TlsClientAuthSubjectDn { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ClientRegistrationSuccessResponse\.TlsClientCertificateBoundAccessTokens Property {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ClientRegistrationSuccessResponse.TlsClientCertificateBoundAccessTokens} Whether access tokens are certificate\-bound whenever the token request arrives over mutual TLS per RFC 8705 §3\.4\. Echoes `ClientInfo.TlsClientCertificateBoundAccessTokens`\. ```csharp public System.Nullable TlsClientCertificateBoundAccessTokens { get; init; } ``` #### Property Value [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') ## ClientRegistrationSuccessResponse\.TokenEndpointAuthMethod Property {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ClientRegistrationSuccessResponse.TokenEndpointAuthMethod} The method used for authenticating the client at the token endpoint\. Optional \- server may assign a default\. Per RFC 7591 §2\. ```csharp public string? TokenEndpointAuthMethod { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ClientRegistrationSuccessResponse\.TokenExchangeAudiences Property {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ClientRegistrationSuccessResponse.TokenExchangeAudiences} Non\-standard extension: default\-deny per\-client allowlist of RFC 8693 `audience` values this client may request when exchanging a token\. Echoes `ClientInfo.TokenExchangeAllowedAudiences`\. ```csharp public string[]? TokenExchangeAudiences { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') ## ClientRegistrationSuccessResponse\.TokenExchangeSubjectTokenTypes Property {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ClientRegistrationSuccessResponse.TokenExchangeSubjectTokenTypes} Non\-standard extension: per\-client allowlist of RFC 8693 `subject_token_type` URIs this client may submit to the Token Exchange grant\. Echoes `ClientInfo.TokenExchangeAllowedSubjectTokenTypes`\. ```csharp public string[]? TokenExchangeSubjectTokenTypes { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') ## ClientRegistrationSuccessResponse\.UserInfoEncryptedResponseAlg Property {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ClientRegistrationSuccessResponse.UserInfoEncryptedResponseAlg} JWE `alg` algorithm for encrypting UserInfo responses\. Optional\. Per OpenID Connect Core §5\.6\.2\. ```csharp public string? UserInfoEncryptedResponseAlg { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ClientRegistrationSuccessResponse\.UserInfoEncryptedResponseEnc Property {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ClientRegistrationSuccessResponse.UserInfoEncryptedResponseEnc} JWE `enc` algorithm for encrypting UserInfo responses\. Optional\. Per OpenID Connect Core §5\.6\.2\. ```csharp public string? UserInfoEncryptedResponseEnc { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IClientCredentialFactory.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces') ## IClientCredentialFactory Interface Encapsulates client credential generation to maintain single responsibility and reduce constructor complexity\. Separates credential\-specific concerns \(ID generation, secret generation, hashing, expiration\) from the broader client registration process\. ```csharp public interface IClientCredentialFactory ``` Derived ↳ [ClientCredentialFactory](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.ClientCredentialFactory 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.ClientCredentialFactory') ### Methods ## IClientCredentialFactory\.Create\(string, string\) Method {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IClientCredentialFactory.Create(string,string)} Creates credentials with authentication\-method\-aware secret generation\. Generates secrets only for methods requiring them \(client\_secret\_basic, client\_secret\_post, client\_secret\_jwt\), avoiding unnecessary secret generation for public clients or private\_key\_jwt authentication\. ```csharp Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ClientCredentials Create(string tokenEndpointAuthMethod, string? clientId=null); ``` #### Parameters ###### `tokenEndpointAuthMethod` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IClientCredentialFactory.Create(string,string).tokenEndpointAuthMethod} Determines secret generation strategy based on OAuth 2\.0 authentication method\. ###### `clientId` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IClientCredentialFactory.Create(string,string).clientId} Allows pre\-registration scenarios where the client ID is externally provided\. #### Returns [ClientCredentials](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ClientCredentials 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.ClientCredentials') Complete credential set including both transmission format \(plain secret\) and storage format \(hash\)\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IClientRequestValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces') ## IClientRequestValidator Interface Validates a request against the client configuration endpoint \(RFC 7592 §2\-§4\)\. Confirms that the bearer registration access token authorizes the operation on the referenced `client_id` and that the client still exists\. ```csharp public interface IClientRequestValidator ``` Derived ↳ [ClientRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.ClientRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.ClientRequestValidator') ### Methods ## IClientRequestValidator\.ValidateAsync\(ClientRequest\) Method {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IClientRequestValidator.ValidateAsync(Abblix.Oidc.Server.Model.ClientRequest)} Validates the request, returning the resolved [ValidClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidClientRequest 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.ValidClientRequest') on success or an [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') describing the rejection\. ```csharp System.Threading.Tasks.Task> ValidateAsync(Abblix.Oidc.Server.Model.ClientRequest request); ``` #### Parameters ###### `request` [ClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRequest 'Abblix\.Oidc\.Server\.Model\.ClientRequest') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IClientRequestValidator.ValidateAsync(Abblix.Oidc.Server.Model.ClientRequest).request} The client management request to validate\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[ValidClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidClientRequest 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.ValidClientRequest')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IInitialAccessTokenRevocationProvider.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces') ## IInitialAccessTokenRevocationProvider Interface Checks whether an initial access token has been revoked\. Implementations may use a database, distributed cache, or other store\. ```csharp public interface IInitialAccessTokenRevocationProvider ``` Derived ↳ [InitialAccessTokenRevocationProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.InitialAccessTokenRevocationProvider 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.InitialAccessTokenRevocationProvider') ### Methods ## IInitialAccessTokenRevocationProvider\.IsRevokedAsync\(string\) Method {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IInitialAccessTokenRevocationProvider.IsRevokedAsync(string)} Determines whether the initial access token with the specified identifier has been revoked\. ```csharp System.Threading.Tasks.Task IsRevokedAsync(string subject); ``` #### Parameters ###### `subject` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IInitialAccessTokenRevocationProvider.IsRevokedAsync(string).subject} The unique identifier of the token \(from the JWT subject claim\)\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task that results in `true` if the token has been revoked, `false` otherwise\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IInitialAccessTokenService.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces') ## IInitialAccessTokenService Interface Issues initial access tokens that authorize calls to the client registration endpoint per RFC 7591 Section 3\. ```csharp public interface IInitialAccessTokenService ``` Derived ↳ [InitialAccessTokenService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.InitialAccessTokenService 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.InitialAccessTokenService') ### Methods ## IInitialAccessTokenService\.IssueTokenAsync\(string, DateTimeOffset, Nullable\\) Method {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IInitialAccessTokenService.IssueTokenAsync(string,System.DateTimeOffset,System.Nullable_System.TimeSpan_)} Issues an initial access token for authorizing client registration\. ```csharp System.Threading.Tasks.Task IssueTokenAsync(string subject, System.DateTimeOffset issuedAt, System.Nullable expiresIn); ``` #### Parameters ###### `subject` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IInitialAccessTokenService.IssueTokenAsync(string,System.DateTimeOffset,System.Nullable_System.TimeSpan_).subject} A unique identifier for the token, used as the JWT subject for revocation tracking\. ###### `issuedAt` [System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IInitialAccessTokenService.IssueTokenAsync(string,System.DateTimeOffset,System.Nullable_System.TimeSpan_).issuedAt} The timestamp when the token is issued\. ###### `expiresIn` [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IInitialAccessTokenService.IssueTokenAsync(string,System.DateTimeOffset,System.Nullable_System.TimeSpan_).expiresIn} The optional duration after which the token expires\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task that results in the encoded initial access token\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IReadClientHandler.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces') ## IReadClientHandler Interface Handles `GET` requests to the client configuration endpoint per RFC 7592 §2\.1, returning the registered metadata of the authenticated client\. ```csharp public interface IReadClientHandler ``` Derived ↳ [ReadClientHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.ReadClientHandler 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.ReadClientHandler') ### Methods ## IReadClientHandler\.HandleAsync\(ClientRequest\) Method {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IReadClientHandler.HandleAsync(Abblix.Oidc.Server.Model.ClientRequest)} Validates the registration access token, then retrieves the current configuration of the addressed client\. Returns either the client's metadata or an OIDC error suitable for the response body\. ```csharp System.Threading.Tasks.Task> HandleAsync(Abblix.Oidc.Server.Model.ClientRequest clientRequest); ``` #### Parameters ###### `clientRequest` [ClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRequest 'Abblix\.Oidc\.Server\.Model\.ClientRequest') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IReadClientHandler.HandleAsync(Abblix.Oidc.Server.Model.ClientRequest).clientRequest} The incoming request including the registration access token and target `client_id`\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[ReadClientSuccessfulResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ReadClientSuccessfulResponse 'Abblix\.Oidc\.Server\.Model\.ReadClientSuccessfulResponse')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IReadClientRequestProcessor.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces') ## IReadClientRequestProcessor Interface Builds the RFC 7592 §2\.1 read\-client response from a request that has already been validated\. Reads stored metadata, formats it for the wire, and issues a fresh `registration_access_token` as recommended by RFC 7592 §3\. ```csharp public interface IReadClientRequestProcessor ``` Derived ↳ [ReadClientRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.ReadClientRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.ReadClientRequestProcessor') ### Methods ## IReadClientRequestProcessor\.ProcessAsync\(ValidClientRequest\) Method {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IReadClientRequestProcessor.ProcessAsync(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidClientRequest)} Produces the response payload for the addressed client, including its current metadata and a refreshed registration access token\. ```csharp System.Threading.Tasks.Task> ProcessAsync(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidClientRequest request); ``` #### Parameters ###### `request` [ValidClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidClientRequest 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.ValidClientRequest') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IReadClientRequestProcessor.ProcessAsync(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidClientRequest).request} A request whose authentication and target client have been validated\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[ReadClientSuccessfulResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ReadClientSuccessfulResponse 'Abblix\.Oidc\.Server\.Model\.ReadClientSuccessfulResponse')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegisterClientHandler.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces') ## IRegisterClientHandler Interface Handles `POST` requests to the registration endpoint per RFC 7591 §3 and the OpenID Connect Dynamic Client Registration 1\.0 specification, validating supplied metadata and provisioning a new client\. ```csharp public interface IRegisterClientHandler ``` Derived ↳ [RegisterClientHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RegisterClientHandler 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.RegisterClientHandler') ### Methods ## IRegisterClientHandler\.HandleAsync\(ClientRegistrationRequest\) Method {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegisterClientHandler.HandleAsync(Abblix.Oidc.Server.Model.ClientRegistrationRequest)} Validates the supplied client metadata and, on success, creates the client record, generates credentials, and issues the registration access token used for later management operations \(RFC 7592\)\. ```csharp System.Threading.Tasks.Task> HandleAsync(Abblix.Oidc.Server.Model.ClientRegistrationRequest clientRegistrationRequest); ``` #### Parameters ###### `clientRegistrationRequest` [ClientRegistrationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRegistrationRequest 'Abblix\.Oidc\.Server\.Model\.ClientRegistrationRequest') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegisterClientHandler.HandleAsync(Abblix.Oidc.Server.Model.ClientRegistrationRequest).clientRegistrationRequest} The client metadata payload as defined in RFC 7591 §2 and OIDC Dynamic Client Registration 1\.0\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[ClientRegistrationSuccessResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ClientRegistrationSuccessResponse 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.ClientRegistrationSuccessResponse')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A successful response per RFC 7591 §3\.2\.1 \(containing `client_id`, `client_secret`, `registration_access_token`, etc\.\) or an error per §3\.2\.2\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegisterClientRequestProcessor.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces') ## IRegisterClientRequestProcessor Interface Persists a new client and constructs the RFC 7591 §3\.2\.1 success response from a request whose metadata has already been validated\. Generates credentials and the `registration_access_token` bound to the new `client_id`\. ```csharp public interface IRegisterClientRequestProcessor ``` Derived ↳ [RegisterClientRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RegisterClientRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.RegisterClientRequestProcessor') ### Methods ## IRegisterClientRequestProcessor\.ProcessAsync\(ValidClientRegistrationRequest\) Method {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegisterClientRequestProcessor.ProcessAsync(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidClientRegistrationRequest)} Stores the validated client and returns the registration response payload\. ```csharp System.Threading.Tasks.Task> ProcessAsync(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidClientRegistrationRequest request); ``` #### Parameters ###### `request` [ValidClientRegistrationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidClientRegistrationRequest 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.ValidClientRegistrationRequest') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegisterClientRequestProcessor.ProcessAsync(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidClientRegistrationRequest).request} The validated registration request\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[ClientRegistrationSuccessResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ClientRegistrationSuccessResponse 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.ClientRegistrationSuccessResponse')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegisterClientRequestValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces') ## IRegisterClientRequestValidator Interface Validates client metadata supplied to the registration endpoint per RFC 7591 §2 and OpenID Connect Dynamic Client Registration 1\.0\. Produces a typed [ValidClientRegistrationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidClientRegistrationRequest 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.ValidClientRegistrationRequest') on success or an [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') describing the rejected metadata field\. ```csharp public interface IRegisterClientRequestValidator ``` Derived ↳ [RegisterClientRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RegisterClientRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.RegisterClientRequestValidator') ↳ [UpdateClientRegistrationValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.UpdateClientRegistrationValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.UpdateClientRegistrationValidator') ### Methods ## IRegisterClientRequestValidator\.ValidateAsync\(ClientRegistrationRequest\) Method {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegisterClientRequestValidator.ValidateAsync(Abblix.Oidc.Server.Model.ClientRegistrationRequest)} Validates the request and returns either the typed valid form or the first error encountered\. ```csharp System.Threading.Tasks.Task> ValidateAsync(Abblix.Oidc.Server.Model.ClientRegistrationRequest request); ``` #### Parameters ###### `request` [ClientRegistrationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRegistrationRequest 'Abblix\.Oidc\.Server\.Model\.ClientRegistrationRequest') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegisterClientRequestValidator.ValidateAsync(Abblix.Oidc.Server.Model.ClientRegistrationRequest).request} The raw registration request to validate\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[ValidClientRegistrationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidClientRegistrationRequest 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.ValidClientRegistrationRequest')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenService.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces') ## IRegistrationAccessTokenService Interface Provides functionality to issue registration access tokens for managing registered clients\. Per RFC 7592 Section 3, the registration access token is used to authenticate subsequent operations on the client configuration endpoint\. ```csharp public interface IRegistrationAccessTokenService ``` Derived ↳ [RegistrationAccessTokenService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RegistrationAccessTokenService 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.RegistrationAccessTokenService') ### Methods ## IRegistrationAccessTokenService\.IssueTokenAsync\(string, DateTimeOffset, Nullable\, string\) Method {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenService.IssueTokenAsync(string,System.DateTimeOffset,System.Nullable_System.TimeSpan_,string)} Issues a registration access token for a registered client\. ```csharp System.Threading.Tasks.Task IssueTokenAsync(string clientId, System.DateTimeOffset issuedAt, System.Nullable expiresIn, string tokenId); ``` #### Parameters ###### `clientId` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenService.IssueTokenAsync(string,System.DateTimeOffset,System.Nullable_System.TimeSpan_,string).clientId} The unique identifier of the registered client\. ###### `issuedAt` [System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenService.IssueTokenAsync(string,System.DateTimeOffset,System.Nullable_System.TimeSpan_,string).issuedAt} The timestamp when the token is issued\. ###### `expiresIn` [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenService.IssueTokenAsync(string,System.DateTimeOffset,System.Nullable_System.TimeSpan_,string).expiresIn} The optional duration after which the token expires\. ###### `tokenId` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenService.IssueTokenAsync(string,System.DateTimeOffset,System.Nullable_System.TimeSpan_,string).tokenId} The identifier \(jti\) to embed in the token\. The caller records this value via the registration\-access\-token store so the validator can bind the token to the client: issuing with a fresh id invalidates earlier tokens, reusing the stored id keeps them valid \(idempotent read\)\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task that results in the encoded registration access token\. ### Remarks The registration access token is a bearer token that authenticates the client when performing read, update, or delete operations on its configuration\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenStore.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces') ## IRegistrationAccessTokenStore Interface Records, for each registered client, the identifier \(jti\) of the registration access token currently authorized to manage it via the RFC 7592 client configuration endpoint\. The token validator accepts only a token whose jti matches the stored value, so rotating the token on update \(storing a fresh jti\) invalidates every previously issued token \(RFC 7592 §5\)\. ```csharp public interface IRegistrationAccessTokenStore ``` Derived ↳ [RegistrationAccessTokenStore](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RegistrationAccessTokenStore 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.RegistrationAccessTokenStore') ### Remarks The binding outlives any single request and must be shared across all server replicas, so the default implementation persists it in the distributed entity storage rather than in process memory\. The binding has no expiration \- it lives as long as the client is registered \- and is removed when the client is deregistered\. ### Methods ## IRegistrationAccessTokenStore\.GetTokenIdAsync\(string\) Method {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenStore.GetTokenIdAsync(string)} Retrieves the jti of the client's current registration access token\. ```csharp System.Threading.Tasks.Task GetTokenIdAsync(string clientId); ``` #### Parameters ###### `clientId` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenStore.GetTokenIdAsync(string).clientId} The identifier of the client\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') The stored jti, or `null` when no binding is recorded \(a statically configured client, or one registered before the binding existed\) \- in which case the validator does not enforce the binding\. ## IRegistrationAccessTokenStore\.RemoveAsync\(string\) Method {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenStore.RemoveAsync(string)} Removes the binding for a deregistered client\. ```csharp System.Threading.Tasks.Task RemoveAsync(string clientId); ``` #### Parameters ###### `clientId` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenStore.RemoveAsync(string).clientId} The identifier of the client being removed\. #### Returns [System\.Threading\.Tasks\.Task](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task 'System\.Threading\.Tasks\.Task') ## IRegistrationAccessTokenStore\.SetTokenIdAsync\(string, string\) Method {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenStore.SetTokenIdAsync(string,string)} Records [tokenId](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenStore#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenStore.SetTokenIdAsync(string,string).tokenId 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IRegistrationAccessTokenStore\.SetTokenIdAsync\(string, string\)\.tokenId') as the jti of the client's current registration access token, replacing any previously stored value \(which thereby becomes invalid\)\. ```csharp System.Threading.Tasks.Task SetTokenIdAsync(string clientId, string tokenId); ``` #### Parameters ###### `clientId` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenStore.SetTokenIdAsync(string,string).clientId} The identifier of the client the token manages\. ###### `tokenId` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenStore.SetTokenIdAsync(string,string).tokenId} The jti embedded in the newly issued registration access token\. #### Returns [System\.Threading\.Tasks\.Task](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task 'System\.Threading\.Tasks\.Task') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces') ## IRegistrationAccessTokenValidator Interface Validates the registration access token presented on calls to the client configuration endpoint per RFC 7592 §3\. Verifies the bearer token from the `Authorization` header is bound to the requested `client_id`\. ```csharp public interface IRegistrationAccessTokenValidator ``` Derived ↳ [RegistrationAccessTokenValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RegistrationAccessTokenValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.RegistrationAccessTokenValidator') ### Methods ## IRegistrationAccessTokenValidator\.ValidateAsync\(AuthenticationHeaderValue, string, string\) Method {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenValidator.ValidateAsync(System.Net.Http.Headers.AuthenticationHeaderValue,string,string)} Validates the bearer token, ensuring it is well\-formed, of the expected type, and authorized to manage the specified client\. ```csharp System.Threading.Tasks.Task ValidateAsync(System.Net.Http.Headers.AuthenticationHeaderValue? header, string clientId, string? expectedTokenId); ``` #### Parameters ###### `header` [System\.Net\.Http\.Headers\.AuthenticationHeaderValue](https://learn.microsoft.com/en-us/dotnet/api/system.net.http.headers.authenticationheadervalue 'System\.Net\.Http\.Headers\.AuthenticationHeaderValue') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenValidator.ValidateAsync(System.Net.Http.Headers.AuthenticationHeaderValue,string,string).header} The HTTP `Authorization` header carrying the bearer token\. ###### `clientId` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenValidator.ValidateAsync(System.Net.Http.Headers.AuthenticationHeaderValue,string,string).clientId} The `client_id` targeted by the management request\. ###### `expectedTokenId` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenValidator.ValidateAsync(System.Net.Http.Headers.AuthenticationHeaderValue,string,string).expectedTokenId} The jti the token must carry to be accepted \- the value stored on the client when its current registration access token was issued\. When `null` the binding is not enforced \(statically configured client, or a record predating the stored id\) and only signature, type and audience are checked\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') `null` when the token is valid for the client; otherwise a human\-readable description of the validation failure\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRemoveClientHandler.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces') ## IRemoveClientHandler Interface Handles `DELETE` requests to the client configuration endpoint per RFC 7592 §2\.3, deregistering an existing client after verifying its registration access token\. A successful deletion invalidates the client's `client_id`, `client_secret`, the registration access token, and any outstanding grants and tokens\. ```csharp public interface IRemoveClientHandler ``` Derived ↳ [RemoveClientHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RemoveClientHandler 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.RemoveClientHandler') ### Methods ## IRemoveClientHandler\.HandleAsync\(ClientRequest\) Method {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRemoveClientHandler.HandleAsync(Abblix.Oidc.Server.Model.ClientRequest)} Validates the request, then removes the addressed client\. The HTTP layer is expected to translate the success result into `204 No Content` per RFC 7592 §2\.3\. ```csharp System.Threading.Tasks.Task> HandleAsync(Abblix.Oidc.Server.Model.ClientRequest clientRequest); ``` #### Parameters ###### `clientRequest` [ClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRequest 'Abblix\.Oidc\.Server\.Model\.ClientRequest') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRemoveClientHandler.HandleAsync(Abblix.Oidc.Server.Model.ClientRequest).clientRequest} The incoming request including the registration access token and target `client_id`\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[RemoveClientSuccessfulResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.RemoveClientSuccessfulResponse 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.RemoveClientSuccessfulResponse')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRemoveClientRequestProcessor.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces') ## IRemoveClientRequestProcessor Interface Performs the storage\-level deregistration of a client whose request has already been validated for authentication and existence per RFC 7592 §2\.3\. ```csharp public interface IRemoveClientRequestProcessor ``` Derived ↳ [RemoveClientRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RemoveClientRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.RemoveClientRequestProcessor') ### Methods ## IRemoveClientRequestProcessor\.ProcessAsync\(ValidClientRequest\) Method {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRemoveClientRequestProcessor.ProcessAsync(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidClientRequest)} Removes the addressed client from the data store and records the removal timestamp\. ```csharp System.Threading.Tasks.Task> ProcessAsync(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidClientRequest request); ``` #### Parameters ###### `request` [ValidClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidClientRequest 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.ValidClientRequest') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRemoveClientRequestProcessor.ProcessAsync(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidClientRequest).request} A request whose authentication and target client have been validated\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[RemoveClientSuccessfulResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.RemoveClientSuccessfulResponse 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.RemoveClientSuccessfulResponse')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IUpdateClientHandler.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces') ## IUpdateClientHandler Interface Defines a contract for handling requests to update client configurations, as part of client management in OAuth 2\.0 and OpenID Connect frameworks per RFC 7592 Section 2\.2\. ```csharp public interface IUpdateClientHandler ``` Derived ↳ [UpdateClientHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.UpdateClientHandler 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.UpdateClientHandler') ### Methods ## IUpdateClientHandler\.HandleAsync\(UpdateClientRequest\) Method {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IUpdateClientHandler.HandleAsync(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.UpdateClientRequest)} Asynchronously handles a request to update a client's configuration details\. ```csharp System.Threading.Tasks.Task> HandleAsync(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.UpdateClientRequest request); ``` #### Parameters ###### `request` [UpdateClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.UpdateClientRequest 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.UpdateClientRequest') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IUpdateClientHandler.HandleAsync(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.UpdateClientRequest).request} The update request containing the client authentication and updated metadata\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[ReadClientSuccessfulResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ReadClientSuccessfulResponse 'Abblix\.Oidc\.Server\.Model\.ReadClientSuccessfulResponse')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task that returns the updated client's configuration details or an error response\. ### Remarks This method processes the incoming request to update a client's configuration per RFC 7592\. It validates the request to ensure proper authentication via registration\_access\_token, validates the updated metadata, and updates the client configuration\. The response includes all client metadata with potentially updated registration\_access\_token\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IUpdateClientRequestProcessor.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces') ## IUpdateClientRequestProcessor Interface Represents an interface for processing update client requests in the context of OpenID Connect per RFC 7592\. ```csharp public interface IUpdateClientRequestProcessor ``` Derived ↳ [UpdateClientRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.UpdateClientRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.UpdateClientRequestProcessor') ### Methods ## IUpdateClientRequestProcessor\.ProcessAsync\(ValidUpdateClientRequest\) Method {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IUpdateClientRequestProcessor.ProcessAsync(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidUpdateClientRequest)} Processes an update client request asynchronously and returns the updated client configuration\. ```csharp System.Threading.Tasks.Task> ProcessAsync(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidUpdateClientRequest request); ``` #### Parameters ###### `request` [ValidUpdateClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidUpdateClientRequest 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.ValidUpdateClientRequest') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IUpdateClientRequestProcessor.ProcessAsync(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidUpdateClientRequest).request} The valid update client request to process\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[ReadClientSuccessfulResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ReadClientSuccessfulResponse 'Abblix\.Oidc\.Server\.Model\.ReadClientSuccessfulResponse')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task representing the processing result with updated client metadata\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IUpdateClientRequestValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces') ## IUpdateClientRequestValidator Interface Represents an interface for validating update client requests in the context of OpenID Connect per RFC 7592\. ```csharp public interface IUpdateClientRequestValidator ``` Derived ↳ [UpdateClientRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.UpdateClientRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.UpdateClientRequestValidator') ### Methods ## IUpdateClientRequestValidator\.ValidateAsync\(UpdateClientRequest\) Method {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IUpdateClientRequestValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.UpdateClientRequest)} Validates an update client request asynchronously\. ```csharp System.Threading.Tasks.Task> ValidateAsync(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.UpdateClientRequest request); ``` #### Parameters ###### `request` [UpdateClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.UpdateClientRequest 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.UpdateClientRequest') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IUpdateClientRequestValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.UpdateClientRequest).request} The update client request to validate\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[ValidUpdateClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidUpdateClientRequest 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.ValidUpdateClientRequest')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task representing the validation result\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.RemoveClientSuccessfulResponse.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces') ## RemoveClientSuccessfulResponse Class Represents the internal result of a successful client deletion operation\. ```csharp public record RemoveClientSuccessfulResponse : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → RemoveClientSuccessfulResponse Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[RemoveClientSuccessfulResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.RemoveClientSuccessfulResponse 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.RemoveClientSuccessfulResponse')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Remarks IMPORTANT: Per RFC 7592 Section 2.3, a successful DELETE request to the client configuration endpoint MUST return HTTP 204 No Content with an empty response body. This record is used internally to track deletion details but should NOT be serialized in the HTTP response. The HTTP response must be 204 No Content with headers: - `Cache-Control: no-store` - `Pragma: no-cache` A successful deletion invalidates: - The client's client_id - The client's client_secret - The registration_access_token - All existing authorization grants and tokens (access tokens, refresh tokens, etc.) ### Constructors ## RemoveClientSuccessfulResponse\(string, DateTimeOffset\) Constructor {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.RemoveClientSuccessfulResponse.RemoveClientSuccessfulResponse(string,System.DateTimeOffset)} Represents the internal result of a successful client deletion operation\. ```csharp public RemoveClientSuccessfulResponse(string ClientId, System.DateTimeOffset RemovedAt); ``` #### Parameters ###### `ClientId` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.RemoveClientSuccessfulResponse.RemoveClientSuccessfulResponse(string,System.DateTimeOffset).ClientId} The unique identifier of the client that was removed\. ###### `RemovedAt` [System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.RemoveClientSuccessfulResponse.RemoveClientSuccessfulResponse(string,System.DateTimeOffset).RemovedAt} The timestamp when the client was removed from the system\. ### Remarks IMPORTANT: Per RFC 7592 Section 2.3, a successful DELETE request to the client configuration endpoint MUST return HTTP 204 No Content with an empty response body. This record is used internally to track deletion details but should NOT be serialized in the HTTP response. The HTTP response must be 204 No Content with headers: - `Cache-Control: no-store` - `Pragma: no-cache` A successful deletion invalidates: - The client's client_id - The client's client_secret - The registration_access_token - All existing authorization grants and tokens (access tokens, refresh tokens, etc.) ### Properties ## RemoveClientSuccessfulResponse\.ClientId Property {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.RemoveClientSuccessfulResponse.ClientId} The unique identifier of the client that was removed\. ```csharp public string ClientId { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## RemoveClientSuccessfulResponse\.RemovedAt Property {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.RemoveClientSuccessfulResponse.RemovedAt} The timestamp when the client was removed from the system\. ```csharp public System.DateTimeOffset RemovedAt { get; init; } ``` #### Property Value [System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.UpdateClientRequest.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces') ## UpdateClientRequest Class Represents a request to update an existing client's configuration per RFC 7592 Section 2\.2\. Combines client authentication \(ClientRequest\) with updated metadata \(ClientRegistrationRequest\)\. ```csharp public record UpdateClientRequest : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → UpdateClientRequest Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[UpdateClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.UpdateClientRequest 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.UpdateClientRequest')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Constructors ## UpdateClientRequest\(ClientRequest, ClientRegistrationRequest\) Constructor {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.UpdateClientRequest.UpdateClientRequest(Abblix.Oidc.Server.Model.ClientRequest,Abblix.Oidc.Server.Model.ClientRegistrationRequest)} Represents a request to update an existing client's configuration per RFC 7592 Section 2\.2\. Combines client authentication \(ClientRequest\) with updated metadata \(ClientRegistrationRequest\)\. ```csharp public UpdateClientRequest(Abblix.Oidc.Server.Model.ClientRequest ClientRequest, Abblix.Oidc.Server.Model.ClientRegistrationRequest RegistrationRequest); ``` #### Parameters ###### `ClientRequest` [ClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRequest 'Abblix\.Oidc\.Server\.Model\.ClientRequest') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.UpdateClientRequest.UpdateClientRequest(Abblix.Oidc.Server.Model.ClientRequest,Abblix.Oidc.Server.Model.ClientRegistrationRequest).ClientRequest} The client authentication information including registration\_access\_token\. ###### `RegistrationRequest` [ClientRegistrationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRegistrationRequest 'Abblix\.Oidc\.Server\.Model\.ClientRegistrationRequest') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.UpdateClientRequest.UpdateClientRequest(Abblix.Oidc.Server.Model.ClientRequest,Abblix.Oidc.Server.Model.ClientRegistrationRequest).RegistrationRequest} The updated client metadata to apply\. ### Properties ## UpdateClientRequest\.ClientRequest Property {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.UpdateClientRequest.ClientRequest} The client authentication information including registration\_access\_token\. ```csharp public Abblix.Oidc.Server.Model.ClientRequest ClientRequest { get; init; } ``` #### Property Value [ClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRequest 'Abblix\.Oidc\.Server\.Model\.ClientRequest') ## UpdateClientRequest\.RegistrationRequest Property {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.UpdateClientRequest.RegistrationRequest} The updated client metadata to apply\. ```csharp public Abblix.Oidc.Server.Model.ClientRegistrationRequest RegistrationRequest { get; init; } ``` #### Property Value [ClientRegistrationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRegistrationRequest 'Abblix\.Oidc\.Server\.Model\.ClientRegistrationRequest') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidClientRegistrationRequest.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces') ## ValidClientRegistrationRequest Class A registration request whose metadata has passed all validators, paired with the resolved `sector_identifier` \- derived from `sector_identifier_uri`, from the registered redirect URIs, or for a backchannel client that registered none from the URI its delivery mode names \(used for pairwise PPID computation per OIDC Core Section 8\.1 and CIBA Core 1\.0 Section 4\)\. ```csharp public record ValidClientRegistrationRequest : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ValidClientRegistrationRequest Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[ValidClientRegistrationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidClientRegistrationRequest 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.ValidClientRegistrationRequest')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Constructors ## ValidClientRegistrationRequest\(ClientRegistrationRequest, string\) Constructor {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidClientRegistrationRequest.ValidClientRegistrationRequest(Abblix.Oidc.Server.Model.ClientRegistrationRequest,string)} A registration request whose metadata has passed all validators, paired with the resolved `sector_identifier` \- derived from `sector_identifier_uri`, from the registered redirect URIs, or for a backchannel client that registered none from the URI its delivery mode names \(used for pairwise PPID computation per OIDC Core Section 8\.1 and CIBA Core 1\.0 Section 4\)\. ```csharp public ValidClientRegistrationRequest(Abblix.Oidc.Server.Model.ClientRegistrationRequest Model, string? SectorIdentifier); ``` #### Parameters ###### `Model` [ClientRegistrationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRegistrationRequest 'Abblix\.Oidc\.Server\.Model\.ClientRegistrationRequest') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidClientRegistrationRequest.ValidClientRegistrationRequest(Abblix.Oidc.Server.Model.ClientRegistrationRequest,string).Model} The validated registration request\. ###### `SectorIdentifier` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidClientRegistrationRequest.ValidClientRegistrationRequest(Abblix.Oidc.Server.Model.ClientRegistrationRequest,string).SectorIdentifier} The host portion to use as the pairwise sector identifier, or `null` when the client does not request pairwise subjects\. ### Properties ## ValidClientRegistrationRequest\.Model Property {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidClientRegistrationRequest.Model} The validated registration request\. ```csharp public Abblix.Oidc.Server.Model.ClientRegistrationRequest Model { get; init; } ``` #### Property Value [ClientRegistrationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRegistrationRequest 'Abblix\.Oidc\.Server\.Model\.ClientRegistrationRequest') ## ValidClientRegistrationRequest\.SectorIdentifier Property {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidClientRegistrationRequest.SectorIdentifier} The host portion to use as the pairwise sector identifier, or `null` when the client does not request pairwise subjects\. ```csharp public string? SectorIdentifier { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidClientRequest.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces') ## ValidClientRequest Class A client configuration endpoint request \(RFC 7592\) that has been authenticated via the registration access token, paired with the resolved [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidClientRequest#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidClientRequest.ClientInfo 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.ValidClientRequest\.ClientInfo') from storage\. ```csharp public record ValidClientRequest : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ValidClientRequest Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[ValidClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidClientRequest 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.ValidClientRequest')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Constructors ## ValidClientRequest\(ClientRequest, ClientInfo\) Constructor {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidClientRequest.ValidClientRequest(Abblix.Oidc.Server.Model.ClientRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo)} A client configuration endpoint request \(RFC 7592\) that has been authenticated via the registration access token, paired with the resolved [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidClientRequest#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidClientRequest.ClientInfo 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.ValidClientRequest\.ClientInfo') from storage\. ```csharp public ValidClientRequest(Abblix.Oidc.Server.Model.ClientRequest Model, Abblix.Oidc.Server.Features.ClientInformation.ClientInfo ClientInfo); ``` #### Parameters ###### `Model` [ClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRequest 'Abblix\.Oidc\.Server\.Model\.ClientRequest') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidClientRequest.ValidClientRequest(Abblix.Oidc.Server.Model.ClientRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo).Model} The original request\. ###### `ClientInfo` [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidClientRequest.ValidClientRequest(Abblix.Oidc.Server.Model.ClientRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo).ClientInfo} The currently stored configuration of the addressed client\. ### Properties ## ValidClientRequest\.ClientInfo Property {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidClientRequest.ClientInfo} The currently stored configuration of the addressed client\. ```csharp public Abblix.Oidc.Server.Features.ClientInformation.ClientInfo ClientInfo { get; init; } ``` #### Property Value [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') ## ValidClientRequest\.Model Property {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidClientRequest.Model} The original request\. ```csharp public Abblix.Oidc.Server.Model.ClientRequest Model { get; init; } ``` #### Property Value [ClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRequest 'Abblix\.Oidc\.Server\.Model\.ClientRequest') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidUpdateClientRequest.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces') ## ValidUpdateClientRequest Class Represents a validated request to update a client's configuration per RFC 7592\. Contains the original request, validated client info, and registration request\. ```csharp public record ValidUpdateClientRequest : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ValidUpdateClientRequest Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[ValidUpdateClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidUpdateClientRequest 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.ValidUpdateClientRequest')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Constructors ## ValidUpdateClientRequest\(UpdateClientRequest, ClientInfo, ClientRegistrationRequest\) Constructor {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidUpdateClientRequest.ValidUpdateClientRequest(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.UpdateClientRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,Abblix.Oidc.Server.Model.ClientRegistrationRequest)} Represents a validated request to update a client's configuration per RFC 7592\. Contains the original request, validated client info, and registration request\. ```csharp public ValidUpdateClientRequest(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.UpdateClientRequest Model, Abblix.Oidc.Server.Features.ClientInformation.ClientInfo ClientInfo, Abblix.Oidc.Server.Model.ClientRegistrationRequest RegistrationRequest); ``` #### Parameters ###### `Model` [UpdateClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.UpdateClientRequest 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.UpdateClientRequest') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidUpdateClientRequest.ValidUpdateClientRequest(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.UpdateClientRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,Abblix.Oidc.Server.Model.ClientRegistrationRequest).Model} The original update request\. ###### `ClientInfo` [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidUpdateClientRequest.ValidUpdateClientRequest(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.UpdateClientRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,Abblix.Oidc.Server.Model.ClientRegistrationRequest).ClientInfo} The validated client information from the data store\. ###### `RegistrationRequest` [ClientRegistrationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRegistrationRequest 'Abblix\.Oidc\.Server\.Model\.ClientRegistrationRequest') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidUpdateClientRequest.ValidUpdateClientRequest(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.UpdateClientRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,Abblix.Oidc.Server.Model.ClientRegistrationRequest).RegistrationRequest} The validated registration request with updated metadata\. ### Properties ## ValidUpdateClientRequest\.ClientInfo Property {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidUpdateClientRequest.ClientInfo} The validated client information from the data store\. ```csharp public Abblix.Oidc.Server.Features.ClientInformation.ClientInfo ClientInfo { get; init; } ``` #### Property Value [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') ## ValidUpdateClientRequest\.Model Property {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidUpdateClientRequest.Model} The original update request\. ```csharp public Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.UpdateClientRequest Model { get; init; } ``` #### Property Value [UpdateClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.UpdateClientRequest 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.UpdateClientRequest') ## ValidUpdateClientRequest\.RegistrationRequest Property {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidUpdateClientRequest.RegistrationRequest} The validated registration request with updated metadata\. ```csharp public Abblix.Oidc.Server.Model.ClientRegistrationRequest RegistrationRequest { get; init; } ``` #### Property Value [ClientRegistrationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRegistrationRequest 'Abblix\.Oidc\.Server\.Model\.ClientRegistrationRequest') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ## Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation Namespace | Classes | | | :--- | :--- | | [AuthorizationDetailsTypesValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.AuthorizationDetailsTypesValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.AuthorizationDetailsTypesValidator') | Rejects client registration when the requested `authorization_details_types` per\-client allowlist \(RFC 9396 §10\) names any `type` value the server does not understand, returning `invalid_client_metadata` per OIDC DCR §3\.2\. Without this gate the registration would succeed and every RAR\-bearing request from this client would fail at the authorize/PAR endpoint with `invalid_authorization_details` \- a worse error surface for the deployer who registered with a typo\. | | [BackChannelAuthenticationValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.BackChannelAuthenticationValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.BackChannelAuthenticationValidator') | Validates CIBA\-related metadata \(OpenID Connect Client\-Initiated Backchannel Authentication 1\.0, Section 4\): the consistency between `backchannel_token_delivery_mode` and `backchannel_client_notification_endpoint`, and that `backchannel_authentication_request_signing_alg` is on the server's supported list\. | | [BackChannelLogoutUriValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.BackChannelLogoutUriValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.BackChannelLogoutUriValidator') | Validates the OIDC Back\-Channel Logout 1\.0 `backchannel_logout_uri`: when supplied it must be an absolute URI that the server is permitted to fetch under the active SSRF policy \([SecureHttpFetchOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.SecureHttpFetch.SecureHttpFetchOptions 'Abblix\.Oidc\.Server\.Features\.SecureHttpFetch\.SecureHttpFetchOptions')\)\. Because the OP itself POSTs the logout token to this endpoint, rejecting an internal/loopback or disallowed\-scheme target at registration stops a registered client from becoming a \(blind\) SSRF vector and surfaces the problem to the caller up front rather than as a silent delivery failure at logout time\. The outbound handler still re\-validates at request time\. | | [ClientIdValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientIdValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.ClientIdValidator') | Cross\-checks the supplied `client_id` against the operation type: for [Update](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.DynamicClientOperation#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.DynamicClientOperation.Update 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.DynamicClientOperation\.Update') \(RFC 7592 §2\.2\) the client must already exist, for [Register](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.DynamicClientOperation#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.DynamicClientOperation.Register 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.DynamicClientOperation\.Register') \(RFC 7591 §3\) it must not\. A missing `client_id` is treated as new\-registration with server\-assigned id\. | | [ClientRegistrationContextValidatorComposite](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientRegistrationContextValidatorComposite 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.ClientRegistrationContextValidatorComposite') | Composite that runs the configured chain of [IClientRegistrationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.IClientRegistrationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.IClientRegistrationContextValidator') steps in order and short\-circuits on the first failure, mirroring RFC 7591 §3\.2\.2 which requires the server to reject a registration on the first invalid metadata field\. | | [ClientRegistrationValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientRegistrationValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.ClientRegistrationValidationContext') | Mutable state shared by the validation pipeline\. Carries the original [ClientRegistrationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRegistrationRequest 'Abblix\.Oidc\.Server\.Model\.ClientRegistrationRequest') alongside derived values that earlier steps compute and later steps \(or the processor\) consume\. | | [CredentialsValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.CredentialsValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.CredentialsValidator') | Validates that client authentication methods are consistent with the credentials provided during registration\. Ensures clients using JWT\-based or TLS authentication have the required credentials \(JWKS for JWT methods, TLS metadata for TLS methods\)\. JWKS may be provided by any client for encryption or request object signing\. | | [EncryptedResponseAlgorithmsValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.EncryptedResponseAlgorithmsValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.EncryptedResponseAlgorithmsValidator') | Validates the JWE algorithms a client requests for the JWTs this server encrypts or decrypts: `id_token_encrypted_response_alg`/`enc` and `userinfo_encrypted_response_alg`/`enc` \(OIDC Core\), `request_object_encryption_alg`/`enc` \(RFC 9101\) and `authorization_encrypted_response_alg`/`enc` \(JARM §3\)\. Each key\-management \(`alg`\) value must appear in the server's supported key\-management algorithms and each content\-encryption \(`enc`\) value in its supported content\-encryption algorithms\. | | [ErrorFactory](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ErrorFactory 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.ErrorFactory') | Builds [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') instances using the error codes RFC 7591 §3\.2\.2 reserves for dynamic client registration: `invalid_redirect_uri`, `invalid_client_metadata`, `invalid_software_statement`, and `unapproved_software_statement`\. | | [GrantTypeValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.GrantTypeValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.GrantTypeValidator') | Enforces the consistency rule from OIDC DCR 1\.0 §2 between `response_types` and `grant_types`: a client requesting `code` must register the `authorization_code` grant, and one requesting `token` or `id_token` must register the `implicit` grant\. | | [InitialAccessTokenValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.InitialAccessTokenValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.InitialAccessTokenValidator') | Validates the initial access token on client registration requests per RFC 7591 Section 3 and RFC 6750 Bearer Token Usage\. When [RequireInitialAccessToken](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions#Abblix.Oidc.Server.Common.Configuration.OidcOptions.RequireInitialAccessToken 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions\.RequireInitialAccessToken') is enabled, checks JWT signature, expiration, type, and revocation status\. Skipped for update operations and when the feature is disabled\. | | [InitiateLoginUriValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.InitiateLoginUriValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.InitiateLoginUriValidator') | Validates the OIDC DCR 1\.0 §2 `initiate_login_uri`: when supplied it must be an absolute URI using the `https` scheme\. | | [JwksUriValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.JwksUriValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.JwksUriValidator') | Validates that a registered `jwks_uri` names a destination this deployment is allowed to fetch from: RFC 7591 Section 2 makes the member a URL, and this server fetches it to load the client's keys\. | | [PostLogoutRedirectUrisValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.PostLogoutRedirectUrisValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.PostLogoutRedirectUrisValidator') | Validates the OpenID Connect RP\-Initiated Logout 1\.0 `post_logout_redirect_uris`: each URI must be absolute, fragment\-free, and consistent with the OIDC DCR 1\.0 §2 scheme rules for the declared `application_type` \(Web = `https`, non\-localhost; Native = custom scheme or `http://localhost`\)\. | | [ScopeValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ScopeValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.ScopeValidator') | Validates the scope values in a client registration request per RFC 7591 Section 2\. Each requested scope must be recognized by the server\. | | [SecurityProfileValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SecurityProfileValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.SecurityProfileValidator') | Fail\-loud companion to the request\-time profile enforcement: rejects a registration whose declared response types can never satisfy the security profile the client falls under, so the contradiction surfaces at registration with a clear `invalid_client_metadata` diagnostic instead of as a per\-request rejection the client has to reverse\-engineer later\. Whether a client is held to a profile is a server\-side policy decision: a dynamically registered client cannot declare one, so it inherits the server\-wide [DefaultSecurityProfile](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions#Abblix.Oidc.Server.Common.Configuration.OidcOptions.DefaultSecurityProfile 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions\.DefaultSecurityProfile')\. | | [SignedResponseAlgorithmsValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SignedResponseAlgorithmsValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.SignedResponseAlgorithmsValidator') | Validates the algorithms a client requests for tokens this server signs: `id_token_signed_response_alg` and `userinfo_signed_response_alg` \(OIDC DCR 1\.0 §2\), and `authorization_signed_response_alg` \(JARM §3\)\. Each must appear in the server's set of supported signing algorithms; in addition, JARM §3 forbids `none` for the authorization response\. | | [SigningAlgorithmsValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SigningAlgorithmsValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.SigningAlgorithmsValidator') | Validates the algorithms a client commits to using on inbound JWTs the server will verify: `request_object_signing_alg` \(OIDC Core §6\.1\), `backchannel_authentication_request_signing_alg` \(CIBA §7\.1\.1\), and `token_endpoint_auth_signing_alg` \(RFC 7591 §2 / RFC 8414 §2\)\. Each must appear in the matching set the server advertises in discovery: `request_object_signing_alg` may be `none`, but `token_endpoint_auth_signing_alg` excludes `none` and `backchannel_authentication_request_signing_alg` excludes both `none` and the symmetric HS\* algorithms\. The same provider feeds the discovery document, so DCR accepts exactly what the server advertises\. | | [SoftwareStatementValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SoftwareStatementValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.SoftwareStatementValidator') | Validates the software\_statement parameter in a client registration request per RFC 7591 Section 2\.3\. Software statements are signed JWTs issued by a third\-party authority asserting metadata about client software\. | | [StoredUriValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.StoredUriValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.StoredUriValidator') | Refuses a registration carrying a relative URI in any member, so no address is stored on a client without something having read it\. | | [SubjectTypeValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SubjectTypeValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.SubjectTypeValidator') | Validates the OIDC Core Section 8 `subject_type` metadata and computes the pairwise sector identifier\. When `pairwise` is requested, a supplied `sector_identifier_uri` \(HTTPS\) is dereferenced and every URI the registration is required to have listed there is checked against its contents; otherwise the host is taken from the registered redirect URIs, which must agree on one \(OIDC Core Section 8\.1\)\. A backchannel client that registered NO redirect URI takes its host instead from the URI CIBA Core 1\.0 Section 4 puts in their place \- the `jwks_uri` in poll and ping, the `backchannel_client_notification_endpoint` in push\. Registering both is allowed and they need not agree: the redirect URIs decide, and the backchannel URI is only ever the sector of a client that has none\. The resolved host is stored on the context for later persistence\. | | [SupportedGrantTypeValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SupportedGrantTypeValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.SupportedGrantTypeValidator') | Rejects client registration when any value in `grant_types` is not advertised as supported by this server, returning `invalid_client_metadata` per OIDC DCR §3\.2\. Without this gate the registration would succeed and the client would only fail later at the token endpoint with `unsupported_grant_type`, or at the authorization endpoint for the `implicit` grant\. Companion to [SupportedResponseTypeValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SupportedResponseTypeValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.SupportedResponseTypeValidator'), which applies the same rule to `response_types`\. | | [SupportedResponseTypeValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SupportedResponseTypeValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.SupportedResponseTypeValidator') | Server\-level support gate for the `response_types` registration parameter \(OIDC DCR §3\.2\): every part of every requested combination must have a registered [IAuthorizationResponseBuilder](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseBuilder 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.IAuthorizationResponseBuilder')\. Without `EnableImplicitFlow()` the `token` / `id_token` processors are absent \- registration must reject those values with `invalid_client_metadata` at registration time, instead of letting the client succeed at registration and fail with `unsupported_response_type` on its first authorization request\. | | [SyncClientRegistrationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SyncClientRegistrationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.SyncClientRegistrationContextValidator') | Convenience base for validation steps whose checks are purely in\-memory: implements the async contract by wrapping the synchronous [Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.SyncClientRegistrationContextValidator\.Validate\(Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.ClientRegistrationValidationContext\)](https://learn.microsoft.com/en-us/dotnet/api/abblix.oidc.server.endpoints.dynamicclientmanagement.validation.syncclientregistrationcontextvalidator.validate#abblix-oidc-server-endpoints-dynamicclientmanagement-validation-syncclientregistrationcontextvalidator-validate(abblix-oidc-server-endpoints-dynamicclientmanagement-validation-clientregistrationvalidationcontext) 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.SyncClientRegistrationContextValidator\.Validate\(Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.ClientRegistrationValidationContext\)') result in a completed task\. | | [TlsClientAuthValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.TlsClientAuthValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.TlsClientAuthValidator') | Validates tls\_client\_auth metadata fields for RFC 8705 mutual TLS client authentication\. Ensures that required metadata is present and properly formatted when tls\_client\_auth method is selected\. | | [TokenEndpointAuthMethodValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.TokenEndpointAuthMethodValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.TokenEndpointAuthMethodValidator') | Validates that the requested `token_endpoint_auth_method` \(RFC 7591 §2\) is one this server announces in `token_endpoint_auth_methods_supported` on its discovery document\. | | Interfaces | | | :--- | :--- | | [IClientRegistrationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.IClientRegistrationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.IClientRegistrationContextValidator') | One step in the client\-registration validation pipeline \(RFC 7591 §2 / OIDC DCR 1\.0\)\. Implementations check a specific aspect of the supplied metadata \(redirect URIs, grant types, signing algorithms, sector identifier, software statement, etc\.\) and either clear it or surface an [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') for the response\. Aggregated by [ClientRegistrationContextValidatorComposite](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientRegistrationContextValidatorComposite 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.ClientRegistrationContextValidatorComposite')\. | | Enums | | | :--- | :--- | | [DynamicClientOperation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.DynamicClientOperation 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.DynamicClientOperation') | Defines the type of dynamic client management operation being performed\. | --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.AuthorizationDetailsTypesValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation') ## AuthorizationDetailsTypesValidator Class Rejects client registration when the requested `authorization_details_types` per\-client allowlist \(RFC 9396 §10\) names any `type` value the server does not understand, returning `invalid_client_metadata` per OIDC DCR §3\.2\. Without this gate the registration would succeed and every RAR\-bearing request from this client would fail at the authorize/PAR endpoint with `invalid_authorization_details` \- a worse error surface for the deployer who registered with a typo\. ```csharp public class AuthorizationDetailsTypesValidator : Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SyncClientRegistrationContextValidator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [SyncClientRegistrationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SyncClientRegistrationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.SyncClientRegistrationContextValidator') → AuthorizationDetailsTypesValidator ### Remarks The server\-supported set is enumerated from the same keyed\-DI registry of [IAuthorizationDetailValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailValidator 'Abblix\.Oidc\.Server\.Features\.RichAuthorizationRequests\.IAuthorizationDetailValidator') implementations that request\-time dispatch uses, via [Microsoft\.Extensions\.DependencyInjection\.KeyedService\.AnyKey](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.keyedservice.anykey 'Microsoft\.Extensions\.DependencyInjection\.KeyedService\.AnyKey')\. This makes registration gating, run\-time gating, and discovery's `authorization_details_types_supported` field share one source of truth \- same shape as [SupportedGrantTypeValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SupportedGrantTypeValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.SupportedGrantTypeValidator')\. Semantics of the requested allowlist: \- `null` \- client does not request any constraint; this validator passes\. \- Empty array \- client explicitly opts out of RAR; passes \(a client may legitimately register zero allowed types to disable the feature for itself\)\. \- Non\-empty array \- every value must appear in the server\-supported set, else reject\. ### Constructors ## AuthorizationDetailsTypesValidator\(IServiceProvider\) Constructor {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.AuthorizationDetailsTypesValidator.AuthorizationDetailsTypesValidator(System.IServiceProvider)} Rejects client registration when the requested `authorization_details_types` per\-client allowlist \(RFC 9396 §10\) names any `type` value the server does not understand, returning `invalid_client_metadata` per OIDC DCR §3\.2\. Without this gate the registration would succeed and every RAR\-bearing request from this client would fail at the authorize/PAR endpoint with `invalid_authorization_details` \- a worse error surface for the deployer who registered with a typo\. ```csharp public AuthorizationDetailsTypesValidator(System.IServiceProvider serviceProvider); ``` #### Parameters ###### `serviceProvider` [System\.IServiceProvider](https://learn.microsoft.com/en-us/dotnet/api/system.iserviceprovider 'System\.IServiceProvider') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.AuthorizationDetailsTypesValidator.AuthorizationDetailsTypesValidator(System.IServiceProvider).serviceProvider} ### Remarks The server\-supported set is enumerated from the same keyed\-DI registry of [IAuthorizationDetailValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailValidator 'Abblix\.Oidc\.Server\.Features\.RichAuthorizationRequests\.IAuthorizationDetailValidator') implementations that request\-time dispatch uses, via [Microsoft\.Extensions\.DependencyInjection\.KeyedService\.AnyKey](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.keyedservice.anykey 'Microsoft\.Extensions\.DependencyInjection\.KeyedService\.AnyKey')\. This makes registration gating, run\-time gating, and discovery's `authorization_details_types_supported` field share one source of truth \- same shape as [SupportedGrantTypeValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SupportedGrantTypeValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.SupportedGrantTypeValidator')\. Semantics of the requested allowlist: \- `null` \- client does not request any constraint; this validator passes\. \- Empty array \- client explicitly opts out of RAR; passes \(a client may legitimately register zero allowed types to disable the feature for itself\)\. \- Non\-empty array \- every value must appear in the server\-supported set, else reject\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.BackChannelAuthenticationValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation') ## BackChannelAuthenticationValidator Class Validates CIBA\-related metadata \(OpenID Connect Client\-Initiated Backchannel Authentication 1\.0, Section 4\): the consistency between `backchannel_token_delivery_mode` and `backchannel_client_notification_endpoint`, and that `backchannel_authentication_request_signing_alg` is on the server's supported list\. ```csharp public class BackChannelAuthenticationValidator : Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.IClientRegistrationContextValidator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → BackChannelAuthenticationValidator Implements [IClientRegistrationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.IClientRegistrationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.IClientRegistrationContextValidator') ### Constructors ## BackChannelAuthenticationValidator\(IJsonWebTokenValidator\) Constructor {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.BackChannelAuthenticationValidator.BackChannelAuthenticationValidator(Abblix.Jwt.IJsonWebTokenValidator)} Validates CIBA\-related metadata \(OpenID Connect Client\-Initiated Backchannel Authentication 1\.0, Section 4\): the consistency between `backchannel_token_delivery_mode` and `backchannel_client_notification_endpoint`, and that `backchannel_authentication_request_signing_alg` is on the server's supported list\. ```csharp public BackChannelAuthenticationValidator(Abblix.Jwt.IJsonWebTokenValidator jwtValidator); ``` #### Parameters ###### `jwtValidator` [IJsonWebTokenValidator](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.IJsonWebTokenValidator 'Abblix\.Jwt\.IJsonWebTokenValidator') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.BackChannelAuthenticationValidator.BackChannelAuthenticationValidator(Abblix.Jwt.IJsonWebTokenValidator).jwtValidator} Source of supported JWT signing algorithms\. ### Methods ## BackChannelAuthenticationValidator\.ValidateAsync\(ClientRegistrationValidationContext\) Method {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.BackChannelAuthenticationValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientRegistrationValidationContext)} Validates the slice of registration metadata this implementation owns\. May mutate [ClientRegistrationValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientRegistrationValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.ClientRegistrationValidationContext') with derived values \(for example the resolved sector identifier\)\. ```csharp public System.Threading.Tasks.Task ValidateAsync(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientRegistrationValidationContext context); ``` #### Parameters ###### `context` [ClientRegistrationValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientRegistrationValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.ClientRegistrationValidationContext') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.BackChannelAuthenticationValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientRegistrationValidationContext).context} The shared validation context for the current request\. Implements [ValidateAsync\(ClientRegistrationValidationContext\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.IClientRegistrationContextValidator#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.IClientRegistrationContextValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientRegistrationValidationContext) 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.IClientRegistrationContextValidator\.ValidateAsync\(Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.ClientRegistrationValidationContext\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') An [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') describing the rejection, or `null` when valid\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.BackChannelLogoutUriValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation') ## BackChannelLogoutUriValidator Class Validates the OIDC Back\-Channel Logout 1\.0 `backchannel_logout_uri`: when supplied it must be an absolute URI that the server is permitted to fetch under the active SSRF policy \([SecureHttpFetchOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.SecureHttpFetch.SecureHttpFetchOptions 'Abblix\.Oidc\.Server\.Features\.SecureHttpFetch\.SecureHttpFetchOptions')\)\. Because the OP itself POSTs the logout token to this endpoint, rejecting an internal/loopback or disallowed\-scheme target at registration stops a registered client from becoming a \(blind\) SSRF vector and surfaces the problem to the caller up front rather than as a silent delivery failure at logout time\. The outbound handler still re\-validates at request time\. ```csharp public class BackChannelLogoutUriValidator : Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SyncClientRegistrationContextValidator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [SyncClientRegistrationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SyncClientRegistrationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.SyncClientRegistrationContextValidator') → BackChannelLogoutUriValidator ### Constructors ## BackChannelLogoutUriValidator\(ISecureUriValidator\) Constructor {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.BackChannelLogoutUriValidator.BackChannelLogoutUriValidator(Abblix.Oidc.Server.Features.SecureHttpFetch.ISecureUriValidator)} Validates the OIDC Back\-Channel Logout 1\.0 `backchannel_logout_uri`: when supplied it must be an absolute URI that the server is permitted to fetch under the active SSRF policy \([SecureHttpFetchOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.SecureHttpFetch.SecureHttpFetchOptions 'Abblix\.Oidc\.Server\.Features\.SecureHttpFetch\.SecureHttpFetchOptions')\)\. Because the OP itself POSTs the logout token to this endpoint, rejecting an internal/loopback or disallowed\-scheme target at registration stops a registered client from becoming a \(blind\) SSRF vector and surfaces the problem to the caller up front rather than as a silent delivery failure at logout time\. The outbound handler still re\-validates at request time\. ```csharp public BackChannelLogoutUriValidator(Abblix.Oidc.Server.Features.SecureHttpFetch.ISecureUriValidator uriValidator); ``` #### Parameters ###### `uriValidator` [ISecureUriValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.SecureHttpFetch.ISecureUriValidator 'Abblix\.Oidc\.Server\.Features\.SecureHttpFetch\.ISecureUriValidator') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.BackChannelLogoutUriValidator.BackChannelLogoutUriValidator(Abblix.Oidc.Server.Features.SecureHttpFetch.ISecureUriValidator).uriValidator} The shared SSRF URI policy used by the outbound HTTP handler\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientIdValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation') ## ClientIdValidator Class Cross\-checks the supplied `client_id` against the operation type: for [Update](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.DynamicClientOperation#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.DynamicClientOperation.Update 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.DynamicClientOperation\.Update') \(RFC 7592 §2\.2\) the client must already exist, for [Register](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.DynamicClientOperation#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.DynamicClientOperation.Register 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.DynamicClientOperation\.Register') \(RFC 7591 §3\) it must not\. A missing `client_id` is treated as new\-registration with server\-assigned id\. ```csharp public class ClientIdValidator : Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.IClientRegistrationContextValidator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ClientIdValidator Implements [IClientRegistrationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.IClientRegistrationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.IClientRegistrationContextValidator') ### Constructors ## ClientIdValidator\(ILogger\, IClientInfoProvider\) Constructor {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientIdValidator.ClientIdValidator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientIdValidator_,Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider)} Cross\-checks the supplied `client_id` against the operation type: for [Update](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.DynamicClientOperation#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.DynamicClientOperation.Update 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.DynamicClientOperation\.Update') \(RFC 7592 §2\.2\) the client must already exist, for [Register](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.DynamicClientOperation#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.DynamicClientOperation.Register 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.DynamicClientOperation\.Register') \(RFC 7591 §3\) it must not\. A missing `client_id` is treated as new\-registration with server\-assigned id\. ```csharp public ClientIdValidator(Microsoft.Extensions.Logging.ILogger logger, Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider clientInfoProvider); ``` #### Parameters ###### `logger` [Microsoft\.Extensions\.Logging\.ILogger<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1')[ClientIdValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientIdValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.ClientIdValidator')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientIdValidator.ClientIdValidator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientIdValidator_,Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider).logger} Logger used for warnings about register/update conflicts\. ###### `clientInfoProvider` [IClientInfoProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.IClientInfoProvider') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientIdValidator.ClientIdValidator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientIdValidator_,Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider).clientInfoProvider} Store consulted to check for existing client records\. ### Methods ## ClientIdValidator\.ValidateAsync\(ClientRegistrationValidationContext\) Method {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientIdValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientRegistrationValidationContext)} Validates the slice of registration metadata this implementation owns\. May mutate [ClientRegistrationValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientRegistrationValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.ClientRegistrationValidationContext') with derived values \(for example the resolved sector identifier\)\. ```csharp public System.Threading.Tasks.Task ValidateAsync(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientRegistrationValidationContext context); ``` #### Parameters ###### `context` [ClientRegistrationValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientRegistrationValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.ClientRegistrationValidationContext') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientIdValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientRegistrationValidationContext).context} The shared validation context for the current request\. Implements [ValidateAsync\(ClientRegistrationValidationContext\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.IClientRegistrationContextValidator#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.IClientRegistrationContextValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientRegistrationValidationContext) 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.IClientRegistrationContextValidator\.ValidateAsync\(Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.ClientRegistrationValidationContext\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') An [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') describing the rejection, or `null` when valid\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientRegistrationContextValidatorComposite.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation') ## ClientRegistrationContextValidatorComposite Class Composite that runs the configured chain of [IClientRegistrationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.IClientRegistrationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.IClientRegistrationContextValidator') steps in order and short\-circuits on the first failure, mirroring RFC 7591 §3\.2\.2 which requires the server to reject a registration on the first invalid metadata field\. ```csharp public class ClientRegistrationContextValidatorComposite : Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.IClientRegistrationContextValidator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ClientRegistrationContextValidatorComposite Implements [IClientRegistrationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.IClientRegistrationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.IClientRegistrationContextValidator') ### Constructors ## ClientRegistrationContextValidatorComposite\(IClientRegistrationContextValidator\[\]\) Constructor {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientRegistrationContextValidatorComposite.ClientRegistrationContextValidatorComposite(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.IClientRegistrationContextValidator[])} Composite that runs the configured chain of [IClientRegistrationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.IClientRegistrationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.IClientRegistrationContextValidator') steps in order and short\-circuits on the first failure, mirroring RFC 7591 §3\.2\.2 which requires the server to reject a registration on the first invalid metadata field\. ```csharp public ClientRegistrationContextValidatorComposite(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.IClientRegistrationContextValidator[] validationSteps); ``` #### Parameters ###### `validationSteps` [IClientRegistrationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.IClientRegistrationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.IClientRegistrationContextValidator')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientRegistrationContextValidatorComposite.ClientRegistrationContextValidatorComposite(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.IClientRegistrationContextValidator[]).validationSteps} The validation steps to execute, in order\. ### Methods ## ClientRegistrationContextValidatorComposite\.ValidateAsync\(ClientRegistrationValidationContext\) Method {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientRegistrationContextValidatorComposite.ValidateAsync(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientRegistrationValidationContext)} Runs each step until one returns an error or all succeed\. ```csharp public System.Threading.Tasks.Task ValidateAsync(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientRegistrationValidationContext context); ``` #### Parameters ###### `context` [ClientRegistrationValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientRegistrationValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.ClientRegistrationValidationContext') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientRegistrationContextValidatorComposite.ValidateAsync(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientRegistrationValidationContext).context} The shared validation context\. Implements [ValidateAsync\(ClientRegistrationValidationContext\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.IClientRegistrationContextValidator#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.IClientRegistrationContextValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientRegistrationValidationContext) 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.IClientRegistrationContextValidator\.ValidateAsync\(Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.ClientRegistrationValidationContext\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') The first error produced, or `null` when every step passes\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientRegistrationValidationContext.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation') ## ClientRegistrationValidationContext Class Mutable state shared by the validation pipeline\. Carries the original [ClientRegistrationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRegistrationRequest 'Abblix\.Oidc\.Server\.Model\.ClientRegistrationRequest') alongside derived values that earlier steps compute and later steps \(or the processor\) consume\. ```csharp public record ClientRegistrationValidationContext : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ClientRegistrationValidationContext Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[ClientRegistrationValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientRegistrationValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.ClientRegistrationValidationContext')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Constructors ## ClientRegistrationValidationContext\(ClientRegistrationRequest\) Constructor {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientRegistrationValidationContext.ClientRegistrationValidationContext(Abblix.Oidc.Server.Model.ClientRegistrationRequest)} Mutable state shared by the validation pipeline\. Carries the original [ClientRegistrationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRegistrationRequest 'Abblix\.Oidc\.Server\.Model\.ClientRegistrationRequest') alongside derived values that earlier steps compute and later steps \(or the processor\) consume\. ```csharp public ClientRegistrationValidationContext(Abblix.Oidc.Server.Model.ClientRegistrationRequest Request); ``` #### Parameters ###### `Request` [ClientRegistrationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRegistrationRequest 'Abblix\.Oidc\.Server\.Model\.ClientRegistrationRequest') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientRegistrationValidationContext.ClientRegistrationValidationContext(Abblix.Oidc.Server.Model.ClientRegistrationRequest).Request} ### Properties ## ClientRegistrationValidationContext\.Operation Property {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientRegistrationValidationContext.Operation} Whether the pipeline is running for a new registration \(RFC 7591 §3\) or for an update of an existing client \(RFC 7592 §2\.2\)\. Steps such as [ClientIdValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientIdValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.ClientIdValidator') branch on this value\. ```csharp public Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.DynamicClientOperation Operation { get; set; } ``` #### Property Value [DynamicClientOperation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.DynamicClientOperation 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.DynamicClientOperation') ## ClientRegistrationValidationContext\.SectorIdentifier Property {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientRegistrationValidationContext.SectorIdentifier} The pairwise sector identifier \(host\) resolved by `SubjectTypeValidator` per OIDC Core §8\.1\. `null` when the client does not request pairwise subjects\. ```csharp public string? SectorIdentifier { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.CredentialsValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation') ## CredentialsValidator Class Validates that client authentication methods are consistent with the credentials provided during registration\. Ensures clients using JWT\-based or TLS authentication have the required credentials \(JWKS for JWT methods, TLS metadata for TLS methods\)\. JWKS may be provided by any client for encryption or request object signing\. ```csharp public class CredentialsValidator : Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SyncClientRegistrationContextValidator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [SyncClientRegistrationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SyncClientRegistrationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.SyncClientRegistrationContextValidator') → CredentialsValidator --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.DynamicClientOperation.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation') ## DynamicClientOperation Enum Defines the type of dynamic client management operation being performed\. ```csharp public enum DynamicClientOperation ``` ### Fields ###### `Register` 0 {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.DynamicClientOperation.Register} New client registration operation \(POST\)\. Client must not exist\. ###### `Update` 1 {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.DynamicClientOperation.Update} Update existing client operation \(PUT\)\. Client must exist\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.EncryptedResponseAlgorithmsValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation') ## EncryptedResponseAlgorithmsValidator Class Validates the JWE algorithms a client requests for the JWTs this server encrypts or decrypts: `id_token_encrypted_response_alg`/`enc` and `userinfo_encrypted_response_alg`/`enc` \(OIDC Core\), `request_object_encryption_alg`/`enc` \(RFC 9101\) and `authorization_encrypted_response_alg`/`enc` \(JARM §3\)\. Each key\-management \(`alg`\) value must appear in the server's supported key\-management algorithms and each content\-encryption \(`enc`\) value in its supported content\-encryption algorithms\. ```csharp public class EncryptedResponseAlgorithmsValidator : Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SyncClientRegistrationContextValidator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [SyncClientRegistrationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SyncClientRegistrationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.SyncClientRegistrationContextValidator') → EncryptedResponseAlgorithmsValidator ### Constructors ## EncryptedResponseAlgorithmsValidator\(IJsonWebTokenValidator\) Constructor {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.EncryptedResponseAlgorithmsValidator.EncryptedResponseAlgorithmsValidator(Abblix.Jwt.IJsonWebTokenValidator)} Validates the JWE algorithms a client requests for the JWTs this server encrypts or decrypts: `id_token_encrypted_response_alg`/`enc` and `userinfo_encrypted_response_alg`/`enc` \(OIDC Core\), `request_object_encryption_alg`/`enc` \(RFC 9101\) and `authorization_encrypted_response_alg`/`enc` \(JARM §3\)\. Each key\-management \(`alg`\) value must appear in the server's supported key\-management algorithms and each content\-encryption \(`enc`\) value in its supported content\-encryption algorithms\. ```csharp public EncryptedResponseAlgorithmsValidator(Abblix.Jwt.IJsonWebTokenValidator jwtValidator); ``` #### Parameters ###### `jwtValidator` [IJsonWebTokenValidator](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.IJsonWebTokenValidator 'Abblix\.Jwt\.IJsonWebTokenValidator') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.EncryptedResponseAlgorithmsValidator.EncryptedResponseAlgorithmsValidator(Abblix.Jwt.IJsonWebTokenValidator).jwtValidator} Source of the JWE algorithms the server supports \(the registered encryptors\)\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ErrorFactory.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation') ## ErrorFactory Class Builds [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') instances using the error codes RFC 7591 §3\.2\.2 reserves for dynamic client registration: `invalid_redirect_uri`, `invalid_client_metadata`, `invalid_software_statement`, and `unapproved_software_statement`\. ```csharp public static class ErrorFactory ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ErrorFactory ### Methods ## ErrorFactory\.InvalidClientMetadata\(string\) Method {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ErrorFactory.InvalidClientMetadata(string)} Creates a validation error for invalid client metadata\. ```csharp public static Abblix.Oidc.Server.Common.OidcError InvalidClientMetadata(string description); ``` #### Parameters ###### `description` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ErrorFactory.InvalidClientMetadata(string).description} The description of the error\. #### Returns [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') An error instance with the error code and description\. ## ErrorFactory\.InvalidRedirectUri\(string\) Method {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ErrorFactory.InvalidRedirectUri(string)} Creates a validation error for an invalid redirect URI\. ```csharp public static Abblix.Oidc.Server.Common.OidcError InvalidRedirectUri(string description); ``` #### Parameters ###### `description` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ErrorFactory.InvalidRedirectUri(string).description} The description of the error\. #### Returns [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') An error instance with the error code and description\. ## ErrorFactory\.InvalidSoftwareStatement\(string\) Method {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ErrorFactory.InvalidSoftwareStatement(string)} Creates a validation error for an invalid software statement per RFC 7591 Section 3\.2\.2\. ```csharp public static Abblix.Oidc.Server.Common.OidcError InvalidSoftwareStatement(string description); ``` #### Parameters ###### `description` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ErrorFactory.InvalidSoftwareStatement(string).description} The description of the error\. #### Returns [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') An error instance with the error code and description\. ## ErrorFactory\.UnapprovedSoftwareStatement\(string\) Method {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ErrorFactory.UnapprovedSoftwareStatement(string)} Creates a validation error for an unapproved software statement per RFC 7591 Section 3\.2\.2\. ```csharp public static Abblix.Oidc.Server.Common.OidcError UnapprovedSoftwareStatement(string description); ``` #### Parameters ###### `description` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ErrorFactory.UnapprovedSoftwareStatement(string).description} The description of the error\. #### Returns [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') An error instance with the error code and description\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.GrantTypeValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation') ## GrantTypeValidator Class Enforces the consistency rule from OIDC DCR 1\.0 §2 between `response_types` and `grant_types`: a client requesting `code` must register the `authorization_code` grant, and one requesting `token` or `id_token` must register the `implicit` grant\. ```csharp public class GrantTypeValidator : Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SyncClientRegistrationContextValidator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [SyncClientRegistrationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SyncClientRegistrationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.SyncClientRegistrationContextValidator') → GrantTypeValidator --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.IClientRegistrationContextValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation') ## IClientRegistrationContextValidator Interface One step in the client\-registration validation pipeline \(RFC 7591 §2 / OIDC DCR 1\.0\)\. Implementations check a specific aspect of the supplied metadata \(redirect URIs, grant types, signing algorithms, sector identifier, software statement, etc\.\) and either clear it or surface an [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') for the response\. Aggregated by [ClientRegistrationContextValidatorComposite](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientRegistrationContextValidatorComposite 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.ClientRegistrationContextValidatorComposite')\. ```csharp public interface IClientRegistrationContextValidator ``` Derived ↳ [BackChannelAuthenticationValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.BackChannelAuthenticationValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.BackChannelAuthenticationValidator') ↳ [ClientIdValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientIdValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.ClientIdValidator') ↳ [ClientRegistrationContextValidatorComposite](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientRegistrationContextValidatorComposite 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.ClientRegistrationContextValidatorComposite') ↳ [InitialAccessTokenValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.InitialAccessTokenValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.InitialAccessTokenValidator') ↳ [SoftwareStatementValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SoftwareStatementValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.SoftwareStatementValidator') ↳ [SubjectTypeValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SubjectTypeValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.SubjectTypeValidator') ↳ [SyncClientRegistrationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SyncClientRegistrationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.SyncClientRegistrationContextValidator') ### Methods ## IClientRegistrationContextValidator\.ValidateAsync\(ClientRegistrationValidationContext\) Method {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.IClientRegistrationContextValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientRegistrationValidationContext)} Validates the slice of registration metadata this implementation owns\. May mutate [ClientRegistrationValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientRegistrationValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.ClientRegistrationValidationContext') with derived values \(for example the resolved sector identifier\)\. ```csharp System.Threading.Tasks.Task ValidateAsync(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientRegistrationValidationContext context); ``` #### Parameters ###### `context` [ClientRegistrationValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientRegistrationValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.ClientRegistrationValidationContext') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.IClientRegistrationContextValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientRegistrationValidationContext).context} The shared validation context for the current request\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') An [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') describing the rejection, or `null` when valid\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.InitialAccessTokenValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation') ## InitialAccessTokenValidator Class Validates the initial access token on client registration requests per RFC 7591 Section 3 and RFC 6750 Bearer Token Usage\. When [RequireInitialAccessToken](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions#Abblix.Oidc.Server.Common.Configuration.OidcOptions.RequireInitialAccessToken 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions\.RequireInitialAccessToken') is enabled, checks JWT signature, expiration, type, and revocation status\. Skipped for update operations and when the feature is disabled\. ```csharp public class InitialAccessTokenValidator : Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.IClientRegistrationContextValidator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → InitialAccessTokenValidator Implements [IClientRegistrationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.IClientRegistrationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.IClientRegistrationContextValidator') ### Constructors ## InitialAccessTokenValidator\(IAuthServiceJwtValidator, IInitialAccessTokenRevocationProvider, IOptionsMonitor\\) Constructor {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.InitialAccessTokenValidator.InitialAccessTokenValidator(Abblix.Oidc.Server.Features.Tokens.Validation.IAuthServiceJwtValidator,Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IInitialAccessTokenRevocationProvider,Microsoft.Extensions.Options.IOptionsMonitor_Abblix.Oidc.Server.Common.Configuration.OidcOptions_)} Validates the initial access token on client registration requests per RFC 7591 Section 3 and RFC 6750 Bearer Token Usage\. When [RequireInitialAccessToken](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions#Abblix.Oidc.Server.Common.Configuration.OidcOptions.RequireInitialAccessToken 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions\.RequireInitialAccessToken') is enabled, checks JWT signature, expiration, type, and revocation status\. Skipped for update operations and when the feature is disabled\. ```csharp public InitialAccessTokenValidator(Abblix.Oidc.Server.Features.Tokens.Validation.IAuthServiceJwtValidator jwtValidator, Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IInitialAccessTokenRevocationProvider revocationProvider, Microsoft.Extensions.Options.IOptionsMonitor options); ``` #### Parameters ###### `jwtValidator` [IAuthServiceJwtValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.Validation.IAuthServiceJwtValidator 'Abblix\.Oidc\.Server\.Features\.Tokens\.Validation\.IAuthServiceJwtValidator') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.InitialAccessTokenValidator.InitialAccessTokenValidator(Abblix.Oidc.Server.Features.Tokens.Validation.IAuthServiceJwtValidator,Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IInitialAccessTokenRevocationProvider,Microsoft.Extensions.Options.IOptionsMonitor_Abblix.Oidc.Server.Common.Configuration.OidcOptions_).jwtValidator} Validates JWT signature and expiration\. ###### `revocationProvider` [IInitialAccessTokenRevocationProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IInitialAccessTokenRevocationProvider 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Interfaces\.IInitialAccessTokenRevocationProvider') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.InitialAccessTokenValidator.InitialAccessTokenValidator(Abblix.Oidc.Server.Features.Tokens.Validation.IAuthServiceJwtValidator,Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IInitialAccessTokenRevocationProvider,Microsoft.Extensions.Options.IOptionsMonitor_Abblix.Oidc.Server.Common.Configuration.OidcOptions_).revocationProvider} Checks whether the token has been revoked\. ###### `options` [Microsoft\.Extensions\.Options\.IOptionsMonitor<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptionsmonitor-1 'Microsoft\.Extensions\.Options\.IOptionsMonitor\`1')[OidcOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptionsmonitor-1 'Microsoft\.Extensions\.Options\.IOptionsMonitor\`1') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.InitialAccessTokenValidator.InitialAccessTokenValidator(Abblix.Oidc.Server.Features.Tokens.Validation.IAuthServiceJwtValidator,Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IInitialAccessTokenRevocationProvider,Microsoft.Extensions.Options.IOptionsMonitor_Abblix.Oidc.Server.Common.Configuration.OidcOptions_).options} OIDC configuration options\. ### Methods ## InitialAccessTokenValidator\.ValidateAsync\(ClientRegistrationValidationContext\) Method {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.InitialAccessTokenValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientRegistrationValidationContext)} Validates the slice of registration metadata this implementation owns\. May mutate [ClientRegistrationValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientRegistrationValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.ClientRegistrationValidationContext') with derived values \(for example the resolved sector identifier\)\. ```csharp public System.Threading.Tasks.Task ValidateAsync(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientRegistrationValidationContext context); ``` #### Parameters ###### `context` [ClientRegistrationValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientRegistrationValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.ClientRegistrationValidationContext') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.InitialAccessTokenValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientRegistrationValidationContext).context} The shared validation context for the current request\. Implements [ValidateAsync\(ClientRegistrationValidationContext\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.IClientRegistrationContextValidator#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.IClientRegistrationContextValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientRegistrationValidationContext) 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.IClientRegistrationContextValidator\.ValidateAsync\(Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.ClientRegistrationValidationContext\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') An [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') describing the rejection, or `null` when valid\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.InitiateLoginUriValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation') ## InitiateLoginUriValidator Class Validates the OIDC DCR 1\.0 §2 `initiate_login_uri`: when supplied it must be an absolute URI using the `https` scheme\. ```csharp public class InitiateLoginUriValidator : Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SyncClientRegistrationContextValidator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [SyncClientRegistrationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SyncClientRegistrationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.SyncClientRegistrationContextValidator') → InitiateLoginUriValidator --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.JwksUriValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation') ## JwksUriValidator Class Validates that a registered `jwks_uri` names a destination this deployment is allowed to fetch from: RFC 7591 Section 2 makes the member a URL, and this server fetches it to load the client's keys\. ```csharp public class JwksUriValidator : Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SyncClientRegistrationContextValidator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [SyncClientRegistrationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SyncClientRegistrationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.SyncClientRegistrationContextValidator') → JwksUriValidator ### Remarks A value the fetch cannot resolve registers happily and produces a client whose keys can never be loaded\. What the registrant then meets is a `private_key_jwt` assertion refused as "no signing key matched", at a moment that names neither the metadata nor the mistake \- and nothing upstream can say more, since the fetcher answers every failure with an empty key set\. Registration is the last point at which the caller is still on the line to be told\. Absoluteness is asked HERE and everything else is asked of the POLICY, which is what [BackChannelLogoutUriValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.BackChannelLogoutUriValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.BackChannelLogoutUriValidator') does with the other address this server fetches. The split matters because absoluteness alone is not the property: a dot is legal in a URI scheme, so `client.example.com:8080/jwks` - the way people write a host and a port - parses as an ABSOLUTE URI whose scheme is the host name and whose [System\.Uri\.Host](https://learn.microsoft.com/en-us/dotnet/api/system.uri.host 'System\.Uri\.Host') is empty, and every member the policy reads below would then be read off a value that names nowhere. The scheme is NOT decided here, and a literal `https` would be wrong: [AllowedDestinations](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.SecureHttpFetch.SecureHttpFetchOptions#Abblix.Oidc.Server.Features.SecureHttpFetch.SecureHttpFetchOptions.AllowedDestinations 'Abblix\.Oidc\.Server\.Features\.SecureHttpFetch\.SecureHttpFetchOptions\.AllowedDestinations') names an address the deployment reaches inside its own network, over plain HTTP, and the policy lifts the scheme restriction for exactly those. Refusing them at registration while the fetch allows them would make one fetched endpoint disagree with the other about the same address. ### Constructors ## JwksUriValidator\(ISecureUriValidator\) Constructor {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.JwksUriValidator.JwksUriValidator(Abblix.Oidc.Server.Features.SecureHttpFetch.ISecureUriValidator)} Validates that a registered `jwks_uri` names a destination this deployment is allowed to fetch from: RFC 7591 Section 2 makes the member a URL, and this server fetches it to load the client's keys\. ```csharp public JwksUriValidator(Abblix.Oidc.Server.Features.SecureHttpFetch.ISecureUriValidator uriValidator); ``` #### Parameters ###### `uriValidator` [ISecureUriValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.SecureHttpFetch.ISecureUriValidator 'Abblix\.Oidc\.Server\.Features\.SecureHttpFetch\.ISecureUriValidator') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.JwksUriValidator.JwksUriValidator(Abblix.Oidc.Server.Features.SecureHttpFetch.ISecureUriValidator).uriValidator} The shared SSRF URI policy used by the outbound HTTP handler\. ### Remarks A value the fetch cannot resolve registers happily and produces a client whose keys can never be loaded\. What the registrant then meets is a `private_key_jwt` assertion refused as "no signing key matched", at a moment that names neither the metadata nor the mistake \- and nothing upstream can say more, since the fetcher answers every failure with an empty key set\. Registration is the last point at which the caller is still on the line to be told\. Absoluteness is asked HERE and everything else is asked of the POLICY, which is what [BackChannelLogoutUriValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.BackChannelLogoutUriValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.BackChannelLogoutUriValidator') does with the other address this server fetches. The split matters because absoluteness alone is not the property: a dot is legal in a URI scheme, so `client.example.com:8080/jwks` - the way people write a host and a port - parses as an ABSOLUTE URI whose scheme is the host name and whose [System\.Uri\.Host](https://learn.microsoft.com/en-us/dotnet/api/system.uri.host 'System\.Uri\.Host') is empty, and every member the policy reads below would then be read off a value that names nowhere. The scheme is NOT decided here, and a literal `https` would be wrong: [AllowedDestinations](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.SecureHttpFetch.SecureHttpFetchOptions#Abblix.Oidc.Server.Features.SecureHttpFetch.SecureHttpFetchOptions.AllowedDestinations 'Abblix\.Oidc\.Server\.Features\.SecureHttpFetch\.SecureHttpFetchOptions\.AllowedDestinations') names an address the deployment reaches inside its own network, over plain HTTP, and the policy lifts the scheme restriction for exactly those. Refusing them at registration while the fetch allows them would make one fetched endpoint disagree with the other about the same address. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.PostLogoutRedirectUrisValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation') ## PostLogoutRedirectUrisValidator Class Validates the OpenID Connect RP\-Initiated Logout 1\.0 `post_logout_redirect_uris`: each URI must be absolute, fragment\-free, and consistent with the OIDC DCR 1\.0 §2 scheme rules for the declared `application_type` \(Web = `https`, non\-localhost; Native = custom scheme or `http://localhost`\)\. ```csharp public class PostLogoutRedirectUrisValidator : Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SyncClientRegistrationContextValidator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [SyncClientRegistrationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SyncClientRegistrationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.SyncClientRegistrationContextValidator') → PostLogoutRedirectUrisValidator --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ScopeValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation') ## ScopeValidator Class Validates the scope values in a client registration request per RFC 7591 Section 2\. Each requested scope must be recognized by the server\. ```csharp public class ScopeValidator : Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SyncClientRegistrationContextValidator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [SyncClientRegistrationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SyncClientRegistrationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.SyncClientRegistrationContextValidator') → ScopeValidator ### Constructors ## ScopeValidator\(IScopeManager\) Constructor {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ScopeValidator.ScopeValidator(Abblix.Oidc.Server.Features.ScopeManagement.IScopeManager)} Validates the scope values in a client registration request per RFC 7591 Section 2\. Each requested scope must be recognized by the server\. ```csharp public ScopeValidator(Abblix.Oidc.Server.Features.ScopeManagement.IScopeManager scopeManager); ``` #### Parameters ###### `scopeManager` [IScopeManager](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ScopeManagement.IScopeManager 'Abblix\.Oidc\.Server\.Features\.ScopeManagement\.IScopeManager') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ScopeValidator.ScopeValidator(Abblix.Oidc.Server.Features.ScopeManagement.IScopeManager).scopeManager} Provides access to known scope definitions\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SecurityProfileValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation') ## SecurityProfileValidator Class Fail\-loud companion to the request\-time profile enforcement: rejects a registration whose declared response types can never satisfy the security profile the client falls under, so the contradiction surfaces at registration with a clear `invalid_client_metadata` diagnostic instead of as a per\-request rejection the client has to reverse\-engineer later\. Whether a client is held to a profile is a server\-side policy decision: a dynamically registered client cannot declare one, so it inherits the server\-wide [DefaultSecurityProfile](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions#Abblix.Oidc.Server.Common.Configuration.OidcOptions.DefaultSecurityProfile 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions\.DefaultSecurityProfile')\. ```csharp public class SecurityProfileValidator : Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SyncClientRegistrationContextValidator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [SyncClientRegistrationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SyncClientRegistrationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.SyncClientRegistrationContextValidator') → SecurityProfileValidator ### Constructors ## SecurityProfileValidator\(IOptions\\) Constructor {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SecurityProfileValidator.SecurityProfileValidator(Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_)} Fail\-loud companion to the request\-time profile enforcement: rejects a registration whose declared response types can never satisfy the security profile the client falls under, so the contradiction surfaces at registration with a clear `invalid_client_metadata` diagnostic instead of as a per\-request rejection the client has to reverse\-engineer later\. Whether a client is held to a profile is a server\-side policy decision: a dynamically registered client cannot declare one, so it inherits the server\-wide [DefaultSecurityProfile](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions#Abblix.Oidc.Server.Common.Configuration.OidcOptions.DefaultSecurityProfile 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions\.DefaultSecurityProfile')\. ```csharp public SecurityProfileValidator(Microsoft.Extensions.Options.IOptions options); ``` #### Parameters ###### `options` [Microsoft\.Extensions\.Options\.IOptions<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptions-1 'Microsoft\.Extensions\.Options\.IOptions\`1')[OidcOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptions-1 'Microsoft\.Extensions\.Options\.IOptions\`1') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SecurityProfileValidator.SecurityProfileValidator(Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_).options} Provides the server\-wide default profile a registered client inherits\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SignedResponseAlgorithmsValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation') ## SignedResponseAlgorithmsValidator Class Validates the algorithms a client requests for tokens this server signs: `id_token_signed_response_alg` and `userinfo_signed_response_alg` \(OIDC DCR 1\.0 §2\), and `authorization_signed_response_alg` \(JARM §3\)\. Each must appear in the server's set of supported signing algorithms; in addition, JARM §3 forbids `none` for the authorization response\. ```csharp public class SignedResponseAlgorithmsValidator : Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SyncClientRegistrationContextValidator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [SyncClientRegistrationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SyncClientRegistrationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.SyncClientRegistrationContextValidator') → SignedResponseAlgorithmsValidator ### Constructors ## SignedResponseAlgorithmsValidator\(IJwtAlgorithmsProvider\) Constructor {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SignedResponseAlgorithmsValidator.SignedResponseAlgorithmsValidator(Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IJwtAlgorithmsProvider)} Validates the algorithms a client requests for tokens this server signs: `id_token_signed_response_alg` and `userinfo_signed_response_alg` \(OIDC DCR 1\.0 §2\), and `authorization_signed_response_alg` \(JARM §3\)\. Each must appear in the server's set of supported signing algorithms; in addition, JARM §3 forbids `none` for the authorization response\. ```csharp public SignedResponseAlgorithmsValidator(Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IJwtAlgorithmsProvider jwtAlgorithms); ``` #### Parameters ###### `jwtAlgorithms` [IJwtAlgorithmsProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IJwtAlgorithmsProvider 'Abblix\.Oidc\.Server\.Endpoints\.Configuration\.Interfaces\.IJwtAlgorithmsProvider') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SignedResponseAlgorithmsValidator.SignedResponseAlgorithmsValidator(Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IJwtAlgorithmsProvider).jwtAlgorithms} Source of supported signing algorithms for outbound tokens\. The same provider feeds the discovery document, so DCR accepts exactly what the server advertises \- in particular HS\* stays rejected here for the same key\-availability reason it is not advertised \(client secrets are stored hashed and cannot serve as HMAC keys\)\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SigningAlgorithmsValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation') ## SigningAlgorithmsValidator Class Validates the algorithms a client commits to using on inbound JWTs the server will verify: `request_object_signing_alg` \(OIDC Core §6\.1\), `backchannel_authentication_request_signing_alg` \(CIBA §7\.1\.1\), and `token_endpoint_auth_signing_alg` \(RFC 7591 §2 / RFC 8414 §2\)\. Each must appear in the matching set the server advertises in discovery: `request_object_signing_alg` may be `none`, but `token_endpoint_auth_signing_alg` excludes `none` and `backchannel_authentication_request_signing_alg` excludes both `none` and the symmetric HS\* algorithms\. The same provider feeds the discovery document, so DCR accepts exactly what the server advertises\. ```csharp public class SigningAlgorithmsValidator : Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SyncClientRegistrationContextValidator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [SyncClientRegistrationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SyncClientRegistrationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.SyncClientRegistrationContextValidator') → SigningAlgorithmsValidator ### Constructors ## SigningAlgorithmsValidator\(IJwtAlgorithmsProvider\) Constructor {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SigningAlgorithmsValidator.SigningAlgorithmsValidator(Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IJwtAlgorithmsProvider)} Validates the algorithms a client commits to using on inbound JWTs the server will verify: `request_object_signing_alg` \(OIDC Core §6\.1\), `backchannel_authentication_request_signing_alg` \(CIBA §7\.1\.1\), and `token_endpoint_auth_signing_alg` \(RFC 7591 §2 / RFC 8414 §2\)\. Each must appear in the matching set the server advertises in discovery: `request_object_signing_alg` may be `none`, but `token_endpoint_auth_signing_alg` excludes `none` and `backchannel_authentication_request_signing_alg` excludes both `none` and the symmetric HS\* algorithms\. The same provider feeds the discovery document, so DCR accepts exactly what the server advertises\. ```csharp public SigningAlgorithmsValidator(Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IJwtAlgorithmsProvider jwtAlgorithms); ``` #### Parameters ###### `jwtAlgorithms` [IJwtAlgorithmsProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IJwtAlgorithmsProvider 'Abblix\.Oidc\.Server\.Endpoints\.Configuration\.Interfaces\.IJwtAlgorithmsProvider') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SigningAlgorithmsValidator.SigningAlgorithmsValidator(Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IJwtAlgorithmsProvider).jwtAlgorithms} Source of the per\-parameter supported signing algorithm sets\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SoftwareStatementValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation') ## SoftwareStatementValidator Class Validates the software\_statement parameter in a client registration request per RFC 7591 Section 2\.3\. Software statements are signed JWTs issued by a third\-party authority asserting metadata about client software\. ```csharp public class SoftwareStatementValidator : Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.IClientRegistrationContextValidator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → SoftwareStatementValidator Implements [IClientRegistrationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.IClientRegistrationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.IClientRegistrationContextValidator') ### Constructors ## SoftwareStatementValidator\(ILogger\, IJsonWebTokenValidator, IOptionsMonitor\, ISecureHttpFetcher\) Constructor {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SoftwareStatementValidator.SoftwareStatementValidator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SoftwareStatementValidator_,Abblix.Jwt.IJsonWebTokenValidator,Microsoft.Extensions.Options.IOptionsMonitor_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,Abblix.Oidc.Server.Features.SecureHttpFetch.ISecureHttpFetcher)} Validates the software\_statement parameter in a client registration request per RFC 7591 Section 2\.3\. Software statements are signed JWTs issued by a third\-party authority asserting metadata about client software\. ```csharp public SoftwareStatementValidator(Microsoft.Extensions.Logging.ILogger logger, Abblix.Jwt.IJsonWebTokenValidator jwtValidator, Microsoft.Extensions.Options.IOptionsMonitor options, Abblix.Oidc.Server.Features.SecureHttpFetch.ISecureHttpFetcher secureFetcher); ``` #### Parameters ###### `logger` [Microsoft\.Extensions\.Logging\.ILogger<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1')[SoftwareStatementValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SoftwareStatementValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.SoftwareStatementValidator')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SoftwareStatementValidator.SoftwareStatementValidator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SoftwareStatementValidator_,Abblix.Jwt.IJsonWebTokenValidator,Microsoft.Extensions.Options.IOptionsMonitor_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,Abblix.Oidc.Server.Features.SecureHttpFetch.ISecureHttpFetcher).logger} Logger for recording validation operations\. ###### `jwtValidator` [IJsonWebTokenValidator](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.IJsonWebTokenValidator 'Abblix\.Jwt\.IJsonWebTokenValidator') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SoftwareStatementValidator.SoftwareStatementValidator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SoftwareStatementValidator_,Abblix.Jwt.IJsonWebTokenValidator,Microsoft.Extensions.Options.IOptionsMonitor_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,Abblix.Oidc.Server.Features.SecureHttpFetch.ISecureHttpFetcher).jwtValidator} Validates the software statement JWT signature and claims\. ###### `options` [Microsoft\.Extensions\.Options\.IOptionsMonitor<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptionsmonitor-1 'Microsoft\.Extensions\.Options\.IOptionsMonitor\`1')[OidcOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptionsmonitor-1 'Microsoft\.Extensions\.Options\.IOptionsMonitor\`1') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SoftwareStatementValidator.SoftwareStatementValidator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SoftwareStatementValidator_,Abblix.Jwt.IJsonWebTokenValidator,Microsoft.Extensions.Options.IOptionsMonitor_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,Abblix.Oidc.Server.Features.SecureHttpFetch.ISecureHttpFetcher).options} OIDC options containing software statement configuration\. ###### `secureFetcher` [ISecureHttpFetcher](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.SecureHttpFetch.ISecureHttpFetcher 'Abblix\.Oidc\.Server\.Features\.SecureHttpFetch\.ISecureHttpFetcher') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SoftwareStatementValidator.SoftwareStatementValidator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SoftwareStatementValidator_,Abblix.Jwt.IJsonWebTokenValidator,Microsoft.Extensions.Options.IOptionsMonitor_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,Abblix.Oidc.Server.Features.SecureHttpFetch.ISecureHttpFetcher).secureFetcher} HTTP fetcher with SSRF protection for retrieving trusted issuer JWKS\. ### Methods ## SoftwareStatementValidator\.ValidateAsync\(ClientRegistrationValidationContext\) Method {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SoftwareStatementValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientRegistrationValidationContext)} Validates the slice of registration metadata this implementation owns\. May mutate [ClientRegistrationValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientRegistrationValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.ClientRegistrationValidationContext') with derived values \(for example the resolved sector identifier\)\. ```csharp public System.Threading.Tasks.Task ValidateAsync(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientRegistrationValidationContext context); ``` #### Parameters ###### `context` [ClientRegistrationValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientRegistrationValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.ClientRegistrationValidationContext') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SoftwareStatementValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientRegistrationValidationContext).context} The shared validation context for the current request\. Implements [ValidateAsync\(ClientRegistrationValidationContext\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.IClientRegistrationContextValidator#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.IClientRegistrationContextValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientRegistrationValidationContext) 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.IClientRegistrationContextValidator\.ValidateAsync\(Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.ClientRegistrationValidationContext\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') An [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') describing the rejection, or `null` when valid\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.StoredUriValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation') ## StoredUriValidator Class Refuses a registration carrying a relative URI in any member, so no address is stored on a client without something having read it\. ```csharp public class StoredUriValidator : Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SyncClientRegistrationContextValidator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [SyncClientRegistrationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SyncClientRegistrationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.SyncClientRegistrationContextValidator') → StoredUriValidator ### Remarks Every URI member is named here, including the ones another validator also looks at\. Those others are each GATED on something that is not the address \- a pairwise subject type, a TLS authentication method, a backchannel delivery mode, a grant type that redirects \- so a registration naming none of those walks past them with the member stored\. What is asked here is asked unconditionally\. What makes this a defect rather than tidiness is `frontchannel_logout_uri`. A relative value reaches `FrontChannelLogoutService`, which builds the logout page's frame-source policy with [System\.Uri\.GetLeftPart\(System\.UriPartial\)](https://learn.microsoft.com/en-us/dotnet/api/system.uri.getleftpart#system-uri-getleftpart(system-uripartial) 'System\.Uri\.GetLeftPart\(System\.UriPartial\)') - and that raises on a relative URI, unconditionally, at logout rather than at registration. ABSOLUTENESS only. The scheme requirements in this pipeline are conditional - a native client's redirect URI carries its own, a fetched address answers to the deployment's policy - and the validators that own those conditions already state them. What is unconditional is that a stored address must name somewhere. The list is written out rather than reflected over, because a reader of this file should be able to see what is checked. What keeps it from falling behind - which it did twice while it was shorter - is `UriMemberCoverageTests`, which finds every URI member on the model by its TYPE and requires this validator to refuse a relative value in each. A member added without a line here fails that row. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SubjectTypeValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation') ## SubjectTypeValidator Class Validates the OIDC Core Section 8 `subject_type` metadata and computes the pairwise sector identifier\. When `pairwise` is requested, a supplied `sector_identifier_uri` \(HTTPS\) is dereferenced and every URI the registration is required to have listed there is checked against its contents; otherwise the host is taken from the registered redirect URIs, which must agree on one \(OIDC Core Section 8\.1\)\. A backchannel client that registered NO redirect URI takes its host instead from the URI CIBA Core 1\.0 Section 4 puts in their place \- the `jwks_uri` in poll and ping, the `backchannel_client_notification_endpoint` in push\. Registering both is allowed and they need not agree: the redirect URIs decide, and the backchannel URI is only ever the sector of a client that has none\. The resolved host is stored on the context for later persistence\. ```csharp public class SubjectTypeValidator : Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.IClientRegistrationContextValidator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → SubjectTypeValidator Implements [IClientRegistrationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.IClientRegistrationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.IClientRegistrationContextValidator') ### Constructors ## SubjectTypeValidator\(ILogger\, ISecureHttpFetcher\) Constructor {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SubjectTypeValidator.SubjectTypeValidator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SubjectTypeValidator_,Abblix.Oidc.Server.Features.SecureHttpFetch.ISecureHttpFetcher)} Validates the OIDC Core Section 8 `subject_type` metadata and computes the pairwise sector identifier\. When `pairwise` is requested, a supplied `sector_identifier_uri` \(HTTPS\) is dereferenced and every URI the registration is required to have listed there is checked against its contents; otherwise the host is taken from the registered redirect URIs, which must agree on one \(OIDC Core Section 8\.1\)\. A backchannel client that registered NO redirect URI takes its host instead from the URI CIBA Core 1\.0 Section 4 puts in their place \- the `jwks_uri` in poll and ping, the `backchannel_client_notification_endpoint` in push\. Registering both is allowed and they need not agree: the redirect URIs decide, and the backchannel URI is only ever the sector of a client that has none\. The resolved host is stored on the context for later persistence\. ```csharp public SubjectTypeValidator(Microsoft.Extensions.Logging.ILogger logger, Abblix.Oidc.Server.Features.SecureHttpFetch.ISecureHttpFetcher secureHttpFetcher); ``` #### Parameters ###### `logger` [Microsoft\.Extensions\.Logging\.ILogger<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1')[SubjectTypeValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SubjectTypeValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.SubjectTypeValidator')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SubjectTypeValidator.SubjectTypeValidator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SubjectTypeValidator_,Abblix.Oidc.Server.Features.SecureHttpFetch.ISecureHttpFetcher).logger} Logger used for warnings about sector\-identifier mismatches\. ###### `secureHttpFetcher` [ISecureHttpFetcher](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.SecureHttpFetch.ISecureHttpFetcher 'Abblix\.Oidc\.Server\.Features\.SecureHttpFetch\.ISecureHttpFetcher') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SubjectTypeValidator.SubjectTypeValidator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SubjectTypeValidator_,Abblix.Oidc.Server.Features.SecureHttpFetch.ISecureHttpFetcher).secureHttpFetcher} SSRF\-protected fetcher for the sector identifier document\. ### Methods ## SubjectTypeValidator\.ValidateAsync\(ClientRegistrationValidationContext\) Method {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SubjectTypeValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientRegistrationValidationContext)} Validates the slice of registration metadata this implementation owns\. May mutate [ClientRegistrationValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientRegistrationValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.ClientRegistrationValidationContext') with derived values \(for example the resolved sector identifier\)\. ```csharp public System.Threading.Tasks.Task ValidateAsync(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientRegistrationValidationContext context); ``` #### Parameters ###### `context` [ClientRegistrationValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientRegistrationValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.ClientRegistrationValidationContext') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SubjectTypeValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientRegistrationValidationContext).context} The shared validation context for the current request\. Implements [ValidateAsync\(ClientRegistrationValidationContext\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.IClientRegistrationContextValidator#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.IClientRegistrationContextValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientRegistrationValidationContext) 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.IClientRegistrationContextValidator\.ValidateAsync\(Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.ClientRegistrationValidationContext\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') An [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') describing the rejection, or `null` when valid\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SupportedGrantTypeValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation') ## SupportedGrantTypeValidator Class Rejects client registration when any value in `grant_types` is not advertised as supported by this server, returning `invalid_client_metadata` per OIDC DCR §3\.2\. Without this gate the registration would succeed and the client would only fail later at the token endpoint with `unsupported_grant_type`, or at the authorization endpoint for the `implicit` grant\. Companion to [SupportedResponseTypeValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SupportedResponseTypeValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.SupportedResponseTypeValidator'), which applies the same rule to `response_types`\. ```csharp public class SupportedGrantTypeValidator : Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SyncClientRegistrationContextValidator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [SyncClientRegistrationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SyncClientRegistrationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.SyncClientRegistrationContextValidator') → SupportedGrantTypeValidator ### Constructors ## SupportedGrantTypeValidator\(IEnumerable\\) Constructor {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SupportedGrantTypeValidator.SupportedGrantTypeValidator(System.Collections.Generic.IEnumerable_Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer_)} Rejects client registration when any value in `grant_types` is not advertised as supported by this server, returning `invalid_client_metadata` per OIDC DCR §3\.2\. Without this gate the registration would succeed and the client would only fail later at the token endpoint with `unsupported_grant_type`, or at the authorization endpoint for the `implicit` grant\. Companion to [SupportedResponseTypeValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SupportedResponseTypeValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.SupportedResponseTypeValidator'), which applies the same rule to `response_types`\. ```csharp public SupportedGrantTypeValidator(System.Collections.Generic.IEnumerable grantTypeInformers); ``` #### Parameters ###### `grantTypeInformers` [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[IGrantTypeInformer](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IGrantTypeInformer')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SupportedGrantTypeValidator.SupportedGrantTypeValidator(System.Collections.Generic.IEnumerable_Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer_).grantTypeInformers} All registered [IGrantTypeInformer](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IGrantTypeInformer') contributors\. Their union is the same `grant_types_supported` set the discovery endpoint advertises, so registration gating, run\-time gating, and discovery share one source of truth\. Notable contributors: the authorization endpoint yields `implicit` only when the host has called `EnableImplicitFlow()`; the composite token\-endpoint grant handler yields every registered token\-endpoint grant such as `authorization_code`, `refresh_token`, `client_credentials`, `jwt-bearer`, and `password` \(only when `EnablePasswordGrant()` has been called\)\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SupportedResponseTypeValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation') ## SupportedResponseTypeValidator Class Server\-level support gate for the `response_types` registration parameter \(OIDC DCR §3\.2\): every part of every requested combination must have a registered [IAuthorizationResponseBuilder](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseBuilder 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.IAuthorizationResponseBuilder')\. Without `EnableImplicitFlow()` the `token` / `id_token` processors are absent \- registration must reject those values with `invalid_client_metadata` at registration time, instead of letting the client succeed at registration and fail with `unsupported_response_type` on its first authorization request\. ```csharp public class SupportedResponseTypeValidator : Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SyncClientRegistrationContextValidator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [SyncClientRegistrationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SyncClientRegistrationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.SyncClientRegistrationContextValidator') → SupportedResponseTypeValidator ### Constructors ## SupportedResponseTypeValidator\(IEnumerable\\) Constructor {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SupportedResponseTypeValidator.SupportedResponseTypeValidator(System.Collections.Generic.IEnumerable_Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseBuilder_)} Server\-level support gate for the `response_types` registration parameter \(OIDC DCR §3\.2\): every part of every requested combination must have a registered [IAuthorizationResponseBuilder](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseBuilder 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.IAuthorizationResponseBuilder')\. Without `EnableImplicitFlow()` the `token` / `id_token` processors are absent \- registration must reject those values with `invalid_client_metadata` at registration time, instead of letting the client succeed at registration and fail with `unsupported_response_type` on its first authorization request\. ```csharp public SupportedResponseTypeValidator(System.Collections.Generic.IEnumerable processors); ``` #### Parameters ###### `processors` [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[IAuthorizationResponseBuilder](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseBuilder 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.IAuthorizationResponseBuilder')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SupportedResponseTypeValidator.SupportedResponseTypeValidator(System.Collections.Generic.IEnumerable_Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseBuilder_).processors} Registered per\-response\-type processors\. Same source of truth used by `FlowTypeValidator` at the authorization endpoint, so registration and run\-time gating cannot drift\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SyncClientRegistrationContextValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation') ## SyncClientRegistrationContextValidator Class Convenience base for validation steps whose checks are purely in\-memory: implements the async contract by wrapping the synchronous [Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.SyncClientRegistrationContextValidator\.Validate\(Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.ClientRegistrationValidationContext\)](https://learn.microsoft.com/en-us/dotnet/api/abblix.oidc.server.endpoints.dynamicclientmanagement.validation.syncclientregistrationcontextvalidator.validate#abblix-oidc-server-endpoints-dynamicclientmanagement-validation-syncclientregistrationcontextvalidator-validate(abblix-oidc-server-endpoints-dynamicclientmanagement-validation-clientregistrationvalidationcontext) 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.SyncClientRegistrationContextValidator\.Validate\(Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.ClientRegistrationValidationContext\)') result in a completed task\. ```csharp public abstract class SyncClientRegistrationContextValidator : Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.IClientRegistrationContextValidator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → SyncClientRegistrationContextValidator Derived ↳ [AuthorizationDetailsTypesValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.AuthorizationDetailsTypesValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.AuthorizationDetailsTypesValidator') ↳ [BackChannelLogoutUriValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.BackChannelLogoutUriValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.BackChannelLogoutUriValidator') ↳ [CredentialsValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.CredentialsValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.CredentialsValidator') ↳ [EncryptedResponseAlgorithmsValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.EncryptedResponseAlgorithmsValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.EncryptedResponseAlgorithmsValidator') ↳ [GrantTypeValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.GrantTypeValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.GrantTypeValidator') ↳ [InitiateLoginUriValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.InitiateLoginUriValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.InitiateLoginUriValidator') ↳ [JwksUriValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.JwksUriValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.JwksUriValidator') ↳ [PostLogoutRedirectUrisValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.PostLogoutRedirectUrisValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.PostLogoutRedirectUrisValidator') ↳ [ScopeValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ScopeValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.ScopeValidator') ↳ [SecurityProfileValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SecurityProfileValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.SecurityProfileValidator') ↳ [SignedResponseAlgorithmsValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SignedResponseAlgorithmsValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.SignedResponseAlgorithmsValidator') ↳ [SigningAlgorithmsValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SigningAlgorithmsValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.SigningAlgorithmsValidator') ↳ [StoredUriValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.StoredUriValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.StoredUriValidator') ↳ [SupportedGrantTypeValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SupportedGrantTypeValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.SupportedGrantTypeValidator') ↳ [SupportedResponseTypeValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SupportedResponseTypeValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.SupportedResponseTypeValidator') ↳ [TlsClientAuthValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.TlsClientAuthValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.TlsClientAuthValidator') ↳ [TokenEndpointAuthMethodValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.TokenEndpointAuthMethodValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.TokenEndpointAuthMethodValidator') Implements [IClientRegistrationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.IClientRegistrationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.IClientRegistrationContextValidator') ### Methods ## SyncClientRegistrationContextValidator\.ValidateAsync\(ClientRegistrationValidationContext\) Method {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SyncClientRegistrationContextValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientRegistrationValidationContext)} Validates the slice of registration metadata this implementation owns\. May mutate [ClientRegistrationValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientRegistrationValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.ClientRegistrationValidationContext') with derived values \(for example the resolved sector identifier\)\. ```csharp public System.Threading.Tasks.Task ValidateAsync(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientRegistrationValidationContext context); ``` #### Parameters ###### `context` [ClientRegistrationValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientRegistrationValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.ClientRegistrationValidationContext') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SyncClientRegistrationContextValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientRegistrationValidationContext).context} The shared validation context for the current request\. Implements [ValidateAsync\(ClientRegistrationValidationContext\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.IClientRegistrationContextValidator#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.IClientRegistrationContextValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientRegistrationValidationContext) 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.IClientRegistrationContextValidator\.ValidateAsync\(Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.ClientRegistrationValidationContext\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') An [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') describing the rejection, or `null` when valid\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.TlsClientAuthValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation') ## TlsClientAuthValidator Class Validates tls\_client\_auth metadata fields for RFC 8705 mutual TLS client authentication\. Ensures that required metadata is present and properly formatted when tls\_client\_auth method is selected\. ```csharp public class TlsClientAuthValidator : Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SyncClientRegistrationContextValidator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [SyncClientRegistrationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SyncClientRegistrationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.SyncClientRegistrationContextValidator') → TlsClientAuthValidator --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.TokenEndpointAuthMethodValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation') ## TokenEndpointAuthMethodValidator Class Validates that the requested `token_endpoint_auth_method` \(RFC 7591 §2\) is one this server announces in `token_endpoint_auth_methods_supported` on its discovery document\. ```csharp public class TokenEndpointAuthMethodValidator : Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SyncClientRegistrationContextValidator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [SyncClientRegistrationContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SyncClientRegistrationContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.DynamicClientManagement\.Validation\.SyncClientRegistrationContextValidator') → TokenEndpointAuthMethodValidator ### Constructors ## TokenEndpointAuthMethodValidator\(IClientAuthenticator\) Constructor {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.TokenEndpointAuthMethodValidator.TokenEndpointAuthMethodValidator(Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator)} Validates that the requested `token_endpoint_auth_method` \(RFC 7591 §2\) is one this server announces in `token_endpoint_auth_methods_supported` on its discovery document\. ```csharp public TokenEndpointAuthMethodValidator(Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator clientAuthenticator); ``` #### Parameters ###### `clientAuthenticator` [IClientAuthenticator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator 'Abblix\.Oidc\.Server\.Features\.ClientAuthentication\.IClientAuthenticator') {#Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.TokenEndpointAuthMethodValidator.TokenEndpointAuthMethodValidator(Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator).clientAuthenticator} Source of supported client authentication methods\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ## Abblix\.Oidc\.Server\.Endpoints\.EndSession Namespace | Classes | | | :--- | :--- | | [EndSessionHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.EndSessionHandler 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.EndSessionHandler') | Default [IEndSessionHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.IEndSessionHandler 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.IEndSessionHandler') implementation\. Delegates validation to [IEndSessionRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Interfaces.IEndSessionRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Interfaces\.IEndSessionRequestValidator'), then forwards a successful [ValidEndSessionRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Interfaces.ValidEndSessionRequest 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Interfaces\.ValidEndSessionRequest') to [IEndSessionRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Interfaces.IEndSessionRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Interfaces\.IEndSessionRequestProcessor'); validation failures short\-circuit and are returned as\-is\. | | [EndSessionRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.EndSessionRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.EndSessionRequestProcessor') | Implements the logic for processing end\-session requests\. | | [EndSessionRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.EndSessionRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.EndSessionRequestValidator') | Implements the logic for validating end\-session requests\. | | Interfaces | | | :--- | :--- | | [IEndSessionHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.IEndSessionHandler 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.IEndSessionHandler') | Top\-level entry point for the OpenID Connect RP\-Initiated Logout endpoint\. Validates the incoming request and, on success, performs sign\-out and produces the post\-logout redirect target plus any front\-channel logout URIs to be invoked by the relying party\. | --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.EndSessionHandler.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.EndSession](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession 'Abblix\.Oidc\.Server\.Endpoints\.EndSession') ## EndSessionHandler Class Default [IEndSessionHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.IEndSessionHandler 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.IEndSessionHandler') implementation\. Delegates validation to [IEndSessionRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Interfaces.IEndSessionRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Interfaces\.IEndSessionRequestValidator'), then forwards a successful [ValidEndSessionRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Interfaces.ValidEndSessionRequest 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Interfaces\.ValidEndSessionRequest') to [IEndSessionRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Interfaces.IEndSessionRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Interfaces\.IEndSessionRequestProcessor'); validation failures short\-circuit and are returned as\-is\. ```csharp public class EndSessionHandler : Abblix.Oidc.Server.Endpoints.EndSession.IEndSessionHandler ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → EndSessionHandler Implements [IEndSessionHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.IEndSessionHandler 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.IEndSessionHandler') ### Constructors ## EndSessionHandler\(IEndSessionRequestValidator, IEndSessionRequestProcessor\) Constructor {#Abblix.Oidc.Server.Endpoints.EndSession.EndSessionHandler.EndSessionHandler(Abblix.Oidc.Server.Endpoints.EndSession.Interfaces.IEndSessionRequestValidator,Abblix.Oidc.Server.Endpoints.EndSession.Interfaces.IEndSessionRequestProcessor)} Default [IEndSessionHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.IEndSessionHandler 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.IEndSessionHandler') implementation\. Delegates validation to [IEndSessionRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Interfaces.IEndSessionRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Interfaces\.IEndSessionRequestValidator'), then forwards a successful [ValidEndSessionRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Interfaces.ValidEndSessionRequest 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Interfaces\.ValidEndSessionRequest') to [IEndSessionRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Interfaces.IEndSessionRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Interfaces\.IEndSessionRequestProcessor'); validation failures short\-circuit and are returned as\-is\. ```csharp public EndSessionHandler(Abblix.Oidc.Server.Endpoints.EndSession.Interfaces.IEndSessionRequestValidator validator, Abblix.Oidc.Server.Endpoints.EndSession.Interfaces.IEndSessionRequestProcessor processor); ``` #### Parameters ###### `validator` [IEndSessionRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Interfaces.IEndSessionRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Interfaces\.IEndSessionRequestValidator') {#Abblix.Oidc.Server.Endpoints.EndSession.EndSessionHandler.EndSessionHandler(Abblix.Oidc.Server.Endpoints.EndSession.Interfaces.IEndSessionRequestValidator,Abblix.Oidc.Server.Endpoints.EndSession.Interfaces.IEndSessionRequestProcessor).validator} ###### `processor` [IEndSessionRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Interfaces.IEndSessionRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Interfaces\.IEndSessionRequestProcessor') {#Abblix.Oidc.Server.Endpoints.EndSession.EndSessionHandler.EndSessionHandler(Abblix.Oidc.Server.Endpoints.EndSession.Interfaces.IEndSessionRequestValidator,Abblix.Oidc.Server.Endpoints.EndSession.Interfaces.IEndSessionRequestProcessor).processor} ### Methods ## EndSessionHandler\.HandleAsync\(EndSessionRequest\) Method {#Abblix.Oidc.Server.Endpoints.EndSession.EndSessionHandler.HandleAsync(Abblix.Oidc.Server.Model.EndSessionRequest)} Handles a single RP\-initiated logout request end to end\. ```csharp public System.Threading.Tasks.Task> HandleAsync(Abblix.Oidc.Server.Model.EndSessionRequest endSessionRequest); ``` #### Parameters ###### `endSessionRequest` [EndSessionRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.EndSessionRequest 'Abblix\.Oidc\.Server\.Model\.EndSessionRequest') {#Abblix.Oidc.Server.Endpoints.EndSession.EndSessionHandler.HandleAsync(Abblix.Oidc.Server.Model.EndSessionRequest).endSessionRequest} The parsed wire\-level end\-session request\. Implements [HandleAsync\(EndSessionRequest\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.IEndSessionHandler#Abblix.Oidc.Server.Endpoints.EndSession.IEndSessionHandler.HandleAsync(Abblix.Oidc.Server.Model.EndSessionRequest) 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.IEndSessionHandler\.HandleAsync\(Abblix\.Oidc\.Server\.Model\.EndSessionRequest\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[EndSessionSuccess](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Interfaces.EndSessionSuccess 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Interfaces\.EndSessionSuccess')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') An [EndSessionSuccess](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Interfaces.EndSessionSuccess 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Interfaces\.EndSessionSuccess') on success, or an [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') describing why the request was rejected\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.EndSessionRequestProcessor.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.EndSession](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession 'Abblix\.Oidc\.Server\.Endpoints\.EndSession') ## EndSessionRequestProcessor Class Implements the logic for processing end\-session requests\. ```csharp public class EndSessionRequestProcessor : Abblix.Oidc.Server.Endpoints.EndSession.Interfaces.IEndSessionRequestProcessor ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → EndSessionRequestProcessor Implements [IEndSessionRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Interfaces.IEndSessionRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Interfaces\.IEndSessionRequestProcessor') ### Remarks This class is responsible for handling end\-session requests\. It facilitates user logout, client notifications, and ensures compliance with the relevant OAuth 2\.0 and OpenID Connect standards\. ### Constructors ## EndSessionRequestProcessor\(ILogger\, IAuthSessionService, IIssuerProvider, IClientInfoProvider, ILogoutNotifier, ITokenRevoker, IOptions\\) Constructor {#Abblix.Oidc.Server.Endpoints.EndSession.EndSessionRequestProcessor.EndSessionRequestProcessor(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.EndSession.EndSessionRequestProcessor_,Abblix.Oidc.Server.Features.UserAuthentication.IAuthSessionService,Abblix.Oidc.Server.Features.Issuer.IIssuerProvider,Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider,Abblix.Oidc.Server.Features.LogoutNotification.ILogoutNotifier,Abblix.Oidc.Server.Features.Tokens.Revocation.ITokenRevoker,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_)} Implements the logic for processing end\-session requests\. ```csharp public EndSessionRequestProcessor(Microsoft.Extensions.Logging.ILogger logger, Abblix.Oidc.Server.Features.UserAuthentication.IAuthSessionService authSessionService, Abblix.Oidc.Server.Features.Issuer.IIssuerProvider issuerProvider, Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider clientInfoProvider, Abblix.Oidc.Server.Features.LogoutNotification.ILogoutNotifier logoutNotifier, Abblix.Oidc.Server.Features.Tokens.Revocation.ITokenRevoker tokenRevoker, Microsoft.Extensions.Options.IOptions options); ``` #### Parameters ###### `logger` [Microsoft\.Extensions\.Logging\.ILogger<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1')[EndSessionRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.EndSessionRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.EndSessionRequestProcessor')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1') {#Abblix.Oidc.Server.Endpoints.EndSession.EndSessionRequestProcessor.EndSessionRequestProcessor(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.EndSession.EndSessionRequestProcessor_,Abblix.Oidc.Server.Features.UserAuthentication.IAuthSessionService,Abblix.Oidc.Server.Features.Issuer.IIssuerProvider,Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider,Abblix.Oidc.Server.Features.LogoutNotification.ILogoutNotifier,Abblix.Oidc.Server.Features.Tokens.Revocation.ITokenRevoker,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_).logger} The logger\. ###### `authSessionService` [IAuthSessionService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.UserAuthentication.IAuthSessionService 'Abblix\.Oidc\.Server\.Features\.UserAuthentication\.IAuthSessionService') {#Abblix.Oidc.Server.Endpoints.EndSession.EndSessionRequestProcessor.EndSessionRequestProcessor(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.EndSession.EndSessionRequestProcessor_,Abblix.Oidc.Server.Features.UserAuthentication.IAuthSessionService,Abblix.Oidc.Server.Features.Issuer.IIssuerProvider,Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider,Abblix.Oidc.Server.Features.LogoutNotification.ILogoutNotifier,Abblix.Oidc.Server.Features.Tokens.Revocation.ITokenRevoker,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_).authSessionService} The authentication service\. ###### `issuerProvider` [IIssuerProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Issuer.IIssuerProvider 'Abblix\.Oidc\.Server\.Features\.Issuer\.IIssuerProvider') {#Abblix.Oidc.Server.Endpoints.EndSession.EndSessionRequestProcessor.EndSessionRequestProcessor(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.EndSession.EndSessionRequestProcessor_,Abblix.Oidc.Server.Features.UserAuthentication.IAuthSessionService,Abblix.Oidc.Server.Features.Issuer.IIssuerProvider,Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider,Abblix.Oidc.Server.Features.LogoutNotification.ILogoutNotifier,Abblix.Oidc.Server.Features.Tokens.Revocation.ITokenRevoker,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_).issuerProvider} The issuer provider\. ###### `clientInfoProvider` [IClientInfoProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.IClientInfoProvider') {#Abblix.Oidc.Server.Endpoints.EndSession.EndSessionRequestProcessor.EndSessionRequestProcessor(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.EndSession.EndSessionRequestProcessor_,Abblix.Oidc.Server.Features.UserAuthentication.IAuthSessionService,Abblix.Oidc.Server.Features.Issuer.IIssuerProvider,Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider,Abblix.Oidc.Server.Features.LogoutNotification.ILogoutNotifier,Abblix.Oidc.Server.Features.Tokens.Revocation.ITokenRevoker,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_).clientInfoProvider} The client info provider\. ###### `logoutNotifier` [ILogoutNotifier](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.ILogoutNotifier 'Abblix\.Oidc\.Server\.Features\.LogoutNotification\.ILogoutNotifier') {#Abblix.Oidc.Server.Endpoints.EndSession.EndSessionRequestProcessor.EndSessionRequestProcessor(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.EndSession.EndSessionRequestProcessor_,Abblix.Oidc.Server.Features.UserAuthentication.IAuthSessionService,Abblix.Oidc.Server.Features.Issuer.IIssuerProvider,Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider,Abblix.Oidc.Server.Features.LogoutNotification.ILogoutNotifier,Abblix.Oidc.Server.Features.Tokens.Revocation.ITokenRevoker,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_).logoutNotifier} The logout notifier\. ###### `tokenRevoker` [ITokenRevoker](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.Revocation.ITokenRevoker 'Abblix\.Oidc\.Server\.Features\.Tokens\.Revocation\.ITokenRevoker') {#Abblix.Oidc.Server.Endpoints.EndSession.EndSessionRequestProcessor.EndSessionRequestProcessor(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.EndSession.EndSessionRequestProcessor_,Abblix.Oidc.Server.Features.UserAuthentication.IAuthSessionService,Abblix.Oidc.Server.Features.Issuer.IIssuerProvider,Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider,Abblix.Oidc.Server.Features.LogoutNotification.ILogoutNotifier,Abblix.Oidc.Server.Features.Tokens.Revocation.ITokenRevoker,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_).tokenRevoker} Revokes the tokens of the ended session, when the deployment asks for it\. ###### `options` [Microsoft\.Extensions\.Options\.IOptions<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptions-1 'Microsoft\.Extensions\.Options\.IOptions\`1')[OidcOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptions-1 'Microsoft\.Extensions\.Options\.IOptions\`1') {#Abblix.Oidc.Server.Endpoints.EndSession.EndSessionRequestProcessor.EndSessionRequestProcessor(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.EndSession.EndSessionRequestProcessor_,Abblix.Oidc.Server.Features.UserAuthentication.IAuthSessionService,Abblix.Oidc.Server.Features.Issuer.IIssuerProvider,Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider,Abblix.Oidc.Server.Features.LogoutNotification.ILogoutNotifier,Abblix.Oidc.Server.Features.Tokens.Revocation.ITokenRevoker,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_).options} Supplies whether ending a session revokes its tokens\. ### Remarks This class is responsible for handling end\-session requests\. It facilitates user logout, client notifications, and ensures compliance with the relevant OAuth 2\.0 and OpenID Connect standards\. ### Methods ## EndSessionRequestProcessor\.ProcessAsync\(ValidEndSessionRequest\) Method {#Abblix.Oidc.Server.Endpoints.EndSession.EndSessionRequestProcessor.ProcessAsync(Abblix.Oidc.Server.Endpoints.EndSession.Interfaces.ValidEndSessionRequest)} Processes the end\-session request and returns the corresponding response\. ```csharp public System.Threading.Tasks.Task> ProcessAsync(Abblix.Oidc.Server.Endpoints.EndSession.Interfaces.ValidEndSessionRequest request); ``` #### Parameters ###### `request` [ValidEndSessionRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Interfaces.ValidEndSessionRequest 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Interfaces\.ValidEndSessionRequest') {#Abblix.Oidc.Server.Endpoints.EndSession.EndSessionRequestProcessor.ProcessAsync(Abblix.Oidc.Server.Endpoints.EndSession.Interfaces.ValidEndSessionRequest).request} The valid end\-session request to be processed\. Implements [ProcessAsync\(ValidEndSessionRequest\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Interfaces.IEndSessionRequestProcessor#Abblix.Oidc.Server.Endpoints.EndSession.Interfaces.IEndSessionRequestProcessor.ProcessAsync(Abblix.Oidc.Server.Endpoints.EndSession.Interfaces.ValidEndSessionRequest) 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Interfaces\.IEndSessionRequestProcessor\.ProcessAsync\(Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Interfaces\.ValidEndSessionRequest\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[EndSessionSuccess](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Interfaces.EndSessionSuccess 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Interfaces\.EndSessionSuccess')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task representing the asynchronous operation, which upon completion will yield an [EndSessionSuccess](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Interfaces.EndSessionSuccess 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Interfaces\.EndSessionSuccess') or an [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.EndSessionRequestValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.EndSession](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession 'Abblix\.Oidc\.Server\.Endpoints\.EndSession') ## EndSessionRequestValidator Class Implements the logic for validating end\-session requests\. ```csharp public class EndSessionRequestValidator : Abblix.Oidc.Server.Endpoints.EndSession.Interfaces.IEndSessionRequestValidator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → EndSessionRequestValidator Implements [IEndSessionRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Interfaces.IEndSessionRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Interfaces\.IEndSessionRequestValidator') ### Remarks This class validates end\-session requests to ensure they conform to expected standards and business rules\. It uses the injected [IEndSessionContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Validation.IEndSessionContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Validation\.IEndSessionContextValidator') for performing the actual validation logic\. Depending on the validation outcome, it constructs an appropriate validation result which can indicate either successful validation or a specific error condition\. ### Constructors ## EndSessionRequestValidator\(IEndSessionContextValidator\) Constructor {#Abblix.Oidc.Server.Endpoints.EndSession.EndSessionRequestValidator.EndSessionRequestValidator(Abblix.Oidc.Server.Endpoints.EndSession.Validation.IEndSessionContextValidator)} Implements the logic for validating end\-session requests\. ```csharp public EndSessionRequestValidator(Abblix.Oidc.Server.Endpoints.EndSession.Validation.IEndSessionContextValidator validator); ``` #### Parameters ###### `validator` [IEndSessionContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Validation.IEndSessionContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Validation\.IEndSessionContextValidator') {#Abblix.Oidc.Server.Endpoints.EndSession.EndSessionRequestValidator.EndSessionRequestValidator(Abblix.Oidc.Server.Endpoints.EndSession.Validation.IEndSessionContextValidator).validator} The end\-session context validator responsible for the core validation logic\. ### Remarks This class validates end\-session requests to ensure they conform to expected standards and business rules\. It uses the injected [IEndSessionContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Validation.IEndSessionContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Validation\.IEndSessionContextValidator') for performing the actual validation logic\. Depending on the validation outcome, it constructs an appropriate validation result which can indicate either successful validation or a specific error condition\. ### Methods ## EndSessionRequestValidator\.ValidateAsync\(EndSessionRequest\) Method {#Abblix.Oidc.Server.Endpoints.EndSession.EndSessionRequestValidator.ValidateAsync(Abblix.Oidc.Server.Model.EndSessionRequest)} Runs the configured validation pipeline over the raw end\-session request\. ```csharp public System.Threading.Tasks.Task> ValidateAsync(Abblix.Oidc.Server.Model.EndSessionRequest request); ``` #### Parameters ###### `request` [EndSessionRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.EndSessionRequest 'Abblix\.Oidc\.Server\.Model\.EndSessionRequest') {#Abblix.Oidc.Server.Endpoints.EndSession.EndSessionRequestValidator.ValidateAsync(Abblix.Oidc.Server.Model.EndSessionRequest).request} The wire\-level request to validate\. Implements [ValidateAsync\(EndSessionRequest\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Interfaces.IEndSessionRequestValidator#Abblix.Oidc.Server.Endpoints.EndSession.Interfaces.IEndSessionRequestValidator.ValidateAsync(Abblix.Oidc.Server.Model.EndSessionRequest) 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Interfaces\.IEndSessionRequestValidator\.ValidateAsync\(Abblix\.Oidc\.Server\.Model\.EndSessionRequest\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[ValidEndSessionRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Interfaces.ValidEndSessionRequest 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Interfaces\.ValidEndSessionRequest')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A [ValidEndSessionRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Interfaces.ValidEndSessionRequest 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Interfaces\.ValidEndSessionRequest') on success, or an [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') identifying the first failed step\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.IEndSessionHandler.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.EndSession](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession 'Abblix\.Oidc\.Server\.Endpoints\.EndSession') ## IEndSessionHandler Interface Top\-level entry point for the OpenID Connect RP\-Initiated Logout endpoint\. Validates the incoming request and, on success, performs sign\-out and produces the post\-logout redirect target plus any front\-channel logout URIs to be invoked by the relying party\. ```csharp public interface IEndSessionHandler ``` Derived ↳ [EndSessionHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.EndSessionHandler 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.EndSessionHandler') ### Methods ## IEndSessionHandler\.HandleAsync\(EndSessionRequest\) Method {#Abblix.Oidc.Server.Endpoints.EndSession.IEndSessionHandler.HandleAsync(Abblix.Oidc.Server.Model.EndSessionRequest)} Handles a single RP\-initiated logout request end to end\. ```csharp System.Threading.Tasks.Task> HandleAsync(Abblix.Oidc.Server.Model.EndSessionRequest endSessionRequest); ``` #### Parameters ###### `endSessionRequest` [EndSessionRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.EndSessionRequest 'Abblix\.Oidc\.Server\.Model\.EndSessionRequest') {#Abblix.Oidc.Server.Endpoints.EndSession.IEndSessionHandler.HandleAsync(Abblix.Oidc.Server.Model.EndSessionRequest).endSessionRequest} The parsed wire\-level end\-session request\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[EndSessionSuccess](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Interfaces.EndSessionSuccess 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Interfaces\.EndSessionSuccess')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') An [EndSessionSuccess](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Interfaces.EndSessionSuccess 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Interfaces\.EndSessionSuccess') on success, or an [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') describing why the request was rejected\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Interfaces.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ## Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Interfaces Namespace | Classes | | | :--- | :--- | | [EndSessionSuccess](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Interfaces.EndSessionSuccess 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Interfaces\.EndSessionSuccess') | Result of a successful RP\-initiated logout \(OpenID Connect RP\-Initiated Logout 1\.0 §3\)\. Carries the post\-logout redirect target \(with `state` already appended when present\) and the set of front\-channel logout URIs the user agent must visit so each affected client can clear its own session\. | | [ValidEndSessionRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Interfaces.ValidEndSessionRequest 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Interfaces\.ValidEndSessionRequest') | Represents a valid end\-session request with the associated client information\. | | Interfaces | | | :--- | :--- | | [IEndSessionRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Interfaces.IEndSessionRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Interfaces\.IEndSessionRequestProcessor') | Performs the side\-effects of RP\-initiated logout once a request has been validated: signs the end user out of the OP session, notifies every client that participated in the session \(back\-channel and/or front\-channel logout\), and assembles the post\-logout redirect target\. | | [IEndSessionRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Interfaces.IEndSessionRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Interfaces\.IEndSessionRequestValidator') | Validates incoming RP\-initiated logout requests against the rules of OpenID Connect RP\-Initiated Logout 1\.0 §2 \(e\.g\. `id_token_hint` integrity, `post_logout_redirect_uri` against the client's registered list, end\-user confirmation when no `id_token_hint` is provided\)\. | --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Interfaces.EndSessionSuccess.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Interfaces') ## EndSessionSuccess Class Result of a successful RP\-initiated logout \(OpenID Connect RP\-Initiated Logout 1\.0 §3\)\. Carries the post\-logout redirect target \(with `state` already appended when present\) and the set of front\-channel logout URIs the user agent must visit so each affected client can clear its own session\. ```csharp public record EndSessionSuccess : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → EndSessionSuccess Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[EndSessionSuccess](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Interfaces.EndSessionSuccess 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Interfaces\.EndSessionSuccess')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Constructors ## EndSessionSuccess\(Uri, IList\\) Constructor {#Abblix.Oidc.Server.Endpoints.EndSession.Interfaces.EndSessionSuccess.EndSessionSuccess(System.Uri,System.Collections.Generic.IList_System.Uri_)} Result of a successful RP\-initiated logout \(OpenID Connect RP\-Initiated Logout 1\.0 §3\)\. Carries the post\-logout redirect target \(with `state` already appended when present\) and the set of front\-channel logout URIs the user agent must visit so each affected client can clear its own session\. ```csharp public EndSessionSuccess(System.Uri? PostLogoutRedirectUri, System.Collections.Generic.IList FrontChannelLogoutRequestUris); ``` #### Parameters ###### `PostLogoutRedirectUri` [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri') {#Abblix.Oidc.Server.Endpoints.EndSession.Interfaces.EndSessionSuccess.EndSessionSuccess(System.Uri,System.Collections.Generic.IList_System.Uri_).PostLogoutRedirectUri} ###### `FrontChannelLogoutRequestUris` [System\.Collections\.Generic\.IList<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ilist-1 'System\.Collections\.Generic\.IList\`1')[System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ilist-1 'System\.Collections\.Generic\.IList\`1') {#Abblix.Oidc.Server.Endpoints.EndSession.Interfaces.EndSessionSuccess.EndSessionSuccess(System.Uri,System.Collections.Generic.IList_System.Uri_).FrontChannelLogoutRequestUris} ### Properties ## EndSessionSuccess\.FrontChannelLogoutRequestUris Property {#Abblix.Oidc.Server.Endpoints.EndSession.Interfaces.EndSessionSuccess.FrontChannelLogoutRequestUris} Front\-channel logout URIs \(OpenID Connect Front\-Channel Logout 1\.0\) collected from every client that participated in the ended session, to be loaded in the user agent so each RP can clear local state\. ```csharp public System.Collections.Generic.IList FrontChannelLogoutRequestUris { get; init; } ``` #### Property Value [System\.Collections\.Generic\.IList<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ilist-1 'System\.Collections\.Generic\.IList\`1')[System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ilist-1 'System\.Collections\.Generic\.IList\`1') ## EndSessionSuccess\.PostLogoutRedirectUri Property {#Abblix.Oidc.Server.Endpoints.EndSession.Interfaces.EndSessionSuccess.PostLogoutRedirectUri} Validated `post_logout_redirect_uri` with `state` appended when supplied, or `null` when the client did not request one \(the OP then renders its own "logged out" page\)\. ```csharp public System.Uri? PostLogoutRedirectUri { get; init; } ``` #### Property Value [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Interfaces.IEndSessionRequestProcessor.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Interfaces') ## IEndSessionRequestProcessor Interface Performs the side\-effects of RP\-initiated logout once a request has been validated: signs the end user out of the OP session, notifies every client that participated in the session \(back\-channel and/or front\-channel logout\), and assembles the post\-logout redirect target\. ```csharp public interface IEndSessionRequestProcessor ``` Derived ↳ [EndSessionRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.EndSessionRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.EndSessionRequestProcessor') ### Methods ## IEndSessionRequestProcessor\.ProcessAsync\(ValidEndSessionRequest\) Method {#Abblix.Oidc.Server.Endpoints.EndSession.Interfaces.IEndSessionRequestProcessor.ProcessAsync(Abblix.Oidc.Server.Endpoints.EndSession.Interfaces.ValidEndSessionRequest)} Executes logout for an already\-validated request\. ```csharp System.Threading.Tasks.Task> ProcessAsync(Abblix.Oidc.Server.Endpoints.EndSession.Interfaces.ValidEndSessionRequest request); ``` #### Parameters ###### `request` [ValidEndSessionRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Interfaces.ValidEndSessionRequest 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Interfaces\.ValidEndSessionRequest') {#Abblix.Oidc.Server.Endpoints.EndSession.Interfaces.IEndSessionRequestProcessor.ProcessAsync(Abblix.Oidc.Server.Endpoints.EndSession.Interfaces.ValidEndSessionRequest).request} A request that passed all validation steps\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[EndSessionSuccess](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Interfaces.EndSessionSuccess 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Interfaces\.EndSessionSuccess')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') An [EndSessionSuccess](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Interfaces.EndSessionSuccess 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Interfaces\.EndSessionSuccess') describing the post\-logout redirect and any front\-channel URIs to invoke; an [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') if processing cannot complete\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Interfaces.IEndSessionRequestValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Interfaces') ## IEndSessionRequestValidator Interface Validates incoming RP\-initiated logout requests against the rules of OpenID Connect RP\-Initiated Logout 1\.0 §2 \(e\.g\. `id_token_hint` integrity, `post_logout_redirect_uri` against the client's registered list, end\-user confirmation when no `id_token_hint` is provided\)\. ```csharp public interface IEndSessionRequestValidator ``` Derived ↳ [EndSessionRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.EndSessionRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.EndSessionRequestValidator') ### Methods ## IEndSessionRequestValidator\.ValidateAsync\(EndSessionRequest\) Method {#Abblix.Oidc.Server.Endpoints.EndSession.Interfaces.IEndSessionRequestValidator.ValidateAsync(Abblix.Oidc.Server.Model.EndSessionRequest)} Runs the configured validation pipeline over the raw end\-session request\. ```csharp System.Threading.Tasks.Task> ValidateAsync(Abblix.Oidc.Server.Model.EndSessionRequest request); ``` #### Parameters ###### `request` [EndSessionRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.EndSessionRequest 'Abblix\.Oidc\.Server\.Model\.EndSessionRequest') {#Abblix.Oidc.Server.Endpoints.EndSession.Interfaces.IEndSessionRequestValidator.ValidateAsync(Abblix.Oidc.Server.Model.EndSessionRequest).request} The wire\-level request to validate\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[ValidEndSessionRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Interfaces.ValidEndSessionRequest 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Interfaces\.ValidEndSessionRequest')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A [ValidEndSessionRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Interfaces.ValidEndSessionRequest 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Interfaces\.ValidEndSessionRequest') on success, or an [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') identifying the first failed step\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Interfaces.ValidEndSessionRequest.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Interfaces') ## ValidEndSessionRequest Class Represents a valid end\-session request with the associated client information\. ```csharp public record ValidEndSessionRequest : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ValidEndSessionRequest Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[ValidEndSessionRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Interfaces.ValidEndSessionRequest 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Interfaces\.ValidEndSessionRequest')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Constructors ## ValidEndSessionRequest\(EndSessionRequest, ClientInfo\) Constructor {#Abblix.Oidc.Server.Endpoints.EndSession.Interfaces.ValidEndSessionRequest.ValidEndSessionRequest(Abblix.Oidc.Server.Model.EndSessionRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo)} Represents a valid end\-session request with the associated client information\. ```csharp public ValidEndSessionRequest(Abblix.Oidc.Server.Model.EndSessionRequest Model, Abblix.Oidc.Server.Features.ClientInformation.ClientInfo? ClientInfo); ``` #### Parameters ###### `Model` [EndSessionRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.EndSessionRequest 'Abblix\.Oidc\.Server\.Model\.EndSessionRequest') {#Abblix.Oidc.Server.Endpoints.EndSession.Interfaces.ValidEndSessionRequest.ValidEndSessionRequest(Abblix.Oidc.Server.Model.EndSessionRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo).Model} ###### `ClientInfo` [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') {#Abblix.Oidc.Server.Endpoints.EndSession.Interfaces.ValidEndSessionRequest.ValidEndSessionRequest(Abblix.Oidc.Server.Model.EndSessionRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo).ClientInfo} ### Properties ## ValidEndSessionRequest\.ClientInfo Property {#Abblix.Oidc.Server.Endpoints.EndSession.Interfaces.ValidEndSessionRequest.ClientInfo} The client information associated with the request\. ```csharp public Abblix.Oidc.Server.Features.ClientInformation.ClientInfo? ClientInfo { get; init; } ``` #### Property Value [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') ## ValidEndSessionRequest\.Model Property {#Abblix.Oidc.Server.Endpoints.EndSession.Interfaces.ValidEndSessionRequest.Model} The end\-session request model\. ```csharp public Abblix.Oidc.Server.Model.EndSessionRequest Model { get; init; } ``` #### Property Value [EndSessionRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.EndSessionRequest 'Abblix\.Oidc\.Server\.Model\.EndSessionRequest') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Validation.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ## Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Validation Namespace | Classes | | | :--- | :--- | | [ClientValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Validation.ClientValidator 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Validation\.ClientValidator') | Resolves the client referenced by the request \(either via `client_id` directly or via `id_token_hint`'s audience\) into a [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') stored on the context for later steps such as post\-logout redirect URI validation\. A request with no client identifier at all is permitted to pass; an identifier that does not resolve yields [UnauthorizedClient](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ErrorCodes#Abblix.Oidc.Server.Common.Constants.ErrorCodes.UnauthorizedClient 'Abblix\.Oidc\.Server\.Common\.Constants\.ErrorCodes\.UnauthorizedClient')\. | | [ConfirmationValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Validation.ConfirmationValidator 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Validation\.ConfirmationValidator') | Enforces the end\-user confirmation step described in OpenID Connect RP\-Initiated Logout 1\.0 §2: when the request omits `id_token_hint` the OP cannot trust that the user really initiated the logout, so a UI confirmation must precede the call\. This validator surfaces [ConfirmationRequired](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ErrorCodes#Abblix.Oidc.Server.Common.Constants.ErrorCodes.ConfirmationRequired 'Abblix\.Oidc\.Server\.Common\.Constants\.ErrorCodes\.ConfirmationRequired') until the host echoes back `confirmed=true`\. | | [EndSessionContextValidatorComposite](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Validation.EndSessionContextValidatorComposite 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Validation\.EndSessionContextValidatorComposite') | Represents a composite validator for end\-session requests\. | | [EndSessionValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Validation.EndSessionValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Validation\.EndSessionValidationContext') | Represents the context for validating an end\-session request\. | | [IdTokenHintValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Validation.IdTokenHintValidator 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Validation\.IdTokenHintValidator') | Validates the `id_token_hint` parameter \(OpenID Connect RP\-Initiated Logout 1\.0 §2\): verifies signature/issuer/audience but deliberately accepts expired tokens \(since the hint's role is to identify a no\-longer\-active session\), then either populates `ClientId` from the token's audience when the request omitted it, or asserts that an explicitly supplied `client_id` matches that audience\. | | [PostLogoutRedirectUrisValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Validation.PostLogoutRedirectUrisValidator 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Validation\.PostLogoutRedirectUrisValidator') | Verifies that the request's `post_logout_redirect_uri` is one of the URIs the resolved client previously registered \(OpenID Connect RP\-Initiated Logout 1\.0 §2\)\. A request without `post_logout_redirect_uri` is allowed; if one is present but the client cannot be resolved from `client_id` or `id_token_hint`, the redirect URI cannot be safely validated and the request is rejected\. | | Interfaces | | | :--- | :--- | | [IEndSessionContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Validation.IEndSessionContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Validation\.IEndSessionContextValidator') | One step in the end\-session validation pipeline\. Each implementation inspects \(and may enrich\) a shared [EndSessionValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Validation.EndSessionValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Validation\.EndSessionValidationContext'); returning a non\-null [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') aborts the pipeline\. Implementations are composed via [EndSessionContextValidatorComposite](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Validation.EndSessionContextValidatorComposite 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Validation\.EndSessionContextValidatorComposite')\. | --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Validation.ClientValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Validation 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Validation') ## ClientValidator Class Resolves the client referenced by the request \(either via `client_id` directly or via `id_token_hint`'s audience\) into a [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') stored on the context for later steps such as post\-logout redirect URI validation\. A request with no client identifier at all is permitted to pass; an identifier that does not resolve yields [UnauthorizedClient](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ErrorCodes#Abblix.Oidc.Server.Common.Constants.ErrorCodes.UnauthorizedClient 'Abblix\.Oidc\.Server\.Common\.Constants\.ErrorCodes\.UnauthorizedClient')\. ```csharp public class ClientValidator : Abblix.Oidc.Server.Endpoints.EndSession.Validation.IEndSessionContextValidator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ClientValidator Implements [IEndSessionContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Validation.IEndSessionContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Validation\.IEndSessionContextValidator') ### Constructors ## ClientValidator\(ILogger\, IClientInfoProvider\) Constructor {#Abblix.Oidc.Server.Endpoints.EndSession.Validation.ClientValidator.ClientValidator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.EndSession.Validation.ClientValidator_,Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider)} Resolves the client referenced by the request \(either via `client_id` directly or via `id_token_hint`'s audience\) into a [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') stored on the context for later steps such as post\-logout redirect URI validation\. A request with no client identifier at all is permitted to pass; an identifier that does not resolve yields [UnauthorizedClient](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ErrorCodes#Abblix.Oidc.Server.Common.Constants.ErrorCodes.UnauthorizedClient 'Abblix\.Oidc\.Server\.Common\.Constants\.ErrorCodes\.UnauthorizedClient')\. ```csharp public ClientValidator(Microsoft.Extensions.Logging.ILogger logger, Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider clientInfoProvider); ``` #### Parameters ###### `logger` [Microsoft\.Extensions\.Logging\.ILogger<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1')[ClientValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Validation.ClientValidator 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Validation\.ClientValidator')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1') {#Abblix.Oidc.Server.Endpoints.EndSession.Validation.ClientValidator.ClientValidator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.EndSession.Validation.ClientValidator_,Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider).logger} ###### `clientInfoProvider` [IClientInfoProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.IClientInfoProvider') {#Abblix.Oidc.Server.Endpoints.EndSession.Validation.ClientValidator.ClientValidator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.EndSession.Validation.ClientValidator_,Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider).clientInfoProvider} ### Methods ## ClientValidator\.ValidateAsync\(EndSessionValidationContext\) Method {#Abblix.Oidc.Server.Endpoints.EndSession.Validation.ClientValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.EndSession.Validation.EndSessionValidationContext)} Performs this validator's check against the shared context\. ```csharp public System.Threading.Tasks.Task ValidateAsync(Abblix.Oidc.Server.Endpoints.EndSession.Validation.EndSessionValidationContext context); ``` #### Parameters ###### `context` [EndSessionValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Validation.EndSessionValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Validation\.EndSessionValidationContext') {#Abblix.Oidc.Server.Endpoints.EndSession.Validation.ClientValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.EndSession.Validation.EndSessionValidationContext).context} Mutable validation context shared with subsequent steps; this validator may populate fields \(such as resolved `ClientInfo` or parsed `id_token_hint`\)\. Implements [ValidateAsync\(EndSessionValidationContext\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Validation.IEndSessionContextValidator#Abblix.Oidc.Server.Endpoints.EndSession.Validation.IEndSessionContextValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.EndSession.Validation.EndSessionValidationContext) 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Validation\.IEndSessionContextValidator\.ValidateAsync\(Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Validation\.EndSessionValidationContext\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') `null` if the request passes this step, otherwise the error to surface\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Validation.ConfirmationValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Validation 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Validation') ## ConfirmationValidator Class Enforces the end\-user confirmation step described in OpenID Connect RP\-Initiated Logout 1\.0 §2: when the request omits `id_token_hint` the OP cannot trust that the user really initiated the logout, so a UI confirmation must precede the call\. This validator surfaces [ConfirmationRequired](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ErrorCodes#Abblix.Oidc.Server.Common.Constants.ErrorCodes.ConfirmationRequired 'Abblix\.Oidc\.Server\.Common\.Constants\.ErrorCodes\.ConfirmationRequired') until the host echoes back `confirmed=true`\. ```csharp public class ConfirmationValidator : Abblix.Oidc.Server.Endpoints.EndSession.Validation.IEndSessionContextValidator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ConfirmationValidator Implements [IEndSessionContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Validation.IEndSessionContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Validation\.IEndSessionContextValidator') ### Methods ## ConfirmationValidator\.ValidateAsync\(EndSessionValidationContext\) Method {#Abblix.Oidc.Server.Endpoints.EndSession.Validation.ConfirmationValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.EndSession.Validation.EndSessionValidationContext)} Performs this validator's check against the shared context\. ```csharp public System.Threading.Tasks.Task ValidateAsync(Abblix.Oidc.Server.Endpoints.EndSession.Validation.EndSessionValidationContext context); ``` #### Parameters ###### `context` [EndSessionValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Validation.EndSessionValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Validation\.EndSessionValidationContext') {#Abblix.Oidc.Server.Endpoints.EndSession.Validation.ConfirmationValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.EndSession.Validation.EndSessionValidationContext).context} Mutable validation context shared with subsequent steps; this validator may populate fields \(such as resolved `ClientInfo` or parsed `id_token_hint`\)\. Implements [ValidateAsync\(EndSessionValidationContext\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Validation.IEndSessionContextValidator#Abblix.Oidc.Server.Endpoints.EndSession.Validation.IEndSessionContextValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.EndSession.Validation.EndSessionValidationContext) 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Validation\.IEndSessionContextValidator\.ValidateAsync\(Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Validation\.EndSessionValidationContext\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') `null` if the request passes this step, otherwise the error to surface\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Validation.EndSessionContextValidatorComposite.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Validation 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Validation') ## EndSessionContextValidatorComposite Class Represents a composite validator for end\-session requests\. ```csharp public class EndSessionContextValidatorComposite : Abblix.Oidc.Server.Endpoints.EndSession.Validation.IEndSessionContextValidator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → EndSessionContextValidatorComposite Implements [IEndSessionContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Validation.IEndSessionContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Validation\.IEndSessionContextValidator') ### Constructors ## EndSessionContextValidatorComposite\(IEndSessionContextValidator\[\]\) Constructor {#Abblix.Oidc.Server.Endpoints.EndSession.Validation.EndSessionContextValidatorComposite.EndSessionContextValidatorComposite(Abblix.Oidc.Server.Endpoints.EndSession.Validation.IEndSessionContextValidator[])} Represents a composite validator for end\-session requests\. ```csharp public EndSessionContextValidatorComposite(Abblix.Oidc.Server.Endpoints.EndSession.Validation.IEndSessionContextValidator[] validationSteps); ``` #### Parameters ###### `validationSteps` [IEndSessionContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Validation.IEndSessionContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Validation\.IEndSessionContextValidator')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Oidc.Server.Endpoints.EndSession.Validation.EndSessionContextValidatorComposite.EndSessionContextValidatorComposite(Abblix.Oidc.Server.Endpoints.EndSession.Validation.IEndSessionContextValidator[]).validationSteps} The array of end\-session context validators to execute\. ### Methods ## EndSessionContextValidatorComposite\.ValidateAsync\(EndSessionValidationContext\) Method {#Abblix.Oidc.Server.Endpoints.EndSession.Validation.EndSessionContextValidatorComposite.ValidateAsync(Abblix.Oidc.Server.Endpoints.EndSession.Validation.EndSessionValidationContext)} Validates the end\-session request using a composite of multiple validators\. ```csharp public System.Threading.Tasks.Task ValidateAsync(Abblix.Oidc.Server.Endpoints.EndSession.Validation.EndSessionValidationContext context); ``` #### Parameters ###### `context` [EndSessionValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Validation.EndSessionValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Validation\.EndSessionValidationContext') {#Abblix.Oidc.Server.Endpoints.EndSession.Validation.EndSessionContextValidatorComposite.ValidateAsync(Abblix.Oidc.Server.Endpoints.EndSession.Validation.EndSessionValidationContext).context} The end\-session validation context\. Implements [ValidateAsync\(EndSessionValidationContext\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Validation.IEndSessionContextValidator#Abblix.Oidc.Server.Endpoints.EndSession.Validation.IEndSessionContextValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.EndSession.Validation.EndSessionValidationContext) 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Validation\.IEndSessionContextValidator\.ValidateAsync\(Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Validation\.EndSessionValidationContext\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task representing the asynchronous operation\. The result is a validation error if any validation step fails; otherwise, null\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Validation.EndSessionValidationContext.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Validation 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Validation') ## EndSessionValidationContext Class Represents the context for validating an end\-session request\. ```csharp public record EndSessionValidationContext : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → EndSessionValidationContext Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[EndSessionValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Validation.EndSessionValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Validation\.EndSessionValidationContext')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Constructors ## EndSessionValidationContext\(EndSessionRequest\) Constructor {#Abblix.Oidc.Server.Endpoints.EndSession.Validation.EndSessionValidationContext.EndSessionValidationContext(Abblix.Oidc.Server.Model.EndSessionRequest)} Represents the context for validating an end\-session request\. ```csharp public EndSessionValidationContext(Abblix.Oidc.Server.Model.EndSessionRequest Request); ``` #### Parameters ###### `Request` [EndSessionRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.EndSessionRequest 'Abblix\.Oidc\.Server\.Model\.EndSessionRequest') {#Abblix.Oidc.Server.Endpoints.EndSession.Validation.EndSessionValidationContext.EndSessionValidationContext(Abblix.Oidc.Server.Model.EndSessionRequest).Request} ### Properties ## EndSessionValidationContext\.ClientId Property {#Abblix.Oidc.Server.Endpoints.EndSession.Validation.EndSessionValidationContext.ClientId} The ClientId associated with the request\. ```csharp public string? ClientId { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## EndSessionValidationContext\.ClientInfo Property {#Abblix.Oidc.Server.Endpoints.EndSession.Validation.EndSessionValidationContext.ClientInfo} The ClientInfo object containing information about the client\. ```csharp public Abblix.Oidc.Server.Features.ClientInformation.ClientInfo? ClientInfo { get; set; } ``` #### Property Value [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') #### Exceptions [System\.InvalidOperationException](https://learn.microsoft.com/en-us/dotnet/api/system.invalidoperationexception 'System\.InvalidOperationException') Thrown when attempting to get a null value\. ## EndSessionValidationContext\.IdToken Property {#Abblix.Oidc.Server.Endpoints.EndSession.Validation.EndSessionValidationContext.IdToken} The ID token associated with the end\-session request\. This token is typically used to validate the identity of the user who initiated the end\-session process\. ```csharp public Abblix.Jwt.JsonWebToken? IdToken { get; set; } ``` #### Property Value [JsonWebToken](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebToken 'Abblix\.Jwt\.JsonWebToken') ## EndSessionValidationContext\.Request Property {#Abblix.Oidc.Server.Endpoints.EndSession.Validation.EndSessionValidationContext.Request} The request object to validate\. ```csharp public Abblix.Oidc.Server.Model.EndSessionRequest Request { get; set; } ``` #### Property Value [EndSessionRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.EndSessionRequest 'Abblix\.Oidc\.Server\.Model\.EndSessionRequest') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Validation.IdTokenHintValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Validation 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Validation') ## IdTokenHintValidator Class Validates the `id_token_hint` parameter \(OpenID Connect RP\-Initiated Logout 1\.0 §2\): verifies signature/issuer/audience but deliberately accepts expired tokens \(since the hint's role is to identify a no\-longer\-active session\), then either populates `ClientId` from the token's audience when the request omitted it, or asserts that an explicitly supplied `client_id` matches that audience\. ```csharp public class IdTokenHintValidator : Abblix.Oidc.Server.Endpoints.EndSession.Validation.IEndSessionContextValidator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → IdTokenHintValidator Implements [IEndSessionContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Validation.IEndSessionContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Validation\.IEndSessionContextValidator') ### Constructors ## IdTokenHintValidator\(IIdTokenHintParser, IClientInfoProvider\) Constructor {#Abblix.Oidc.Server.Endpoints.EndSession.Validation.IdTokenHintValidator.IdTokenHintValidator(Abblix.Oidc.Server.Features.Tokens.Validation.IIdTokenHintParser,Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider)} Validates the `id_token_hint` parameter \(OpenID Connect RP\-Initiated Logout 1\.0 §2\): verifies signature/issuer/audience but deliberately accepts expired tokens \(since the hint's role is to identify a no\-longer\-active session\), then either populates `ClientId` from the token's audience when the request omitted it, or asserts that an explicitly supplied `client_id` matches that audience\. ```csharp public IdTokenHintValidator(Abblix.Oidc.Server.Features.Tokens.Validation.IIdTokenHintParser hintParser, Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider clientInfoProvider); ``` #### Parameters ###### `hintParser` [IIdTokenHintParser](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.Validation.IIdTokenHintParser 'Abblix\.Oidc\.Server\.Features\.Tokens\.Validation\.IIdTokenHintParser') {#Abblix.Oidc.Server.Endpoints.EndSession.Validation.IdTokenHintValidator.IdTokenHintValidator(Abblix.Oidc.Server.Features.Tokens.Validation.IIdTokenHintParser,Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider).hintParser} ###### `clientInfoProvider` [IClientInfoProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.IClientInfoProvider') {#Abblix.Oidc.Server.Endpoints.EndSession.Validation.IdTokenHintValidator.IdTokenHintValidator(Abblix.Oidc.Server.Features.Tokens.Validation.IIdTokenHintParser,Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider).clientInfoProvider} ### Methods ## IdTokenHintValidator\.ValidateAsync\(EndSessionValidationContext\) Method {#Abblix.Oidc.Server.Endpoints.EndSession.Validation.IdTokenHintValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.EndSession.Validation.EndSessionValidationContext)} Performs this validator's check against the shared context\. ```csharp public System.Threading.Tasks.Task ValidateAsync(Abblix.Oidc.Server.Endpoints.EndSession.Validation.EndSessionValidationContext context); ``` #### Parameters ###### `context` [EndSessionValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Validation.EndSessionValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Validation\.EndSessionValidationContext') {#Abblix.Oidc.Server.Endpoints.EndSession.Validation.IdTokenHintValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.EndSession.Validation.EndSessionValidationContext).context} Mutable validation context shared with subsequent steps; this validator may populate fields \(such as resolved `ClientInfo` or parsed `id_token_hint`\)\. Implements [ValidateAsync\(EndSessionValidationContext\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Validation.IEndSessionContextValidator#Abblix.Oidc.Server.Endpoints.EndSession.Validation.IEndSessionContextValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.EndSession.Validation.EndSessionValidationContext) 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Validation\.IEndSessionContextValidator\.ValidateAsync\(Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Validation\.EndSessionValidationContext\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') `null` if the request passes this step, otherwise the error to surface\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Validation.IEndSessionContextValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Validation 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Validation') ## IEndSessionContextValidator Interface One step in the end\-session validation pipeline\. Each implementation inspects \(and may enrich\) a shared [EndSessionValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Validation.EndSessionValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Validation\.EndSessionValidationContext'); returning a non\-null [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') aborts the pipeline\. Implementations are composed via [EndSessionContextValidatorComposite](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Validation.EndSessionContextValidatorComposite 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Validation\.EndSessionContextValidatorComposite')\. ```csharp public interface IEndSessionContextValidator ``` Derived ↳ [ClientValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Validation.ClientValidator 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Validation\.ClientValidator') ↳ [ConfirmationValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Validation.ConfirmationValidator 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Validation\.ConfirmationValidator') ↳ [EndSessionContextValidatorComposite](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Validation.EndSessionContextValidatorComposite 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Validation\.EndSessionContextValidatorComposite') ↳ [IdTokenHintValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Validation.IdTokenHintValidator 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Validation\.IdTokenHintValidator') ↳ [PostLogoutRedirectUrisValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Validation.PostLogoutRedirectUrisValidator 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Validation\.PostLogoutRedirectUrisValidator') ### Methods ## IEndSessionContextValidator\.ValidateAsync\(EndSessionValidationContext\) Method {#Abblix.Oidc.Server.Endpoints.EndSession.Validation.IEndSessionContextValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.EndSession.Validation.EndSessionValidationContext)} Performs this validator's check against the shared context\. ```csharp System.Threading.Tasks.Task ValidateAsync(Abblix.Oidc.Server.Endpoints.EndSession.Validation.EndSessionValidationContext context); ``` #### Parameters ###### `context` [EndSessionValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Validation.EndSessionValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Validation\.EndSessionValidationContext') {#Abblix.Oidc.Server.Endpoints.EndSession.Validation.IEndSessionContextValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.EndSession.Validation.EndSessionValidationContext).context} Mutable validation context shared with subsequent steps; this validator may populate fields \(such as resolved `ClientInfo` or parsed `id_token_hint`\)\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') `null` if the request passes this step, otherwise the error to surface\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Validation.PostLogoutRedirectUrisValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Validation 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Validation') ## PostLogoutRedirectUrisValidator Class Verifies that the request's `post_logout_redirect_uri` is one of the URIs the resolved client previously registered \(OpenID Connect RP\-Initiated Logout 1\.0 §2\)\. A request without `post_logout_redirect_uri` is allowed; if one is present but the client cannot be resolved from `client_id` or `id_token_hint`, the redirect URI cannot be safely validated and the request is rejected\. ```csharp public class PostLogoutRedirectUrisValidator : Abblix.Oidc.Server.Endpoints.EndSession.Validation.IEndSessionContextValidator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → PostLogoutRedirectUrisValidator Implements [IEndSessionContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Validation.IEndSessionContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Validation\.IEndSessionContextValidator') ### Constructors ## PostLogoutRedirectUrisValidator\(ILogger\\) Constructor {#Abblix.Oidc.Server.Endpoints.EndSession.Validation.PostLogoutRedirectUrisValidator.PostLogoutRedirectUrisValidator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.EndSession.Validation.PostLogoutRedirectUrisValidator_)} Verifies that the request's `post_logout_redirect_uri` is one of the URIs the resolved client previously registered \(OpenID Connect RP\-Initiated Logout 1\.0 §2\)\. A request without `post_logout_redirect_uri` is allowed; if one is present but the client cannot be resolved from `client_id` or `id_token_hint`, the redirect URI cannot be safely validated and the request is rejected\. ```csharp public PostLogoutRedirectUrisValidator(Microsoft.Extensions.Logging.ILogger logger); ``` #### Parameters ###### `logger` [Microsoft\.Extensions\.Logging\.ILogger<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1')[PostLogoutRedirectUrisValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Validation.PostLogoutRedirectUrisValidator 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Validation\.PostLogoutRedirectUrisValidator')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1') {#Abblix.Oidc.Server.Endpoints.EndSession.Validation.PostLogoutRedirectUrisValidator.PostLogoutRedirectUrisValidator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.EndSession.Validation.PostLogoutRedirectUrisValidator_).logger} ### Methods ## PostLogoutRedirectUrisValidator\.ValidateAsync\(EndSessionValidationContext\) Method {#Abblix.Oidc.Server.Endpoints.EndSession.Validation.PostLogoutRedirectUrisValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.EndSession.Validation.EndSessionValidationContext)} Performs this validator's check against the shared context\. ```csharp public System.Threading.Tasks.Task ValidateAsync(Abblix.Oidc.Server.Endpoints.EndSession.Validation.EndSessionValidationContext context); ``` #### Parameters ###### `context` [EndSessionValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Validation.EndSessionValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Validation\.EndSessionValidationContext') {#Abblix.Oidc.Server.Endpoints.EndSession.Validation.PostLogoutRedirectUrisValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.EndSession.Validation.EndSessionValidationContext).context} Mutable validation context shared with subsequent steps; this validator may populate fields \(such as resolved `ClientInfo` or parsed `id_token_hint`\)\. Implements [ValidateAsync\(EndSessionValidationContext\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Validation.IEndSessionContextValidator#Abblix.Oidc.Server.Endpoints.EndSession.Validation.IEndSessionContextValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.EndSession.Validation.EndSessionValidationContext) 'Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Validation\.IEndSessionContextValidator\.ValidateAsync\(Abblix\.Oidc\.Server\.Endpoints\.EndSession\.Validation\.EndSessionValidationContext\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') `null` if the request passes this step, otherwise the error to surface\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ## Abblix\.Oidc\.Server\.Endpoints\.Introspection Namespace | Classes | | | :--- | :--- | | [IntrospectionHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection.IntrospectionHandler 'Abblix\.Oidc\.Server\.Endpoints\.Introspection\.IntrospectionHandler') | Manages the processing of token introspection requests according to OAuth 2\.0 specifications, facilitating the validation and introspection of tokens to determine their current state and metadata\. | | [IntrospectionRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection.IntrospectionRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.Introspection\.IntrospectionRequestProcessor') | Implements the logic for processing introspection requests and generating introspection responses\. | | [IntrospectionRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection.IntrospectionRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.Introspection\.IntrospectionRequestValidator') | Validates the introspection request properties and authenticates a client that initiated the request\. | --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection.IntrospectionHandler.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Introspection](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection 'Abblix\.Oidc\.Server\.Endpoints\.Introspection') ## IntrospectionHandler Class Manages the processing of token introspection requests according to OAuth 2\.0 specifications, facilitating the validation and introspection of tokens to determine their current state and metadata\. ```csharp public class IntrospectionHandler : Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.IIntrospectionHandler ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → IntrospectionHandler Implements [IIntrospectionHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.IIntrospectionHandler 'Abblix\.Oidc\.Server\.Endpoints\.Introspection\.Interfaces\.IIntrospectionHandler') ### Constructors ## IntrospectionHandler\(IIntrospectionRequestValidator, IIntrospectionRequestProcessor\) Constructor {#Abblix.Oidc.Server.Endpoints.Introspection.IntrospectionHandler.IntrospectionHandler(Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.IIntrospectionRequestValidator,Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.IIntrospectionRequestProcessor)} Manages the processing of token introspection requests according to OAuth 2\.0 specifications, facilitating the validation and introspection of tokens to determine their current state and metadata\. ```csharp public IntrospectionHandler(Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.IIntrospectionRequestValidator validator, Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.IIntrospectionRequestProcessor processor); ``` #### Parameters ###### `validator` [IIntrospectionRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.IIntrospectionRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.Introspection\.Interfaces\.IIntrospectionRequestValidator') {#Abblix.Oidc.Server.Endpoints.Introspection.IntrospectionHandler.IntrospectionHandler(Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.IIntrospectionRequestValidator,Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.IIntrospectionRequestProcessor).validator} An implementation of [IIntrospectionRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.IIntrospectionRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.Introspection\.Interfaces\.IIntrospectionRequestValidator') tasked with validating introspection requests against OAuth 2\.0 standards\. ###### `processor` [IIntrospectionRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.IIntrospectionRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.Introspection\.Interfaces\.IIntrospectionRequestProcessor') {#Abblix.Oidc.Server.Endpoints.Introspection.IntrospectionHandler.IntrospectionHandler(Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.IIntrospectionRequestValidator,Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.IIntrospectionRequestProcessor).processor} An implementation of [IIntrospectionRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.IIntrospectionRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.Introspection\.Interfaces\.IIntrospectionRequestProcessor') responsible for processing validated introspection requests and retrieving token information\. ### Methods ## IntrospectionHandler\.HandleAsync\(IntrospectionRequest, ClientRequest\) Method {#Abblix.Oidc.Server.Endpoints.Introspection.IntrospectionHandler.HandleAsync(Abblix.Oidc.Server.Model.IntrospectionRequest,Abblix.Oidc.Server.Model.ClientRequest)} Asynchronously handles an introspection request by validating the request and, if valid, processing it to return the state and metadata of the specified token\. ```csharp public System.Threading.Tasks.Task> HandleAsync(Abblix.Oidc.Server.Model.IntrospectionRequest introspectionRequest, Abblix.Oidc.Server.Model.ClientRequest clientRequest); ``` #### Parameters ###### `introspectionRequest` [IntrospectionRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.IntrospectionRequest 'Abblix\.Oidc\.Server\.Model\.IntrospectionRequest') {#Abblix.Oidc.Server.Endpoints.Introspection.IntrospectionHandler.HandleAsync(Abblix.Oidc.Server.Model.IntrospectionRequest,Abblix.Oidc.Server.Model.ClientRequest).introspectionRequest} The introspection request containing the token to be introspected and other relevant parameters\. ###### `clientRequest` [ClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRequest 'Abblix\.Oidc\.Server\.Model\.ClientRequest') {#Abblix.Oidc.Server.Endpoints.Introspection.IntrospectionHandler.HandleAsync(Abblix.Oidc.Server.Model.IntrospectionRequest,Abblix.Oidc.Server.Model.ClientRequest).clientRequest} Supplementary information about the client making the request, useful for contextual validation\. Implements [HandleAsync\(IntrospectionRequest, ClientRequest\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.IIntrospectionHandler#Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.IIntrospectionHandler.HandleAsync(Abblix.Oidc.Server.Model.IntrospectionRequest,Abblix.Oidc.Server.Model.ClientRequest) 'Abblix\.Oidc\.Server\.Endpoints\.Introspection\.Interfaces\.IIntrospectionHandler\.HandleAsync\(Abblix\.Oidc\.Server\.Model\.IntrospectionRequest, Abblix\.Oidc\.Server\.Model\.ClientRequest\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[IntrospectionSuccess](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.IntrospectionSuccess 'Abblix\.Oidc\.Server\.Endpoints\.Introspection\.Interfaces\.IntrospectionSuccess')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A [System\.Threading\.Tasks\.Task](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task 'System\.Threading\.Tasks\.Task') that resolves to an [IntrospectionSuccess](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.IntrospectionSuccess 'Abblix\.Oidc\.Server\.Endpoints\.Introspection\.Interfaces\.IntrospectionSuccess'), which includes the token's active status and potentially other metadata, or an [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') if the request is invalid\. ### Remarks Implementations of this method are crucial for maintaining the integrity and security of token\-based authentication systems by allowing resource servers and other entities to verify the validity and attributes of tokens\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection.IntrospectionRequestProcessor.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Introspection](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection 'Abblix\.Oidc\.Server\.Endpoints\.Introspection') ## IntrospectionRequestProcessor Class Implements the logic for processing introspection requests and generating introspection responses\. ```csharp public class IntrospectionRequestProcessor : Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.IIntrospectionRequestProcessor ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → IntrospectionRequestProcessor Implements [IIntrospectionRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.IIntrospectionRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.Introspection\.Interfaces\.IIntrospectionRequestProcessor') ### Remarks This class handles the introspection of tokens to determine if they are active or inactive\. It follows the OAuth 2\.0 Token Introspection specification \(RFC 7662\)\. The processor examines the token's status and provides an appropriate response as per the specification\. ### Constructors ## IntrospectionRequestProcessor\(IClientInfoProvider, ISubjectTypeConverter\) Constructor {#Abblix.Oidc.Server.Endpoints.Introspection.IntrospectionRequestProcessor.IntrospectionRequestProcessor(Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider,Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter)} Implements the logic for processing introspection requests and generating introspection responses\. ```csharp public IntrospectionRequestProcessor(Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider clientInfoProvider, Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter subjectTypeConverter); ``` #### Parameters ###### `clientInfoProvider` [IClientInfoProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.IClientInfoProvider') {#Abblix.Oidc.Server.Endpoints.Introspection.IntrospectionRequestProcessor.IntrospectionRequestProcessor(Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider,Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter).clientInfoProvider} Resolves the client a token was issued to, so its subject can be opened before being re\-sealed for a different caller\. ###### `subjectTypeConverter` [ISubjectTypeConverter](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter 'Abblix\.Oidc\.Server\.Features\.PairwiseIdentifiers\.ISubjectTypeConverter') {#Abblix.Oidc.Server.Endpoints.Introspection.IntrospectionRequestProcessor.IntrospectionRequestProcessor(Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider,Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter).subjectTypeConverter} Opens and re\-seals the end\-user identifier per client sector\. ### Remarks This class handles the introspection of tokens to determine if they are active or inactive\. It follows the OAuth 2\.0 Token Introspection specification \(RFC 7662\)\. The processor examines the token's status and provides an appropriate response as per the specification\. ### Methods ## IntrospectionRequestProcessor\.ProcessAsync\(ValidIntrospectionRequest\) Method {#Abblix.Oidc.Server.Endpoints.Introspection.IntrospectionRequestProcessor.ProcessAsync(Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.ValidIntrospectionRequest)} Processes an introspection request and returns the corresponding introspection response\. ```csharp public System.Threading.Tasks.Task> ProcessAsync(Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.ValidIntrospectionRequest request); ``` #### Parameters ###### `request` [ValidIntrospectionRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.ValidIntrospectionRequest 'Abblix\.Oidc\.Server\.Endpoints\.Introspection\.Interfaces\.ValidIntrospectionRequest') {#Abblix.Oidc.Server.Endpoints.Introspection.IntrospectionRequestProcessor.ProcessAsync(Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.ValidIntrospectionRequest).request} The valid introspection request to process\. It contains the token to be introspected\. Implements [ProcessAsync\(ValidIntrospectionRequest\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.IIntrospectionRequestProcessor#Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.IIntrospectionRequestProcessor.ProcessAsync(Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.ValidIntrospectionRequest) 'Abblix\.Oidc\.Server\.Endpoints\.Introspection\.Interfaces\.IIntrospectionRequestProcessor\.ProcessAsync\(Abblix\.Oidc\.Server\.Endpoints\.Introspection\.Interfaces\.ValidIntrospectionRequest\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[IntrospectionSuccess](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.IntrospectionSuccess 'Abblix\.Oidc\.Server\.Endpoints\.Introspection\.Interfaces\.IntrospectionSuccess')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A [System\.Threading\.Tasks\.Task](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task 'System\.Threading\.Tasks\.Task') representing the asynchronous operation, with a result of [IntrospectionSuccess](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.IntrospectionSuccess 'Abblix\.Oidc\.Server\.Endpoints\.Introspection\.Interfaces\.IntrospectionSuccess') or an [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')\. The response indicates the active status of the token and contains associated claims\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection.IntrospectionRequestValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Introspection](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection 'Abblix\.Oidc\.Server\.Endpoints\.Introspection') ## IntrospectionRequestValidator Class Validates the introspection request properties and authenticates a client that initiated the request\. ```csharp public class IntrospectionRequestValidator : Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.IIntrospectionRequestValidator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → IntrospectionRequestValidator Implements [IIntrospectionRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.IIntrospectionRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.Introspection\.Interfaces\.IIntrospectionRequestValidator') ### Remarks This class performs validation of introspection requests and client authentication\. It ensures that the request is authorized and the provided token is valid for the client\. The validation process includes checking the authenticity of the client and the integrity of the token\. It leverages a client request authenticator for client authentication and a JWT validator for token validation\. ### Constructors ## IntrospectionRequestValidator\(ILogger\, IClientAuthenticator, IAuthServiceJwtValidator\) Constructor {#Abblix.Oidc.Server.Endpoints.Introspection.IntrospectionRequestValidator.IntrospectionRequestValidator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.Introspection.IntrospectionRequestValidator_,Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator,Abblix.Oidc.Server.Features.Tokens.Validation.IAuthServiceJwtValidator)} Validates the introspection request properties and authenticates a client that initiated the request\. ```csharp public IntrospectionRequestValidator(Microsoft.Extensions.Logging.ILogger logger, Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator clientAuthenticator, Abblix.Oidc.Server.Features.Tokens.Validation.IAuthServiceJwtValidator jwtValidator); ``` #### Parameters ###### `logger` [Microsoft\.Extensions\.Logging\.ILogger<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1')[IntrospectionRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection.IntrospectionRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.Introspection\.IntrospectionRequestValidator')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1') {#Abblix.Oidc.Server.Endpoints.Introspection.IntrospectionRequestValidator.IntrospectionRequestValidator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.Introspection.IntrospectionRequestValidator_,Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator,Abblix.Oidc.Server.Features.Tokens.Validation.IAuthServiceJwtValidator).logger} The logger for logging activities within the validator\. ###### `clientAuthenticator` [IClientAuthenticator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator 'Abblix\.Oidc\.Server\.Features\.ClientAuthentication\.IClientAuthenticator') {#Abblix.Oidc.Server.Endpoints.Introspection.IntrospectionRequestValidator.IntrospectionRequestValidator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.Introspection.IntrospectionRequestValidator_,Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator,Abblix.Oidc.Server.Features.Tokens.Validation.IAuthServiceJwtValidator).clientAuthenticator} The client request authenticator to authenticate the client\. ###### `jwtValidator` [IAuthServiceJwtValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.Validation.IAuthServiceJwtValidator 'Abblix\.Oidc\.Server\.Features\.Tokens\.Validation\.IAuthServiceJwtValidator') {#Abblix.Oidc.Server.Endpoints.Introspection.IntrospectionRequestValidator.IntrospectionRequestValidator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.Introspection.IntrospectionRequestValidator_,Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator,Abblix.Oidc.Server.Features.Tokens.Validation.IAuthServiceJwtValidator).jwtValidator} The JWT validator to validate the token\. ### Remarks This class performs validation of introspection requests and client authentication\. It ensures that the request is authorized and the provided token is valid for the client\. The validation process includes checking the authenticity of the client and the integrity of the token\. It leverages a client request authenticator for client authentication and a JWT validator for token validation\. ### Methods ## IntrospectionRequestValidator\.ValidateAsync\(IntrospectionRequest, ClientRequest\) Method {#Abblix.Oidc.Server.Endpoints.Introspection.IntrospectionRequestValidator.ValidateAsync(Abblix.Oidc.Server.Model.IntrospectionRequest,Abblix.Oidc.Server.Model.ClientRequest)} Validates the introspection request properties and authenticates a client that initiated the request\. ```csharp public System.Threading.Tasks.Task> ValidateAsync(Abblix.Oidc.Server.Model.IntrospectionRequest introspectionRequest, Abblix.Oidc.Server.Model.ClientRequest clientRequest); ``` #### Parameters ###### `introspectionRequest` [IntrospectionRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.IntrospectionRequest 'Abblix\.Oidc\.Server\.Model\.IntrospectionRequest') {#Abblix.Oidc.Server.Endpoints.Introspection.IntrospectionRequestValidator.ValidateAsync(Abblix.Oidc.Server.Model.IntrospectionRequest,Abblix.Oidc.Server.Model.ClientRequest).introspectionRequest} The introspection request to validate\. It includes the token and client information for validation\. ###### `clientRequest` [ClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRequest 'Abblix\.Oidc\.Server\.Model\.ClientRequest') {#Abblix.Oidc.Server.Endpoints.Introspection.IntrospectionRequestValidator.ValidateAsync(Abblix.Oidc.Server.Model.IntrospectionRequest,Abblix.Oidc.Server.Model.ClientRequest).clientRequest} Additional client request information for contextual validation\. Implements [ValidateAsync\(IntrospectionRequest, ClientRequest\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.IIntrospectionRequestValidator#Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.IIntrospectionRequestValidator.ValidateAsync(Abblix.Oidc.Server.Model.IntrospectionRequest,Abblix.Oidc.Server.Model.ClientRequest) 'Abblix\.Oidc\.Server\.Endpoints\.Introspection\.Interfaces\.IIntrospectionRequestValidator\.ValidateAsync\(Abblix\.Oidc\.Server\.Model\.IntrospectionRequest, Abblix\.Oidc\.Server\.Model\.ClientRequest\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[ValidIntrospectionRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.ValidIntrospectionRequest 'Abblix\.Oidc\.Server\.Endpoints\.Introspection\.Interfaces\.ValidIntrospectionRequest')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task representing the asynchronous validation operation\. The task result contains the [Result<TSuccess,TFailure>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2') which indicates whether the request is valid or contains errors\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ## Abblix\.Oidc\.Server\.Endpoints\.Introspection\.Interfaces Namespace | Classes | | | :--- | :--- | | [IntrospectionSuccess](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.IntrospectionSuccess 'Abblix\.Oidc\.Server\.Endpoints\.Introspection\.Interfaces\.IntrospectionSuccess') | Server\-side model of the introspection response defined by RFC 7662 §2\.2: a Boolean `active` flag and, when active, the token's metadata claims\. Hosts may extend the JSON via additional top\-level members; cross\-domain extensions should be listed in the IANA "OAuth Token Introspection Response" registry \(RFC 7662 §3\.1\)\. | | [IntrospectionSuccess\.Parameters](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.IntrospectionSuccess.Parameters 'Abblix\.Oidc\.Server\.Endpoints\.Introspection\.Interfaces\.IntrospectionSuccess\.Parameters') | Wire\-level member names of the introspection response, as registered in the IANA "OAuth Token Introspection Response" registry \(RFC 7662 §3\.1\)\. | | [ValidIntrospectionRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.ValidIntrospectionRequest 'Abblix\.Oidc\.Server\.Endpoints\.Introspection\.Interfaces\.ValidIntrospectionRequest') | Output of [IIntrospectionRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.IIntrospectionRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.Introspection\.Interfaces\.IIntrospectionRequestValidator') handed to the processor: pairs the original request with either the parsed token \(active branch\) or a `null` token \(inactive branch produced via [InvalidToken\(IntrospectionRequest, ClientInfo\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.ValidIntrospectionRequest#Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.ValidIntrospectionRequest.InvalidToken(Abblix.Oidc.Server.Model.IntrospectionRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo) 'Abblix\.Oidc\.Server\.Endpoints\.Introspection\.Interfaces\.ValidIntrospectionRequest\.InvalidToken\(Abblix\.Oidc\.Server\.Model\.IntrospectionRequest, Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo\)'), used so token\-level failures flow through the same processing path without disclosing why per RFC 7662 §2\.2\)\. | | Interfaces | | | :--- | :--- | | [IIntrospectionHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.IIntrospectionHandler 'Abblix\.Oidc\.Server\.Endpoints\.Introspection\.Interfaces\.IIntrospectionHandler') | Defines the contract for handling introspection requests to determine the current state and validity of OAuth 2\.0 tokens, such as access tokens or refresh tokens\. | | [IIntrospectionRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.IIntrospectionRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.Introspection\.Interfaces\.IIntrospectionRequestProcessor') | Builds the RFC 7662 introspection response for an already\-validated request: returns `active=true` with claims for a live token, or `active=false` alone when the token is missing, expired, revoked, or issued to a different client \(§2\.2\)\. | | [IIntrospectionRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.IIntrospectionRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.Introspection\.Interfaces\.IIntrospectionRequestValidator') | Authenticates the calling client \(RFC 7662 §2\.1, "the protected resource calls the introspection endpoint using an HTTP request"\) and validates the supplied `token`\. Implementations are expected to coerce token problems \(expired, signed by a different issuer, audience mismatch, issued to another client\) into a non\-disclosing `active=false` result via [InvalidToken\(IntrospectionRequest, ClientInfo\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.ValidIntrospectionRequest#Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.ValidIntrospectionRequest.InvalidToken(Abblix.Oidc.Server.Model.IntrospectionRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo) 'Abblix\.Oidc\.Server\.Endpoints\.Introspection\.Interfaces\.ValidIntrospectionRequest\.InvalidToken\(Abblix\.Oidc\.Server\.Model\.IntrospectionRequest, Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo\)')\. | --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.IIntrospectionHandler.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Introspection\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.Introspection\.Interfaces') ## IIntrospectionHandler Interface Defines the contract for handling introspection requests to determine the current state and validity of OAuth 2\.0 tokens, such as access tokens or refresh tokens\. ```csharp public interface IIntrospectionHandler ``` Derived ↳ [IntrospectionHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection.IntrospectionHandler 'Abblix\.Oidc\.Server\.Endpoints\.Introspection\.IntrospectionHandler') ### Methods ## IIntrospectionHandler\.HandleAsync\(IntrospectionRequest, ClientRequest\) Method {#Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.IIntrospectionHandler.HandleAsync(Abblix.Oidc.Server.Model.IntrospectionRequest,Abblix.Oidc.Server.Model.ClientRequest)} Asynchronously processes an introspection request, validating its authorization and the token in question, and then returning the token's state and other relevant information\. ```csharp System.Threading.Tasks.Task> HandleAsync(Abblix.Oidc.Server.Model.IntrospectionRequest introspectionRequest, Abblix.Oidc.Server.Model.ClientRequest clientRequest); ``` #### Parameters ###### `introspectionRequest` [IntrospectionRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.IntrospectionRequest 'Abblix\.Oidc\.Server\.Model\.IntrospectionRequest') {#Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.IIntrospectionHandler.HandleAsync(Abblix.Oidc.Server.Model.IntrospectionRequest,Abblix.Oidc.Server.Model.ClientRequest).introspectionRequest} The introspection request containing the token and possibly other parameters required for validating the request and introspecting the token\. ###### `clientRequest` [ClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRequest 'Abblix\.Oidc\.Server\.Model\.ClientRequest') {#Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.IIntrospectionHandler.HandleAsync(Abblix.Oidc.Server.Model.IntrospectionRequest,Abblix.Oidc.Server.Model.ClientRequest).clientRequest} Additional information about the client making the request, which may be necessary for validating the request in certain contexts\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[IntrospectionSuccess](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.IntrospectionSuccess 'Abblix\.Oidc\.Server\.Endpoints\.Introspection\.Interfaces\.IntrospectionSuccess')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A [System\.Threading\.Tasks\.Task](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task 'System\.Threading\.Tasks\.Task') that, when completed successfully, results in an [IntrospectionSuccess](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.IntrospectionSuccess 'Abblix\.Oidc\.Server\.Endpoints\.Introspection\.Interfaces\.IntrospectionSuccess') or an [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')\. The success response contains information about the token's current state, such as whether it is active, and potentially other metadata\. In case of an invalid request, the error response will detail the reasons for rejection\. ### Remarks Implementations of this interface play a critical role in the security of OAuth 2\.0 and OIDC systems by enabling resource servers and other relying parties to verify the validity and metadata of tokens\. This helps prevent unauthorized access and ensures that tokens are used in accordance with their intended scopes and lifetimes\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.IIntrospectionRequestProcessor.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Introspection\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.Introspection\.Interfaces') ## IIntrospectionRequestProcessor Interface Builds the RFC 7662 introspection response for an already\-validated request: returns `active=true` with claims for a live token, or `active=false` alone when the token is missing, expired, revoked, or issued to a different client \(§2\.2\)\. ```csharp public interface IIntrospectionRequestProcessor ``` Derived ↳ [IntrospectionRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection.IntrospectionRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.Introspection\.IntrospectionRequestProcessor') ### Methods ## IIntrospectionRequestProcessor\.ProcessAsync\(ValidIntrospectionRequest\) Method {#Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.IIntrospectionRequestProcessor.ProcessAsync(Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.ValidIntrospectionRequest)} Produces the introspection response for a validated request\. ```csharp System.Threading.Tasks.Task> ProcessAsync(Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.ValidIntrospectionRequest request); ``` #### Parameters ###### `request` [ValidIntrospectionRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.ValidIntrospectionRequest 'Abblix\.Oidc\.Server\.Endpoints\.Introspection\.Interfaces\.ValidIntrospectionRequest') {#Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.IIntrospectionRequestProcessor.ProcessAsync(Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.ValidIntrospectionRequest).request} A request that has cleared client authentication and token validation\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[IntrospectionSuccess](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.IntrospectionSuccess 'Abblix\.Oidc\.Server\.Endpoints\.Introspection\.Interfaces\.IntrospectionSuccess')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') An [IntrospectionSuccess](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.IntrospectionSuccess 'Abblix\.Oidc\.Server\.Endpoints\.Introspection\.Interfaces\.IntrospectionSuccess'); processing\-time errors map to [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.IIntrospectionRequestValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Introspection\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.Introspection\.Interfaces') ## IIntrospectionRequestValidator Interface Authenticates the calling client \(RFC 7662 §2\.1, "the protected resource calls the introspection endpoint using an HTTP request"\) and validates the supplied `token`\. Implementations are expected to coerce token problems \(expired, signed by a different issuer, audience mismatch, issued to another client\) into a non\-disclosing `active=false` result via [InvalidToken\(IntrospectionRequest, ClientInfo\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.ValidIntrospectionRequest#Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.ValidIntrospectionRequest.InvalidToken(Abblix.Oidc.Server.Model.IntrospectionRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo) 'Abblix\.Oidc\.Server\.Endpoints\.Introspection\.Interfaces\.ValidIntrospectionRequest\.InvalidToken\(Abblix\.Oidc\.Server\.Model\.IntrospectionRequest, Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo\)')\. ```csharp public interface IIntrospectionRequestValidator ``` Derived ↳ [IntrospectionRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection.IntrospectionRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.Introspection\.IntrospectionRequestValidator') ### Methods ## IIntrospectionRequestValidator\.ValidateAsync\(IntrospectionRequest, ClientRequest\) Method {#Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.IIntrospectionRequestValidator.ValidateAsync(Abblix.Oidc.Server.Model.IntrospectionRequest,Abblix.Oidc.Server.Model.ClientRequest)} Authenticates the caller and validates the introspected token\. ```csharp System.Threading.Tasks.Task> ValidateAsync(Abblix.Oidc.Server.Model.IntrospectionRequest introspectionRequest, Abblix.Oidc.Server.Model.ClientRequest clientRequest); ``` #### Parameters ###### `introspectionRequest` [IntrospectionRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.IntrospectionRequest 'Abblix\.Oidc\.Server\.Model\.IntrospectionRequest') {#Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.IIntrospectionRequestValidator.ValidateAsync(Abblix.Oidc.Server.Model.IntrospectionRequest,Abblix.Oidc.Server.Model.ClientRequest).introspectionRequest} Wire\-level request carrying the `token` to introspect\. ###### `clientRequest` [ClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRequest 'Abblix\.Oidc\.Server\.Model\.ClientRequest') {#Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.IIntrospectionRequestValidator.ValidateAsync(Abblix.Oidc.Server.Model.IntrospectionRequest,Abblix.Oidc.Server.Model.ClientRequest).clientRequest} Carrier of the client's authentication credentials\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[ValidIntrospectionRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.ValidIntrospectionRequest 'Abblix\.Oidc\.Server\.Endpoints\.Introspection\.Interfaces\.ValidIntrospectionRequest')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A [ValidIntrospectionRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.ValidIntrospectionRequest 'Abblix\.Oidc\.Server\.Endpoints\.Introspection\.Interfaces\.ValidIntrospectionRequest') on success \(with `Token` set or null\); an [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') only when the caller itself cannot be authenticated\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.IntrospectionSuccess.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Introspection\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.Introspection\.Interfaces') ## IntrospectionSuccess Class Server\-side model of the introspection response defined by RFC 7662 §2\.2: a Boolean `active` flag and, when active, the token's metadata claims\. Hosts may extend the JSON via additional top\-level members; cross\-domain extensions should be listed in the IANA "OAuth Token Introspection Response" registry \(RFC 7662 §3\.1\)\. ```csharp public record IntrospectionSuccess : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → IntrospectionSuccess Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[IntrospectionSuccess](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.IntrospectionSuccess 'Abblix\.Oidc\.Server\.Endpoints\.Introspection\.Interfaces\.IntrospectionSuccess')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Constructors ## IntrospectionSuccess\(bool, JsonObject, ClientInfo\) Constructor {#Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.IntrospectionSuccess.IntrospectionSuccess(bool,System.Text.Json.Nodes.JsonObject,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo)} Server\-side model of the introspection response defined by RFC 7662 §2\.2: a Boolean `active` flag and, when active, the token's metadata claims\. Hosts may extend the JSON via additional top\-level members; cross\-domain extensions should be listed in the IANA "OAuth Token Introspection Response" registry \(RFC 7662 §3\.1\)\. ```csharp public IntrospectionSuccess(bool Active, System.Text.Json.Nodes.JsonObject? Claims, Abblix.Oidc.Server.Features.ClientInformation.ClientInfo ClientInfo); ``` #### Parameters ###### `Active` [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') {#Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.IntrospectionSuccess.IntrospectionSuccess(bool,System.Text.Json.Nodes.JsonObject,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo).Active} ###### `Claims` [System\.Text\.Json\.Nodes\.JsonObject](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonobject 'System\.Text\.Json\.Nodes\.JsonObject') {#Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.IntrospectionSuccess.IntrospectionSuccess(bool,System.Text.Json.Nodes.JsonObject,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo).Claims} ###### `ClientInfo` [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') {#Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.IntrospectionSuccess.IntrospectionSuccess(bool,System.Text.Json.Nodes.JsonObject,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo).ClientInfo} ### Properties ## IntrospectionSuccess\.Active Property {#Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.IntrospectionSuccess.Active} RFC 7662 `active` field: `true` only if the token is currently valid and the caller is permitted to introspect it\. `false` covers all other cases \(expired, revoked, unknown, or not allowed\) and per §2\.2 is returned without disclosing why\. ```csharp public bool Active { get; } ``` #### Property Value [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') ## IntrospectionSuccess\.Claims Property {#Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.IntrospectionSuccess.Claims} Token metadata claims \(e\.g\. `scope`, `sub`, `aud`, `exp`\) when [Active](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.IntrospectionSuccess#Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.IntrospectionSuccess.Active 'Abblix\.Oidc\.Server\.Endpoints\.Introspection\.Interfaces\.IntrospectionSuccess\.Active') is `true`; otherwise `null`, in line with RFC 7662's guidance not to leak information about inactive tokens\. ```csharp public System.Text.Json.Nodes.JsonObject? Claims { get; } ``` #### Property Value [System\.Text\.Json\.Nodes\.JsonObject](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonobject 'System\.Text\.Json\.Nodes\.JsonObject') ## IntrospectionSuccess\.ClientInfo Property {#Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.IntrospectionSuccess.ClientInfo} The authenticated client that requested the introspection\. Not serialized into the response body; it selects the response format \(plain JSON vs\. a signed/encrypted JWT per RFC 9701\)\. ```csharp public Abblix.Oidc.Server.Features.ClientInformation.ClientInfo ClientInfo { get; } ``` #### Property Value [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.IntrospectionSuccess.Parameters.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Introspection\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.Introspection\.Interfaces').[IntrospectionSuccess](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.IntrospectionSuccess 'Abblix\.Oidc\.Server\.Endpoints\.Introspection\.Interfaces\.IntrospectionSuccess') ## IntrospectionSuccess\.Parameters Class Wire\-level member names of the introspection response, as registered in the IANA "OAuth Token Introspection Response" registry \(RFC 7662 §3\.1\)\. ```csharp public static class IntrospectionSuccess.Parameters ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → Parameters ### Fields ## IntrospectionSuccess\.Parameters\.Active Field {#Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.IntrospectionSuccess.Parameters.Active} The `active` response member \(RFC 7662 §2\.2\) reporting whether the token is currently active\. ```csharp public const string Active = "active"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.ValidIntrospectionRequest.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Introspection\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.Introspection\.Interfaces') ## ValidIntrospectionRequest Class Output of [IIntrospectionRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.IIntrospectionRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.Introspection\.Interfaces\.IIntrospectionRequestValidator') handed to the processor: pairs the original request with either the parsed token \(active branch\) or a `null` token \(inactive branch produced via [InvalidToken\(IntrospectionRequest, ClientInfo\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.ValidIntrospectionRequest#Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.ValidIntrospectionRequest.InvalidToken(Abblix.Oidc.Server.Model.IntrospectionRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo) 'Abblix\.Oidc\.Server\.Endpoints\.Introspection\.Interfaces\.ValidIntrospectionRequest\.InvalidToken\(Abblix\.Oidc\.Server\.Model\.IntrospectionRequest, Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo\)'), used so token\-level failures flow through the same processing path without disclosing why per RFC 7662 §2\.2\)\. ```csharp public record ValidIntrospectionRequest : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ValidIntrospectionRequest Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[ValidIntrospectionRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.ValidIntrospectionRequest 'Abblix\.Oidc\.Server\.Endpoints\.Introspection\.Interfaces\.ValidIntrospectionRequest')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Constructors ## ValidIntrospectionRequest\(IntrospectionRequest, ClientInfo, JsonWebToken\) Constructor {#Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.ValidIntrospectionRequest.ValidIntrospectionRequest(Abblix.Oidc.Server.Model.IntrospectionRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,Abblix.Jwt.JsonWebToken)} Active\-branch constructor: the token authenticated, was issued to this client and passed validation\. ```csharp public ValidIntrospectionRequest(Abblix.Oidc.Server.Model.IntrospectionRequest model, Abblix.Oidc.Server.Features.ClientInformation.ClientInfo clientInfo, Abblix.Jwt.JsonWebToken token); ``` #### Parameters ###### `model` [IntrospectionRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.IntrospectionRequest 'Abblix\.Oidc\.Server\.Model\.IntrospectionRequest') {#Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.ValidIntrospectionRequest.ValidIntrospectionRequest(Abblix.Oidc.Server.Model.IntrospectionRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,Abblix.Jwt.JsonWebToken).model} The introspection request model\. ###### `clientInfo` [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') {#Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.ValidIntrospectionRequest.ValidIntrospectionRequest(Abblix.Oidc.Server.Model.IntrospectionRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,Abblix.Jwt.JsonWebToken).clientInfo} The authenticated client making the introspection request; it determines the response format \(plain JSON vs\. a signed/encrypted JWT per RFC 9701\)\. ###### `token` [JsonWebToken](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebToken 'Abblix\.Jwt\.JsonWebToken') {#Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.ValidIntrospectionRequest.ValidIntrospectionRequest(Abblix.Oidc.Server.Model.IntrospectionRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,Abblix.Jwt.JsonWebToken).token} The parsed JWT to be reported as `active=true`\. ### Properties ## ValidIntrospectionRequest\.ClientInfo Property {#Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.ValidIntrospectionRequest.ClientInfo} The authenticated client making the introspection request, used to select the response format \(RFC 9701\)\. ```csharp public Abblix.Oidc.Server.Features.ClientInformation.ClientInfo ClientInfo { get; } ``` #### Property Value [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') ## ValidIntrospectionRequest\.Model Property {#Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.ValidIntrospectionRequest.Model} The introspection request model\. ```csharp public Abblix.Oidc.Server.Model.IntrospectionRequest Model { get; } ``` #### Property Value [IntrospectionRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.IntrospectionRequest 'Abblix\.Oidc\.Server\.Model\.IntrospectionRequest') ## ValidIntrospectionRequest\.Token Property {#Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.ValidIntrospectionRequest.Token} The JSON Web Token to introspect\. ```csharp public Abblix.Jwt.JsonWebToken? Token { get; } ``` #### Property Value [JsonWebToken](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebToken 'Abblix\.Jwt\.JsonWebToken') ### Methods ## ValidIntrospectionRequest\.InvalidToken\(IntrospectionRequest, ClientInfo\) Method {#Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.ValidIntrospectionRequest.InvalidToken(Abblix.Oidc.Server.Model.IntrospectionRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo)} Creates a valid introspection request for an invalid token\. ```csharp public static Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.ValidIntrospectionRequest InvalidToken(Abblix.Oidc.Server.Model.IntrospectionRequest model, Abblix.Oidc.Server.Features.ClientInformation.ClientInfo clientInfo); ``` #### Parameters ###### `model` [IntrospectionRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.IntrospectionRequest 'Abblix\.Oidc\.Server\.Model\.IntrospectionRequest') {#Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.ValidIntrospectionRequest.InvalidToken(Abblix.Oidc.Server.Model.IntrospectionRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo).model} The introspection request model\. ###### `clientInfo` [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') {#Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.ValidIntrospectionRequest.InvalidToken(Abblix.Oidc.Server.Model.IntrospectionRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo).clientInfo} The authenticated client making the introspection request\. #### Returns [ValidIntrospectionRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.ValidIntrospectionRequest 'Abblix\.Oidc\.Server\.Endpoints\.Introspection\.Interfaces\.ValidIntrospectionRequest') A valid introspection request with the "active" field set to "false\." ### Remarks See https://www.rfc-editor.org/rfc/rfc7662\#section-5.2 --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.PushedAuthorization.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ## Abblix\.Oidc\.Server\.Endpoints\.PushedAuthorization Namespace | Classes | | | :--- | :--- | | [PushedAuthorizationHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.PushedAuthorization.PushedAuthorizationHandler 'Abblix\.Oidc\.Server\.Endpoints\.PushedAuthorization\.PushedAuthorizationHandler') | Handles the processing of Pushed Authorization Requests \(PAR\) by validating the requests and then processing them if valid\. This class acts as an intermediary between the validation and processing stages of the PAR workflow\. | | [PushedAuthorizationRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.PushedAuthorization.PushedAuthorizationRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.PushedAuthorization\.PushedAuthorizationRequestProcessor') | Processes pushed authorization requests by storing them and generating a response that includes the request URI and expiration information\. | | [PushedAuthorizationRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.PushedAuthorization.PushedAuthorizationRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.PushedAuthorization\.PushedAuthorizationRequestValidator') | Validates pushed authorization requests by enforcing OAuth 2\.0 protocol constraints\. This validator ensures that requests do not use prohibited parameters and comply with standard authorization request requirements\. | --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.PushedAuthorization.PushedAuthorizationHandler.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.PushedAuthorization](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.PushedAuthorization 'Abblix\.Oidc\.Server\.Endpoints\.PushedAuthorization') ## PushedAuthorizationHandler Class Handles the processing of Pushed Authorization Requests \(PAR\) by validating the requests and then processing them if valid\. This class acts as an intermediary between the validation and processing stages of the PAR workflow\. ```csharp public class PushedAuthorizationHandler : Abblix.Oidc.Server.Endpoints.PushedAuthorization.Interfaces.IPushedAuthorizationHandler ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → PushedAuthorizationHandler Implements [IPushedAuthorizationHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.PushedAuthorization.Interfaces.IPushedAuthorizationHandler 'Abblix\.Oidc\.Server\.Endpoints\.PushedAuthorization\.Interfaces\.IPushedAuthorizationHandler') ### Constructors ## PushedAuthorizationHandler\(IAuthorizationRequestFetcher, IPushedAuthorizationRequestValidator, IPushedAuthorizationRequestProcessor\) Constructor {#Abblix.Oidc.Server.Endpoints.PushedAuthorization.PushedAuthorizationHandler.PushedAuthorizationHandler(Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.IAuthorizationRequestFetcher,Abblix.Oidc.Server.Endpoints.PushedAuthorization.Interfaces.IPushedAuthorizationRequestValidator,Abblix.Oidc.Server.Endpoints.PushedAuthorization.Interfaces.IPushedAuthorizationRequestProcessor)} Handles the processing of Pushed Authorization Requests \(PAR\) by validating the requests and then processing them if valid\. This class acts as an intermediary between the validation and processing stages of the PAR workflow\. ```csharp public PushedAuthorizationHandler(Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.IAuthorizationRequestFetcher fetcher, Abblix.Oidc.Server.Endpoints.PushedAuthorization.Interfaces.IPushedAuthorizationRequestValidator validator, Abblix.Oidc.Server.Endpoints.PushedAuthorization.Interfaces.IPushedAuthorizationRequestProcessor processor); ``` #### Parameters ###### `fetcher` [IAuthorizationRequestFetcher](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.IAuthorizationRequestFetcher 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.RequestFetching\.IAuthorizationRequestFetcher') {#Abblix.Oidc.Server.Endpoints.PushedAuthorization.PushedAuthorizationHandler.PushedAuthorizationHandler(Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.IAuthorizationRequestFetcher,Abblix.Oidc.Server.Endpoints.PushedAuthorization.Interfaces.IPushedAuthorizationRequestValidator,Abblix.Oidc.Server.Endpoints.PushedAuthorization.Interfaces.IPushedAuthorizationRequestProcessor).fetcher} An instance of [IAuthorizationRequestFetcher](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.IAuthorizationRequestFetcher 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.RequestFetching\.IAuthorizationRequestFetcher') used to resolve `request` / `request_uri` JAR payloads before validation\. ###### `validator` [IPushedAuthorizationRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.PushedAuthorization.Interfaces.IPushedAuthorizationRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.PushedAuthorization\.Interfaces\.IPushedAuthorizationRequestValidator') {#Abblix.Oidc.Server.Endpoints.PushedAuthorization.PushedAuthorizationHandler.PushedAuthorizationHandler(Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.IAuthorizationRequestFetcher,Abblix.Oidc.Server.Endpoints.PushedAuthorization.Interfaces.IPushedAuthorizationRequestValidator,Abblix.Oidc.Server.Endpoints.PushedAuthorization.Interfaces.IPushedAuthorizationRequestProcessor).validator} An instance of [IPushedAuthorizationRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.PushedAuthorization.Interfaces.IPushedAuthorizationRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.PushedAuthorization\.Interfaces\.IPushedAuthorizationRequestValidator') used for validating pushed authorization requests\. ###### `processor` [IPushedAuthorizationRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.PushedAuthorization.Interfaces.IPushedAuthorizationRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.PushedAuthorization\.Interfaces\.IPushedAuthorizationRequestProcessor') {#Abblix.Oidc.Server.Endpoints.PushedAuthorization.PushedAuthorizationHandler.PushedAuthorizationHandler(Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.IAuthorizationRequestFetcher,Abblix.Oidc.Server.Endpoints.PushedAuthorization.Interfaces.IPushedAuthorizationRequestValidator,Abblix.Oidc.Server.Endpoints.PushedAuthorization.Interfaces.IPushedAuthorizationRequestProcessor).processor} An instance of [IPushedAuthorizationRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.PushedAuthorization.Interfaces.IPushedAuthorizationRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.PushedAuthorization\.Interfaces\.IPushedAuthorizationRequestProcessor') used for processing validated authorization requests\. ### Methods ## PushedAuthorizationHandler\.HandleAsync\(AuthorizationRequest, ClientRequest\) Method {#Abblix.Oidc.Server.Endpoints.PushedAuthorization.PushedAuthorizationHandler.HandleAsync(Abblix.Oidc.Server.Model.AuthorizationRequest,Abblix.Oidc.Server.Model.ClientRequest)} Asynchronously handles a pushed authorization request by first validating it and then processing it if the validation is successful\. ```csharp public System.Threading.Tasks.Task HandleAsync(Abblix.Oidc.Server.Model.AuthorizationRequest authorizationRequest, Abblix.Oidc.Server.Model.ClientRequest clientRequest); ``` #### Parameters ###### `authorizationRequest` [AuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.AuthorizationRequest 'Abblix\.Oidc\.Server\.Model\.AuthorizationRequest') {#Abblix.Oidc.Server.Endpoints.PushedAuthorization.PushedAuthorizationHandler.HandleAsync(Abblix.Oidc.Server.Model.AuthorizationRequest,Abblix.Oidc.Server.Model.ClientRequest).authorizationRequest} The authorization request details as received from the client\. ###### `clientRequest` [ClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRequest 'Abblix\.Oidc\.Server\.Model\.ClientRequest') {#Abblix.Oidc.Server.Endpoints.PushedAuthorization.PushedAuthorizationHandler.HandleAsync(Abblix.Oidc.Server.Model.AuthorizationRequest,Abblix.Oidc.Server.Model.ClientRequest).clientRequest} Additional client request information that may be needed for contextual validation\. Implements [HandleAsync\(AuthorizationRequest, ClientRequest\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.PushedAuthorization.Interfaces.IPushedAuthorizationHandler#Abblix.Oidc.Server.Endpoints.PushedAuthorization.Interfaces.IPushedAuthorizationHandler.HandleAsync(Abblix.Oidc.Server.Model.AuthorizationRequest,Abblix.Oidc.Server.Model.ClientRequest) 'Abblix\.Oidc\.Server\.Endpoints\.PushedAuthorization\.Interfaces\.IPushedAuthorizationHandler\.HandleAsync\(Abblix\.Oidc\.Server\.Model\.AuthorizationRequest, Abblix\.Oidc\.Server\.Model\.ClientRequest\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[AuthorizationResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationResponse 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationResponse')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A [System\.Threading\.Tasks\.Task](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task 'System\.Threading\.Tasks\.Task') that upon completion yields an [AuthorizationResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationResponse 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationResponse'), which could be a successful response with the request being processed or an error response if the validation fails\. ### Remarks This method ensures that pushed authorization requests are thoroughly validated against the system's criteria before proceeding with processing\. This validation includes, but is not limited to, verifying the client's identity, the request's integrity, and its compliance with the system's policies\. Successful validation leads to the processing of the request, which typically involves generating a request URI or an error response in case of failure\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.PushedAuthorization.PushedAuthorizationRequestProcessor.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.PushedAuthorization](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.PushedAuthorization 'Abblix\.Oidc\.Server\.Endpoints\.PushedAuthorization') ## PushedAuthorizationRequestProcessor Class Processes pushed authorization requests by storing them and generating a response that includes the request URI and expiration information\. ```csharp public class PushedAuthorizationRequestProcessor : Abblix.Oidc.Server.Endpoints.PushedAuthorization.Interfaces.IPushedAuthorizationRequestProcessor ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → PushedAuthorizationRequestProcessor Implements [IPushedAuthorizationRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.PushedAuthorization.Interfaces.IPushedAuthorizationRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.PushedAuthorization\.Interfaces\.IPushedAuthorizationRequestProcessor') ### Constructors ## PushedAuthorizationRequestProcessor\(IAuthorizationRequestStorage, IOptionsSnapshot\\) Constructor {#Abblix.Oidc.Server.Endpoints.PushedAuthorization.PushedAuthorizationRequestProcessor.PushedAuthorizationRequestProcessor(Abblix.Oidc.Server.Features.Storages.IAuthorizationRequestStorage,Microsoft.Extensions.Options.IOptionsSnapshot_Abblix.Oidc.Server.Common.Configuration.OidcOptions_)} Processes pushed authorization requests by storing them and generating a response that includes the request URI and expiration information\. ```csharp public PushedAuthorizationRequestProcessor(Abblix.Oidc.Server.Features.Storages.IAuthorizationRequestStorage storage, Microsoft.Extensions.Options.IOptionsSnapshot options); ``` #### Parameters ###### `storage` [IAuthorizationRequestStorage](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Storages.IAuthorizationRequestStorage 'Abblix\.Oidc\.Server\.Features\.Storages\.IAuthorizationRequestStorage') {#Abblix.Oidc.Server.Endpoints.PushedAuthorization.PushedAuthorizationRequestProcessor.PushedAuthorizationRequestProcessor(Abblix.Oidc.Server.Features.Storages.IAuthorizationRequestStorage,Microsoft.Extensions.Options.IOptionsSnapshot_Abblix.Oidc.Server.Common.Configuration.OidcOptions_).storage} ###### `options` [Microsoft\.Extensions\.Options\.IOptionsSnapshot<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptionssnapshot-1 'Microsoft\.Extensions\.Options\.IOptionsSnapshot\`1')[OidcOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptionssnapshot-1 'Microsoft\.Extensions\.Options\.IOptionsSnapshot\`1') {#Abblix.Oidc.Server.Endpoints.PushedAuthorization.PushedAuthorizationRequestProcessor.PushedAuthorizationRequestProcessor(Abblix.Oidc.Server.Features.Storages.IAuthorizationRequestStorage,Microsoft.Extensions.Options.IOptionsSnapshot_Abblix.Oidc.Server.Common.Configuration.OidcOptions_).options} ### Methods ## PushedAuthorizationRequestProcessor\.ProcessAsync\(ValidAuthorizationRequest\) Method {#Abblix.Oidc.Server.Endpoints.PushedAuthorization.PushedAuthorizationRequestProcessor.ProcessAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest)} Asynchronously processes a valid pushed authorization request by storing it and returning a response that includes the request URI for later retrieval and the duration for which the request is valid\. ```csharp public System.Threading.Tasks.Task ProcessAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest request); ``` #### Parameters ###### `request` [ValidAuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.ValidAuthorizationRequest') {#Abblix.Oidc.Server.Endpoints.PushedAuthorization.PushedAuthorizationRequestProcessor.ProcessAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest).request} The valid pushed authorization request to process\. Implements [ProcessAsync\(ValidAuthorizationRequest\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.PushedAuthorization.Interfaces.IPushedAuthorizationRequestProcessor#Abblix.Oidc.Server.Endpoints.PushedAuthorization.Interfaces.IPushedAuthorizationRequestProcessor.ProcessAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest) 'Abblix\.Oidc\.Server\.Endpoints\.PushedAuthorization\.Interfaces\.IPushedAuthorizationRequestProcessor\.ProcessAsync\(Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.ValidAuthorizationRequest\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[AuthorizationResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationResponse 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationResponse')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task that resolves to an [AuthorizationResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationResponse 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationResponse') containing the request URI and expiration information\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.PushedAuthorization.PushedAuthorizationRequestValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.PushedAuthorization](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.PushedAuthorization 'Abblix\.Oidc\.Server\.Endpoints\.PushedAuthorization') ## PushedAuthorizationRequestValidator Class Validates pushed authorization requests by enforcing OAuth 2\.0 protocol constraints\. This validator ensures that requests do not use prohibited parameters and comply with standard authorization request requirements\. ```csharp public class PushedAuthorizationRequestValidator : Abblix.Oidc.Server.Endpoints.PushedAuthorization.Interfaces.IPushedAuthorizationRequestValidator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → PushedAuthorizationRequestValidator Implements [IPushedAuthorizationRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.PushedAuthorization.Interfaces.IPushedAuthorizationRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.PushedAuthorization\.Interfaces\.IPushedAuthorizationRequestValidator') ### Constructors ## PushedAuthorizationRequestValidator\(IAuthorizationRequestValidator, IClientAuthenticator, IProofValidator\) Constructor {#Abblix.Oidc.Server.Endpoints.PushedAuthorization.PushedAuthorizationRequestValidator.PushedAuthorizationRequestValidator(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationRequestValidator,Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator,Abblix.Oidc.Server.Features.DPoP.IProofValidator)} Validates pushed authorization requests by enforcing OAuth 2\.0 protocol constraints\. This validator ensures that requests do not use prohibited parameters and comply with standard authorization request requirements\. ```csharp public PushedAuthorizationRequestValidator(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationRequestValidator authorizationRequestValidator, Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator clientAuthenticator, Abblix.Oidc.Server.Features.DPoP.IProofValidator proofValidator); ``` #### Parameters ###### `authorizationRequestValidator` [IAuthorizationRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.IAuthorizationRequestValidator') {#Abblix.Oidc.Server.Endpoints.PushedAuthorization.PushedAuthorizationRequestValidator.PushedAuthorizationRequestValidator(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationRequestValidator,Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator,Abblix.Oidc.Server.Features.DPoP.IProofValidator).authorizationRequestValidator} ###### `clientAuthenticator` [IClientAuthenticator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator 'Abblix\.Oidc\.Server\.Features\.ClientAuthentication\.IClientAuthenticator') {#Abblix.Oidc.Server.Endpoints.PushedAuthorization.PushedAuthorizationRequestValidator.PushedAuthorizationRequestValidator(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationRequestValidator,Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator,Abblix.Oidc.Server.Features.DPoP.IProofValidator).clientAuthenticator} ###### `proofValidator` [IProofValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DPoP.IProofValidator 'Abblix\.Oidc\.Server\.Features\.DPoP\.IProofValidator') {#Abblix.Oidc.Server.Endpoints.PushedAuthorization.PushedAuthorizationRequestValidator.PushedAuthorizationRequestValidator(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationRequestValidator,Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator,Abblix.Oidc.Server.Features.DPoP.IProofValidator).proofValidator} ### Methods ## PushedAuthorizationRequestValidator\.ValidateAsync\(AuthorizationRequest, ClientRequest\) Method {#Abblix.Oidc.Server.Endpoints.PushedAuthorization.PushedAuthorizationRequestValidator.ValidateAsync(Abblix.Oidc.Server.Model.AuthorizationRequest,Abblix.Oidc.Server.Model.ClientRequest)} Validates a pushed authorization request according to OAuth 2\.0 and OpenID Connect standards\. This method ensures that the request does not contain prohibited parameters like 'request\_uri' and verifies that it adheres to the client's registered parameters\. It effectively prevents misuse and ensures that the request is legitimately associated with the authenticated client\. ```csharp public System.Threading.Tasks.Task> ValidateAsync(Abblix.Oidc.Server.Model.AuthorizationRequest authorizationRequest, Abblix.Oidc.Server.Model.ClientRequest clientRequest); ``` #### Parameters ###### `authorizationRequest` [AuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.AuthorizationRequest 'Abblix\.Oidc\.Server\.Model\.AuthorizationRequest') {#Abblix.Oidc.Server.Endpoints.PushedAuthorization.PushedAuthorizationRequestValidator.ValidateAsync(Abblix.Oidc.Server.Model.AuthorizationRequest,Abblix.Oidc.Server.Model.ClientRequest).authorizationRequest} The authorization request to be validated\. ###### `clientRequest` [ClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRequest 'Abblix\.Oidc\.Server\.Model\.ClientRequest') {#Abblix.Oidc.Server.Endpoints.PushedAuthorization.PushedAuthorizationRequestValidator.ValidateAsync(Abblix.Oidc.Server.Model.AuthorizationRequest,Abblix.Oidc.Server.Model.ClientRequest).clientRequest} Carrier of the client's authentication credentials \(basic, JWT assertion, mTLS, etc\.\) used to authenticate the client per RFC 9126 §2\. Also carries an optional DPoP header used to pre\-bind the request to a proof\-of\-possession key \(RFC 9449 §10\)\. Implements [ValidateAsync\(AuthorizationRequest, ClientRequest\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.PushedAuthorization.Interfaces.IPushedAuthorizationRequestValidator#Abblix.Oidc.Server.Endpoints.PushedAuthorization.Interfaces.IPushedAuthorizationRequestValidator.ValidateAsync(Abblix.Oidc.Server.Model.AuthorizationRequest,Abblix.Oidc.Server.Model.ClientRequest) 'Abblix\.Oidc\.Server\.Endpoints\.PushedAuthorization\.Interfaces\.IPushedAuthorizationRequestValidator\.ValidateAsync\(Abblix\.Oidc\.Server\.Model\.AuthorizationRequest, Abblix\.Oidc\.Server\.Model\.ClientRequest\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[ValidAuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.ValidAuthorizationRequest')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[AuthorizationRequestValidationError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationRequestValidationError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task that resolves to a validation result, indicating whether the request is valid and adheres to the expected protocol constraints\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.PushedAuthorization.Interfaces.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ## Abblix\.Oidc\.Server\.Endpoints\.PushedAuthorization\.Interfaces Namespace | Classes | | | :--- | :--- | | [PushedAuthorizationResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.PushedAuthorization.Interfaces.PushedAuthorizationResponse 'Abblix\.Oidc\.Server\.Endpoints\.PushedAuthorization\.Interfaces\.PushedAuthorizationResponse') | Successful response from the Pushed Authorization Request endpoint \(RFC 9126 §2\.2\): the opaque `request_uri` the client must echo to the authorization endpoint, and the lifetime `expires_in` in seconds after which the server may discard the stored request payload\. | | Interfaces | | | :--- | :--- | | [IPushedAuthorizationHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.PushedAuthorization.Interfaces.IPushedAuthorizationHandler 'Abblix\.Oidc\.Server\.Endpoints\.PushedAuthorization\.Interfaces\.IPushedAuthorizationHandler') | Defines the contract for handling Pushed Authorization Requests \(PAR\) as specified in OAuth 2\.0 and OpenID Connect\. Ensures that implementations can validate and process these requests in a secure and compliant manner\. | | [IPushedAuthorizationRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.PushedAuthorization.Interfaces.IPushedAuthorizationRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.PushedAuthorization\.Interfaces\.IPushedAuthorizationRequestProcessor') | Processes valid pushed authorization requests, generating a response that includes the request's URI and its expiration\. | | [IPushedAuthorizationRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.PushedAuthorization.Interfaces.IPushedAuthorizationRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.PushedAuthorization\.Interfaces\.IPushedAuthorizationRequestValidator') | Provides validation for pushed authorization requests in an OAuth 2\.0 context, ensuring they adhere to protocol specifications\. This interface evaluates the conformity of authorization requests with expected parameters and limitations before their acceptance for processing\. | --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.PushedAuthorization.Interfaces.IPushedAuthorizationHandler.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.PushedAuthorization\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.PushedAuthorization.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.PushedAuthorization\.Interfaces') ## IPushedAuthorizationHandler Interface Defines the contract for handling Pushed Authorization Requests \(PAR\) as specified in OAuth 2\.0 and OpenID Connect\. Ensures that implementations can validate and process these requests in a secure and compliant manner\. ```csharp public interface IPushedAuthorizationHandler ``` Derived ↳ [PushedAuthorizationHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.PushedAuthorization.PushedAuthorizationHandler 'Abblix\.Oidc\.Server\.Endpoints\.PushedAuthorization\.PushedAuthorizationHandler') ### Methods ## IPushedAuthorizationHandler\.HandleAsync\(AuthorizationRequest, ClientRequest\) Method {#Abblix.Oidc.Server.Endpoints.PushedAuthorization.Interfaces.IPushedAuthorizationHandler.HandleAsync(Abblix.Oidc.Server.Model.AuthorizationRequest,Abblix.Oidc.Server.Model.ClientRequest)} Asynchronously handles and processes a Pushed Authorization Request, ensuring it complies with OAuth 2\.0 and OpenID Connect specifications\. ```csharp System.Threading.Tasks.Task HandleAsync(Abblix.Oidc.Server.Model.AuthorizationRequest authorizationRequest, Abblix.Oidc.Server.Model.ClientRequest clientRequest); ``` #### Parameters ###### `authorizationRequest` [AuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.AuthorizationRequest 'Abblix\.Oidc\.Server\.Model\.AuthorizationRequest') {#Abblix.Oidc.Server.Endpoints.PushedAuthorization.Interfaces.IPushedAuthorizationHandler.HandleAsync(Abblix.Oidc.Server.Model.AuthorizationRequest,Abblix.Oidc.Server.Model.ClientRequest).authorizationRequest} An instance of [AuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.AuthorizationRequest 'Abblix\.Oidc\.Server\.Model\.AuthorizationRequest') representing the details of the authorization request submitted by the client\. ###### `clientRequest` [ClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRequest 'Abblix\.Oidc\.Server\.Model\.ClientRequest') {#Abblix.Oidc.Server.Endpoints.PushedAuthorization.Interfaces.IPushedAuthorizationHandler.HandleAsync(Abblix.Oidc.Server.Model.AuthorizationRequest,Abblix.Oidc.Server.Model.ClientRequest).clientRequest} An instance of [ClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRequest 'Abblix\.Oidc\.Server\.Model\.ClientRequest') providing additional information about the client making the request, used for contextual validation\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[AuthorizationResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationResponse 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationResponse')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A [System\.Threading\.Tasks\.Task](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task 'System\.Threading\.Tasks\.Task') that resolves to an [AuthorizationResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationResponse 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationResponse'), indicating the outcome of the request processing\. The response can be a successful authorization or an error response if the request fails validation or processing\. ### Remarks This method is central to the PAR mechanism, enabling clients to pre\-register authorization requests\. It validates the request against system policies and, if valid, processes it to generate a unique request URI or returns an error if the request is invalid or unauthorized\. This approach enhances security by minimizing the exposure of sensitive information in subsequent authorization requests\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.PushedAuthorization.Interfaces.IPushedAuthorizationRequestProcessor.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.PushedAuthorization\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.PushedAuthorization.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.PushedAuthorization\.Interfaces') ## IPushedAuthorizationRequestProcessor Interface Processes valid pushed authorization requests, generating a response that includes the request's URI and its expiration\. ```csharp public interface IPushedAuthorizationRequestProcessor ``` Derived ↳ [PushedAuthorizationRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.PushedAuthorization.PushedAuthorizationRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.PushedAuthorization\.PushedAuthorizationRequestProcessor') ### Methods ## IPushedAuthorizationRequestProcessor\.ProcessAsync\(ValidAuthorizationRequest\) Method {#Abblix.Oidc.Server.Endpoints.PushedAuthorization.Interfaces.IPushedAuthorizationRequestProcessor.ProcessAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest)} Asynchronously processes a valid authorization request and generates a response\. ```csharp System.Threading.Tasks.Task ProcessAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest request); ``` #### Parameters ###### `request` [ValidAuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.ValidAuthorizationRequest') {#Abblix.Oidc.Server.Endpoints.PushedAuthorization.Interfaces.IPushedAuthorizationRequestProcessor.ProcessAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest).request} The valid authorization request to process\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[AuthorizationResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationResponse 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationResponse')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task that resolves to an authorization response, including the request URI and expiration time\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.PushedAuthorization.Interfaces.IPushedAuthorizationRequestValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.PushedAuthorization\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.PushedAuthorization.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.PushedAuthorization\.Interfaces') ## IPushedAuthorizationRequestValidator Interface Provides validation for pushed authorization requests in an OAuth 2\.0 context, ensuring they adhere to protocol specifications\. This interface evaluates the conformity of authorization requests with expected parameters and limitations before their acceptance for processing\. ```csharp public interface IPushedAuthorizationRequestValidator ``` Derived ↳ [PushedAuthorizationRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.PushedAuthorization.PushedAuthorizationRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.PushedAuthorization\.PushedAuthorizationRequestValidator') ### Methods ## IPushedAuthorizationRequestValidator\.ValidateAsync\(AuthorizationRequest, ClientRequest\) Method {#Abblix.Oidc.Server.Endpoints.PushedAuthorization.Interfaces.IPushedAuthorizationRequestValidator.ValidateAsync(Abblix.Oidc.Server.Model.AuthorizationRequest,Abblix.Oidc.Server.Model.ClientRequest)} Asynchronously validates a pushed authorization request against OAuth 2\.0 specifications\. This method ensures the request meets all necessary criteria and constraints defined for secure processing\. ```csharp System.Threading.Tasks.Task> ValidateAsync(Abblix.Oidc.Server.Model.AuthorizationRequest authorizationRequest, Abblix.Oidc.Server.Model.ClientRequest clientRequest); ``` #### Parameters ###### `authorizationRequest` [AuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.AuthorizationRequest 'Abblix\.Oidc\.Server\.Model\.AuthorizationRequest') {#Abblix.Oidc.Server.Endpoints.PushedAuthorization.Interfaces.IPushedAuthorizationRequestValidator.ValidateAsync(Abblix.Oidc.Server.Model.AuthorizationRequest,Abblix.Oidc.Server.Model.ClientRequest).authorizationRequest} The authorization request to be validated\. ###### `clientRequest` [ClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRequest 'Abblix\.Oidc\.Server\.Model\.ClientRequest') {#Abblix.Oidc.Server.Endpoints.PushedAuthorization.Interfaces.IPushedAuthorizationRequestValidator.ValidateAsync(Abblix.Oidc.Server.Model.AuthorizationRequest,Abblix.Oidc.Server.Model.ClientRequest).clientRequest} Additional client request information for contextual validation\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[ValidAuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.ValidAuthorizationRequest')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[AuthorizationRequestValidationError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationRequestValidationError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task that upon completion provides a validation result, indicating either success and validity of the request or the presence of errors\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.PushedAuthorization.Interfaces.PushedAuthorizationResponse.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.PushedAuthorization\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.PushedAuthorization.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.PushedAuthorization\.Interfaces') ## PushedAuthorizationResponse Class Successful response from the Pushed Authorization Request endpoint \(RFC 9126 §2\.2\): the opaque `request_uri` the client must echo to the authorization endpoint, and the lifetime `expires_in` in seconds after which the server may discard the stored request payload\. ```csharp public record PushedAuthorizationResponse : Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationResponse, System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [AuthorizationResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationResponse 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationResponse') → PushedAuthorizationResponse Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[PushedAuthorizationResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.PushedAuthorization.Interfaces.PushedAuthorizationResponse 'Abblix\.Oidc\.Server\.Endpoints\.PushedAuthorization\.Interfaces\.PushedAuthorizationResponse')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Constructors ## PushedAuthorizationResponse\(AuthorizationRequest, Uri, TimeSpan\) Constructor {#Abblix.Oidc.Server.Endpoints.PushedAuthorization.Interfaces.PushedAuthorizationResponse.PushedAuthorizationResponse(Abblix.Oidc.Server.Model.AuthorizationRequest,System.Uri,System.TimeSpan)} Successful response from the Pushed Authorization Request endpoint \(RFC 9126 §2\.2\): the opaque `request_uri` the client must echo to the authorization endpoint, and the lifetime `expires_in` in seconds after which the server may discard the stored request payload\. ```csharp public PushedAuthorizationResponse(Abblix.Oidc.Server.Model.AuthorizationRequest Model, System.Uri RequestUri, System.TimeSpan ExpiresIn); ``` #### Parameters ###### `Model` [AuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.AuthorizationRequest 'Abblix\.Oidc\.Server\.Model\.AuthorizationRequest') {#Abblix.Oidc.Server.Endpoints.PushedAuthorization.Interfaces.PushedAuthorizationResponse.PushedAuthorizationResponse(Abblix.Oidc.Server.Model.AuthorizationRequest,System.Uri,System.TimeSpan).Model} ###### `RequestUri` [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri') {#Abblix.Oidc.Server.Endpoints.PushedAuthorization.Interfaces.PushedAuthorizationResponse.PushedAuthorizationResponse(Abblix.Oidc.Server.Model.AuthorizationRequest,System.Uri,System.TimeSpan).RequestUri} ###### `ExpiresIn` [System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan') {#Abblix.Oidc.Server.Endpoints.PushedAuthorization.Interfaces.PushedAuthorizationResponse.PushedAuthorizationResponse(Abblix.Oidc.Server.Model.AuthorizationRequest,System.Uri,System.TimeSpan).ExpiresIn} ### Properties ## PushedAuthorizationResponse\.ExpiresIn Property {#Abblix.Oidc.Server.Endpoints.PushedAuthorization.Interfaces.PushedAuthorizationResponse.ExpiresIn} RFC 9126 §2\.2 `expires_in`: lifetime of [RequestUri](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.PushedAuthorization.Interfaces.PushedAuthorizationResponse#Abblix.Oidc.Server.Endpoints.PushedAuthorization.Interfaces.PushedAuthorizationResponse.RequestUri 'Abblix\.Oidc\.Server\.Endpoints\.PushedAuthorization\.Interfaces\.PushedAuthorizationResponse\.RequestUri'); once it elapses the authorization server is free to invalidate the entry and reject any subsequent authorization request that references it\. ```csharp public System.TimeSpan ExpiresIn { get; init; } ``` #### Property Value [System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan') ## PushedAuthorizationResponse\.RequestUri Property {#Abblix.Oidc.Server.Endpoints.PushedAuthorization.Interfaces.PushedAuthorizationResponse.RequestUri} RFC 9126 §2\.2 `request_uri`: a one\-time\-use, server\-generated reference to the stored authorization request, to be passed by the client on the redirect to the authorization endpoint instead of the parameters themselves\. ```csharp public System.Uri RequestUri { get; init; } ``` #### Property Value [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Revocation.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ## Abblix\.Oidc\.Server\.Endpoints\.Revocation Namespace | Classes | | | :--- | :--- | | [RevocationHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Revocation.RevocationHandler 'Abblix\.Oidc\.Server\.Endpoints\.Revocation\.RevocationHandler') | Manages the handling of token revocation requests in accordance with OAuth 2\.0 specifications, ensuring that such requests are properly validated and processed to revoke tokens as intended\. | | [RevocationRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Revocation.RevocationRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.Revocation\.RevocationRequestProcessor') | Processes revocation requests for tokens\. This class is responsible for handling the logic associated with revoking tokens, such as access tokens or refresh tokens\. | | [RevocationRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Revocation.RevocationRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.Revocation\.RevocationRequestValidator') | Validates revocation requests in accordance with OAuth 2\.0 standards\. This class is responsible for ensuring that revocation requests meet the criteria specified in OAuth 2\.0 Token Revocation \(RFC 7009\)\. It validates the authenticity of the client and the token involved in the request\. | --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Revocation.RevocationHandler.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Revocation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Revocation 'Abblix\.Oidc\.Server\.Endpoints\.Revocation') ## RevocationHandler Class Manages the handling of token revocation requests in accordance with OAuth 2\.0 specifications, ensuring that such requests are properly validated and processed to revoke tokens as intended\. ```csharp public class RevocationHandler : Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.IRevocationHandler ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → RevocationHandler Implements [IRevocationHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.IRevocationHandler 'Abblix\.Oidc\.Server\.Endpoints\.Revocation\.Interfaces\.IRevocationHandler') ### Constructors ## RevocationHandler\(IRevocationRequestValidator, IRevocationRequestProcessor\) Constructor {#Abblix.Oidc.Server.Endpoints.Revocation.RevocationHandler.RevocationHandler(Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.IRevocationRequestValidator,Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.IRevocationRequestProcessor)} Manages the handling of token revocation requests in accordance with OAuth 2\.0 specifications, ensuring that such requests are properly validated and processed to revoke tokens as intended\. ```csharp public RevocationHandler(Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.IRevocationRequestValidator validator, Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.IRevocationRequestProcessor processor); ``` #### Parameters ###### `validator` [IRevocationRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.IRevocationRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.Revocation\.Interfaces\.IRevocationRequestValidator') {#Abblix.Oidc.Server.Endpoints.Revocation.RevocationHandler.RevocationHandler(Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.IRevocationRequestValidator,Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.IRevocationRequestProcessor).validator} An implementation of [IRevocationRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.IRevocationRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.Revocation\.Interfaces\.IRevocationRequestValidator') responsible for validating the revocation request against the OAuth 2\.0 specifications\. ###### `processor` [IRevocationRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.IRevocationRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.Revocation\.Interfaces\.IRevocationRequestProcessor') {#Abblix.Oidc.Server.Endpoints.Revocation.RevocationHandler.RevocationHandler(Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.IRevocationRequestValidator,Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.IRevocationRequestProcessor).processor} An implementation of [IRevocationRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.IRevocationRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.Revocation\.Interfaces\.IRevocationRequestProcessor') responsible for processing validated revocation requests to effectively revoke tokens\. ### Methods ## RevocationHandler\.HandleAsync\(RevocationRequest, ClientRequest\) Method {#Abblix.Oidc.Server.Endpoints.Revocation.RevocationHandler.HandleAsync(Abblix.Oidc.Server.Model.RevocationRequest,Abblix.Oidc.Server.Model.ClientRequest)} Asynchronously handles a token revocation request by validating it and then processing it if the validation succeeds\. ```csharp public System.Threading.Tasks.Task> HandleAsync(Abblix.Oidc.Server.Model.RevocationRequest revocationRequest, Abblix.Oidc.Server.Model.ClientRequest clientRequest); ``` #### Parameters ###### `revocationRequest` [RevocationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.RevocationRequest 'Abblix\.Oidc\.Server\.Model\.RevocationRequest') {#Abblix.Oidc.Server.Endpoints.Revocation.RevocationHandler.HandleAsync(Abblix.Oidc.Server.Model.RevocationRequest,Abblix.Oidc.Server.Model.ClientRequest).revocationRequest} The revocation request details, mapped to the model expected by the system\. ###### `clientRequest` [ClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRequest 'Abblix\.Oidc\.Server\.Model\.ClientRequest') {#Abblix.Oidc.Server.Endpoints.Revocation.RevocationHandler.HandleAsync(Abblix.Oidc.Server.Model.RevocationRequest,Abblix.Oidc.Server.Model.ClientRequest).clientRequest} Additional client request information that may be necessary for validation\. Implements [HandleAsync\(RevocationRequest, ClientRequest\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.IRevocationHandler#Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.IRevocationHandler.HandleAsync(Abblix.Oidc.Server.Model.RevocationRequest,Abblix.Oidc.Server.Model.ClientRequest) 'Abblix\.Oidc\.Server\.Endpoints\.Revocation\.Interfaces\.IRevocationHandler\.HandleAsync\(Abblix\.Oidc\.Server\.Model\.RevocationRequest, Abblix\.Oidc\.Server\.Model\.ClientRequest\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[TokenRevoked](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.TokenRevoked 'Abblix\.Oidc\.Server\.Endpoints\.Revocation\.Interfaces\.TokenRevoked')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A [System\.Threading\.Tasks\.Task](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task 'System\.Threading\.Tasks\.Task') that resolves to a [Result<TSuccess,TFailure>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2') containing either [TokenRevoked](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.TokenRevoked 'Abblix\.Oidc\.Server\.Endpoints\.Revocation\.Interfaces\.TokenRevoked') on success or [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') on failure\. ### Remarks This method plays a critical role in maintaining the security and integrity of the OAuth 2\.0 ecosystem by allowing tokens to be revoked when they are no longer needed or when a security issue necessitates their invalidation\. It ensures that revocation requests are thoroughly vetted before any action is taken, preventing unauthorized or malicious attempts to revoke tokens\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Revocation.RevocationRequestProcessor.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Revocation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Revocation 'Abblix\.Oidc\.Server\.Endpoints\.Revocation') ## RevocationRequestProcessor Class Processes revocation requests for tokens\. This class is responsible for handling the logic associated with revoking tokens, such as access tokens or refresh tokens\. ```csharp public class RevocationRequestProcessor : Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.IRevocationRequestProcessor ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → RevocationRequestProcessor Implements [IRevocationRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.IRevocationRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.Revocation\.Interfaces\.IRevocationRequestProcessor') ### Constructors ## RevocationRequestProcessor\(ITokenRegistry, TimeProvider\) Constructor {#Abblix.Oidc.Server.Endpoints.Revocation.RevocationRequestProcessor.RevocationRequestProcessor(Abblix.Oidc.Server.Features.Storages.ITokenRegistry,System.TimeProvider)} Processes revocation requests for tokens\. This class is responsible for handling the logic associated with revoking tokens, such as access tokens or refresh tokens\. ```csharp public RevocationRequestProcessor(Abblix.Oidc.Server.Features.Storages.ITokenRegistry tokenRegistry, System.TimeProvider clock); ``` #### Parameters ###### `tokenRegistry` [ITokenRegistry](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Storages.ITokenRegistry 'Abblix\.Oidc\.Server\.Features\.Storages\.ITokenRegistry') {#Abblix.Oidc.Server.Endpoints.Revocation.RevocationRequestProcessor.RevocationRequestProcessor(Abblix.Oidc.Server.Features.Storages.ITokenRegistry,System.TimeProvider).tokenRegistry} The token registry to be used by this processor for managing token statuses\. ###### `clock` [System\.TimeProvider](https://learn.microsoft.com/en-us/dotnet/api/system.timeprovider 'System\.TimeProvider') {#Abblix.Oidc.Server.Endpoints.Revocation.RevocationRequestProcessor.RevocationRequestProcessor(Abblix.Oidc.Server.Features.Storages.ITokenRegistry,System.TimeProvider).clock} Provides the current time for timestamping the revocation operation\. ### Methods ## RevocationRequestProcessor\.ProcessAsync\(ValidRevocationRequest\) Method {#Abblix.Oidc.Server.Endpoints.Revocation.RevocationRequestProcessor.ProcessAsync(Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.ValidRevocationRequest)} Asynchronously processes a valid revocation request\. This method handles the revocation of a specified token by changing its status to 'Revoked' in the token registry\. The operation ensures that the token is no longer valid for any future requests\. ```csharp public System.Threading.Tasks.Task> ProcessAsync(Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.ValidRevocationRequest request); ``` #### Parameters ###### `request` [ValidRevocationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.ValidRevocationRequest 'Abblix\.Oidc\.Server\.Endpoints\.Revocation\.Interfaces\.ValidRevocationRequest') {#Abblix.Oidc.Server.Endpoints.Revocation.RevocationRequestProcessor.ProcessAsync(Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.ValidRevocationRequest).request} The revocation request to be processed\. Contains information about the token to be revoked\. Implements [ProcessAsync\(ValidRevocationRequest\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.IRevocationRequestProcessor#Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.IRevocationRequestProcessor.ProcessAsync(Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.ValidRevocationRequest) 'Abblix\.Oidc\.Server\.Endpoints\.Revocation\.Interfaces\.IRevocationRequestProcessor\.ProcessAsync\(Abblix\.Oidc\.Server\.Endpoints\.Revocation\.Interfaces\.ValidRevocationRequest\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[TokenRevoked](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.TokenRevoked 'Abblix\.Oidc\.Server\.Endpoints\.Revocation\.Interfaces\.TokenRevoked')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A [System\.Threading\.Tasks\.Task](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task 'System\.Threading\.Tasks\.Task') representing the asynchronous operation, which upon completion will yield a [Result<TSuccess,TFailure>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2') containing either [TokenRevoked](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.TokenRevoked 'Abblix\.Oidc\.Server\.Endpoints\.Revocation\.Interfaces\.TokenRevoked') on success or [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') on failure\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Revocation.RevocationRequestValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Revocation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Revocation 'Abblix\.Oidc\.Server\.Endpoints\.Revocation') ## RevocationRequestValidator Class Validates revocation requests in accordance with OAuth 2\.0 standards\. This class is responsible for ensuring that revocation requests meet the criteria specified in OAuth 2\.0 Token Revocation \(RFC 7009\)\. It validates the authenticity of the client and the token involved in the request\. ```csharp public class RevocationRequestValidator : Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.IRevocationRequestValidator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → RevocationRequestValidator Implements [IRevocationRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.IRevocationRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.Revocation\.Interfaces\.IRevocationRequestValidator') ### Constructors ## RevocationRequestValidator\(ILogger\, IClientAuthenticator, IAuthServiceJwtValidator\) Constructor {#Abblix.Oidc.Server.Endpoints.Revocation.RevocationRequestValidator.RevocationRequestValidator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.Revocation.RevocationRequestValidator_,Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator,Abblix.Oidc.Server.Features.Tokens.Validation.IAuthServiceJwtValidator)} Validates revocation requests in accordance with OAuth 2\.0 standards\. This class is responsible for ensuring that revocation requests meet the criteria specified in OAuth 2\.0 Token Revocation \(RFC 7009\)\. It validates the authenticity of the client and the token involved in the request\. ```csharp public RevocationRequestValidator(Microsoft.Extensions.Logging.ILogger logger, Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator clientAuthenticator, Abblix.Oidc.Server.Features.Tokens.Validation.IAuthServiceJwtValidator jwtValidator); ``` #### Parameters ###### `logger` [Microsoft\.Extensions\.Logging\.ILogger<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1')[RevocationRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Revocation.RevocationRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.Revocation\.RevocationRequestValidator')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1') {#Abblix.Oidc.Server.Endpoints.Revocation.RevocationRequestValidator.RevocationRequestValidator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.Revocation.RevocationRequestValidator_,Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator,Abblix.Oidc.Server.Features.Tokens.Validation.IAuthServiceJwtValidator).logger} Provides logging capabilities to record validation outcomes and errors\. ###### `clientAuthenticator` [IClientAuthenticator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator 'Abblix\.Oidc\.Server\.Features\.ClientAuthentication\.IClientAuthenticator') {#Abblix.Oidc.Server.Endpoints.Revocation.RevocationRequestValidator.RevocationRequestValidator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.Revocation.RevocationRequestValidator_,Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator,Abblix.Oidc.Server.Features.Tokens.Validation.IAuthServiceJwtValidator).clientAuthenticator} The client request authenticator to be used in the validation process\. Ensures that the client sending the revocation request is authenticated and authorized to revoke tokens\. ###### `jwtValidator` [IAuthServiceJwtValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.Validation.IAuthServiceJwtValidator 'Abblix\.Oidc\.Server\.Features\.Tokens\.Validation\.IAuthServiceJwtValidator') {#Abblix.Oidc.Server.Endpoints.Revocation.RevocationRequestValidator.RevocationRequestValidator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.Revocation.RevocationRequestValidator_,Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator,Abblix.Oidc.Server.Features.Tokens.Validation.IAuthServiceJwtValidator).jwtValidator} The JWT validator to be used for validating the token included in the revocation request\. Ensures that the token is valid and that it belongs to the client requesting revocation\. ### Methods ## RevocationRequestValidator\.ValidateAsync\(RevocationRequest, ClientRequest\) Method {#Abblix.Oidc.Server.Endpoints.Revocation.RevocationRequestValidator.ValidateAsync(Abblix.Oidc.Server.Model.RevocationRequest,Abblix.Oidc.Server.Model.ClientRequest)} Asynchronously validates a revocation request against the OAuth 2\.0 revocation request specifications\. It checks the client's credentials and the validity of the token to be revoked\. The validation ensures that the token belongs to the authenticated client and is valid as per JWT standards\. ```csharp public System.Threading.Tasks.Task> ValidateAsync(Abblix.Oidc.Server.Model.RevocationRequest revocationRequest, Abblix.Oidc.Server.Model.ClientRequest clientRequest); ``` #### Parameters ###### `revocationRequest` [RevocationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.RevocationRequest 'Abblix\.Oidc\.Server\.Model\.RevocationRequest') {#Abblix.Oidc.Server.Endpoints.Revocation.RevocationRequestValidator.ValidateAsync(Abblix.Oidc.Server.Model.RevocationRequest,Abblix.Oidc.Server.Model.ClientRequest).revocationRequest} The revocation request to be validated\. Contains the token to be revoked and client information\. ###### `clientRequest` [ClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRequest 'Abblix\.Oidc\.Server\.Model\.ClientRequest') {#Abblix.Oidc.Server.Endpoints.Revocation.RevocationRequestValidator.ValidateAsync(Abblix.Oidc.Server.Model.RevocationRequest,Abblix.Oidc.Server.Model.ClientRequest).clientRequest} Additional client request information for contextual validation\. Implements [ValidateAsync\(RevocationRequest, ClientRequest\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.IRevocationRequestValidator#Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.IRevocationRequestValidator.ValidateAsync(Abblix.Oidc.Server.Model.RevocationRequest,Abblix.Oidc.Server.Model.ClientRequest) 'Abblix\.Oidc\.Server\.Endpoints\.Revocation\.Interfaces\.IRevocationRequestValidator\.ValidateAsync\(Abblix\.Oidc\.Server\.Model\.RevocationRequest, Abblix\.Oidc\.Server\.Model\.ClientRequest\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[ValidRevocationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.ValidRevocationRequest 'Abblix\.Oidc\.Server\.Endpoints\.Revocation\.Interfaces\.ValidRevocationRequest')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A [System\.Threading\.Tasks\.Task](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task 'System\.Threading\.Tasks\.Task') representing the asynchronous operation, which upon completion will yield a [Result<TSuccess,TFailure>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')\. The result indicates whether the request is valid or contains any errors\. ### Remarks This method follows the OAuth 2\.0 revocation flow, ensuring that the token being revoked belongs to the authenticated client, protecting against cross\-client token revocation\. In case of validation failure, it logs a warning with the specific cause\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ## Abblix\.Oidc\.Server\.Endpoints\.Revocation\.Interfaces Namespace | Classes | | | :--- | :--- | | [TokenRevoked](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.TokenRevoked 'Abblix\.Oidc\.Server\.Endpoints\.Revocation\.Interfaces\.TokenRevoked') | Represents a response indicating that the token has been successfully revoked\. | | [ValidRevocationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.ValidRevocationRequest 'Abblix\.Oidc\.Server\.Endpoints\.Revocation\.Interfaces\.ValidRevocationRequest') | Represents a valid revocation request, including the request model and the associated token, if available\. | | Interfaces | | | :--- | :--- | | [IRevocationHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.IRevocationHandler 'Abblix\.Oidc\.Server\.Endpoints\.Revocation\.Interfaces\.IRevocationHandler') | Defines a contract for handling revocation requests for access or refresh tokens as per OAuth 2\.0 Token Revocation specifications\. Ensures implementations can securely validate and process such requests to revoke tokens effectively\. | | [IRevocationRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.IRevocationRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.Revocation\.Interfaces\.IRevocationRequestProcessor') | Represents the capability to handle token revocation requests\. The authorization server invalidates tokens immediately upon revocation, preventing their future use\. Depending on the server's policy, revoking a token may also affect related tokens and the underlying authorization grant\. If a refresh token is revoked and the server supports revocation of access tokens, associated access tokens should also be invalidated\. | | [IRevocationRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.IRevocationRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.Revocation\.Interfaces\.IRevocationRequestValidator') | Represents the capability to validate revocation requests\. The authorization server validates client credentials \(for confidential clients\) and checks if the token was issued to the requesting client\. If validation fails, the request is refused, and an error message is provided to the client by the authorization server\. | --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.IRevocationHandler.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Revocation\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Revocation.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.Revocation\.Interfaces') ## IRevocationHandler Interface Defines a contract for handling revocation requests for access or refresh tokens as per OAuth 2\.0 Token Revocation specifications\. Ensures implementations can securely validate and process such requests to revoke tokens effectively\. ```csharp public interface IRevocationHandler ``` Derived ↳ [RevocationHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Revocation.RevocationHandler 'Abblix\.Oidc\.Server\.Endpoints\.Revocation\.RevocationHandler') ### Methods ## IRevocationHandler\.HandleAsync\(RevocationRequest, ClientRequest\) Method {#Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.IRevocationHandler.HandleAsync(Abblix.Oidc.Server.Model.RevocationRequest,Abblix.Oidc.Server.Model.ClientRequest)} Asynchronously handles a token revocation request by validating and then processing it to revoke the specified token\. ```csharp System.Threading.Tasks.Task> HandleAsync(Abblix.Oidc.Server.Model.RevocationRequest revocationRequest, Abblix.Oidc.Server.Model.ClientRequest clientRequest); ``` #### Parameters ###### `revocationRequest` [RevocationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.RevocationRequest 'Abblix\.Oidc\.Server\.Model\.RevocationRequest') {#Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.IRevocationHandler.HandleAsync(Abblix.Oidc.Server.Model.RevocationRequest,Abblix.Oidc.Server.Model.ClientRequest).revocationRequest} The details of the revocation request, including the token to be revoked\. ###### `clientRequest` [ClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRequest 'Abblix\.Oidc\.Server\.Model\.ClientRequest') {#Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.IRevocationHandler.HandleAsync(Abblix.Oidc.Server.Model.RevocationRequest,Abblix.Oidc.Server.Model.ClientRequest).clientRequest} Additional information about the client making the revocation request, necessary for context\-specific validation\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[TokenRevoked](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.TokenRevoked 'Abblix\.Oidc\.Server\.Endpoints\.Revocation\.Interfaces\.TokenRevoked')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A [System\.Threading\.Tasks\.Task](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task 'System\.Threading\.Tasks\.Task') that resolves to a [Result<TSuccess,TFailure>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2') containing either [TokenRevoked](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.TokenRevoked 'Abblix\.Oidc\.Server\.Endpoints\.Revocation\.Interfaces\.TokenRevoked') on success or [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') on failure\. ### Remarks This method is crucial for maintaining the security and integrity of the authorization server by allowing clients to revoke tokens that are no longer needed or may have been compromised\. Implementations must ensure that revocation requests are authenticated and authorized before proceeding with token revocation, adhering to the OAuth 2\.0 Token Revocation specification \(RFC 7009\)\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.IRevocationRequestProcessor.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Revocation\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Revocation.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.Revocation\.Interfaces') ## IRevocationRequestProcessor Interface Represents the capability to handle token revocation requests\. The authorization server invalidates tokens immediately upon revocation, preventing their future use\. Depending on the server's policy, revoking a token may also affect related tokens and the underlying authorization grant\. If a refresh token is revoked and the server supports revocation of access tokens, associated access tokens should also be invalidated\. ```csharp public interface IRevocationRequestProcessor ``` Derived ↳ [RevocationRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Revocation.RevocationRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.Revocation\.RevocationRequestProcessor') ### Remarks For more details, refer to RFC 7009 Section 2\.1: https://www.rfc-editor.org/rfc/rfc7009\#section-2.1 ### Methods ## IRevocationRequestProcessor\.ProcessAsync\(ValidRevocationRequest\) Method {#Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.IRevocationRequestProcessor.ProcessAsync(Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.ValidRevocationRequest)} Processes a token revocation request\. This method is responsible for handling the request to revoke a token, ensuring that the token and any associated tokens are invalidated\. ```csharp System.Threading.Tasks.Task> ProcessAsync(Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.ValidRevocationRequest request); ``` #### Parameters ###### `request` [ValidRevocationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.ValidRevocationRequest 'Abblix\.Oidc\.Server\.Endpoints\.Revocation\.Interfaces\.ValidRevocationRequest') {#Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.IRevocationRequestProcessor.ProcessAsync(Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.ValidRevocationRequest).request} The valid revocation request to be processed\. It contains the token that needs to be revoked along with any relevant information\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[TokenRevoked](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.TokenRevoked 'Abblix\.Oidc\.Server\.Endpoints\.Revocation\.Interfaces\.TokenRevoked')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task representing the asynchronous operation, which upon completion will return a [Result<TSuccess,TFailure>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2') containing either [TokenRevoked](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.TokenRevoked 'Abblix\.Oidc\.Server\.Endpoints\.Revocation\.Interfaces\.TokenRevoked') on success or [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') on failure\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.IRevocationRequestValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Revocation\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Revocation.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.Revocation\.Interfaces') ## IRevocationRequestValidator Interface Represents the capability to validate revocation requests\. The authorization server validates client credentials \(for confidential clients\) and checks if the token was issued to the requesting client\. If validation fails, the request is refused, and an error message is provided to the client by the authorization server\. ```csharp public interface IRevocationRequestValidator ``` Derived ↳ [RevocationRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Revocation.RevocationRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.Revocation\.RevocationRequestValidator') ### Methods ## IRevocationRequestValidator\.ValidateAsync\(RevocationRequest, ClientRequest\) Method {#Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.IRevocationRequestValidator.ValidateAsync(Abblix.Oidc.Server.Model.RevocationRequest,Abblix.Oidc.Server.Model.ClientRequest)} Validates a revocation request\. ```csharp System.Threading.Tasks.Task> ValidateAsync(Abblix.Oidc.Server.Model.RevocationRequest revocationRequest, Abblix.Oidc.Server.Model.ClientRequest clientRequest); ``` #### Parameters ###### `revocationRequest` [RevocationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.RevocationRequest 'Abblix\.Oidc\.Server\.Model\.RevocationRequest') {#Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.IRevocationRequestValidator.ValidateAsync(Abblix.Oidc.Server.Model.RevocationRequest,Abblix.Oidc.Server.Model.ClientRequest).revocationRequest} The revocation request to be validated\. ###### `clientRequest` [ClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRequest 'Abblix\.Oidc\.Server\.Model\.ClientRequest') {#Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.IRevocationRequestValidator.ValidateAsync(Abblix.Oidc.Server.Model.RevocationRequest,Abblix.Oidc.Server.Model.ClientRequest).clientRequest} Additional client request information for contextual validation\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[ValidRevocationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.ValidRevocationRequest 'Abblix\.Oidc\.Server\.Endpoints\.Revocation\.Interfaces\.ValidRevocationRequest')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task representing the asynchronous operation with the validation result\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.TokenRevoked.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Revocation\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Revocation.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.Revocation\.Interfaces') ## TokenRevoked Class Represents a response indicating that the token has been successfully revoked\. ```csharp public record TokenRevoked : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → TokenRevoked Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[TokenRevoked](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.TokenRevoked 'Abblix\.Oidc\.Server\.Endpoints\.Revocation\.Interfaces\.TokenRevoked')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Constructors ## TokenRevoked\(string, string, DateTimeOffset\) Constructor {#Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.TokenRevoked.TokenRevoked(string,string,System.DateTimeOffset)} Represents a response indicating that the token has been successfully revoked\. ```csharp public TokenRevoked(string? TokenId, string? TokenTypeHint, System.DateTimeOffset RevokedAt); ``` #### Parameters ###### `TokenId` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.TokenRevoked.TokenRevoked(string,string,System.DateTimeOffset).TokenId} The unique identifier \(jti\) of the revoked token, if available\. ###### `TokenTypeHint` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.TokenRevoked.TokenRevoked(string,string,System.DateTimeOffset).TokenTypeHint} The type hint of the token that was revoked \(e\.g\., access\_token, refresh\_token\)\. ###### `RevokedAt` [System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset') {#Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.TokenRevoked.TokenRevoked(string,string,System.DateTimeOffset).RevokedAt} The timestamp when the token was revoked\. ### Properties ## TokenRevoked\.RevokedAt Property {#Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.TokenRevoked.RevokedAt} The timestamp when the token was revoked\. ```csharp public System.DateTimeOffset RevokedAt { get; init; } ``` #### Property Value [System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset') ## TokenRevoked\.TokenId Property {#Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.TokenRevoked.TokenId} The unique identifier \(jti\) of the revoked token, if available\. ```csharp public string? TokenId { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## TokenRevoked\.TokenTypeHint Property {#Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.TokenRevoked.TokenTypeHint} The type hint of the token that was revoked \(e\.g\., access\_token, refresh\_token\)\. ```csharp public string? TokenTypeHint { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.ValidRevocationRequest.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Revocation\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Revocation.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.Revocation\.Interfaces') ## ValidRevocationRequest Class Represents a valid revocation request, including the request model and the associated token, if available\. ```csharp public record ValidRevocationRequest : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ValidRevocationRequest Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[ValidRevocationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.ValidRevocationRequest 'Abblix\.Oidc\.Server\.Endpoints\.Revocation\.Interfaces\.ValidRevocationRequest')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Constructors ## ValidRevocationRequest\(RevocationRequest, JsonWebToken\) Constructor {#Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.ValidRevocationRequest.ValidRevocationRequest(Abblix.Oidc.Server.Model.RevocationRequest,Abblix.Jwt.JsonWebToken)} Initializes a valid revocation request with the provided model and token\. ```csharp public ValidRevocationRequest(Abblix.Oidc.Server.Model.RevocationRequest model, Abblix.Jwt.JsonWebToken token); ``` #### Parameters ###### `model` [RevocationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.RevocationRequest 'Abblix\.Oidc\.Server\.Model\.RevocationRequest') {#Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.ValidRevocationRequest.ValidRevocationRequest(Abblix.Oidc.Server.Model.RevocationRequest,Abblix.Jwt.JsonWebToken).model} ###### `token` [JsonWebToken](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebToken 'Abblix\.Jwt\.JsonWebToken') {#Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.ValidRevocationRequest.ValidRevocationRequest(Abblix.Oidc.Server.Model.RevocationRequest,Abblix.Jwt.JsonWebToken).token} ### Properties ## ValidRevocationRequest\.Model Property {#Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.ValidRevocationRequest.Model} The revocation request model\. ```csharp public Abblix.Oidc.Server.Model.RevocationRequest Model { get; } ``` #### Property Value [RevocationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.RevocationRequest 'Abblix\.Oidc\.Server\.Model\.RevocationRequest') ## ValidRevocationRequest\.Token Property {#Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.ValidRevocationRequest.Token} The associated token, if available\. ```csharp public Abblix.Jwt.JsonWebToken? Token { get; } ``` #### Property Value [JsonWebToken](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebToken 'Abblix\.Jwt\.JsonWebToken') ### Methods ## ValidRevocationRequest\.InvalidToken\(RevocationRequest\) Method {#Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.ValidRevocationRequest.InvalidToken(Abblix.Oidc.Server.Model.RevocationRequest)} Creates a valid revocation request for an invalid token without a token association\. ```csharp public static Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.ValidRevocationRequest InvalidToken(Abblix.Oidc.Server.Model.RevocationRequest model); ``` #### Parameters ###### `model` [RevocationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.RevocationRequest 'Abblix\.Oidc\.Server\.Model\.RevocationRequest') {#Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.ValidRevocationRequest.InvalidToken(Abblix.Oidc.Server.Model.RevocationRequest).model} #### Returns [ValidRevocationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.ValidRevocationRequest 'Abblix\.Oidc\.Server\.Endpoints\.Revocation\.Interfaces\.ValidRevocationRequest') ### Remarks Invalid tokens do not cause an error response since the client cannot handle such an error in a reasonable way\. Moreover, the purpose of the revocation request, invalidating the particular token, is already achieved\. See https://www.rfc-editor.org/rfc/rfc7009\#section-2.2 --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ## Abblix\.Oidc\.Server\.Endpoints\.Token Namespace | Classes | | | :--- | :--- | | [AuthorizationCodeReusePreventingDecorator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.AuthorizationCodeReusePreventingDecorator 'Abblix\.Oidc\.Server\.Endpoints\.Token\.AuthorizationCodeReusePreventingDecorator') | Refuses a second redemption of an authorization code, and revokes the tokens the first one issued, in compliance with OAuth 2\.0 security best practices\. Two defences, split by WHEN the repeat arrives rather than by where: the claim refuses one arriving beside the first, and the issued tokens written back at the key catch one arriving after it\. Both hold across processes\. | | [TokenAuthorizationContextEvaluator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.TokenAuthorizationContextEvaluator 'Abblix\.Oidc\.Server\.Endpoints\.Token\.TokenAuthorizationContextEvaluator') | Default [ITokenAuthorizationContextEvaluator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenAuthorizationContextEvaluator 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.ITokenAuthorizationContextEvaluator'): narrows the originally granted scope and resource sets to the intersection with what the token request asks for \(RFC 6749 §6 / RFC 8707 §2\.2\), and, when the client authenticated via mTLS, derives the RFC 8705 §3 `cnf.x5t#S256` certificate thumbprint to bind the issued tokens\. | | [TokenHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.TokenHandler 'Abblix\.Oidc\.Server\.Endpoints\.Token\.TokenHandler') | Manages the processing of token requests according to OAuth 2\.0 and OpenID Connect specifications\. This includes validating the request for compliance with the protocol requirements and processing it to issue, renew or exchange tokens as appropriate\. | | [TokenRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.TokenRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.Token\.TokenRequestProcessor') | Default [ITokenRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.ITokenRequestProcessor'): always issues an access token \(RFC 6749 §5\.1\), adds a refresh token when `offline_access` is in the granted scope \(OIDC Core 1\.0 §11\), and adds an ID token when `openid` is in scope \(OIDC Core 1\.0 §3\.1\.3\.3, with `at_hash` computed from the issued access token\)\. | | [TokenRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.TokenRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.Token\.TokenRequestValidator') | Validates token requests against OAuth 2\.0 specifications, ensuring that requests are properly formed and authorized\. This class plays a critical role in the OAuth 2\.0 authentication and authorization process by verifying the integrity and authenticity of token requests, according to the framework defined in RFC 6749\. | --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.AuthorizationCodeReusePreventingDecorator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Token](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token 'Abblix\.Oidc\.Server\.Endpoints\.Token') ## AuthorizationCodeReusePreventingDecorator Class Refuses a second redemption of an authorization code, and revokes the tokens the first one issued, in compliance with OAuth 2\.0 security best practices\. Two defences, split by WHEN the repeat arrives rather than by where: the claim refuses one arriving beside the first, and the issued tokens written back at the key catch one arriving after it\. Both hold across processes\. ```csharp public class AuthorizationCodeReusePreventingDecorator : Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenRequestProcessor ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → AuthorizationCodeReusePreventingDecorator Implements [ITokenRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.ITokenRequestProcessor') ### Remarks Neither is complete on its own terms\. The claim reads the value under the same hold of the gate that removes it, so on ONE node two callers cannot be handed the same grant; across processes the gate holds nothing and both can be, which is issue 435\. And the write\-back is what the second defence rests on, so a first redemption that ends without issuing tokens leaves nothing for it to catch\. The refusal this class returns is the same string either way\. This class decorates the standard token request processing flow with additional security measures to ensure the integrity of the authorization process. It detects when an authorization code, which should only be used once, is attempted to be used multiple times. In such cases, it revokes any tokens previously issued with that code and denies the request, effectively mitigating potential security risks associated with code reuse. ### Constructors ## AuthorizationCodeReusePreventingDecorator\(ITokenRequestProcessor, ITokenRegistry, IAuthorizationCodeService\) Constructor {#Abblix.Oidc.Server.Endpoints.Token.AuthorizationCodeReusePreventingDecorator.AuthorizationCodeReusePreventingDecorator(Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenRequestProcessor,Abblix.Oidc.Server.Features.Storages.ITokenRegistry,Abblix.Oidc.Server.Features.Storages.IAuthorizationCodeService)} Refuses a second redemption of an authorization code, and revokes the tokens the first one issued, in compliance with OAuth 2\.0 security best practices\. Two defences, split by WHEN the repeat arrives rather than by where: the claim refuses one arriving beside the first, and the issued tokens written back at the key catch one arriving after it\. Both hold across processes\. ```csharp public AuthorizationCodeReusePreventingDecorator(Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenRequestProcessor processor, Abblix.Oidc.Server.Features.Storages.ITokenRegistry tokenRegistry, Abblix.Oidc.Server.Features.Storages.IAuthorizationCodeService authorizationCodeService); ``` #### Parameters ###### `processor` [ITokenRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.ITokenRequestProcessor') {#Abblix.Oidc.Server.Endpoints.Token.AuthorizationCodeReusePreventingDecorator.AuthorizationCodeReusePreventingDecorator(Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenRequestProcessor,Abblix.Oidc.Server.Features.Storages.ITokenRegistry,Abblix.Oidc.Server.Features.Storages.IAuthorizationCodeService).processor} The underlying token request processor to be enhanced\. ###### `tokenRegistry` [ITokenRegistry](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Storages.ITokenRegistry 'Abblix\.Oidc\.Server\.Features\.Storages\.ITokenRegistry') {#Abblix.Oidc.Server.Endpoints.Token.AuthorizationCodeReusePreventingDecorator.AuthorizationCodeReusePreventingDecorator(Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenRequestProcessor,Abblix.Oidc.Server.Features.Storages.ITokenRegistry,Abblix.Oidc.Server.Features.Storages.IAuthorizationCodeService).tokenRegistry} The registry used for managing token states and revocation\. ###### `authorizationCodeService` [IAuthorizationCodeService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Storages.IAuthorizationCodeService 'Abblix\.Oidc\.Server\.Features\.Storages\.IAuthorizationCodeService') {#Abblix.Oidc.Server.Endpoints.Token.AuthorizationCodeReusePreventingDecorator.AuthorizationCodeReusePreventingDecorator(Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenRequestProcessor,Abblix.Oidc.Server.Features.Storages.ITokenRegistry,Abblix.Oidc.Server.Features.Storages.IAuthorizationCodeService).authorizationCodeService} The service responsible for managing the lifecycle of authorization codes\. ### Remarks Neither is complete on its own terms\. The claim reads the value under the same hold of the gate that removes it, so on ONE node two callers cannot be handed the same grant; across processes the gate holds nothing and both can be, which is issue 435\. And the write\-back is what the second defence rests on, so a first redemption that ends without issuing tokens leaves nothing for it to catch\. The refusal this class returns is the same string either way\. This class decorates the standard token request processing flow with additional security measures to ensure the integrity of the authorization process. It detects when an authorization code, which should only be used once, is attempted to be used multiple times. In such cases, it revokes any tokens previously issued with that code and denies the request, effectively mitigating potential security risks associated with code reuse. ### Methods ## AuthorizationCodeReusePreventingDecorator\.ProcessAsync\(ValidTokenRequest\) Method {#Abblix.Oidc.Server.Endpoints.Token.AuthorizationCodeReusePreventingDecorator.ProcessAsync(Abblix.Oidc.Server.Endpoints.Token.Interfaces.ValidTokenRequest)} Processes a valid token request, including revoking existing tokens if necessary and registering new tokens\. ```csharp public System.Threading.Tasks.Task> ProcessAsync(Abblix.Oidc.Server.Endpoints.Token.Interfaces.ValidTokenRequest request); ``` #### Parameters ###### `request` [ValidTokenRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.ValidTokenRequest 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.ValidTokenRequest') {#Abblix.Oidc.Server.Endpoints.Token.AuthorizationCodeReusePreventingDecorator.ProcessAsync(Abblix.Oidc.Server.Endpoints.Token.Interfaces.ValidTokenRequest).request} The valid token request to process\. Implements [ProcessAsync\(ValidTokenRequest\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenRequestProcessor#Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenRequestProcessor.ProcessAsync(Abblix.Oidc.Server.Endpoints.Token.Interfaces.ValidTokenRequest) 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.ITokenRequestProcessor\.ProcessAsync\(Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.ValidTokenRequest\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[TokenIssued](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.TokenIssued 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.TokenIssued')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task that returns a [TokenIssued](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.TokenIssued 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.TokenIssued') on success or an [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') on failure\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.TokenAuthorizationContextEvaluator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Token](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token 'Abblix\.Oidc\.Server\.Endpoints\.Token') ## TokenAuthorizationContextEvaluator Class Default [ITokenAuthorizationContextEvaluator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenAuthorizationContextEvaluator 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.ITokenAuthorizationContextEvaluator'): narrows the originally granted scope and resource sets to the intersection with what the token request asks for \(RFC 6749 §6 / RFC 8707 §2\.2\), and, when the client authenticated via mTLS, derives the RFC 8705 §3 `cnf.x5t#S256` certificate thumbprint to bind the issued tokens\. ```csharp public class TokenAuthorizationContextEvaluator : Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenAuthorizationContextEvaluator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → TokenAuthorizationContextEvaluator Implements [ITokenAuthorizationContextEvaluator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenAuthorizationContextEvaluator 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.ITokenAuthorizationContextEvaluator') ### Methods ## TokenAuthorizationContextEvaluator\.EvaluateAuthorizationContext\(ValidTokenRequest\) Method {#Abblix.Oidc.Server.Endpoints.Token.TokenAuthorizationContextEvaluator.EvaluateAuthorizationContext(Abblix.Oidc.Server.Endpoints.Token.Interfaces.ValidTokenRequest)} Evaluates and constructs a new [AuthorizationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.AuthorizationContext 'Abblix\.Oidc\.Server\.Common\.AuthorizationContext') by refining and reconciling the scopes and resources from the original authorization request based on the current token request\. ```csharp public Abblix.Oidc.Server.Common.AuthorizationContext EvaluateAuthorizationContext(Abblix.Oidc.Server.Endpoints.Token.Interfaces.ValidTokenRequest request); ``` #### Parameters ###### `request` [ValidTokenRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.ValidTokenRequest 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.ValidTokenRequest') {#Abblix.Oidc.Server.Endpoints.Token.TokenAuthorizationContextEvaluator.EvaluateAuthorizationContext(Abblix.Oidc.Server.Endpoints.Token.Interfaces.ValidTokenRequest).request} The valid token request that contains the original authorization grant and any additional token\-specific requests\. Implements [EvaluateAuthorizationContext\(ValidTokenRequest\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenAuthorizationContextEvaluator#Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenAuthorizationContextEvaluator.EvaluateAuthorizationContext(Abblix.Oidc.Server.Endpoints.Token.Interfaces.ValidTokenRequest) 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.ITokenAuthorizationContextEvaluator\.EvaluateAuthorizationContext\(Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.ValidTokenRequest\)') #### Returns [AuthorizationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.AuthorizationContext 'Abblix\.Oidc\.Server\.Common\.AuthorizationContext') An updated [AuthorizationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.AuthorizationContext 'Abblix\.Oidc\.Server\.Common\.AuthorizationContext') that reflects the actual scopes and resources that should be considered during the token issuance process\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.TokenHandler.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Token](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token 'Abblix\.Oidc\.Server\.Endpoints\.Token') ## TokenHandler Class Manages the processing of token requests according to OAuth 2\.0 and OpenID Connect specifications\. This includes validating the request for compliance with the protocol requirements and processing it to issue, renew or exchange tokens as appropriate\. ```csharp public class TokenHandler : Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenHandler ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → TokenHandler Implements [ITokenHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenHandler 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.ITokenHandler') ### Constructors ## TokenHandler\(ITokenRequestValidator, ITokenRequestProcessor\) Constructor {#Abblix.Oidc.Server.Endpoints.Token.TokenHandler.TokenHandler(Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenRequestValidator,Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenRequestProcessor)} Manages the processing of token requests according to OAuth 2\.0 and OpenID Connect specifications\. This includes validating the request for compliance with the protocol requirements and processing it to issue, renew or exchange tokens as appropriate\. ```csharp public TokenHandler(Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenRequestValidator validator, Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenRequestProcessor processor); ``` #### Parameters ###### `validator` [ITokenRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.ITokenRequestValidator') {#Abblix.Oidc.Server.Endpoints.Token.TokenHandler.TokenHandler(Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenRequestValidator,Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenRequestProcessor).validator} An implementation of [ITokenRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.ITokenRequestValidator') responsible for ensuring that token requests meet the required validation criteria\. ###### `processor` [ITokenRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.ITokenRequestProcessor') {#Abblix.Oidc.Server.Endpoints.Token.TokenHandler.TokenHandler(Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenRequestValidator,Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenRequestProcessor).processor} An implementation of [ITokenRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.ITokenRequestProcessor') responsible for executing the logic necessary to issue, renew, or exchange tokens based on validated requests\. ### Methods ## TokenHandler\.HandleAsync\(TokenRequest, ClientRequest, CancellationToken\) Method {#Abblix.Oidc.Server.Endpoints.Token.TokenHandler.HandleAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Model.ClientRequest,System.Threading.CancellationToken)} Asynchronously handles a token request by first validating it and then, if the validation is successful, processing the request to issue, renew, or exchange tokens as required by the request parameters\. ```csharp public System.Threading.Tasks.Task> HandleAsync(Abblix.Oidc.Server.Model.TokenRequest tokenRequest, Abblix.Oidc.Server.Model.ClientRequest clientRequest, System.Threading.CancellationToken cancellationToken); ``` #### Parameters ###### `tokenRequest` [TokenRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.TokenRequest 'Abblix\.Oidc\.Server\.Model\.TokenRequest') {#Abblix.Oidc.Server.Endpoints.Token.TokenHandler.HandleAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Model.ClientRequest,System.Threading.CancellationToken).tokenRequest} An object containing the details of the token request, including the grant type, client credentials and other necessary parameters\. ###### `clientRequest` [ClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRequest 'Abblix\.Oidc\.Server\.Model\.ClientRequest') {#Abblix.Oidc.Server.Endpoints.Token.TokenHandler.HandleAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Model.ClientRequest,System.Threading.CancellationToken).clientRequest} Additional information about the client making the request, used for contextual validation\. ###### `cancellationToken` [System\.Threading\.CancellationToken](https://learn.microsoft.com/en-us/dotnet/api/system.threading.cancellationtoken 'System\.Threading\.CancellationToken') {#Abblix.Oidc.Server.Endpoints.Token.TokenHandler.HandleAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Model.ClientRequest,System.Threading.CancellationToken).cancellationToken} Abandons the operation when the caller stops waiting\. Implements [HandleAsync\(TokenRequest, ClientRequest, CancellationToken\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenHandler#Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenHandler.HandleAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Model.ClientRequest,System.Threading.CancellationToken) 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.ITokenHandler\.HandleAsync\(Abblix\.Oidc\.Server\.Model\.TokenRequest, Abblix\.Oidc\.Server\.Model\.ClientRequest, System\.Threading\.CancellationToken\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[TokenIssued](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.TokenIssued 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.TokenIssued')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A [System\.Threading\.Tasks\.Task](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task 'System\.Threading\.Tasks\.Task') that resolves to a [TokenIssued](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.TokenIssued 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.TokenIssued'), indicating the outcome of the request handling\. The success response includes the issued tokens, while an [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') details the reason for failure if the request does not pass validation or cannot be processed\. ### Remarks This method is integral to the security and functionality of the OAuth 2\.0 and OpenID Connect framework, ensuring that only valid and authorized requests result in the issuance, renewal, or exchange of tokens\. It employs rigorous validation to prevent unauthorized access and to maintain the integrity of the token lifecycle management process\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.TokenRequestProcessor.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Token](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token 'Abblix\.Oidc\.Server\.Endpoints\.Token') ## TokenRequestProcessor Class Default [ITokenRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.ITokenRequestProcessor'): always issues an access token \(RFC 6749 §5\.1\), adds a refresh token when `offline_access` is in the granted scope \(OIDC Core 1\.0 §11\), and adds an ID token when `openid` is in scope \(OIDC Core 1\.0 §3\.1\.3\.3, with `at_hash` computed from the issued access token\)\. ```csharp public class TokenRequestProcessor : Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenRequestProcessor ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → TokenRequestProcessor Implements [ITokenRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.ITokenRequestProcessor') ### Constructors ## TokenRequestProcessor\(IAccessTokenService, IRefreshTokenService, IIdentityTokenService, ITokenAuthorizationContextEvaluator\) Constructor {#Abblix.Oidc.Server.Endpoints.Token.TokenRequestProcessor.TokenRequestProcessor(Abblix.Oidc.Server.Features.Tokens.IAccessTokenService,Abblix.Oidc.Server.Features.Tokens.IRefreshTokenService,Abblix.Oidc.Server.Features.Tokens.IIdentityTokenService,Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenAuthorizationContextEvaluator)} Default [ITokenRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.ITokenRequestProcessor'): always issues an access token \(RFC 6749 §5\.1\), adds a refresh token when `offline_access` is in the granted scope \(OIDC Core 1\.0 §11\), and adds an ID token when `openid` is in scope \(OIDC Core 1\.0 §3\.1\.3\.3, with `at_hash` computed from the issued access token\)\. ```csharp public TokenRequestProcessor(Abblix.Oidc.Server.Features.Tokens.IAccessTokenService accessTokenService, Abblix.Oidc.Server.Features.Tokens.IRefreshTokenService refreshTokenService, Abblix.Oidc.Server.Features.Tokens.IIdentityTokenService identityTokenService, Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenAuthorizationContextEvaluator tokenContextEvaluator); ``` #### Parameters ###### `accessTokenService` [IAccessTokenService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.IAccessTokenService 'Abblix\.Oidc\.Server\.Features\.Tokens\.IAccessTokenService') {#Abblix.Oidc.Server.Endpoints.Token.TokenRequestProcessor.TokenRequestProcessor(Abblix.Oidc.Server.Features.Tokens.IAccessTokenService,Abblix.Oidc.Server.Features.Tokens.IRefreshTokenService,Abblix.Oidc.Server.Features.Tokens.IIdentityTokenService,Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenAuthorizationContextEvaluator).accessTokenService} Issues access\-token JWTs\. ###### `refreshTokenService` [IRefreshTokenService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.IRefreshTokenService 'Abblix\.Oidc\.Server\.Features\.Tokens\.IRefreshTokenService') {#Abblix.Oidc.Server.Endpoints.Token.TokenRequestProcessor.TokenRequestProcessor(Abblix.Oidc.Server.Features.Tokens.IAccessTokenService,Abblix.Oidc.Server.Features.Tokens.IRefreshTokenService,Abblix.Oidc.Server.Features.Tokens.IIdentityTokenService,Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenAuthorizationContextEvaluator).refreshTokenService} Issues refresh\-token JWTs, rolling the previous one for refresh\-token grants\. ###### `identityTokenService` [IIdentityTokenService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.IIdentityTokenService 'Abblix\.Oidc\.Server\.Features\.Tokens\.IIdentityTokenService') {#Abblix.Oidc.Server.Endpoints.Token.TokenRequestProcessor.TokenRequestProcessor(Abblix.Oidc.Server.Features.Tokens.IAccessTokenService,Abblix.Oidc.Server.Features.Tokens.IRefreshTokenService,Abblix.Oidc.Server.Features.Tokens.IIdentityTokenService,Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenAuthorizationContextEvaluator).identityTokenService} Issues ID tokens\. ###### `tokenContextEvaluator` [ITokenAuthorizationContextEvaluator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenAuthorizationContextEvaluator 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.ITokenAuthorizationContextEvaluator') {#Abblix.Oidc.Server.Endpoints.Token.TokenRequestProcessor.TokenRequestProcessor(Abblix.Oidc.Server.Features.Tokens.IAccessTokenService,Abblix.Oidc.Server.Features.Tokens.IRefreshTokenService,Abblix.Oidc.Server.Features.Tokens.IIdentityTokenService,Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenAuthorizationContextEvaluator).tokenContextEvaluator} Narrows scopes/resources and computes mTLS confirmation binding\. ### Methods ## TokenRequestProcessor\.ProcessAsync\(ValidTokenRequest\) Method {#Abblix.Oidc.Server.Endpoints.Token.TokenRequestProcessor.ProcessAsync(Abblix.Oidc.Server.Endpoints.Token.Interfaces.ValidTokenRequest)} Asynchronously processes a valid token request, determining the necessary tokens to generate based on the request's scope and grant type\. It generates an access token for every request and, depending on the scope, may also generate a refresh token and an ID token for OpenID Connect authentication\. ```csharp public System.Threading.Tasks.Task> ProcessAsync(Abblix.Oidc.Server.Endpoints.Token.Interfaces.ValidTokenRequest request); ``` #### Parameters ###### `request` [ValidTokenRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.ValidTokenRequest 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.ValidTokenRequest') {#Abblix.Oidc.Server.Endpoints.Token.TokenRequestProcessor.ProcessAsync(Abblix.Oidc.Server.Endpoints.Token.Interfaces.ValidTokenRequest).request} The validated token request containing client and authorization session information\. Implements [ProcessAsync\(ValidTokenRequest\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenRequestProcessor#Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenRequestProcessor.ProcessAsync(Abblix.Oidc.Server.Endpoints.Token.Interfaces.ValidTokenRequest) 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.ITokenRequestProcessor\.ProcessAsync\(Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.ValidTokenRequest\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[TokenIssued](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.TokenIssued 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.TokenIssued')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task representing the asynchronous operation, yielding a [TokenIssued](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.TokenIssued 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.TokenIssued') containing the generated tokens, or an [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') if processing fails\. ### Remarks Access tokens authorize clients for resource access; refresh tokens enable long\-lived sessions by allowing new access tokens to be obtained without re\-authentication; ID tokens provide identity information about the user, crucial for OpenID Connect authentication flows\. This method ensures secure and compliant token generation\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.TokenRequestValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Token](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token 'Abblix\.Oidc\.Server\.Endpoints\.Token') ## TokenRequestValidator Class Validates token requests against OAuth 2\.0 specifications, ensuring that requests are properly formed and authorized\. This class plays a critical role in the OAuth 2\.0 authentication and authorization process by verifying the integrity and authenticity of token requests, according to the framework defined in RFC 6749\. ```csharp public class TokenRequestValidator : Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenRequestValidator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → TokenRequestValidator Implements [ITokenRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.ITokenRequestValidator') ### Constructors ## TokenRequestValidator\(ITokenContextValidator\) Constructor {#Abblix.Oidc.Server.Endpoints.Token.TokenRequestValidator.TokenRequestValidator(Abblix.Oidc.Server.Endpoints.Token.Validation.ITokenContextValidator)} Validates token requests against OAuth 2\.0 specifications, ensuring that requests are properly formed and authorized\. This class plays a critical role in the OAuth 2\.0 authentication and authorization process by verifying the integrity and authenticity of token requests, according to the framework defined in RFC 6749\. ```csharp public TokenRequestValidator(Abblix.Oidc.Server.Endpoints.Token.Validation.ITokenContextValidator validator); ``` #### Parameters ###### `validator` [ITokenContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation.ITokenContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation\.ITokenContextValidator') {#Abblix.Oidc.Server.Endpoints.Token.TokenRequestValidator.TokenRequestValidator(Abblix.Oidc.Server.Endpoints.Token.Validation.ITokenContextValidator).validator} The token context validator used to validate token requests\. ### Methods ## TokenRequestValidator\.ValidateAsync\(TokenRequest, ClientRequest, CancellationToken\) Method {#Abblix.Oidc.Server.Endpoints.Token.TokenRequestValidator.ValidateAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Model.ClientRequest,System.Threading.CancellationToken)} Asynchronously validates a token request against the OAuth 2\.0 specifications\. It checks for proper authorization of the client, the validity of the grant type, and other request parameters\. This process involves authenticating the client using the provided client authenticator and then delegating the grant\-specific validation to the appropriate grant handler\. ```csharp public System.Threading.Tasks.Task> ValidateAsync(Abblix.Oidc.Server.Model.TokenRequest tokenRequest, Abblix.Oidc.Server.Model.ClientRequest clientRequest, System.Threading.CancellationToken cancellationToken); ``` #### Parameters ###### `tokenRequest` [TokenRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.TokenRequest 'Abblix\.Oidc\.Server\.Model\.TokenRequest') {#Abblix.Oidc.Server.Endpoints.Token.TokenRequestValidator.ValidateAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Model.ClientRequest,System.Threading.CancellationToken).tokenRequest} The token request containing all necessary parameters for validation\. ###### `clientRequest` [ClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRequest 'Abblix\.Oidc\.Server\.Model\.ClientRequest') {#Abblix.Oidc.Server.Endpoints.Token.TokenRequestValidator.ValidateAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Model.ClientRequest,System.Threading.CancellationToken).clientRequest} Client request information necessary for client authentication\. ###### `cancellationToken` [System\.Threading\.CancellationToken](https://learn.microsoft.com/en-us/dotnet/api/system.threading.cancellationtoken 'System\.Threading\.CancellationToken') {#Abblix.Oidc.Server.Endpoints.Token.TokenRequestValidator.ValidateAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Model.ClientRequest,System.Threading.CancellationToken).cancellationToken} Abandons the operation when the caller stops waiting\. Implements [ValidateAsync\(TokenRequest, ClientRequest, CancellationToken\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenRequestValidator#Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenRequestValidator.ValidateAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Model.ClientRequest,System.Threading.CancellationToken) 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.ITokenRequestValidator\.ValidateAsync\(Abblix\.Oidc\.Server\.Model\.TokenRequest, Abblix\.Oidc\.Server\.Model\.ClientRequest, System\.Threading\.CancellationToken\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[ValidTokenRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.ValidTokenRequest 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.ValidTokenRequest')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A [System\.Threading\.Tasks\.Task](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task 'System\.Threading\.Tasks\.Task') that resolves to a [Result<TSuccess,TFailure>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2'), indicating the outcome of the validation process\. This result can either denote a successful validation or contain error information specifying why the request was invalid\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ## Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants Namespace | Classes | | | :--- | :--- | | [AuthorizationCodeGrantHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.AuthorizationCodeGrantHandler 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.AuthorizationCodeGrantHandler') | [IAuthorizationGrantHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.IAuthorizationGrantHandler') for `grant_type=authorization_code` \(RFC 6749 §4\.1\.3\)\. Resolves the code to its stored [AuthorizedGrant](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.AuthorizedGrant'), asserts that the redeeming client is the same one the code was issued to, and, when a `code_challenge` was bound at the authorization request, runs the RFC 7636 §4\.6 verification by transforming the submitted `code_verifier` with the recorded `plain` / `S256` / `S512` method\. | | [BackChannelAuthenticationGrantHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.BackChannelAuthenticationGrantHandler 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.BackChannelAuthenticationGrantHandler') | Handles the authorization process for backchannel authentication requests under the Client\-Initiated Backchannel Authentication \(CIBA\) grant type\. This handler validates the token request based on the backchannel authentication flow, ensuring that the client is authorized and that the user has been authenticated before tokens are issued\. Supports both short\-polling \(immediate response\) and long\-polling \(holds connection until auth completes\)\. | | [ClientCredentialsGrantHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.ClientCredentialsGrantHandler 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.ClientCredentialsGrantHandler') | Handles the authorization process for the client credentials grant type within the OAuth 2\.0 framework\. This grant type is designed for machine\-to\-machine \(M2M\) authentication where the client itself is the resource owner\. There is no end\-user involved in this flow \- the client uses its own credentials to obtain an access token directly from the authorization server\. | | [CompositeAuthorizationGrantHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.CompositeAuthorizationGrantHandler 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.CompositeAuthorizationGrantHandler') | A composite handler that coordinates multiple authorization grant handlers for processing OAuth 2\.0 token requests\. This class allows for flexible and extensible handling of various grant types by delegating specific grant processing tasks to individual handlers\. It dynamically aggregates all available grant handlers, facilitating the addition of new handlers without modifying the core authorization flow\. | | [DeviceCodeGrantHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.DeviceCodeGrantHandler 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.DeviceCodeGrantHandler') | Handles the Device Code grant type as defined in RFC 8628\. This handler validates token requests for the device authorization flow, checking the device code status and returning tokens when authorized\. | | [ErrorFactory](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.ErrorFactory 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.ErrorFactory') | Builds [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') instances using the error codes RFC 6749 §5\.2 defines for the token endpoint\. Mirrors the sibling per\-area factories \(authorization validation, dynamic client registration, secure HTTP fetch\): each area exposes only the error codes its specification legitimately uses, so codes from one protocol surface do not leak into another\. | | [JwtBearerGrantHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.JwtBearerGrantHandler 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.JwtBearerGrantHandler') | Handles the JWT Bearer grant type per RFC 7523, allowing clients to exchange a JWT assertion for an access token\. This grant type is used when a client has obtained a JWT from a trusted identity provider and wants to exchange it for an access token at this authorization server\. | | [PasswordGrantHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.PasswordGrantHandler 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.PasswordGrantHandler') | Handles the authorization process for the password grant type within the OAuth 2\.0 framework\. This handler validates the user's credentials and processes token requests based on the password grant type\. The password grant type allows clients to directly exchange a user's credentials \(username and password\) for an access token, typically for trusted clients\. | | [RefreshTokenGrantHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.RefreshTokenGrantHandler 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.RefreshTokenGrantHandler') | [IAuthorizationGrantHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.IAuthorizationGrantHandler') for `grant_type=refresh_token` \(RFC 6749 §6\)\. Verifies the refresh token's signature and lifetime, requires the JWT `typ` header to be `rt+jwt`, recovers the original [AuthorizedGrant](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.AuthorizedGrant'), and rejects the request with `invalid_grant` when the refreshing client differs from the client that received the token\. | | [TokenExchangeGrantHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.TokenExchangeGrantHandler 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.TokenExchangeGrantHandler') | [IAuthorizationGrantHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.IAuthorizationGrantHandler') for RFC 8693 Token Exchange \(`grant_type=urn:ietf:params:oauth:grant-type:token-exchange`\)\. | | Interfaces | | | :--- | :--- | | [IAuthorizationGrantHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.IAuthorizationGrantHandler') | Strategy contract for resolving the `grant_type`\-specific portion of an OAuth 2\.0 token request \(RFC 6749 §4\) into an [AuthorizedGrant](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.AuthorizedGrant'): an authentication session plus the [AuthorizationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.AuthorizationContext 'Abblix\.Oidc\.Server\.Common\.AuthorizationContext') \(subject, scope, resources, claims\) that the issued tokens will inherit\. Each implementation advertises the grant types it owns via [GrantTypesSupported](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer#Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer.GrantTypesSupported 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IGrantTypeInformer\.GrantTypesSupported')\. | --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.AuthorizationCodeGrantHandler.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants') ## AuthorizationCodeGrantHandler Class [IAuthorizationGrantHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.IAuthorizationGrantHandler') for `grant_type=authorization_code` \(RFC 6749 §4\.1\.3\)\. Resolves the code to its stored [AuthorizedGrant](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.AuthorizedGrant'), asserts that the redeeming client is the same one the code was issued to, and, when a `code_challenge` was bound at the authorization request, runs the RFC 7636 §4\.6 verification by transforming the submitted `code_verifier` with the recorded `plain` / `S256` / `S512` method\. ```csharp public class AuthorizationCodeGrantHandler : Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler, Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → AuthorizationCodeGrantHandler Implements [IAuthorizationGrantHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.IAuthorizationGrantHandler'), [IGrantTypeInformer](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IGrantTypeInformer') ### Constructors ## AuthorizationCodeGrantHandler\(IAuthorizationCodeService\) Constructor {#Abblix.Oidc.Server.Endpoints.Token.Grants.AuthorizationCodeGrantHandler.AuthorizationCodeGrantHandler(Abblix.Oidc.Server.Features.Storages.IAuthorizationCodeService)} [IAuthorizationGrantHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.IAuthorizationGrantHandler') for `grant_type=authorization_code` \(RFC 6749 §4\.1\.3\)\. Resolves the code to its stored [AuthorizedGrant](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.AuthorizedGrant'), asserts that the redeeming client is the same one the code was issued to, and, when a `code_challenge` was bound at the authorization request, runs the RFC 7636 §4\.6 verification by transforming the submitted `code_verifier` with the recorded `plain` / `S256` / `S512` method\. ```csharp public AuthorizationCodeGrantHandler(Abblix.Oidc.Server.Features.Storages.IAuthorizationCodeService authorizationCodeService); ``` #### Parameters ###### `authorizationCodeService` [IAuthorizationCodeService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Storages.IAuthorizationCodeService 'Abblix\.Oidc\.Server\.Features\.Storages\.IAuthorizationCodeService') {#Abblix.Oidc.Server.Endpoints.Token.Grants.AuthorizationCodeGrantHandler.AuthorizationCodeGrantHandler(Abblix.Oidc.Server.Features.Storages.IAuthorizationCodeService).authorizationCodeService} Persists, looks up and removes authorization codes\. ### Properties ## AuthorizationCodeGrantHandler\.GrantTypesSupported Property {#Abblix.Oidc.Server.Endpoints.Token.Grants.AuthorizationCodeGrantHandler.GrantTypesSupported} Provides the grant type this handler supports, which is the OAuth 2\.0 'authorization\_code' grant type\. This information is useful for identifying the handler's capabilities in a broader authorization framework\. ```csharp public System.Collections.Generic.IEnumerable GrantTypesSupported { get; } ``` Implements [GrantTypesSupported](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer#Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer.GrantTypesSupported 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IGrantTypeInformer\.GrantTypesSupported') #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ### Methods ## AuthorizationCodeGrantHandler\.AuthorizeAsync\(TokenRequest, ClientInfo, CancellationToken\) Method {#Abblix.Oidc.Server.Endpoints.Token.Grants.AuthorizationCodeGrantHandler.AuthorizeAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.Threading.CancellationToken)} Authorizes a token request asynchronously using the authorization code grant type\. This method validates the authorization code submitted by the client, ensures the client making the request is the same as the one to whom the code was originally issued, and performs any necessary PKCE checks\. It ensures that all security requirements, including client verification and PKCE validation, are enforced before tokens are issued\. ```csharp public System.Threading.Tasks.Task> AuthorizeAsync(Abblix.Oidc.Server.Model.TokenRequest request, Abblix.Oidc.Server.Features.ClientInformation.ClientInfo clientInfo, System.Threading.CancellationToken cancellationToken); ``` #### Parameters ###### `request` [TokenRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.TokenRequest 'Abblix\.Oidc\.Server\.Model\.TokenRequest') {#Abblix.Oidc.Server.Endpoints.Token.Grants.AuthorizationCodeGrantHandler.AuthorizeAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.Threading.CancellationToken).request} The token request containing the authorization code and other necessary parameters\. ###### `clientInfo` [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') {#Abblix.Oidc.Server.Endpoints.Token.Grants.AuthorizationCodeGrantHandler.AuthorizeAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.Threading.CancellationToken).clientInfo} Information about the client, used to verify that the request is valid for this client\. ###### `cancellationToken` [System\.Threading\.CancellationToken](https://learn.microsoft.com/en-us/dotnet/api/system.threading.cancellationtoken 'System\.Threading\.CancellationToken') {#Abblix.Oidc.Server.Endpoints.Token.Grants.AuthorizationCodeGrantHandler.AuthorizeAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.Threading.CancellationToken).cancellationToken} Abandons the operation when the caller stops waiting\. Implements [AuthorizeAsync\(TokenRequest, ClientInfo, CancellationToken\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler#Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler.AuthorizeAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.Threading.CancellationToken) 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.IAuthorizationGrantHandler\.AuthorizeAsync\(Abblix\.Oidc\.Server\.Model\.TokenRequest, Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo, System\.Threading\.CancellationToken\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[AuthorizedGrant](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.AuthorizedGrant')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task that represents the asynchronous authorization operation\. The result is either an authorized grant or an error indicating why the request failed\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.BackChannelAuthenticationGrantHandler.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants') ## BackChannelAuthenticationGrantHandler Class Handles the authorization process for backchannel authentication requests under the Client\-Initiated Backchannel Authentication \(CIBA\) grant type\. This handler validates the token request based on the backchannel authentication flow, ensuring that the client is authorized and that the user has been authenticated before tokens are issued\. Supports both short\-polling \(immediate response\) and long\-polling \(holds connection until auth completes\)\. ```csharp public class BackChannelAuthenticationGrantHandler : Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler, Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → BackChannelAuthenticationGrantHandler Implements [IAuthorizationGrantHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.IAuthorizationGrantHandler'), [IGrantTypeInformer](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IGrantTypeInformer') ### Constructors ## BackChannelAuthenticationGrantHandler\(ILogger\, IBackChannelRequestStorage, IAuthorizationDetailsPolicy, TimeProvider, IOptions\, IServiceProvider, ISubjectTypeConverter, IBackChannelLongPollingService\) Constructor {#Abblix.Oidc.Server.Endpoints.Token.Grants.BackChannelAuthenticationGrantHandler.BackChannelAuthenticationGrantHandler(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.Token.Grants.BackChannelAuthenticationGrantHandler_,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage,Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy,System.TimeProvider,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,System.IServiceProvider,Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelLongPollingService)} Handles the authorization process for backchannel authentication requests under the Client\-Initiated Backchannel Authentication \(CIBA\) grant type\. This handler validates the token request based on the backchannel authentication flow, ensuring that the client is authorized and that the user has been authenticated before tokens are issued\. Supports both short\-polling \(immediate response\) and long\-polling \(holds connection until auth completes\)\. ```csharp public BackChannelAuthenticationGrantHandler(Microsoft.Extensions.Logging.ILogger logger, Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage storage, Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy authorizationDetailsPolicy, System.TimeProvider timeProvider, Microsoft.Extensions.Options.IOptions options, System.IServiceProvider serviceProvider, Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter subjectTypeConverter, Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelLongPollingService? statusNotifier=null); ``` #### Parameters ###### `logger` [Microsoft\.Extensions\.Logging\.ILogger<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1')[BackChannelAuthenticationGrantHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.BackChannelAuthenticationGrantHandler 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.BackChannelAuthenticationGrantHandler')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1') {#Abblix.Oidc.Server.Endpoints.Token.Grants.BackChannelAuthenticationGrantHandler.BackChannelAuthenticationGrantHandler(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.Token.Grants.BackChannelAuthenticationGrantHandler_,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage,Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy,System.TimeProvider,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,System.IServiceProvider,Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelLongPollingService).logger} Records a refusal the client is deliberately told nothing specific about\. ###### `storage` [IBackChannelRequestStorage](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces\.IBackChannelRequestStorage') {#Abblix.Oidc.Server.Endpoints.Token.Grants.BackChannelAuthenticationGrantHandler.BackChannelAuthenticationGrantHandler(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.Token.Grants.BackChannelAuthenticationGrantHandler_,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage,Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy,System.TimeProvider,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,System.IServiceProvider,Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelLongPollingService).storage} Service for storing and retrieving backchannel authentication requests\. ###### `authorizationDetailsPolicy` [IAuthorizationDetailsPolicy](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy 'Abblix\.Oidc\.Server\.Features\.RichAuthorizationRequests\.IAuthorizationDetailsPolicy') {#Abblix.Oidc.Server.Endpoints.Token.Grants.BackChannelAuthenticationGrantHandler.BackChannelAuthenticationGrantHandler(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.Token.Grants.BackChannelAuthenticationGrantHandler_,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage,Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy,System.TimeProvider,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,System.IServiceProvider,Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelLongPollingService).authorizationDetailsPolicy} Asks the per\-type validators whether the grant's authorization\_details are still acceptable, which is the only comparison that can see inside an entry\. ###### `timeProvider` [System\.TimeProvider](https://learn.microsoft.com/en-us/dotnet/api/system.timeprovider 'System\.TimeProvider') {#Abblix.Oidc.Server.Endpoints.Token.Grants.BackChannelAuthenticationGrantHandler.BackChannelAuthenticationGrantHandler(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.Token.Grants.BackChannelAuthenticationGrantHandler_,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage,Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy,System.TimeProvider,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,System.IServiceProvider,Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelLongPollingService).timeProvider} Provides access to the current time\. ###### `options` [Microsoft\.Extensions\.Options\.IOptions<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptions-1 'Microsoft\.Extensions\.Options\.IOptions\`1')[OidcOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptions-1 'Microsoft\.Extensions\.Options\.IOptions\`1') {#Abblix.Oidc.Server.Endpoints.Token.Grants.BackChannelAuthenticationGrantHandler.BackChannelAuthenticationGrantHandler(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.Token.Grants.BackChannelAuthenticationGrantHandler_,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage,Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy,System.TimeProvider,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,System.IServiceProvider,Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelLongPollingService).options} Configuration options for backchannel authentication including long\-polling settings\. ###### `serviceProvider` [System\.IServiceProvider](https://learn.microsoft.com/en-us/dotnet/api/system.iserviceprovider 'System\.IServiceProvider') {#Abblix.Oidc.Server.Endpoints.Token.Grants.BackChannelAuthenticationGrantHandler.BackChannelAuthenticationGrantHandler(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.Token.Grants.BackChannelAuthenticationGrantHandler_,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage,Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy,System.TimeProvider,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,System.IServiceProvider,Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelLongPollingService).serviceProvider} Service provider for resolving mode\-specific grant processors\. ###### `subjectTypeConverter` [ISubjectTypeConverter](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter 'Abblix\.Oidc\.Server\.Features\.PairwiseIdentifiers\.ISubjectTypeConverter') {#Abblix.Oidc.Server.Endpoints.Token.Grants.BackChannelAuthenticationGrantHandler.BackChannelAuthenticationGrantHandler(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.Token.Grants.BackChannelAuthenticationGrantHandler_,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage,Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy,System.TimeProvider,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,System.IServiceProvider,Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelLongPollingService).subjectTypeConverter} Seals the authenticated session's subject the way the requesting client sees it, so it can be compared against the end user the original request named\. ###### `statusNotifier` [IBackChannelLongPollingService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelLongPollingService 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces\.IBackChannelLongPollingService') {#Abblix.Oidc.Server.Endpoints.Token.Grants.BackChannelAuthenticationGrantHandler.BackChannelAuthenticationGrantHandler(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.Token.Grants.BackChannelAuthenticationGrantHandler_,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage,Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy,System.TimeProvider,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,System.IServiceProvider,Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelLongPollingService).statusNotifier} Notifier for long\-polling status changes \(null if long\-polling disabled\)\. ### Properties ## BackChannelAuthenticationGrantHandler\.GrantTypesSupported Property {#Abblix.Oidc.Server.Endpoints.Token.Grants.BackChannelAuthenticationGrantHandler.GrantTypesSupported} Specifies the grant types supported by this handler, specifically the "CIBA" \(Client\-Initiated Backchannel Authentication\) grant type\. This property ensures that the handler is only invoked for the specific grant type it supports\. ```csharp public System.Collections.Generic.IEnumerable GrantTypesSupported { get; } ``` Implements [GrantTypesSupported](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer#Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer.GrantTypesSupported 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IGrantTypeInformer\.GrantTypesSupported') #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ### Methods ## BackChannelAuthenticationGrantHandler\.AuthorizeAsync\(TokenRequest, ClientInfo, CancellationToken\) Method {#Abblix.Oidc.Server.Endpoints.Token.Grants.BackChannelAuthenticationGrantHandler.AuthorizeAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.Threading.CancellationToken)} Processes the authorization request by verifying the authentication request ID and checking the status of the associated backchannel authentication request\. Supports both short\-polling \(immediate response\) and optional long\-polling \(holds connection until authentication completes or timeout\)\. ```csharp public System.Threading.Tasks.Task> AuthorizeAsync(Abblix.Oidc.Server.Model.TokenRequest request, Abblix.Oidc.Server.Features.ClientInformation.ClientInfo clientInfo, System.Threading.CancellationToken cancellationToken); ``` #### Parameters ###### `request` [TokenRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.TokenRequest 'Abblix\.Oidc\.Server\.Model\.TokenRequest') {#Abblix.Oidc.Server.Endpoints.Token.Grants.BackChannelAuthenticationGrantHandler.AuthorizeAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.Threading.CancellationToken).request} The token request containing the authentication request ID and other parameters\. ###### `clientInfo` [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') {#Abblix.Oidc.Server.Endpoints.Token.Grants.BackChannelAuthenticationGrantHandler.AuthorizeAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.Threading.CancellationToken).clientInfo} Information about the client making the request, used to validate client identity and determine token delivery mode \(poll/ping/push\)\. ###### `cancellationToken` [System\.Threading\.CancellationToken](https://learn.microsoft.com/en-us/dotnet/api/system.threading.cancellationtoken 'System\.Threading\.CancellationToken') {#Abblix.Oidc.Server.Endpoints.Token.Grants.BackChannelAuthenticationGrantHandler.AuthorizeAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.Threading.CancellationToken).cancellationToken} Abandons the operation when the caller stops waiting\. Implements [AuthorizeAsync\(TokenRequest, ClientInfo, CancellationToken\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler#Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler.AuthorizeAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.Threading.CancellationToken) 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.IAuthorizationGrantHandler\.AuthorizeAsync\(Abblix\.Oidc\.Server\.Model\.TokenRequest, Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo, System\.Threading\.CancellationToken\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[AuthorizedGrant](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.AuthorizedGrant')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') Either an authorized grant if authentication succeeded, or an error indicating why the request failed \(authorization\_pending, access\_denied, expired\_token, slow\_down, or invalid\_grant\)\. ### Remarks Behavior by Authentication Status: - Authenticated: - Pending (short-polling): - Pending (long-polling): - Denied: - Expired/Not Found: - Rate Limited: Long-polling reduces latency (0-1s vs 0-5s) and server load (1-4 req/min vs 12 req/min) by holding the connection open until authentication completes instead of requiring repeated polling. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.ClientCredentialsGrantHandler.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants') ## ClientCredentialsGrantHandler Class Handles the authorization process for the client credentials grant type within the OAuth 2\.0 framework\. This grant type is designed for machine\-to\-machine \(M2M\) authentication where the client itself is the resource owner\. There is no end\-user involved in this flow \- the client uses its own credentials to obtain an access token directly from the authorization server\. ```csharp public class ClientCredentialsGrantHandler : Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler, Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ClientCredentialsGrantHandler Implements [IAuthorizationGrantHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.IAuthorizationGrantHandler'), [IGrantTypeInformer](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IGrantTypeInformer') ### Remarks The client credentials grant type is specified in RFC 6749 Section 4\.4\. It is typically used in scenarios such as: \- Backend services accessing APIs \- Scheduled jobs or automated tasks \- Microservice\-to\-microservice communication \- CI/CD pipelines The client must authenticate itself before this handler is invoked, using methods such as client\_secret\_basic, client\_secret\_post, or private\_key\_jwt\. ### Constructors ## ClientCredentialsGrantHandler\(ISessionIdGenerator, TimeProvider\) Constructor {#Abblix.Oidc.Server.Endpoints.Token.Grants.ClientCredentialsGrantHandler.ClientCredentialsGrantHandler(Abblix.Oidc.Server.Features.RandomGenerators.ISessionIdGenerator,System.TimeProvider)} Handles the authorization process for the client credentials grant type within the OAuth 2\.0 framework\. This grant type is designed for machine\-to\-machine \(M2M\) authentication where the client itself is the resource owner\. There is no end\-user involved in this flow \- the client uses its own credentials to obtain an access token directly from the authorization server\. ```csharp public ClientCredentialsGrantHandler(Abblix.Oidc.Server.Features.RandomGenerators.ISessionIdGenerator sessionIdGenerator, System.TimeProvider timeProvider); ``` #### Parameters ###### `sessionIdGenerator` [ISessionIdGenerator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.ISessionIdGenerator 'Abblix\.Oidc\.Server\.Features\.RandomGenerators\.ISessionIdGenerator') {#Abblix.Oidc.Server.Endpoints.Token.Grants.ClientCredentialsGrantHandler.ClientCredentialsGrantHandler(Abblix.Oidc.Server.Features.RandomGenerators.ISessionIdGenerator,System.TimeProvider).sessionIdGenerator} Generates unique session identifiers for authentication sessions\. ###### `timeProvider` [System\.TimeProvider](https://learn.microsoft.com/en-us/dotnet/api/system.timeprovider 'System\.TimeProvider') {#Abblix.Oidc.Server.Endpoints.Token.Grants.ClientCredentialsGrantHandler.ClientCredentialsGrantHandler(Abblix.Oidc.Server.Features.RandomGenerators.ISessionIdGenerator,System.TimeProvider).timeProvider} Provides access to the current time for session timestamps\. ### Remarks The client credentials grant type is specified in RFC 6749 Section 4\.4\. It is typically used in scenarios such as: \- Backend services accessing APIs \- Scheduled jobs or automated tasks \- Microservice\-to\-microservice communication \- CI/CD pipelines The client must authenticate itself before this handler is invoked, using methods such as client\_secret\_basic, client\_secret\_post, or private\_key\_jwt\. ### Properties ## ClientCredentialsGrantHandler\.GrantTypesSupported Property {#Abblix.Oidc.Server.Endpoints.Token.Grants.ClientCredentialsGrantHandler.GrantTypesSupported} Specifies the grant type that this handler supports, which is the "client\_credentials" grant type\. This ensures that this handler is only invoked when processing requests with the client credentials grant type\. ```csharp public System.Collections.Generic.IEnumerable GrantTypesSupported { get; } ``` Implements [GrantTypesSupported](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer#Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer.GrantTypesSupported 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IGrantTypeInformer\.GrantTypesSupported') #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ### Methods ## ClientCredentialsGrantHandler\.AuthorizeAsync\(TokenRequest, ClientInfo, CancellationToken\) Method {#Abblix.Oidc.Server.Endpoints.Token.Grants.ClientCredentialsGrantHandler.AuthorizeAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.Threading.CancellationToken)} Asynchronously processes the token request using the client credentials grant type\. Since the client has already been authenticated \(via client authentication middleware\), this handler creates a grant for the client with the requested scope\. ```csharp public System.Threading.Tasks.Task> AuthorizeAsync(Abblix.Oidc.Server.Model.TokenRequest request, Abblix.Oidc.Server.Features.ClientInformation.ClientInfo clientInfo, System.Threading.CancellationToken cancellationToken); ``` #### Parameters ###### `request` [TokenRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.TokenRequest 'Abblix\.Oidc\.Server\.Model\.TokenRequest') {#Abblix.Oidc.Server.Endpoints.Token.Grants.ClientCredentialsGrantHandler.AuthorizeAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.Threading.CancellationToken).request} The token request containing the requested scope and other parameters\. ###### `clientInfo` [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') {#Abblix.Oidc.Server.Endpoints.Token.Grants.ClientCredentialsGrantHandler.AuthorizeAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.Threading.CancellationToken).clientInfo} Information about the authenticated client making the request\. ###### `cancellationToken` [System\.Threading\.CancellationToken](https://learn.microsoft.com/en-us/dotnet/api/system.threading.cancellationtoken 'System\.Threading\.CancellationToken') {#Abblix.Oidc.Server.Endpoints.Token.Grants.ClientCredentialsGrantHandler.AuthorizeAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.Threading.CancellationToken).cancellationToken} Abandons the operation when the caller stops waiting\. Implements [AuthorizeAsync\(TokenRequest, ClientInfo, CancellationToken\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler#Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler.AuthorizeAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.Threading.CancellationToken) 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.IAuthorizationGrantHandler\.AuthorizeAsync\(Abblix\.Oidc\.Server\.Model\.TokenRequest, Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo, System\.Threading\.CancellationToken\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[AuthorizedGrant](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.AuthorizedGrant')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task that completes with an authorized grant containing the client session and context\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.CompositeAuthorizationGrantHandler.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants') ## CompositeAuthorizationGrantHandler Class A composite handler that coordinates multiple authorization grant handlers for processing OAuth 2\.0 token requests\. This class allows for flexible and extensible handling of various grant types by delegating specific grant processing tasks to individual handlers\. It dynamically aggregates all available grant handlers, facilitating the addition of new handlers without modifying the core authorization flow\. ```csharp public class CompositeAuthorizationGrantHandler : Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler, Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → CompositeAuthorizationGrantHandler Implements [IAuthorizationGrantHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.IAuthorizationGrantHandler'), [IGrantTypeInformer](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IGrantTypeInformer') ### Constructors ## CompositeAuthorizationGrantHandler\(IEnumerable\\) Constructor {#Abblix.Oidc.Server.Endpoints.Token.Grants.CompositeAuthorizationGrantHandler.CompositeAuthorizationGrantHandler(System.Collections.Generic.IEnumerable_Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler_)} A composite handler that coordinates multiple authorization grant handlers for processing OAuth 2\.0 token requests\. This class allows for flexible and extensible handling of various grant types by delegating specific grant processing tasks to individual handlers\. It dynamically aggregates all available grant handlers, facilitating the addition of new handlers without modifying the core authorization flow\. ```csharp public CompositeAuthorizationGrantHandler(System.Collections.Generic.IEnumerable grantHandlers); ``` #### Parameters ###### `grantHandlers` [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[IAuthorizationGrantHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.IAuthorizationGrantHandler')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') {#Abblix.Oidc.Server.Endpoints.Token.Grants.CompositeAuthorizationGrantHandler.CompositeAuthorizationGrantHandler(System.Collections.Generic.IEnumerable_Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler_).grantHandlers} A collection of grant handlers, each responsible for a specific set of grant types\. ### Properties ## CompositeAuthorizationGrantHandler\.GrantTypesSupported Property {#Abblix.Oidc.Server.Endpoints.Token.Grants.CompositeAuthorizationGrantHandler.GrantTypesSupported} Provides a list of all the supported grant types across the registered grant handlers\. This allows the composite handler to advertise the full set of supported grant types, which can be used for validation and discovery of capabilities by client applications\. ```csharp public System.Collections.Generic.IEnumerable GrantTypesSupported { get; } ``` Implements [GrantTypesSupported](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer#Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer.GrantTypesSupported 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IGrantTypeInformer\.GrantTypesSupported') #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ### Methods ## CompositeAuthorizationGrantHandler\.AuthorizeAsync\(TokenRequest, ClientInfo, CancellationToken\) Method {#Abblix.Oidc.Server.Endpoints.Token.Grants.CompositeAuthorizationGrantHandler.AuthorizeAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.Threading.CancellationToken)} Processes a token request asynchronously by delegating the request to the appropriate handler based on the grant type\. If a handler for the requested grant type is found, it delegates the request to that handler for processing\. Otherwise, it returns an error indicating that the grant type is not supported\. This method abstracts away the complexity of identifying and invoking the correct handler, simplifying the main authorization flow\. ```csharp public System.Threading.Tasks.Task> AuthorizeAsync(Abblix.Oidc.Server.Model.TokenRequest request, Abblix.Oidc.Server.Features.ClientInformation.ClientInfo clientInfo, System.Threading.CancellationToken cancellationToken); ``` #### Parameters ###### `request` [TokenRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.TokenRequest 'Abblix\.Oidc\.Server\.Model\.TokenRequest') {#Abblix.Oidc.Server.Endpoints.Token.Grants.CompositeAuthorizationGrantHandler.AuthorizeAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.Threading.CancellationToken).request} The token request, which includes the grant type and relevant parameters for processing the request\. ###### `clientInfo` [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') {#Abblix.Oidc.Server.Endpoints.Token.Grants.CompositeAuthorizationGrantHandler.AuthorizeAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.Threading.CancellationToken).clientInfo} The client information used to validate and process the request, ensuring the request is authorized\. ###### `cancellationToken` [System\.Threading\.CancellationToken](https://learn.microsoft.com/en-us/dotnet/api/system.threading.cancellationtoken 'System\.Threading\.CancellationToken') {#Abblix.Oidc.Server.Endpoints.Token.Grants.CompositeAuthorizationGrantHandler.AuthorizeAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.Threading.CancellationToken).cancellationToken} Abandons the operation when the caller stops waiting\. Implements [AuthorizeAsync\(TokenRequest, ClientInfo, CancellationToken\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler#Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler.AuthorizeAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.Threading.CancellationToken) 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.IAuthorizationGrantHandler\.AuthorizeAsync\(Abblix\.Oidc\.Server\.Model\.TokenRequest, Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo, System\.Threading\.CancellationToken\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[AuthorizedGrant](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.AuthorizedGrant')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task that resolves to the result of the authorization process\. If successful, it contains the granted authorization; otherwise, it contains an error explaining why the authorization failed\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.DeviceCodeGrantHandler.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants') ## DeviceCodeGrantHandler Class Handles the Device Code grant type as defined in RFC 8628\. This handler validates token requests for the device authorization flow, checking the device code status and returning tokens when authorized\. ```csharp public class DeviceCodeGrantHandler : Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler, Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → DeviceCodeGrantHandler Implements [IAuthorizationGrantHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.IAuthorizationGrantHandler'), [IGrantTypeInformer](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IGrantTypeInformer') ### Constructors ## DeviceCodeGrantHandler\(ILogger\, IDeviceAuthorizationStorage, IAuthorizationDetailsPolicy, TimeProvider, IOptions\\) Constructor {#Abblix.Oidc.Server.Endpoints.Token.Grants.DeviceCodeGrantHandler.DeviceCodeGrantHandler(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.Token.Grants.DeviceCodeGrantHandler_,Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IDeviceAuthorizationStorage,Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy,System.TimeProvider,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_)} Handles the Device Code grant type as defined in RFC 8628\. This handler validates token requests for the device authorization flow, checking the device code status and returning tokens when authorized\. ```csharp public DeviceCodeGrantHandler(Microsoft.Extensions.Logging.ILogger logger, Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IDeviceAuthorizationStorage storage, Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy authorizationDetailsPolicy, System.TimeProvider timeProvider, Microsoft.Extensions.Options.IOptions options); ``` #### Parameters ###### `logger` [Microsoft\.Extensions\.Logging\.ILogger<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1')[DeviceCodeGrantHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.DeviceCodeGrantHandler 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.DeviceCodeGrantHandler')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1') {#Abblix.Oidc.Server.Endpoints.Token.Grants.DeviceCodeGrantHandler.DeviceCodeGrantHandler(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.Token.Grants.DeviceCodeGrantHandler_,Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IDeviceAuthorizationStorage,Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy,System.TimeProvider,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_).logger} Records a refusal the client learns nothing from, and the approval path cannot have reported\. ###### `storage` [IDeviceAuthorizationStorage](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IDeviceAuthorizationStorage 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.Interfaces\.IDeviceAuthorizationStorage') {#Abblix.Oidc.Server.Endpoints.Token.Grants.DeviceCodeGrantHandler.DeviceCodeGrantHandler(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.Token.Grants.DeviceCodeGrantHandler_,Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IDeviceAuthorizationStorage,Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy,System.TimeProvider,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_).storage} Service for storing and retrieving device authorization requests\. ###### `authorizationDetailsPolicy` [IAuthorizationDetailsPolicy](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy 'Abblix\.Oidc\.Server\.Features\.RichAuthorizationRequests\.IAuthorizationDetailsPolicy') {#Abblix.Oidc.Server.Endpoints.Token.Grants.DeviceCodeGrantHandler.DeviceCodeGrantHandler(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.Token.Grants.DeviceCodeGrantHandler_,Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IDeviceAuthorizationStorage,Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy,System.TimeProvider,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_).authorizationDetailsPolicy} Asks the per\-type validators whether the grant's authorization\_details are still acceptable, which is the only comparison that can see inside an entry\. ###### `timeProvider` [System\.TimeProvider](https://learn.microsoft.com/en-us/dotnet/api/system.timeprovider 'System\.TimeProvider') {#Abblix.Oidc.Server.Endpoints.Token.Grants.DeviceCodeGrantHandler.DeviceCodeGrantHandler(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.Token.Grants.DeviceCodeGrantHandler_,Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IDeviceAuthorizationStorage,Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy,System.TimeProvider,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_).timeProvider} Provides access to the current time\. ###### `options` [Microsoft\.Extensions\.Options\.IOptions<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptions-1 'Microsoft\.Extensions\.Options\.IOptions\`1')[OidcOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptions-1 'Microsoft\.Extensions\.Options\.IOptions\`1') {#Abblix.Oidc.Server.Endpoints.Token.Grants.DeviceCodeGrantHandler.DeviceCodeGrantHandler(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.Token.Grants.DeviceCodeGrantHandler_,Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IDeviceAuthorizationStorage,Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy,System.TimeProvider,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_).options} Configuration options containing polling interval settings\. ### Properties ## DeviceCodeGrantHandler\.GrantTypesSupported Property {#Abblix.Oidc.Server.Endpoints.Token.Grants.DeviceCodeGrantHandler.GrantTypesSupported} The grant types supported by this component, as defined in OAuth 2\.0 and OpenID Connect specifications\. ```csharp public System.Collections.Generic.IEnumerable GrantTypesSupported { get; } ``` Implements [GrantTypesSupported](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer#Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer.GrantTypesSupported 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IGrantTypeInformer\.GrantTypesSupported') #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ### Remarks Common grant types include: - "authorization_code" - Authorization Code Grant - "implicit" - Implicit Grant - "refresh_token" - Refresh Token Grant - "client_credentials" - Client Credentials Grant - "password" - Resource Owner Password Credentials Grant ### Methods ## DeviceCodeGrantHandler\.AuthorizeAsync\(TokenRequest, ClientInfo, CancellationToken\) Method {#Abblix.Oidc.Server.Endpoints.Token.Grants.DeviceCodeGrantHandler.AuthorizeAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.Threading.CancellationToken)} Resolves the grant\-specific input from [request](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.DeviceCodeGrantHandler#Abblix.Oidc.Server.Endpoints.Token.Grants.DeviceCodeGrantHandler.AuthorizeAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.Threading.CancellationToken).request 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.DeviceCodeGrantHandler\.AuthorizeAsync\(Abblix\.Oidc\.Server\.Model\.TokenRequest, Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo, System\.Threading\.CancellationToken\)\.request') \(authorization code, refresh token, device code, client credentials, JWT assertion, etc\.\) into the [AuthorizedGrant](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.AuthorizedGrant') that will drive token issuance, or an [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') such as `invalid_grant`, `authorization_pending`, or `slow_down`\. ```csharp public System.Threading.Tasks.Task> AuthorizeAsync(Abblix.Oidc.Server.Model.TokenRequest request, Abblix.Oidc.Server.Features.ClientInformation.ClientInfo clientInfo, System.Threading.CancellationToken cancellationToken); ``` #### Parameters ###### `request` [TokenRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.TokenRequest 'Abblix\.Oidc\.Server\.Model\.TokenRequest') {#Abblix.Oidc.Server.Endpoints.Token.Grants.DeviceCodeGrantHandler.AuthorizeAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.Threading.CancellationToken).request} The token request \(already authenticated against the client\)\. ###### `clientInfo` [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') {#Abblix.Oidc.Server.Endpoints.Token.Grants.DeviceCodeGrantHandler.AuthorizeAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.Threading.CancellationToken).clientInfo} The authenticated client; used to enforce that the grant was issued to the same client that is now redeeming it\. ###### `cancellationToken` [System\.Threading\.CancellationToken](https://learn.microsoft.com/en-us/dotnet/api/system.threading.cancellationtoken 'System\.Threading\.CancellationToken') {#Abblix.Oidc.Server.Endpoints.Token.Grants.DeviceCodeGrantHandler.AuthorizeAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.Threading.CancellationToken).cancellationToken} Implements [AuthorizeAsync\(TokenRequest, ClientInfo, CancellationToken\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler#Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler.AuthorizeAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.Threading.CancellationToken) 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.IAuthorizationGrantHandler\.AuthorizeAsync\(Abblix\.Oidc\.Server\.Model\.TokenRequest, Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo, System\.Threading\.CancellationToken\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[AuthorizedGrant](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.AuthorizedGrant')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.ErrorFactory.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants') ## ErrorFactory Class Builds [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') instances using the error codes RFC 6749 §5\.2 defines for the token endpoint\. Mirrors the sibling per\-area factories \(authorization validation, dynamic client registration, secure HTTP fetch\): each area exposes only the error codes its specification legitimately uses, so codes from one protocol surface do not leak into another\. ```csharp public static class ErrorFactory ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ErrorFactory ### Methods ## ErrorFactory\.InvalidRequest\(string\) Method {#Abblix.Oidc.Server.Endpoints.Token.Grants.ErrorFactory.InvalidRequest(string)} Creates an error for a malformed token request \- a missing, repeated, or otherwise invalid parameter \(RFC 6749 §5\.2, `invalid_request`\)\. ```csharp public static Abblix.Oidc.Server.Common.OidcError InvalidRequest(string description); ``` #### Parameters ###### `description` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Endpoints.Token.Grants.ErrorFactory.InvalidRequest(string).description} The description of the error\. #### Returns [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') An error instance with the error code and description\. ## ErrorFactory\.MissingParameter\(string\) Method {#Abblix.Oidc.Server.Endpoints.Token.Grants.ErrorFactory.MissingParameter(string)} Creates an error for a token request whose required parameter is absent \(RFC 6749 §5\.2, `invalid_request`\)\. ```csharp public static Abblix.Oidc.Server.Common.OidcError MissingParameter(string parameterName); ``` #### Parameters ###### `parameterName` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Endpoints.Token.Grants.ErrorFactory.MissingParameter(string).parameterName} The wire\-level name of the missing parameter\. #### Returns [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') An error instance with the error code and description\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants') ## IAuthorizationGrantHandler Interface Strategy contract for resolving the `grant_type`\-specific portion of an OAuth 2\.0 token request \(RFC 6749 §4\) into an [AuthorizedGrant](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.AuthorizedGrant'): an authentication session plus the [AuthorizationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.AuthorizationContext 'Abblix\.Oidc\.Server\.Common\.AuthorizationContext') \(subject, scope, resources, claims\) that the issued tokens will inherit\. Each implementation advertises the grant types it owns via [GrantTypesSupported](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer#Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer.GrantTypesSupported 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IGrantTypeInformer\.GrantTypesSupported')\. ```csharp public interface IAuthorizationGrantHandler : Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer ``` Derived ↳ [AuthorizationCodeGrantHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.AuthorizationCodeGrantHandler 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.AuthorizationCodeGrantHandler') ↳ [BackChannelAuthenticationGrantHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.BackChannelAuthenticationGrantHandler 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.BackChannelAuthenticationGrantHandler') ↳ [ClientCredentialsGrantHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.ClientCredentialsGrantHandler 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.ClientCredentialsGrantHandler') ↳ [CompositeAuthorizationGrantHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.CompositeAuthorizationGrantHandler 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.CompositeAuthorizationGrantHandler') ↳ [DeviceCodeGrantHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.DeviceCodeGrantHandler 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.DeviceCodeGrantHandler') ↳ [JwtBearerGrantHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.JwtBearerGrantHandler 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.JwtBearerGrantHandler') ↳ [PasswordGrantHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.PasswordGrantHandler 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.PasswordGrantHandler') ↳ [RefreshTokenGrantHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.RefreshTokenGrantHandler 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.RefreshTokenGrantHandler') ↳ [TokenExchangeGrantHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.TokenExchangeGrantHandler 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.TokenExchangeGrantHandler') Implements [IGrantTypeInformer](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IGrantTypeInformer') ### Methods ## IAuthorizationGrantHandler\.AuthorizeAsync\(TokenRequest, ClientInfo\) Method {#Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler.AuthorizeAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo)} Resolves the grant\-specific input from [request](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler#Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler.AuthorizeAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo).request 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.IAuthorizationGrantHandler\.AuthorizeAsync\(Abblix\.Oidc\.Server\.Model\.TokenRequest, Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo\)\.request') \(authorization code, refresh token, device code, client credentials, JWT assertion, etc\.\) into the [AuthorizedGrant](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.AuthorizedGrant') that will drive token issuance, or an [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') such as `invalid_grant`, `authorization_pending`, or `slow_down`\. ```csharp System.Threading.Tasks.Task> AuthorizeAsync(Abblix.Oidc.Server.Model.TokenRequest request, Abblix.Oidc.Server.Features.ClientInformation.ClientInfo clientInfo); ``` #### Parameters ###### `request` [TokenRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.TokenRequest 'Abblix\.Oidc\.Server\.Model\.TokenRequest') {#Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler.AuthorizeAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo).request} The token request \(already authenticated against the client\)\. ###### `clientInfo` [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') {#Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler.AuthorizeAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo).clientInfo} The authenticated client; used to enforce that the grant was issued to the same client that is now redeeming it\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[AuthorizedGrant](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.AuthorizedGrant')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') ## IAuthorizationGrantHandler\.AuthorizeAsync\(TokenRequest, ClientInfo, CancellationToken\) Method {#Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler.AuthorizeAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.Threading.CancellationToken)} Resolves the grant\-specific input from [request](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler#Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler.AuthorizeAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.Threading.CancellationToken).request 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.IAuthorizationGrantHandler\.AuthorizeAsync\(Abblix\.Oidc\.Server\.Model\.TokenRequest, Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo, System\.Threading\.CancellationToken\)\.request') \(authorization code, refresh token, device code, client credentials, JWT assertion, etc\.\) into the [AuthorizedGrant](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.AuthorizedGrant') that will drive token issuance, or an [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') such as `invalid_grant`, `authorization_pending`, or `slow_down`\. ```csharp System.Threading.Tasks.Task> AuthorizeAsync(Abblix.Oidc.Server.Model.TokenRequest request, Abblix.Oidc.Server.Features.ClientInformation.ClientInfo clientInfo, System.Threading.CancellationToken cancellationToken); ``` #### Parameters ###### `request` [TokenRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.TokenRequest 'Abblix\.Oidc\.Server\.Model\.TokenRequest') {#Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler.AuthorizeAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.Threading.CancellationToken).request} The token request \(already authenticated against the client\)\. ###### `clientInfo` [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') {#Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler.AuthorizeAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.Threading.CancellationToken).clientInfo} The authenticated client; used to enforce that the grant was issued to the same client that is now redeeming it\. ###### `cancellationToken` [System\.Threading\.CancellationToken](https://learn.microsoft.com/en-us/dotnet/api/system.threading.cancellationtoken 'System\.Threading\.CancellationToken') {#Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler.AuthorizeAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.Threading.CancellationToken).cancellationToken} #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[AuthorizedGrant](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.AuthorizedGrant')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.JwtBearerGrantHandler.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants') ## JwtBearerGrantHandler Class Handles the JWT Bearer grant type per RFC 7523, allowing clients to exchange a JWT assertion for an access token\. This grant type is used when a client has obtained a JWT from a trusted identity provider and wants to exchange it for an access token at this authorization server\. ```csharp public class JwtBearerGrantHandler : Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler, Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → JwtBearerGrantHandler Implements [IAuthorizationGrantHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.IAuthorizationGrantHandler'), [IGrantTypeInformer](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IGrantTypeInformer') ### Remarks The JWT Bearer grant type is specified in RFC 7523 and is commonly used in scenarios such as: \- Service\-to\-service authentication with pre\-existing trust relationships \- Token exchange between federated identity providers \- API\-to\-API communication where the calling service has a JWT from an identity provider \- Single sign\-on \(SSO\) across different domains or organizations The JWT assertion must contain specific claims per RFC 7523 Section 3: \- iss \(issuer\): Identifies the principal that issued the JWT \- sub \(subject\): Identifies the principal that is the subject of the JWT \- aud \(audience\): Identifies the recipients that the JWT is intended for \(must include this authorization server\) \- exp \(expiration time\): Identifies the expiration time on or after which the JWT MUST NOT be accepted \- jti \(JWT ID\): Optional per RFC 7523 Section 3, which lets the authorization server keep the set of used values and refuse a repeat The authorization server validates the JWT signature, claims, and ensures the issuer is trusted before issuing an access token\. ### Constructors ## JwtBearerGrantHandler\(ILogger\, IJsonWebTokenValidator, IJwtBearerIssuerProvider, IRequestInfoProvider, ISessionIdGenerator, TimeProvider, IOptions\\) Constructor {#Abblix.Oidc.Server.Endpoints.Token.Grants.JwtBearerGrantHandler.JwtBearerGrantHandler(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.Token.Grants.JwtBearerGrantHandler_,Abblix.Jwt.IJsonWebTokenValidator,Abblix.Oidc.Server.Features.JwtBearer.IJwtBearerIssuerProvider,Abblix.Oidc.Server.Common.Interfaces.IRequestInfoProvider,Abblix.Oidc.Server.Features.RandomGenerators.ISessionIdGenerator,System.TimeProvider,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_)} Handles the JWT Bearer grant type per RFC 7523, allowing clients to exchange a JWT assertion for an access token\. This grant type is used when a client has obtained a JWT from a trusted identity provider and wants to exchange it for an access token at this authorization server\. ```csharp public JwtBearerGrantHandler(Microsoft.Extensions.Logging.ILogger logger, Abblix.Jwt.IJsonWebTokenValidator jwtValidator, Abblix.Oidc.Server.Features.JwtBearer.IJwtBearerIssuerProvider issuerProvider, Abblix.Oidc.Server.Common.Interfaces.IRequestInfoProvider requestInfoProvider, Abblix.Oidc.Server.Features.RandomGenerators.ISessionIdGenerator sessionIdGenerator, System.TimeProvider timeProvider, Microsoft.Extensions.Options.IOptions oidcOptions); ``` #### Parameters ###### `logger` [Microsoft\.Extensions\.Logging\.ILogger<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1')[JwtBearerGrantHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.JwtBearerGrantHandler 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.JwtBearerGrantHandler')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1') {#Abblix.Oidc.Server.Endpoints.Token.Grants.JwtBearerGrantHandler.JwtBearerGrantHandler(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.Token.Grants.JwtBearerGrantHandler_,Abblix.Jwt.IJsonWebTokenValidator,Abblix.Oidc.Server.Features.JwtBearer.IJwtBearerIssuerProvider,Abblix.Oidc.Server.Common.Interfaces.IRequestInfoProvider,Abblix.Oidc.Server.Features.RandomGenerators.ISessionIdGenerator,System.TimeProvider,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_).logger} Logger for recording JWT Bearer grant validation events and errors\. ###### `jwtValidator` [IJsonWebTokenValidator](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.IJsonWebTokenValidator 'Abblix\.Jwt\.IJsonWebTokenValidator') {#Abblix.Oidc.Server.Endpoints.Token.Grants.JwtBearerGrantHandler.JwtBearerGrantHandler(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.Token.Grants.JwtBearerGrantHandler_,Abblix.Jwt.IJsonWebTokenValidator,Abblix.Oidc.Server.Features.JwtBearer.IJwtBearerIssuerProvider,Abblix.Oidc.Server.Common.Interfaces.IRequestInfoProvider,Abblix.Oidc.Server.Features.RandomGenerators.ISessionIdGenerator,System.TimeProvider,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_).jwtValidator} Validates JWT assertions including signature verification and claims validation\. ###### `issuerProvider` [IJwtBearerIssuerProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.JwtBearer.IJwtBearerIssuerProvider 'Abblix\.Oidc\.Server\.Features\.JwtBearer\.IJwtBearerIssuerProvider') {#Abblix.Oidc.Server.Endpoints.Token.Grants.JwtBearerGrantHandler.JwtBearerGrantHandler(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.Token.Grants.JwtBearerGrantHandler_,Abblix.Jwt.IJsonWebTokenValidator,Abblix.Oidc.Server.Features.JwtBearer.IJwtBearerIssuerProvider,Abblix.Oidc.Server.Common.Interfaces.IRequestInfoProvider,Abblix.Oidc.Server.Features.RandomGenerators.ISessionIdGenerator,System.TimeProvider,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_).issuerProvider} Provides comprehensive JWT Bearer functionality including trusted issuers, keys, and replay protection\. ###### `requestInfoProvider` [IRequestInfoProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IRequestInfoProvider 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IRequestInfoProvider') {#Abblix.Oidc.Server.Endpoints.Token.Grants.JwtBearerGrantHandler.JwtBearerGrantHandler(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.Token.Grants.JwtBearerGrantHandler_,Abblix.Jwt.IJsonWebTokenValidator,Abblix.Oidc.Server.Features.JwtBearer.IJwtBearerIssuerProvider,Abblix.Oidc.Server.Common.Interfaces.IRequestInfoProvider,Abblix.Oidc.Server.Features.RandomGenerators.ISessionIdGenerator,System.TimeProvider,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_).requestInfoProvider} Provides information about the current HTTP request for audience validation\. ###### `sessionIdGenerator` [ISessionIdGenerator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.ISessionIdGenerator 'Abblix\.Oidc\.Server\.Features\.RandomGenerators\.ISessionIdGenerator') {#Abblix.Oidc.Server.Endpoints.Token.Grants.JwtBearerGrantHandler.JwtBearerGrantHandler(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.Token.Grants.JwtBearerGrantHandler_,Abblix.Jwt.IJsonWebTokenValidator,Abblix.Oidc.Server.Features.JwtBearer.IJwtBearerIssuerProvider,Abblix.Oidc.Server.Common.Interfaces.IRequestInfoProvider,Abblix.Oidc.Server.Features.RandomGenerators.ISessionIdGenerator,System.TimeProvider,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_).sessionIdGenerator} Generates unique session identifiers for authentication sessions\. ###### `timeProvider` [System\.TimeProvider](https://learn.microsoft.com/en-us/dotnet/api/system.timeprovider 'System\.TimeProvider') {#Abblix.Oidc.Server.Endpoints.Token.Grants.JwtBearerGrantHandler.JwtBearerGrantHandler(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.Token.Grants.JwtBearerGrantHandler_,Abblix.Jwt.IJsonWebTokenValidator,Abblix.Oidc.Server.Features.JwtBearer.IJwtBearerIssuerProvider,Abblix.Oidc.Server.Common.Interfaces.IRequestInfoProvider,Abblix.Oidc.Server.Features.RandomGenerators.ISessionIdGenerator,System.TimeProvider,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_).timeProvider} Provides access to the current time for session timestamps\. ###### `oidcOptions` [Microsoft\.Extensions\.Options\.IOptions<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptions-1 'Microsoft\.Extensions\.Options\.IOptions\`1')[OidcOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptions-1 'Microsoft\.Extensions\.Options\.IOptions\`1') {#Abblix.Oidc.Server.Endpoints.Token.Grants.JwtBearerGrantHandler.JwtBearerGrantHandler(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.Token.Grants.JwtBearerGrantHandler_,Abblix.Jwt.IJsonWebTokenValidator,Abblix.Oidc.Server.Features.JwtBearer.IJwtBearerIssuerProvider,Abblix.Oidc.Server.Common.Interfaces.IRequestInfoProvider,Abblix.Oidc.Server.Features.RandomGenerators.ISessionIdGenerator,System.TimeProvider,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_).oidcOptions} Carries the deployment's clock tolerance and the default security profile a client without one of its own falls back to\. ### Remarks The JWT Bearer grant type is specified in RFC 7523 and is commonly used in scenarios such as: \- Service\-to\-service authentication with pre\-existing trust relationships \- Token exchange between federated identity providers \- API\-to\-API communication where the calling service has a JWT from an identity provider \- Single sign\-on \(SSO\) across different domains or organizations The JWT assertion must contain specific claims per RFC 7523 Section 3: \- iss \(issuer\): Identifies the principal that issued the JWT \- sub \(subject\): Identifies the principal that is the subject of the JWT \- aud \(audience\): Identifies the recipients that the JWT is intended for \(must include this authorization server\) \- exp \(expiration time\): Identifies the expiration time on or after which the JWT MUST NOT be accepted \- jti \(JWT ID\): Optional per RFC 7523 Section 3, which lets the authorization server keep the set of used values and refuse a repeat The authorization server validates the JWT signature, claims, and ensures the issuer is trusted before issuing an access token\. ### Properties ## JwtBearerGrantHandler\.GrantTypesSupported Property {#Abblix.Oidc.Server.Endpoints.Token.Grants.JwtBearerGrantHandler.GrantTypesSupported} Specifies the grant type that this handler supports, which is the JWT Bearer grant type\. ```csharp public System.Collections.Generic.IEnumerable GrantTypesSupported { get; } ``` Implements [GrantTypesSupported](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer#Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer.GrantTypesSupported 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IGrantTypeInformer\.GrantTypesSupported') #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ### Methods ## JwtBearerGrantHandler\.AuthorizeAsync\(TokenRequest, ClientInfo, CancellationToken\) Method {#Abblix.Oidc.Server.Endpoints.Token.Grants.JwtBearerGrantHandler.AuthorizeAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.Threading.CancellationToken)} Asynchronously processes the token request using the JWT Bearer grant type\. Validates the JWT assertion and, if valid, issues an access token\. ```csharp public System.Threading.Tasks.Task> AuthorizeAsync(Abblix.Oidc.Server.Model.TokenRequest request, Abblix.Oidc.Server.Features.ClientInformation.ClientInfo clientInfo, System.Threading.CancellationToken cancellationToken); ``` #### Parameters ###### `request` [TokenRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.TokenRequest 'Abblix\.Oidc\.Server\.Model\.TokenRequest') {#Abblix.Oidc.Server.Endpoints.Token.Grants.JwtBearerGrantHandler.AuthorizeAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.Threading.CancellationToken).request} The token request containing the JWT assertion and requested scope\. ###### `clientInfo` [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') {#Abblix.Oidc.Server.Endpoints.Token.Grants.JwtBearerGrantHandler.AuthorizeAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.Threading.CancellationToken).clientInfo} Information about the authenticated client making the request\. ###### `cancellationToken` [System\.Threading\.CancellationToken](https://learn.microsoft.com/en-us/dotnet/api/system.threading.cancellationtoken 'System\.Threading\.CancellationToken') {#Abblix.Oidc.Server.Endpoints.Token.Grants.JwtBearerGrantHandler.AuthorizeAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.Threading.CancellationToken).cancellationToken} Abandons the operation when the caller stops waiting\. Implements [AuthorizeAsync\(TokenRequest, ClientInfo, CancellationToken\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler#Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler.AuthorizeAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.Threading.CancellationToken) 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.IAuthorizationGrantHandler\.AuthorizeAsync\(Abblix\.Oidc\.Server\.Model\.TokenRequest, Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo, System\.Threading\.CancellationToken\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[AuthorizedGrant](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.AuthorizedGrant')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task that completes with either an authorized grant containing the user session and context, or an error indicating why the JWT assertion was rejected\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.PasswordGrantHandler.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants') ## PasswordGrantHandler Class Handles the authorization process for the password grant type within the OAuth 2\.0 framework\. This handler validates the user's credentials and processes token requests based on the password grant type\. The password grant type allows clients to directly exchange a user's credentials \(username and password\) for an access token, typically for trusted clients\. ```csharp public class PasswordGrantHandler : Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler, Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → PasswordGrantHandler Implements [IAuthorizationGrantHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.IAuthorizationGrantHandler'), [IGrantTypeInformer](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IGrantTypeInformer') ### Constructors ## PasswordGrantHandler\(IUserCredentialsAuthenticator\) Constructor {#Abblix.Oidc.Server.Endpoints.Token.Grants.PasswordGrantHandler.PasswordGrantHandler(Abblix.Oidc.Server.Common.Interfaces.IUserCredentialsAuthenticator)} Handles the authorization process for the password grant type within the OAuth 2\.0 framework\. This handler validates the user's credentials and processes token requests based on the password grant type\. The password grant type allows clients to directly exchange a user's credentials \(username and password\) for an access token, typically for trusted clients\. ```csharp public PasswordGrantHandler(Abblix.Oidc.Server.Common.Interfaces.IUserCredentialsAuthenticator userCredentialsAuthenticator); ``` #### Parameters ###### `userCredentialsAuthenticator` [IUserCredentialsAuthenticator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IUserCredentialsAuthenticator 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IUserCredentialsAuthenticator') {#Abblix.Oidc.Server.Endpoints.Token.Grants.PasswordGrantHandler.PasswordGrantHandler(Abblix.Oidc.Server.Common.Interfaces.IUserCredentialsAuthenticator).userCredentialsAuthenticator} A service for authenticating the user's credentials\. ### Properties ## PasswordGrantHandler\.GrantTypesSupported Property {#Abblix.Oidc.Server.Endpoints.Token.Grants.PasswordGrantHandler.GrantTypesSupported} Specifies the grant type that this handler supports, which is the "password" grant type\. This ensures that this handler is only invoked when processing requests with the password grant type\. ```csharp public System.Collections.Generic.IEnumerable GrantTypesSupported { get; } ``` Implements [GrantTypesSupported](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer#Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer.GrantTypesSupported 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IGrantTypeInformer\.GrantTypesSupported') #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ### Methods ## PasswordGrantHandler\.AuthorizeAsync\(TokenRequest, ClientInfo, CancellationToken\) Method {#Abblix.Oidc.Server.Endpoints.Token.Grants.PasswordGrantHandler.AuthorizeAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.Threading.CancellationToken)} Asynchronously processes the token request using the password grant type\. The handler ensures the request contains the necessary parameters, validates the user's credentials, and then proceeds to authorize the request if the credentials are valid\. It delegates credential validation to the user credentials authenticator, which handles the security checks related to user authentication\. ```csharp public System.Threading.Tasks.Task> AuthorizeAsync(Abblix.Oidc.Server.Model.TokenRequest request, Abblix.Oidc.Server.Features.ClientInformation.ClientInfo clientInfo, System.Threading.CancellationToken cancellationToken); ``` #### Parameters ###### `request` [TokenRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.TokenRequest 'Abblix\.Oidc\.Server\.Model\.TokenRequest') {#Abblix.Oidc.Server.Endpoints.Token.Grants.PasswordGrantHandler.AuthorizeAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.Threading.CancellationToken).request} The token request containing the user's credentials and other parameters\. ###### `clientInfo` [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') {#Abblix.Oidc.Server.Endpoints.Token.Grants.PasswordGrantHandler.AuthorizeAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.Threading.CancellationToken).clientInfo} Information about the client making the request, used for validation and context\. ###### `cancellationToken` [System\.Threading\.CancellationToken](https://learn.microsoft.com/en-us/dotnet/api/system.threading.cancellationtoken 'System\.Threading\.CancellationToken') {#Abblix.Oidc.Server.Endpoints.Token.Grants.PasswordGrantHandler.AuthorizeAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.Threading.CancellationToken).cancellationToken} Abandons the operation when the caller stops waiting\. Implements [AuthorizeAsync\(TokenRequest, ClientInfo, CancellationToken\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler#Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler.AuthorizeAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.Threading.CancellationToken) 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.IAuthorizationGrantHandler\.AuthorizeAsync\(Abblix\.Oidc\.Server\.Model\.TokenRequest, Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo, System\.Threading\.CancellationToken\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[AuthorizedGrant](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.AuthorizedGrant')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task that completes with the authorization result, which could be an error or successful grant\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.RefreshTokenGrantHandler.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants') ## RefreshTokenGrantHandler Class [IAuthorizationGrantHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.IAuthorizationGrantHandler') for `grant_type=refresh_token` \(RFC 6749 §6\)\. Verifies the refresh token's signature and lifetime, requires the JWT `typ` header to be `rt+jwt`, recovers the original [AuthorizedGrant](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.AuthorizedGrant'), and rejects the request with `invalid_grant` when the refreshing client differs from the client that received the token\. ```csharp public class RefreshTokenGrantHandler : Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler, Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → RefreshTokenGrantHandler Implements [IAuthorizationGrantHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.IAuthorizationGrantHandler'), [IGrantTypeInformer](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IGrantTypeInformer') ### Constructors ## RefreshTokenGrantHandler\(IAuthServiceJwtValidator, IRefreshTokenService\) Constructor {#Abblix.Oidc.Server.Endpoints.Token.Grants.RefreshTokenGrantHandler.RefreshTokenGrantHandler(Abblix.Oidc.Server.Features.Tokens.Validation.IAuthServiceJwtValidator,Abblix.Oidc.Server.Features.Tokens.IRefreshTokenService)} [IAuthorizationGrantHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.IAuthorizationGrantHandler') for `grant_type=refresh_token` \(RFC 6749 §6\)\. Verifies the refresh token's signature and lifetime, requires the JWT `typ` header to be `rt+jwt`, recovers the original [AuthorizedGrant](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.AuthorizedGrant'), and rejects the request with `invalid_grant` when the refreshing client differs from the client that received the token\. ```csharp public RefreshTokenGrantHandler(Abblix.Oidc.Server.Features.Tokens.Validation.IAuthServiceJwtValidator jwtValidator, Abblix.Oidc.Server.Features.Tokens.IRefreshTokenService refreshTokenService); ``` #### Parameters ###### `jwtValidator` [IAuthServiceJwtValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.Validation.IAuthServiceJwtValidator 'Abblix\.Oidc\.Server\.Features\.Tokens\.Validation\.IAuthServiceJwtValidator') {#Abblix.Oidc.Server.Endpoints.Token.Grants.RefreshTokenGrantHandler.RefreshTokenGrantHandler(Abblix.Oidc.Server.Features.Tokens.Validation.IAuthServiceJwtValidator,Abblix.Oidc.Server.Features.Tokens.IRefreshTokenService).jwtValidator} Validates the refresh\-token JWT issued by this server\. ###### `refreshTokenService` [IRefreshTokenService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.IRefreshTokenService 'Abblix\.Oidc\.Server\.Features\.Tokens\.IRefreshTokenService') {#Abblix.Oidc.Server.Endpoints.Token.Grants.RefreshTokenGrantHandler.RefreshTokenGrantHandler(Abblix.Oidc.Server.Features.Tokens.Validation.IAuthServiceJwtValidator,Abblix.Oidc.Server.Features.Tokens.IRefreshTokenService).refreshTokenService} Resolves the refresh\-token JWT to an [AuthorizedGrant](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.AuthorizedGrant') and enforces single\-use / rotation semantics\. ### Properties ## RefreshTokenGrantHandler\.GrantTypesSupported Property {#Abblix.Oidc.Server.Endpoints.Token.Grants.RefreshTokenGrantHandler.GrantTypesSupported} Indicates that this handler is responsible for processing the 'refresh\_token' grant type\. The framework uses this information to ensure that this handler is only invoked for the refresh token flow\. ```csharp public System.Collections.Generic.IEnumerable GrantTypesSupported { get; } ``` Implements [GrantTypesSupported](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer#Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer.GrantTypesSupported 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IGrantTypeInformer\.GrantTypesSupported') #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ### Methods ## RefreshTokenGrantHandler\.AuthorizeAsync\(TokenRequest, ClientInfo, CancellationToken\) Method {#Abblix.Oidc.Server.Endpoints.Token.Grants.RefreshTokenGrantHandler.AuthorizeAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.Threading.CancellationToken)} Processes a token request using the refresh token grant type\. This method validates the refresh token, ensures that the token is associated with the correct client, and generates new tokens if the request is valid\. ```csharp public System.Threading.Tasks.Task> AuthorizeAsync(Abblix.Oidc.Server.Model.TokenRequest request, Abblix.Oidc.Server.Features.ClientInformation.ClientInfo clientInfo, System.Threading.CancellationToken cancellationToken); ``` #### Parameters ###### `request` [TokenRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.TokenRequest 'Abblix\.Oidc\.Server\.Model\.TokenRequest') {#Abblix.Oidc.Server.Endpoints.Token.Grants.RefreshTokenGrantHandler.AuthorizeAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.Threading.CancellationToken).request} The token request, containing the refresh token and other required parameters\. ###### `clientInfo` [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') {#Abblix.Oidc.Server.Endpoints.Token.Grants.RefreshTokenGrantHandler.AuthorizeAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.Threading.CancellationToken).clientInfo} The client information, used to verify the request is coming from an authorized client\. ###### `cancellationToken` [System\.Threading\.CancellationToken](https://learn.microsoft.com/en-us/dotnet/api/system.threading.cancellationtoken 'System\.Threading\.CancellationToken') {#Abblix.Oidc.Server.Endpoints.Token.Grants.RefreshTokenGrantHandler.AuthorizeAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.Threading.CancellationToken).cancellationToken} Abandons the operation when the caller stops waiting\. Implements [AuthorizeAsync\(TokenRequest, ClientInfo, CancellationToken\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler#Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler.AuthorizeAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.Threading.CancellationToken) 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.IAuthorizationGrantHandler\.AuthorizeAsync\(Abblix\.Oidc\.Server\.Model\.TokenRequest, Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo, System\.Threading\.CancellationToken\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[AuthorizedGrant](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.AuthorizedGrant')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task representing the outcome of the authorization process, either returning a successful grant with a new access token or an error if the request is invalid or the refresh token is unauthorized\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.TokenExchangeGrantHandler.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants') ## TokenExchangeGrantHandler Class [IAuthorizationGrantHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.IAuthorizationGrantHandler') for RFC 8693 Token Exchange \(`grant_type=urn:ietf:params:oauth:grant-type:token-exchange`\)\. ```csharp public class TokenExchangeGrantHandler : Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler, Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → TokenExchangeGrantHandler Implements [IAuthorizationGrantHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.IAuthorizationGrantHandler'), [IGrantTypeInformer](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IGrantTypeInformer') ### Remarks Per\-format subject\-token validation is delegated to keyed [ISubjectTokenResolver](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.TokenExchange.ISubjectTokenResolver 'Abblix\.Oidc\.Server\.Features\.TokenExchange\.ISubjectTokenResolver') implementations: [JwtSubjectTokenResolver](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.TokenExchange.JwtSubjectTokenResolver 'Abblix\.Oidc\.Server\.Features\.TokenExchange\.JwtSubjectTokenResolver') for the three JWT\-based type URIs \(`access_token`, `id_token`, `jwt`\) and [RefreshTokenSubjectTokenResolver](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.TokenExchange.RefreshTokenSubjectTokenResolver 'Abblix\.Oidc\.Server\.Features\.TokenExchange\.RefreshTokenSubjectTokenResolver') for refresh tokens\. Lookup that returns no resolver for the requested key yields `invalid_request` \-\- the library never silently accepts an unknown `subject_token_type`\. Hosts may register additional resolvers for formats this library does not handle natively\. Authorization is structured as a monadic `Bind`-chain on [Result<TSuccess,TFailure>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2'), mirroring [JwtBearerGrantHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.JwtBearerGrantHandler 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.JwtBearerGrantHandler'): each step returns either an enriched [Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.TokenExchangeGrantHandler\.ValidationContext](https://learn.microsoft.com/en-us/dotnet/api/abblix.oidc.server.endpoints.token.grants.tokenexchangegranthandler.validationcontext 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.TokenExchangeGrantHandler\.ValidationContext') or an [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError'); the chain short-circuits at the first failure. Subject-token resolution sits in the middle of the chain, so post-resolve guards (cross-client origin, typ-confusion, forwarded AD allowlist) read the resolved [SubjectTokenContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.TokenExchange.SubjectTokenContext 'Abblix\.Oidc\.Server\.Features\.TokenExchange\.SubjectTokenContext') directly from the context. Supports both RFC 8693 §4.1 modes: impersonation (no `actor_token`; the issued token's `sub` equals the subject_token's subject, no `act` claim) and delegation (`actor_token` provided; the issued token's `sub` still equals the subject's subject, and the `act` claim names the actor. When the subject_token itself already carries an `act` chain, the new actor is layered on top -- the previous chain becomes the new actor's nested `act.act`). ### Constructors ## TokenExchangeGrantHandler\(IServiceProvider, ISessionIdGenerator, TimeProvider\) Constructor {#Abblix.Oidc.Server.Endpoints.Token.Grants.TokenExchangeGrantHandler.TokenExchangeGrantHandler(System.IServiceProvider,Abblix.Oidc.Server.Features.RandomGenerators.ISessionIdGenerator,System.TimeProvider)} [IAuthorizationGrantHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.IAuthorizationGrantHandler') for RFC 8693 Token Exchange \(`grant_type=urn:ietf:params:oauth:grant-type:token-exchange`\)\. ```csharp public TokenExchangeGrantHandler(System.IServiceProvider serviceProvider, Abblix.Oidc.Server.Features.RandomGenerators.ISessionIdGenerator sessionIdGenerator, System.TimeProvider timeProvider); ``` #### Parameters ###### `serviceProvider` [System\.IServiceProvider](https://learn.microsoft.com/en-us/dotnet/api/system.iserviceprovider 'System\.IServiceProvider') {#Abblix.Oidc.Server.Endpoints.Token.Grants.TokenExchangeGrantHandler.TokenExchangeGrantHandler(System.IServiceProvider,Abblix.Oidc.Server.Features.RandomGenerators.ISessionIdGenerator,System.TimeProvider).serviceProvider} ###### `sessionIdGenerator` [ISessionIdGenerator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.ISessionIdGenerator 'Abblix\.Oidc\.Server\.Features\.RandomGenerators\.ISessionIdGenerator') {#Abblix.Oidc.Server.Endpoints.Token.Grants.TokenExchangeGrantHandler.TokenExchangeGrantHandler(System.IServiceProvider,Abblix.Oidc.Server.Features.RandomGenerators.ISessionIdGenerator,System.TimeProvider).sessionIdGenerator} ###### `timeProvider` [System\.TimeProvider](https://learn.microsoft.com/en-us/dotnet/api/system.timeprovider 'System\.TimeProvider') {#Abblix.Oidc.Server.Endpoints.Token.Grants.TokenExchangeGrantHandler.TokenExchangeGrantHandler(System.IServiceProvider,Abblix.Oidc.Server.Features.RandomGenerators.ISessionIdGenerator,System.TimeProvider).timeProvider} ### Remarks Per\-format subject\-token validation is delegated to keyed [ISubjectTokenResolver](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.TokenExchange.ISubjectTokenResolver 'Abblix\.Oidc\.Server\.Features\.TokenExchange\.ISubjectTokenResolver') implementations: [JwtSubjectTokenResolver](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.TokenExchange.JwtSubjectTokenResolver 'Abblix\.Oidc\.Server\.Features\.TokenExchange\.JwtSubjectTokenResolver') for the three JWT\-based type URIs \(`access_token`, `id_token`, `jwt`\) and [RefreshTokenSubjectTokenResolver](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.TokenExchange.RefreshTokenSubjectTokenResolver 'Abblix\.Oidc\.Server\.Features\.TokenExchange\.RefreshTokenSubjectTokenResolver') for refresh tokens\. Lookup that returns no resolver for the requested key yields `invalid_request` \-\- the library never silently accepts an unknown `subject_token_type`\. Hosts may register additional resolvers for formats this library does not handle natively\. Authorization is structured as a monadic `Bind`-chain on [Result<TSuccess,TFailure>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2'), mirroring [JwtBearerGrantHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.JwtBearerGrantHandler 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.JwtBearerGrantHandler'): each step returns either an enriched [Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.TokenExchangeGrantHandler\.ValidationContext](https://learn.microsoft.com/en-us/dotnet/api/abblix.oidc.server.endpoints.token.grants.tokenexchangegranthandler.validationcontext 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.TokenExchangeGrantHandler\.ValidationContext') or an [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError'); the chain short-circuits at the first failure. Subject-token resolution sits in the middle of the chain, so post-resolve guards (cross-client origin, typ-confusion, forwarded AD allowlist) read the resolved [SubjectTokenContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.TokenExchange.SubjectTokenContext 'Abblix\.Oidc\.Server\.Features\.TokenExchange\.SubjectTokenContext') directly from the context. Supports both RFC 8693 §4.1 modes: impersonation (no `actor_token`; the issued token's `sub` equals the subject_token's subject, no `act` claim) and delegation (`actor_token` provided; the issued token's `sub` still equals the subject's subject, and the `act` claim names the actor. When the subject_token itself already carries an `act` chain, the new actor is layered on top -- the previous chain becomes the new actor's nested `act.act`). ### Properties ## TokenExchangeGrantHandler\.GrantTypesSupported Property {#Abblix.Oidc.Server.Endpoints.Token.Grants.TokenExchangeGrantHandler.GrantTypesSupported} The grant types supported by this component, as defined in OAuth 2\.0 and OpenID Connect specifications\. ```csharp public System.Collections.Generic.IEnumerable GrantTypesSupported { get; } ``` Implements [GrantTypesSupported](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer#Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer.GrantTypesSupported 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IGrantTypeInformer\.GrantTypesSupported') #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ### Remarks Common grant types include: - "authorization_code" - Authorization Code Grant - "implicit" - Implicit Grant - "refresh_token" - Refresh Token Grant - "client_credentials" - Client Credentials Grant - "password" - Resource Owner Password Credentials Grant ### Methods ## TokenExchangeGrantHandler\.AuthorizeAsync\(TokenRequest, ClientInfo, CancellationToken\) Method {#Abblix.Oidc.Server.Endpoints.Token.Grants.TokenExchangeGrantHandler.AuthorizeAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.Threading.CancellationToken)} Resolves the grant\-specific input from [request](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.TokenExchangeGrantHandler#Abblix.Oidc.Server.Endpoints.Token.Grants.TokenExchangeGrantHandler.AuthorizeAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.Threading.CancellationToken).request 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.TokenExchangeGrantHandler\.AuthorizeAsync\(Abblix\.Oidc\.Server\.Model\.TokenRequest, Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo, System\.Threading\.CancellationToken\)\.request') \(authorization code, refresh token, device code, client credentials, JWT assertion, etc\.\) into the [AuthorizedGrant](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.AuthorizedGrant') that will drive token issuance, or an [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') such as `invalid_grant`, `authorization_pending`, or `slow_down`\. ```csharp public System.Threading.Tasks.Task> AuthorizeAsync(Abblix.Oidc.Server.Model.TokenRequest request, Abblix.Oidc.Server.Features.ClientInformation.ClientInfo clientInfo, System.Threading.CancellationToken cancellationToken); ``` #### Parameters ###### `request` [TokenRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.TokenRequest 'Abblix\.Oidc\.Server\.Model\.TokenRequest') {#Abblix.Oidc.Server.Endpoints.Token.Grants.TokenExchangeGrantHandler.AuthorizeAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.Threading.CancellationToken).request} The token request \(already authenticated against the client\)\. ###### `clientInfo` [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') {#Abblix.Oidc.Server.Endpoints.Token.Grants.TokenExchangeGrantHandler.AuthorizeAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.Threading.CancellationToken).clientInfo} The authenticated client; used to enforce that the grant was issued to the same client that is now redeeming it\. ###### `cancellationToken` [System\.Threading\.CancellationToken](https://learn.microsoft.com/en-us/dotnet/api/system.threading.cancellationtoken 'System\.Threading\.CancellationToken') {#Abblix.Oidc.Server.Endpoints.Token.Grants.TokenExchangeGrantHandler.AuthorizeAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.Threading.CancellationToken).cancellationToken} Implements [AuthorizeAsync\(TokenRequest, ClientInfo, CancellationToken\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler#Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler.AuthorizeAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.Threading.CancellationToken) 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.IAuthorizationGrantHandler\.AuthorizeAsync\(Abblix\.Oidc\.Server\.Model\.TokenRequest, Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo, System\.Threading\.CancellationToken\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[AuthorizedGrant](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.AuthorizedGrant')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ## Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces Namespace | Classes | | | :--- | :--- | | [AuthorizedGrant](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.AuthorizedGrant') | The \(authentication\-session, authorization\-context\) pair from which the token endpoint mints access, refresh and ID tokens\. Produced by an [IAuthorizationGrantHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.IAuthorizationGrantHandler') and carried through token issuance\. | | [RefreshTokenAuthorizedGrant](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.RefreshTokenAuthorizedGrant 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.RefreshTokenAuthorizedGrant') | Represents an authorized grant result for a refresh token request\. Contains the authenticated session, authorization context, and the associated refresh token\. | | [TokenInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.TokenInfo 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.TokenInfo') | Identity of an issued token, recorded against an authorization grant so that the token can be revoked by JTI if the grant is later invalidated \(for example when an authorization code is reused\)\. | | [TokenIssued](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.TokenIssued 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.TokenIssued') | Successful token endpoint response per RFC 6749 §5\.1, optionally extended with the OIDC Core 1\.0 §3\.1\.3\.3 `id_token`\. | | [ValidTokenRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.ValidTokenRequest 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.ValidTokenRequest') | Represents a valid token request along with related authentication and authorization information\. | | Interfaces | | | :--- | :--- | | [ITokenAuthorizationContextEvaluator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenAuthorizationContextEvaluator 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.ITokenAuthorizationContextEvaluator') | Defines an evaluator for determining the [AuthorizationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.AuthorizationContext 'Abblix\.Oidc\.Server\.Common\.AuthorizationContext') based on token requests\. | | [ITokenHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenHandler 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.ITokenHandler') | Defines a contract for handling OAuth 2\.0 token requests, encompassing validation, processing, and issuance of tokens based on authorization grants\. | | [ITokenRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.ITokenRequestProcessor') | Processes incoming token requests from clients, ensuring they are valid and authorized before issuing the appropriate token response\. Depending on the request type and granted permissions, the response can include various types of tokens such as Access Tokens, Refresh Tokens and ID Tokens\. | | [ITokenRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.ITokenRequestValidator') | Validates an incoming OAuth 2\.0 token request \(RFC 6749 §3\.2\) against the rules required by the requested `grant_type`: client authentication, grant ownership \(e\.g\. an authorization code MUST have been issued to the authenticated client per OIDC Core 1\.0 §3\.1\.3\.2\), redirect URI equivalence for code exchange, scope and resource \(RFC 8707\) consistency, and PKCE verifier matching \(RFC 7636 §4\.5\) where applicable\. | --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces') ## AuthorizedGrant Class The \(authentication\-session, authorization\-context\) pair from which the token endpoint mints access, refresh and ID tokens\. Produced by an [IAuthorizationGrantHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.IAuthorizationGrantHandler') and carried through token issuance\. ```csharp public record AuthorizedGrant : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → AuthorizedGrant Derived ↳ [RefreshTokenAuthorizedGrant](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.RefreshTokenAuthorizedGrant 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.RefreshTokenAuthorizedGrant') Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[AuthorizedGrant](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.AuthorizedGrant')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Constructors ## AuthorizedGrant\(AuthSession, AuthorizationContext\) Constructor {#Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant.AuthorizedGrant(Abblix.Oidc.Server.Features.UserAuthentication.AuthSession,Abblix.Oidc.Server.Common.AuthorizationContext)} The \(authentication\-session, authorization\-context\) pair from which the token endpoint mints access, refresh and ID tokens\. Produced by an [IAuthorizationGrantHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.IAuthorizationGrantHandler') and carried through token issuance\. ```csharp public AuthorizedGrant(Abblix.Oidc.Server.Features.UserAuthentication.AuthSession AuthSession, Abblix.Oidc.Server.Common.AuthorizationContext Context); ``` #### Parameters ###### `AuthSession` [AuthSession](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.UserAuthentication.AuthSession 'Abblix\.Oidc\.Server\.Features\.UserAuthentication\.AuthSession') {#Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant.AuthorizedGrant(Abblix.Oidc.Server.Features.UserAuthentication.AuthSession,Abblix.Oidc.Server.Common.AuthorizationContext).AuthSession} The user's authentication session \(subject, sid, auth\_time, idp\)\. ###### `Context` [AuthorizationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.AuthorizationContext 'Abblix\.Oidc\.Server\.Common\.AuthorizationContext') {#Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant.AuthorizedGrant(Abblix.Oidc.Server.Features.UserAuthentication.AuthSession,Abblix.Oidc.Server.Common.AuthorizationContext).Context} The authorization decision \(client\_id, scope, resources, requested claims, confirmation binding\) inherited by the issued tokens\. ### Properties ## AuthorizedGrant\.AuthSession Property {#Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant.AuthSession} The user's authentication session \(subject, sid, auth\_time, idp\)\. ```csharp public Abblix.Oidc.Server.Features.UserAuthentication.AuthSession AuthSession { get; init; } ``` #### Property Value [AuthSession](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.UserAuthentication.AuthSession 'Abblix\.Oidc\.Server\.Features\.UserAuthentication\.AuthSession') ## AuthorizedGrant\.Context Property {#Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant.Context} The authorization decision \(client\_id, scope, resources, requested claims, confirmation binding\) inherited by the issued tokens\. ```csharp public Abblix.Oidc.Server.Common.AuthorizationContext Context { get; init; } ``` #### Property Value [AuthorizationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.AuthorizationContext 'Abblix\.Oidc\.Server\.Common\.AuthorizationContext') ## AuthorizedGrant\.IssuedTokens Property {#Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant.IssuedTokens} Tokens already issued from this grant\. Tracked for the authorization\-code reuse defense: if the same code is presented twice, every previously issued token is revoked by JTI\. ```csharp public Abblix.Oidc.Server.Endpoints.Token.Interfaces.TokenInfo[]? IssuedTokens { get; init; } ``` #### Property Value [TokenInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.TokenInfo 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.TokenInfo')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenAuthorizationContextEvaluator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces') ## ITokenAuthorizationContextEvaluator Interface Defines an evaluator for determining the [AuthorizationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.AuthorizationContext 'Abblix\.Oidc\.Server\.Common\.AuthorizationContext') based on token requests\. ```csharp public interface ITokenAuthorizationContextEvaluator ``` Derived ↳ [TokenAuthorizationContextEvaluator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.TokenAuthorizationContextEvaluator 'Abblix\.Oidc\.Server\.Endpoints\.Token\.TokenAuthorizationContextEvaluator') ### Methods ## ITokenAuthorizationContextEvaluator\.EvaluateAuthorizationContext\(ValidTokenRequest\) Method {#Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenAuthorizationContextEvaluator.EvaluateAuthorizationContext(Abblix.Oidc.Server.Endpoints.Token.Interfaces.ValidTokenRequest)} Evaluates and constructs a new [AuthorizationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.AuthorizationContext 'Abblix\.Oidc\.Server\.Common\.AuthorizationContext') by refining and reconciling the scopes and resources from the original authorization request based on the current token request\. ```csharp Abblix.Oidc.Server.Common.AuthorizationContext EvaluateAuthorizationContext(Abblix.Oidc.Server.Endpoints.Token.Interfaces.ValidTokenRequest request); ``` #### Parameters ###### `request` [ValidTokenRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.ValidTokenRequest 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.ValidTokenRequest') {#Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenAuthorizationContextEvaluator.EvaluateAuthorizationContext(Abblix.Oidc.Server.Endpoints.Token.Interfaces.ValidTokenRequest).request} The valid token request that contains the original authorization grant and any additional token\-specific requests\. #### Returns [AuthorizationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.AuthorizationContext 'Abblix\.Oidc\.Server\.Common\.AuthorizationContext') An updated [AuthorizationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.AuthorizationContext 'Abblix\.Oidc\.Server\.Common\.AuthorizationContext') that reflects the actual scopes and resources that should be considered during the token issuance process\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenHandler.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces') ## ITokenHandler Interface Defines a contract for handling OAuth 2\.0 token requests, encompassing validation, processing, and issuance of tokens based on authorization grants\. ```csharp public interface ITokenHandler ``` Derived ↳ [TokenHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.TokenHandler 'Abblix\.Oidc\.Server\.Endpoints\.Token\.TokenHandler') ### Methods ## ITokenHandler\.HandleAsync\(TokenRequest, ClientRequest\) Method {#Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenHandler.HandleAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Model.ClientRequest)} Asynchronously handles a token request, validating the request details and, if valid, processing it to issue, renew or exchange tokens according to OAuth 2\.0 and OpenID Connect standards\. ```csharp System.Threading.Tasks.Task> HandleAsync(Abblix.Oidc.Server.Model.TokenRequest tokenRequest, Abblix.Oidc.Server.Model.ClientRequest clientRequest); ``` #### Parameters ###### `tokenRequest` [TokenRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.TokenRequest 'Abblix\.Oidc\.Server\.Model\.TokenRequest') {#Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenHandler.HandleAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Model.ClientRequest).tokenRequest} The token request containing essential parameters such as the grant type, client credentials, and other parameters pertinent to the token issuance process\. ###### `clientRequest` [ClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRequest 'Abblix\.Oidc\.Server\.Model\.ClientRequest') {#Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenHandler.HandleAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Model.ClientRequest).clientRequest} Supplementary information about the client making the request, necessary for performing contextual validation and ensuring the request complies with security policies\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[TokenIssued](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.TokenIssued 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.TokenIssued')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A [System\.Threading\.Tasks\.Task](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task 'System\.Threading\.Tasks\.Task') resulting in a [TokenIssued](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.TokenIssued 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.TokenIssued') on success, which contains the issued tokens \(access token, refresh token, ID token, etc\.\), or an [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') describing the reason for request failure\. ### Remarks Implementations of this interface are critical to the secure and compliant functioning of an OAuth 2\.0 authorization server\. They must ensure that only valid and authorized requests lead to the issuance of tokens, thereby maintaining the integrity and security of the authentication and authorization process\. ## ITokenHandler\.HandleAsync\(TokenRequest, ClientRequest, CancellationToken\) Method {#Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenHandler.HandleAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Model.ClientRequest,System.Threading.CancellationToken)} Asynchronously handles a token request, validating the request details and, if valid, processing it to issue, renew or exchange tokens according to OAuth 2\.0 and OpenID Connect standards\. ```csharp System.Threading.Tasks.Task> HandleAsync(Abblix.Oidc.Server.Model.TokenRequest tokenRequest, Abblix.Oidc.Server.Model.ClientRequest clientRequest, System.Threading.CancellationToken cancellationToken); ``` #### Parameters ###### `tokenRequest` [TokenRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.TokenRequest 'Abblix\.Oidc\.Server\.Model\.TokenRequest') {#Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenHandler.HandleAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Model.ClientRequest,System.Threading.CancellationToken).tokenRequest} The token request containing essential parameters such as the grant type, client credentials, and other parameters pertinent to the token issuance process\. ###### `clientRequest` [ClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRequest 'Abblix\.Oidc\.Server\.Model\.ClientRequest') {#Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenHandler.HandleAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Model.ClientRequest,System.Threading.CancellationToken).clientRequest} Supplementary information about the client making the request, necessary for performing contextual validation and ensuring the request complies with security policies\. ###### `cancellationToken` [System\.Threading\.CancellationToken](https://learn.microsoft.com/en-us/dotnet/api/system.threading.cancellationtoken 'System\.Threading\.CancellationToken') {#Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenHandler.HandleAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Model.ClientRequest,System.Threading.CancellationToken).cancellationToken} #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[TokenIssued](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.TokenIssued 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.TokenIssued')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A [System\.Threading\.Tasks\.Task](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task 'System\.Threading\.Tasks\.Task') resulting in a [TokenIssued](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.TokenIssued 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.TokenIssued') on success, which contains the issued tokens \(access token, refresh token, ID token, etc\.\), or an [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') describing the reason for request failure\. ### Remarks Implementations of this interface are critical to the secure and compliant functioning of an OAuth 2\.0 authorization server\. They must ensure that only valid and authorized requests lead to the issuance of tokens, thereby maintaining the integrity and security of the authentication and authorization process\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenRequestProcessor.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces') ## ITokenRequestProcessor Interface Processes incoming token requests from clients, ensuring they are valid and authorized before issuing the appropriate token response\. Depending on the request type and granted permissions, the response can include various types of tokens such as Access Tokens, Refresh Tokens and ID Tokens\. ```csharp public interface ITokenRequestProcessor ``` Derived ↳ [AuthorizationCodeReusePreventingDecorator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.AuthorizationCodeReusePreventingDecorator 'Abblix\.Oidc\.Server\.Endpoints\.Token\.AuthorizationCodeReusePreventingDecorator') ↳ [TokenRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.TokenRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.Token\.TokenRequestProcessor') ### Remarks This interface abstracts the core logic behind token issuance in compliance with OAuth 2\.0 and OpenID Connect standards\. Implementations are responsible for validating the token request details, determining the types of tokens to issue based on the request's scope and authorization, and generating a token response that conforms to the protocol specifications\. While the typical response includes an Access Token and, in the case of OpenID Connect, an ID Token, the exact contents of the response may vary based on the request parameters and server policies\. ### Methods ## ITokenRequestProcessor\.ProcessAsync\(ValidTokenRequest\) Method {#Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenRequestProcessor.ProcessAsync(Abblix.Oidc.Server.Endpoints.Token.Interfaces.ValidTokenRequest)} Asynchronously processes a validated and authorized token request, generating a token response\. ```csharp System.Threading.Tasks.Task> ProcessAsync(Abblix.Oidc.Server.Endpoints.Token.Interfaces.ValidTokenRequest request); ``` #### Parameters ###### `request` [ValidTokenRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.ValidTokenRequest 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.ValidTokenRequest') {#Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenRequestProcessor.ProcessAsync(Abblix.Oidc.Server.Endpoints.Token.Interfaces.ValidTokenRequest).request} The validated token request from the client\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[TokenIssued](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.TokenIssued 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.TokenIssued')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task that resolves to a [TokenIssued](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.TokenIssued 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.TokenIssued'), encapsulating the tokens to be issued to the client, or an [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') if processing fails\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenRequestValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces') ## ITokenRequestValidator Interface Validates an incoming OAuth 2\.0 token request \(RFC 6749 §3\.2\) against the rules required by the requested `grant_type`: client authentication, grant ownership \(e\.g\. an authorization code MUST have been issued to the authenticated client per OIDC Core 1\.0 §3\.1\.3\.2\), redirect URI equivalence for code exchange, scope and resource \(RFC 8707\) consistency, and PKCE verifier matching \(RFC 7636 §4\.5\) where applicable\. ```csharp public interface ITokenRequestValidator ``` Derived ↳ [TokenRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.TokenRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.Token\.TokenRequestValidator') ### Methods ## ITokenRequestValidator\.ValidateAsync\(TokenRequest, ClientRequest\) Method {#Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenRequestValidator.ValidateAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Model.ClientRequest)} Validates the request and returns a [ValidTokenRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.ValidTokenRequest 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.ValidTokenRequest') ready for token issuance, or an [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') using one of the codes from RFC 6749 §5\.2 \(e\.g\. `invalid_grant`, `invalid_client`, `unsupported_grant_type`\)\. ```csharp System.Threading.Tasks.Task> ValidateAsync(Abblix.Oidc.Server.Model.TokenRequest tokenRequest, Abblix.Oidc.Server.Model.ClientRequest clientRequest); ``` #### Parameters ###### `tokenRequest` [TokenRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.TokenRequest 'Abblix\.Oidc\.Server\.Model\.TokenRequest') {#Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenRequestValidator.ValidateAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Model.ClientRequest).tokenRequest} ###### `clientRequest` [ClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRequest 'Abblix\.Oidc\.Server\.Model\.ClientRequest') {#Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenRequestValidator.ValidateAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Model.ClientRequest).clientRequest} #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[ValidTokenRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.ValidTokenRequest 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.ValidTokenRequest')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') ## ITokenRequestValidator\.ValidateAsync\(TokenRequest, ClientRequest, CancellationToken\) Method {#Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenRequestValidator.ValidateAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Model.ClientRequest,System.Threading.CancellationToken)} Validates the request and returns a [ValidTokenRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.ValidTokenRequest 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.ValidTokenRequest') ready for token issuance, or an [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') using one of the codes from RFC 6749 §5\.2 \(e\.g\. `invalid_grant`, `invalid_client`, `unsupported_grant_type`\)\. ```csharp System.Threading.Tasks.Task> ValidateAsync(Abblix.Oidc.Server.Model.TokenRequest tokenRequest, Abblix.Oidc.Server.Model.ClientRequest clientRequest, System.Threading.CancellationToken cancellationToken); ``` #### Parameters ###### `tokenRequest` [TokenRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.TokenRequest 'Abblix\.Oidc\.Server\.Model\.TokenRequest') {#Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenRequestValidator.ValidateAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Model.ClientRequest,System.Threading.CancellationToken).tokenRequest} ###### `clientRequest` [ClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRequest 'Abblix\.Oidc\.Server\.Model\.ClientRequest') {#Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenRequestValidator.ValidateAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Model.ClientRequest,System.Threading.CancellationToken).clientRequest} ###### `cancellationToken` [System\.Threading\.CancellationToken](https://learn.microsoft.com/en-us/dotnet/api/system.threading.cancellationtoken 'System\.Threading\.CancellationToken') {#Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenRequestValidator.ValidateAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Model.ClientRequest,System.Threading.CancellationToken).cancellationToken} #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[ValidTokenRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.ValidTokenRequest 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.ValidTokenRequest')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.RefreshTokenAuthorizedGrant.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces') ## RefreshTokenAuthorizedGrant Class Represents an authorized grant result for a refresh token request\. Contains the authenticated session, authorization context, and the associated refresh token\. ```csharp public record RefreshTokenAuthorizedGrant : Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant, System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [AuthorizedGrant](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.AuthorizedGrant') → RefreshTokenAuthorizedGrant Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[RefreshTokenAuthorizedGrant](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.RefreshTokenAuthorizedGrant 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.RefreshTokenAuthorizedGrant')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Constructors ## RefreshTokenAuthorizedGrant\(AuthSession, AuthorizationContext, JsonWebToken\) Constructor {#Abblix.Oidc.Server.Endpoints.Token.Interfaces.RefreshTokenAuthorizedGrant.RefreshTokenAuthorizedGrant(Abblix.Oidc.Server.Features.UserAuthentication.AuthSession,Abblix.Oidc.Server.Common.AuthorizationContext,Abblix.Jwt.JsonWebToken)} Represents an authorized grant result for a refresh token request\. Contains the authenticated session, authorization context, and the associated refresh token\. ```csharp public RefreshTokenAuthorizedGrant(Abblix.Oidc.Server.Features.UserAuthentication.AuthSession AuthSession, Abblix.Oidc.Server.Common.AuthorizationContext Context, Abblix.Jwt.JsonWebToken RefreshToken); ``` #### Parameters ###### `AuthSession` [AuthSession](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.UserAuthentication.AuthSession 'Abblix\.Oidc\.Server\.Features\.UserAuthentication\.AuthSession') {#Abblix.Oidc.Server.Endpoints.Token.Interfaces.RefreshTokenAuthorizedGrant.RefreshTokenAuthorizedGrant(Abblix.Oidc.Server.Features.UserAuthentication.AuthSession,Abblix.Oidc.Server.Common.AuthorizationContext,Abblix.Jwt.JsonWebToken).AuthSession} The authenticated user session, which includes information about the user's authentication state\. ###### `Context` [AuthorizationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.AuthorizationContext 'Abblix\.Oidc\.Server\.Common\.AuthorizationContext') {#Abblix.Oidc.Server.Endpoints.Token.Interfaces.RefreshTokenAuthorizedGrant.RefreshTokenAuthorizedGrant(Abblix.Oidc.Server.Features.UserAuthentication.AuthSession,Abblix.Oidc.Server.Common.AuthorizationContext,Abblix.Jwt.JsonWebToken).Context} The authorization context containing details about the current authorization process, such as requested scopes and client information\. ###### `RefreshToken` [JsonWebToken](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebToken 'Abblix\.Jwt\.JsonWebToken') {#Abblix.Oidc.Server.Endpoints.Token.Interfaces.RefreshTokenAuthorizedGrant.RefreshTokenAuthorizedGrant(Abblix.Oidc.Server.Features.UserAuthentication.AuthSession,Abblix.Oidc.Server.Common.AuthorizationContext,Abblix.Jwt.JsonWebToken).RefreshToken} The refresh token associated with the authorized grant, used to obtain new access tokens without requiring further user interaction\. ### Properties ## RefreshTokenAuthorizedGrant\.RefreshToken Property {#Abblix.Oidc.Server.Endpoints.Token.Interfaces.RefreshTokenAuthorizedGrant.RefreshToken} The refresh token associated with the authorized grant, used to obtain new access tokens without requiring further user interaction\. ```csharp public Abblix.Jwt.JsonWebToken RefreshToken { get; init; } ``` #### Property Value [JsonWebToken](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebToken 'Abblix\.Jwt\.JsonWebToken') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.TokenInfo.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces') ## TokenInfo Class Identity of an issued token, recorded against an authorization grant so that the token can be revoked by JTI if the grant is later invalidated \(for example when an authorization code is reused\)\. ```csharp public record TokenInfo : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → TokenInfo Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[TokenInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.TokenInfo 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.TokenInfo')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Constructors ## TokenInfo\(string, DateTimeOffset\) Constructor {#Abblix.Oidc.Server.Endpoints.Token.Interfaces.TokenInfo.TokenInfo(string,System.DateTimeOffset)} Identity of an issued token, recorded against an authorization grant so that the token can be revoked by JTI if the grant is later invalidated \(for example when an authorization code is reused\)\. ```csharp public TokenInfo(string JwtId, System.DateTimeOffset ExpiresAt); ``` #### Parameters ###### `JwtId` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Endpoints.Token.Interfaces.TokenInfo.TokenInfo(string,System.DateTimeOffset).JwtId} The token's `jti` claim\. ###### `ExpiresAt` [System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset') {#Abblix.Oidc.Server.Endpoints.Token.Interfaces.TokenInfo.TokenInfo(string,System.DateTimeOffset).ExpiresAt} When the token expires; used to expire the revocation record alongside the token itself\. ### Properties ## TokenInfo\.ExpiresAt Property {#Abblix.Oidc.Server.Endpoints.Token.Interfaces.TokenInfo.ExpiresAt} When the token expires; used to expire the revocation record alongside the token itself\. ```csharp public System.DateTimeOffset ExpiresAt { get; init; } ``` #### Property Value [System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset') ## TokenInfo\.JwtId Property {#Abblix.Oidc.Server.Endpoints.Token.Interfaces.TokenInfo.JwtId} The token's `jti` claim\. ```csharp public string JwtId { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.TokenIssued.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces') ## TokenIssued Class Successful token endpoint response per RFC 6749 §5\.1, optionally extended with the OIDC Core 1\.0 §3\.1\.3\.3 `id_token`\. ```csharp public record TokenIssued : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → TokenIssued Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[TokenIssued](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.TokenIssued 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.TokenIssued')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Constructors ## TokenIssued\(EncodedJsonWebToken, string, TimeSpan, Uri\) Constructor {#Abblix.Oidc.Server.Endpoints.Token.Interfaces.TokenIssued.TokenIssued(Abblix.Oidc.Server.Features.Tokens.EncodedJsonWebToken,string,System.TimeSpan,System.Uri)} Successful token endpoint response per RFC 6749 §5\.1, optionally extended with the OIDC Core 1\.0 §3\.1\.3\.3 `id_token`\. ```csharp public TokenIssued(Abblix.Oidc.Server.Features.Tokens.EncodedJsonWebToken AccessToken, string TokenType, System.TimeSpan ExpiresIn, System.Uri IssuedTokenType); ``` #### Parameters ###### `AccessToken` [EncodedJsonWebToken](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.EncodedJsonWebToken 'Abblix\.Oidc\.Server\.Features\.Tokens\.EncodedJsonWebToken') {#Abblix.Oidc.Server.Endpoints.Token.Interfaces.TokenIssued.TokenIssued(Abblix.Oidc.Server.Features.Tokens.EncodedJsonWebToken,string,System.TimeSpan,System.Uri).AccessToken} The issued access token \(`access_token`\)\. ###### `TokenType` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Endpoints.Token.Interfaces.TokenIssued.TokenIssued(Abblix.Oidc.Server.Features.Tokens.EncodedJsonWebToken,string,System.TimeSpan,System.Uri).TokenType} The `token_type`, typically `Bearer` \(RFC 6750\)\. ###### `ExpiresIn` [System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan') {#Abblix.Oidc.Server.Endpoints.Token.Interfaces.TokenIssued.TokenIssued(Abblix.Oidc.Server.Features.Tokens.EncodedJsonWebToken,string,System.TimeSpan,System.Uri).ExpiresIn} Lifetime returned as `expires_in`\. ###### `IssuedTokenType` [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri') {#Abblix.Oidc.Server.Endpoints.Token.Interfaces.TokenIssued.TokenIssued(Abblix.Oidc.Server.Features.Tokens.EncodedJsonWebToken,string,System.TimeSpan,System.Uri).IssuedTokenType} URI identifying the type of the issued token, used by RFC 8693 token exchange\. ### Properties ## TokenIssued\.AccessToken Property {#Abblix.Oidc.Server.Endpoints.Token.Interfaces.TokenIssued.AccessToken} The issued access token \(`access_token`\)\. ```csharp public Abblix.Oidc.Server.Features.Tokens.EncodedJsonWebToken AccessToken { get; init; } ``` #### Property Value [EncodedJsonWebToken](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.EncodedJsonWebToken 'Abblix\.Oidc\.Server\.Features\.Tokens\.EncodedJsonWebToken') ## TokenIssued\.AuthorizationDetails Property {#Abblix.Oidc.Server.Endpoints.Token.Interfaces.TokenIssued.AuthorizationDetails} The RFC 9396 `authorization_details` assigned to the access token as the raw [System\.Text\.Json\.Nodes\.JsonArray](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonarray 'System\.Text\.Json\.Nodes\.JsonArray'), surfaced byte\-exact in the JSON token response per RFC 9396 §7 \(MUST\)\. `null` when no RAR was used\. ```csharp public System.Text.Json.Nodes.JsonArray? AuthorizationDetails { get; init; } ``` #### Property Value [System\.Text\.Json\.Nodes\.JsonArray](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonarray 'System\.Text\.Json\.Nodes\.JsonArray') ## TokenIssued\.ExpiresIn Property {#Abblix.Oidc.Server.Endpoints.Token.Interfaces.TokenIssued.ExpiresIn} Lifetime returned as `expires_in`\. ```csharp public System.TimeSpan ExpiresIn { get; init; } ``` #### Property Value [System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan') ## TokenIssued\.IdToken Property {#Abblix.Oidc.Server.Endpoints.Token.Interfaces.TokenIssued.IdToken} An ID token that provides identity information about the user\. ```csharp public Abblix.Oidc.Server.Features.Tokens.EncodedJsonWebToken? IdToken { get; set; } ``` #### Property Value [EncodedJsonWebToken](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.EncodedJsonWebToken 'Abblix\.Oidc\.Server\.Features\.Tokens\.EncodedJsonWebToken') ## TokenIssued\.IssuedTokenType Property {#Abblix.Oidc.Server.Endpoints.Token.Interfaces.TokenIssued.IssuedTokenType} URI identifying the type of the issued token, used by RFC 8693 token exchange\. ```csharp public System.Uri IssuedTokenType { get; init; } ``` #### Property Value [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri') ## TokenIssued\.RefreshToken Property {#Abblix.Oidc.Server.Endpoints.Token.Interfaces.TokenIssued.RefreshToken} The optional refresh token that can be used to obtain new access tokens\. ```csharp public Abblix.Oidc.Server.Features.Tokens.EncodedJsonWebToken? RefreshToken { get; set; } ``` #### Property Value [EncodedJsonWebToken](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.EncodedJsonWebToken 'Abblix\.Oidc\.Server\.Features\.Tokens\.EncodedJsonWebToken') ## TokenIssued\.Scope Property {#Abblix.Oidc.Server.Endpoints.Token.Interfaces.TokenIssued.Scope} The scopes associated with the access token issued\. Scopes indicate the permissions granted to the access token\. ```csharp public System.Collections.Generic.IEnumerable Scope { get; } ``` #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ## TokenIssued\.TokenType Property {#Abblix.Oidc.Server.Endpoints.Token.Interfaces.TokenIssued.TokenType} The `token_type`, typically `Bearer` \(RFC 6750\)\. ```csharp public string TokenType { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.ValidTokenRequest.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces') ## ValidTokenRequest Class Represents a valid token request along with related authentication and authorization information\. ```csharp public record ValidTokenRequest : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ValidTokenRequest Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[ValidTokenRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.ValidTokenRequest 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.ValidTokenRequest')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Constructors ## ValidTokenRequest\(TokenValidationContext\) Constructor {#Abblix.Oidc.Server.Endpoints.Token.Interfaces.ValidTokenRequest.ValidTokenRequest(Abblix.Oidc.Server.Endpoints.Token.Validation.TokenValidationContext)} Builds the validated request from a populated [TokenValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation.TokenValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation\.TokenValidationContext'), taking the mutual\-TLS client certificate \(if any\) and the DPoP proof\-of\-possession key thumbprint \(if any\) from the populated context\. ```csharp public ValidTokenRequest(Abblix.Oidc.Server.Endpoints.Token.Validation.TokenValidationContext context); ``` #### Parameters ###### `context` [TokenValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation.TokenValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation\.TokenValidationContext') {#Abblix.Oidc.Server.Endpoints.Token.Interfaces.ValidTokenRequest.ValidTokenRequest(Abblix.Oidc.Server.Endpoints.Token.Validation.TokenValidationContext).context} ## ValidTokenRequest\(TokenRequest, AuthorizedGrant, ClientInfo, ScopeDefinition\[\], ResourceDefinition\[\], X509Certificate2, string, string\) Constructor {#Abblix.Oidc.Server.Endpoints.Token.Interfaces.ValidTokenRequest.ValidTokenRequest(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,Abblix.Oidc.Server.Common.Constants.ScopeDefinition[],Abblix.Oidc.Server.Common.Constants.ResourceDefinition[],System.Security.Cryptography.X509Certificates.X509Certificate2,string,string)} Represents a valid token request along with related authentication and authorization information\. ```csharp public ValidTokenRequest(Abblix.Oidc.Server.Model.TokenRequest Model, Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant AuthorizedGrant, Abblix.Oidc.Server.Features.ClientInformation.ClientInfo ClientInfo, Abblix.Oidc.Server.Common.Constants.ScopeDefinition[] Scope, Abblix.Oidc.Server.Common.Constants.ResourceDefinition[] Resources, System.Security.Cryptography.X509Certificates.X509Certificate2? ClientCertificate=null, string? ProofKeyThumbprint=null, string? PushDeliveryOf=null); ``` #### Parameters ###### `Model` [TokenRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.TokenRequest 'Abblix\.Oidc\.Server\.Model\.TokenRequest') {#Abblix.Oidc.Server.Endpoints.Token.Interfaces.ValidTokenRequest.ValidTokenRequest(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,Abblix.Oidc.Server.Common.Constants.ScopeDefinition[],Abblix.Oidc.Server.Common.Constants.ResourceDefinition[],System.Security.Cryptography.X509Certificates.X509Certificate2,string,string).Model} The token request model containing the information required to process the token request\. ###### `AuthorizedGrant` [AuthorizedGrant](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.AuthorizedGrant') {#Abblix.Oidc.Server.Endpoints.Token.Interfaces.ValidTokenRequest.ValidTokenRequest(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,Abblix.Oidc.Server.Common.Constants.ScopeDefinition[],Abblix.Oidc.Server.Common.Constants.ResourceDefinition[],System.Security.Cryptography.X509Certificates.X509Certificate2,string,string).AuthorizedGrant} The authorized grant result which encapsulates the result of the authorization process\. ###### `ClientInfo` [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') {#Abblix.Oidc.Server.Endpoints.Token.Interfaces.ValidTokenRequest.ValidTokenRequest(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,Abblix.Oidc.Server.Common.Constants.ScopeDefinition[],Abblix.Oidc.Server.Common.Constants.ResourceDefinition[],System.Security.Cryptography.X509Certificates.X509Certificate2,string,string).ClientInfo} Information about the client making the token request, including client credentials and metadata\. ###### `Scope` [ScopeDefinition](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ScopeDefinition 'Abblix\.Oidc\.Server\.Common\.Constants\.ScopeDefinition')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Oidc.Server.Endpoints.Token.Interfaces.ValidTokenRequest.ValidTokenRequest(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,Abblix.Oidc.Server.Common.Constants.ScopeDefinition[],Abblix.Oidc.Server.Common.Constants.ResourceDefinition[],System.Security.Cryptography.X509Certificates.X509Certificate2,string,string).Scope} The scopes associated with the token request, indicating the permissions requested by the client\. ###### `Resources` [ResourceDefinition](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ResourceDefinition 'Abblix\.Oidc\.Server\.Common\.Constants\.ResourceDefinition')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Oidc.Server.Endpoints.Token.Interfaces.ValidTokenRequest.ValidTokenRequest(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,Abblix.Oidc.Server.Common.Constants.ScopeDefinition[],Abblix.Oidc.Server.Common.Constants.ResourceDefinition[],System.Security.Cryptography.X509Certificates.X509Certificate2,string,string).Resources} The resources associated with the token request, detailing the specific resources the client is requesting access to\. ###### `ClientCertificate` [System\.Security\.Cryptography\.X509Certificates\.X509Certificate2](https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.x509certificates.x509certificate2 'System\.Security\.Cryptography\.X509Certificates\.X509Certificate2') {#Abblix.Oidc.Server.Endpoints.Token.Interfaces.ValidTokenRequest.ValidTokenRequest(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,Abblix.Oidc.Server.Common.Constants.ScopeDefinition[],Abblix.Oidc.Server.Common.Constants.ResourceDefinition[],System.Security.Cryptography.X509Certificates.X509Certificate2,string,string).ClientCertificate} The client X\.509 certificate presented at the token endpoint for mutual\-TLS client authentication \(RFC 8705\), when applicable; otherwise `null`\. ###### `ProofKeyThumbprint` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Endpoints.Token.Interfaces.ValidTokenRequest.ValidTokenRequest(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,Abblix.Oidc.Server.Common.Constants.ScopeDefinition[],Abblix.Oidc.Server.Common.Constants.ResourceDefinition[],System.Security.Cryptography.X509Certificates.X509Certificate2,string,string).ProofKeyThumbprint} The RFC 7638 JWK thumbprint of the DPoP proof key bound to the request \(RFC 9449 Section 6\.1\), when the client presented a valid DPoP proof; otherwise `null`\. ###### `PushDeliveryOf` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Endpoints.Token.Interfaces.ValidTokenRequest.ValidTokenRequest(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,Abblix.Oidc.Server.Common.Constants.ScopeDefinition[],Abblix.Oidc.Server.Common.Constants.ResourceDefinition[],System.Security.Cryptography.X509Certificates.X509Certificate2,string,string).PushDeliveryOf} The `auth_req_id` this request delivers in CIBA push mode, or `null` for every other caller\. It is stated rather than derived: the delivery mode is reachable from [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.ValidTokenRequest#Abblix.Oidc.Server.Endpoints.Token.Interfaces.ValidTokenRequest.ClientInfo 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.ValidTokenRequest\.ClientInfo'), but deriving it would put CIBA's rules inside the path every grant type takes, and the push caller holds the identifier anyway\. See [PushDeliveryBindings](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.PushDeliveryBindings 'Abblix\.Oidc\.Server\.Features\.Tokens\.PushDeliveryBindings') for what it turns into and why the claims are required there and nowhere else\. ### Properties ## ValidTokenRequest\.AuthorizedGrant Property {#Abblix.Oidc.Server.Endpoints.Token.Interfaces.ValidTokenRequest.AuthorizedGrant} The authorized grant result which encapsulates the result of the authorization process\. ```csharp public Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant AuthorizedGrant { get; init; } ``` #### Property Value [AuthorizedGrant](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.AuthorizedGrant') ## ValidTokenRequest\.ClientCertificate Property {#Abblix.Oidc.Server.Endpoints.Token.Interfaces.ValidTokenRequest.ClientCertificate} The client X\.509 certificate presented at the token endpoint for mutual\-TLS client authentication \(RFC 8705\), when applicable; otherwise `null`\. ```csharp public System.Security.Cryptography.X509Certificates.X509Certificate2? ClientCertificate { get; init; } ``` #### Property Value [System\.Security\.Cryptography\.X509Certificates\.X509Certificate2](https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.x509certificates.x509certificate2 'System\.Security\.Cryptography\.X509Certificates\.X509Certificate2') ## ValidTokenRequest\.ClientInfo Property {#Abblix.Oidc.Server.Endpoints.Token.Interfaces.ValidTokenRequest.ClientInfo} Information about the client making the token request, including client credentials and metadata\. ```csharp public Abblix.Oidc.Server.Features.ClientInformation.ClientInfo ClientInfo { get; init; } ``` #### Property Value [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') ## ValidTokenRequest\.Model Property {#Abblix.Oidc.Server.Endpoints.Token.Interfaces.ValidTokenRequest.Model} The token request model containing the information required to process the token request\. ```csharp public Abblix.Oidc.Server.Model.TokenRequest Model { get; init; } ``` #### Property Value [TokenRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.TokenRequest 'Abblix\.Oidc\.Server\.Model\.TokenRequest') ## ValidTokenRequest\.ProofKeyThumbprint Property {#Abblix.Oidc.Server.Endpoints.Token.Interfaces.ValidTokenRequest.ProofKeyThumbprint} The RFC 7638 JWK thumbprint of the DPoP proof key bound to the request \(RFC 9449 Section 6\.1\), when the client presented a valid DPoP proof; otherwise `null`\. ```csharp public string? ProofKeyThumbprint { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ValidTokenRequest\.PushDeliveryOf Property {#Abblix.Oidc.Server.Endpoints.Token.Interfaces.ValidTokenRequest.PushDeliveryOf} The `auth_req_id` this request delivers in CIBA push mode, or `null` for every other caller\. It is stated rather than derived: the delivery mode is reachable from [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.ValidTokenRequest#Abblix.Oidc.Server.Endpoints.Token.Interfaces.ValidTokenRequest.ClientInfo 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.ValidTokenRequest\.ClientInfo'), but deriving it would put CIBA's rules inside the path every grant type takes, and the push caller holds the identifier anyway\. See [PushDeliveryBindings](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.PushDeliveryBindings 'Abblix\.Oidc\.Server\.Features\.Tokens\.PushDeliveryBindings') for what it turns into and why the claims are required there and nowhere else\. ```csharp public string? PushDeliveryOf { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ValidTokenRequest\.Resources Property {#Abblix.Oidc.Server.Endpoints.Token.Interfaces.ValidTokenRequest.Resources} The resources associated with the token request, detailing the specific resources the client is requesting access to\. ```csharp public Abblix.Oidc.Server.Common.Constants.ResourceDefinition[] Resources { get; init; } ``` #### Property Value [ResourceDefinition](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ResourceDefinition 'Abblix\.Oidc\.Server\.Common\.Constants\.ResourceDefinition')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') ## ValidTokenRequest\.Scope Property {#Abblix.Oidc.Server.Endpoints.Token.Interfaces.ValidTokenRequest.Scope} The scopes associated with the token request, indicating the permissions requested by the client\. ```csharp public Abblix.Oidc.Server.Common.Constants.ScopeDefinition[] Scope { get; init; } ``` #### Property Value [ScopeDefinition](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ScopeDefinition 'Abblix\.Oidc\.Server\.Common\.Constants\.ScopeDefinition')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ## Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation Namespace | Classes | | | :--- | :--- | | [AuthorizationGrantValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation.AuthorizationGrantValidator 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation\.AuthorizationGrantValidator') | Validates the authorization grant in the context of a token request, ensuring that the request is authorized and that the associated redirect URI matches the one used during the initial authorization request | | [ClientValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation.ClientValidator 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation\.ClientValidator') | Validates the client information in the context of a token request, ensuring that the client is properly authenticated\. | | [DPoPTokenEndpointValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation.DPoPTokenEndpointValidator 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation\.DPoPTokenEndpointValidator') | Token\-endpoint enforcement of RFC 9449 DPoP: validates the proof JWT carried on the inbound `DPoP` header against the request's method\+URI, runs the layered nonce\-policy if the deployment requires it, and stashes the proof's JWK thumbprint on the validation context so the processor can bind `cnf.jkt` onto the issued access token\. | | [ResourceValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation.ResourceValidator 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation\.ResourceValidator') | Provides validation for resource\-related data within token requests, ensuring that all requested resources are recognized and appropriately scoped according to OAuth 2\.0 and OpenID Connect standards\. | | [RevokedSessionValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation.RevokedSessionValidator 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation\.RevokedSessionValidator') | Refuses a grant whose authentication session a revocation cutoff has caught\. | | [ScopeValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation.ScopeValidator 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation\.ScopeValidator') | Validates the scopes specified in token requests using a scope manager to ensure their validity and availability\. This validator checks whether each requested scope is recognized and authorized for use, ensuring that clients only receive permissions appropriate to their needs and in compliance with server policies\. | | [SyncTokenContextValidatorBase](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation.SyncTokenContextValidatorBase 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation\.SyncTokenContextValidatorBase') | Provides a base class for implementing synchronous token context validators\. This class simplifies the creation of token context validators by offering a synchronous validation method that is automatically wrapped in an asynchronous call\. | | [TokenContextValidatorComposite](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation.TokenContextValidatorComposite 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation\.TokenContextValidatorComposite') | Represents a composite validator for token context validation, executing a sequence of individual validators\. This class allows multiple validators to be combined, each responsible for a specific validation step, and short\-circuits the validation process if any step fails\. | | [TokenValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation.TokenValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation\.TokenValidationContext') | Encapsulates the context required for validating token requests, including client and authorization grant details\. | | Interfaces | | | :--- | :--- | | [ITokenContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation.ITokenContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation\.ITokenContextValidator') | Defines the contract for a token context validator, responsible for validating different aspects of a token request within a given context\. Implementations of this interface ensure that the token request adheres to the expected security and business rules\. | --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation.AuthorizationGrantValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation') ## AuthorizationGrantValidator Class Validates the authorization grant in the context of a token request, ensuring that the request is authorized and that the associated redirect URI matches the one used during the initial authorization request ```csharp public class AuthorizationGrantValidator : Abblix.Oidc.Server.Endpoints.Token.Validation.ITokenContextValidator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → AuthorizationGrantValidator Implements [ITokenContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation.ITokenContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation\.ITokenContextValidator') ### Remarks This validator interacts with the [IAuthorizationGrantHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.IAuthorizationGrantHandler') to perform the necessary checks on the authorization grant\. It ensures that the token request is made for an authorized grant and verifies the consistency of the redirect URI\. If the grant is valid and authorized, it updates the validation context ### Constructors ## AuthorizationGrantValidator\(IAuthorizationGrantHandler\) Constructor {#Abblix.Oidc.Server.Endpoints.Token.Validation.AuthorizationGrantValidator.AuthorizationGrantValidator(Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler)} Validates the authorization grant in the context of a token request, ensuring that the request is authorized and that the associated redirect URI matches the one used during the initial authorization request ```csharp public AuthorizationGrantValidator(Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler grantHandler); ``` #### Parameters ###### `grantHandler` [IAuthorizationGrantHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.IAuthorizationGrantHandler') {#Abblix.Oidc.Server.Endpoints.Token.Validation.AuthorizationGrantValidator.AuthorizationGrantValidator(Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler).grantHandler} The handler responsible for authorizing the grant\. ### Remarks This validator interacts with the [IAuthorizationGrantHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.IAuthorizationGrantHandler') to perform the necessary checks on the authorization grant\. It ensures that the token request is made for an authorized grant and verifies the consistency of the redirect URI\. If the grant is valid and authorized, it updates the validation context ### Methods ## AuthorizationGrantValidator\.ValidateAsync\(TokenValidationContext, CancellationToken\) Method {#Abblix.Oidc.Server.Endpoints.Token.Validation.AuthorizationGrantValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.Token.Validation.TokenValidationContext,System.Threading.CancellationToken)} Asynchronously validates the authorization grant in the token request context\. This method checks if the grant is valid and authorized for the client making the request\. It also ensures that the redirect URI used in the token request matches the one used during the initial authorization request\. ```csharp public System.Threading.Tasks.Task ValidateAsync(Abblix.Oidc.Server.Endpoints.Token.Validation.TokenValidationContext context, System.Threading.CancellationToken cancellationToken); ``` #### Parameters ###### `context` [TokenValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation.TokenValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation\.TokenValidationContext') {#Abblix.Oidc.Server.Endpoints.Token.Validation.AuthorizationGrantValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.Token.Validation.TokenValidationContext,System.Threading.CancellationToken).context} The validation context containing the token request and client information\. ###### `cancellationToken` [System\.Threading\.CancellationToken](https://learn.microsoft.com/en-us/dotnet/api/system.threading.cancellationtoken 'System\.Threading\.CancellationToken') {#Abblix.Oidc.Server.Endpoints.Token.Validation.AuthorizationGrantValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.Token.Validation.TokenValidationContext,System.Threading.CancellationToken).cancellationToken} Abandons the operation when the caller stops waiting\. Implements [ValidateAsync\(TokenValidationContext, CancellationToken\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation.ITokenContextValidator#Abblix.Oidc.Server.Endpoints.Token.Validation.ITokenContextValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.Token.Validation.TokenValidationContext,System.Threading.CancellationToken) 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation\.ITokenContextValidator\.ValidateAsync\(Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation\.TokenValidationContext, System\.Threading\.CancellationToken\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') if the authorization grant is invalid, including an error code and description; otherwise, null indicating that the grant is valid and the context has been updated\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation.ClientValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation') ## ClientValidator Class Validates the client information in the context of a token request, ensuring that the client is properly authenticated\. ```csharp public class ClientValidator : Abblix.Oidc.Server.Endpoints.Token.Validation.ITokenContextValidator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ClientValidator Implements [ITokenContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation.ITokenContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation\.ITokenContextValidator') ### Remarks This validator is responsible for authenticating the client making the token request\. It leverages the [IClientAuthenticator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator 'Abblix\.Oidc\.Server\.Features\.ClientAuthentication\.IClientAuthenticator') to perform the authentication, and if successful, attaches the client information to the validation context\. If the authentication fails, it returns an error indicating that the client is not authorized\. ### Constructors ## ClientValidator\(IClientAuthenticator\) Constructor {#Abblix.Oidc.Server.Endpoints.Token.Validation.ClientValidator.ClientValidator(Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator)} Validates the client information in the context of a token request, ensuring that the client is properly authenticated\. ```csharp public ClientValidator(Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator clientAuthenticator); ``` #### Parameters ###### `clientAuthenticator` [IClientAuthenticator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator 'Abblix\.Oidc\.Server\.Features\.ClientAuthentication\.IClientAuthenticator') {#Abblix.Oidc.Server.Endpoints.Token.Validation.ClientValidator.ClientValidator(Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator).clientAuthenticator} The client authenticator used to authenticate the client\. ### Remarks This validator is responsible for authenticating the client making the token request\. It leverages the [IClientAuthenticator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator 'Abblix\.Oidc\.Server\.Features\.ClientAuthentication\.IClientAuthenticator') to perform the authentication, and if successful, attaches the client information to the validation context\. If the authentication fails, it returns an error indicating that the client is not authorized\. ### Methods ## ClientValidator\.ValidateAsync\(TokenValidationContext, CancellationToken\) Method {#Abblix.Oidc.Server.Endpoints.Token.Validation.ClientValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.Token.Validation.TokenValidationContext,System.Threading.CancellationToken)} Asynchronously validates the client in the token request context\. This method checks if the client can be authenticated using the provided client request information\. If the client is successfully authenticated, the client information is added to the context; otherwise, an error is returned\. ```csharp public System.Threading.Tasks.Task ValidateAsync(Abblix.Oidc.Server.Endpoints.Token.Validation.TokenValidationContext context, System.Threading.CancellationToken cancellationToken); ``` #### Parameters ###### `context` [TokenValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation.TokenValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation\.TokenValidationContext') {#Abblix.Oidc.Server.Endpoints.Token.Validation.ClientValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.Token.Validation.TokenValidationContext,System.Threading.CancellationToken).context} The validation context containing the token request and client information\. ###### `cancellationToken` [System\.Threading\.CancellationToken](https://learn.microsoft.com/en-us/dotnet/api/system.threading.cancellationtoken 'System\.Threading\.CancellationToken') {#Abblix.Oidc.Server.Endpoints.Token.Validation.ClientValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.Token.Validation.TokenValidationContext,System.Threading.CancellationToken).cancellationToken} Abandons the operation when the caller stops waiting\. Implements [ValidateAsync\(TokenValidationContext, CancellationToken\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation.ITokenContextValidator#Abblix.Oidc.Server.Endpoints.Token.Validation.ITokenContextValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.Token.Validation.TokenValidationContext,System.Threading.CancellationToken) 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation\.ITokenContextValidator\.ValidateAsync\(Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation\.TokenValidationContext, System\.Threading\.CancellationToken\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') if the client cannot be authenticated, otherwise null indicating successful validation\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation.DPoPTokenEndpointValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation') ## DPoPTokenEndpointValidator Class Token\-endpoint enforcement of RFC 9449 DPoP: validates the proof JWT carried on the inbound `DPoP` header against the request's method\+URI, runs the layered nonce\-policy if the deployment requires it, and stashes the proof's JWK thumbprint on the validation context so the processor can bind `cnf.jkt` onto the issued access token\. ```csharp public class DPoPTokenEndpointValidator : Abblix.Oidc.Server.Features.DPoP.DPoPNonceValidator, Abblix.Oidc.Server.Endpoints.Token.Validation.ITokenContextValidator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [DPoPNonceValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DPoP.DPoPNonceValidator 'Abblix\.Oidc\.Server\.Features\.DPoP\.DPoPNonceValidator') → DPoPTokenEndpointValidator Implements [ITokenContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation.ITokenContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation\.ITokenContextValidator') ### Remarks Sits AFTER [ClientValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation.ClientValidator 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation\.ClientValidator') in the composite \- that ordering is load\-bearing because this step reads [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation.TokenValidationContext#Abblix.Oidc.Server.Endpoints.Token.Validation.TokenValidationContext.ClientInfo 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation\.TokenValidationContext\.ClientInfo') to decide whether DPoP is mandatory \([RequireDPoP](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.RequireDPoP 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo\.RequireDPoP')\) or opportunistic\. When the client opts in but the proof is missing, the request is rejected with `invalid_dpop_proof`; when the client does not opt in, a missing proof is silently accepted \(Bearer token issued downstream\) and a present\-and\-valid proof still binds the token \(RFC 9449 §5\.2 server\-side opportunistic binding\)\. ### Constructors ## DPoPTokenEndpointValidator\(ILogger\, IProofValidator, INonceService, IOptionsMonitor\\) Constructor {#Abblix.Oidc.Server.Endpoints.Token.Validation.DPoPTokenEndpointValidator.DPoPTokenEndpointValidator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.Token.Validation.DPoPTokenEndpointValidator_,Abblix.Oidc.Server.Features.DPoP.IProofValidator,Abblix.Oidc.Server.Features.Nonces.INonceService,Microsoft.Extensions.Options.IOptionsMonitor_Abblix.Oidc.Server.Common.Configuration.OidcOptions_)} Token\-endpoint enforcement of RFC 9449 DPoP: validates the proof JWT carried on the inbound `DPoP` header against the request's method\+URI, runs the layered nonce\-policy if the deployment requires it, and stashes the proof's JWK thumbprint on the validation context so the processor can bind `cnf.jkt` onto the issued access token\. ```csharp public DPoPTokenEndpointValidator(Microsoft.Extensions.Logging.ILogger logger, Abblix.Oidc.Server.Features.DPoP.IProofValidator proofValidator, Abblix.Oidc.Server.Features.Nonces.INonceService nonceService, Microsoft.Extensions.Options.IOptionsMonitor options); ``` #### Parameters ###### `logger` [Microsoft\.Extensions\.Logging\.ILogger<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1')[DPoPTokenEndpointValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation.DPoPTokenEndpointValidator 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation\.DPoPTokenEndpointValidator')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1') {#Abblix.Oidc.Server.Endpoints.Token.Validation.DPoPTokenEndpointValidator.DPoPTokenEndpointValidator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.Token.Validation.DPoPTokenEndpointValidator_,Abblix.Oidc.Server.Features.DPoP.IProofValidator,Abblix.Oidc.Server.Features.Nonces.INonceService,Microsoft.Extensions.Options.IOptionsMonitor_Abblix.Oidc.Server.Common.Configuration.OidcOptions_).logger} ###### `proofValidator` [IProofValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DPoP.IProofValidator 'Abblix\.Oidc\.Server\.Features\.DPoP\.IProofValidator') {#Abblix.Oidc.Server.Endpoints.Token.Validation.DPoPTokenEndpointValidator.DPoPTokenEndpointValidator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.Token.Validation.DPoPTokenEndpointValidator_,Abblix.Oidc.Server.Features.DPoP.IProofValidator,Abblix.Oidc.Server.Features.Nonces.INonceService,Microsoft.Extensions.Options.IOptionsMonitor_Abblix.Oidc.Server.Common.Configuration.OidcOptions_).proofValidator} ###### `nonceService` [INonceService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Nonces.INonceService 'Abblix\.Oidc\.Server\.Features\.Nonces\.INonceService') {#Abblix.Oidc.Server.Endpoints.Token.Validation.DPoPTokenEndpointValidator.DPoPTokenEndpointValidator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.Token.Validation.DPoPTokenEndpointValidator_,Abblix.Oidc.Server.Features.DPoP.IProofValidator,Abblix.Oidc.Server.Features.Nonces.INonceService,Microsoft.Extensions.Options.IOptionsMonitor_Abblix.Oidc.Server.Common.Configuration.OidcOptions_).nonceService} ###### `options` [Microsoft\.Extensions\.Options\.IOptionsMonitor<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptionsmonitor-1 'Microsoft\.Extensions\.Options\.IOptionsMonitor\`1')[OidcOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptionsmonitor-1 'Microsoft\.Extensions\.Options\.IOptionsMonitor\`1') {#Abblix.Oidc.Server.Endpoints.Token.Validation.DPoPTokenEndpointValidator.DPoPTokenEndpointValidator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.Token.Validation.DPoPTokenEndpointValidator_,Abblix.Oidc.Server.Features.DPoP.IProofValidator,Abblix.Oidc.Server.Features.Nonces.INonceService,Microsoft.Extensions.Options.IOptionsMonitor_Abblix.Oidc.Server.Common.Configuration.OidcOptions_).options} ### Remarks Sits AFTER [ClientValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation.ClientValidator 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation\.ClientValidator') in the composite \- that ordering is load\-bearing because this step reads [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation.TokenValidationContext#Abblix.Oidc.Server.Endpoints.Token.Validation.TokenValidationContext.ClientInfo 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation\.TokenValidationContext\.ClientInfo') to decide whether DPoP is mandatory \([RequireDPoP](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.RequireDPoP 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo\.RequireDPoP')\) or opportunistic\. When the client opts in but the proof is missing, the request is rejected with `invalid_dpop_proof`; when the client does not opt in, a missing proof is silently accepted \(Bearer token issued downstream\) and a present\-and\-valid proof still binds the token \(RFC 9449 §5\.2 server\-side opportunistic binding\)\. ### Methods ## DPoPTokenEndpointValidator\.ValidateAsync\(TokenValidationContext, CancellationToken\) Method {#Abblix.Oidc.Server.Endpoints.Token.Validation.DPoPTokenEndpointValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.Token.Validation.TokenValidationContext,System.Threading.CancellationToken)} Asynchronously validates the token request within the provided context, checking for compliance with the necessary validation rules such as client authentication, scope validation, grant validation, etc\. ```csharp public System.Threading.Tasks.Task ValidateAsync(Abblix.Oidc.Server.Endpoints.Token.Validation.TokenValidationContext context, System.Threading.CancellationToken cancellationToken); ``` #### Parameters ###### `context` [TokenValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation.TokenValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation\.TokenValidationContext') {#Abblix.Oidc.Server.Endpoints.Token.Validation.DPoPTokenEndpointValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.Token.Validation.TokenValidationContext,System.Threading.CancellationToken).context} The context containing the token request and related information that needs to be validated\. ###### `cancellationToken` [System\.Threading\.CancellationToken](https://learn.microsoft.com/en-us/dotnet/api/system.threading.cancellationtoken 'System\.Threading\.CancellationToken') {#Abblix.Oidc.Server.Endpoints.Token.Validation.DPoPTokenEndpointValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.Token.Validation.TokenValidationContext,System.Threading.CancellationToken).cancellationToken} Implements [ValidateAsync\(TokenValidationContext, CancellationToken\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation.ITokenContextValidator#Abblix.Oidc.Server.Endpoints.Token.Validation.ITokenContextValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.Token.Validation.TokenValidationContext,System.Threading.CancellationToken) 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation\.ITokenContextValidator\.ValidateAsync\(Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation\.TokenValidationContext, System\.Threading\.CancellationToken\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') containing error details if the validation fails; otherwise, returns null indicating that the validation was successful\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation.ITokenContextValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation') ## ITokenContextValidator Interface Defines the contract for a token context validator, responsible for validating different aspects of a token request within a given context\. Implementations of this interface ensure that the token request adheres to the expected security and business rules\. ```csharp public interface ITokenContextValidator ``` Derived ↳ [AuthorizationGrantValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation.AuthorizationGrantValidator 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation\.AuthorizationGrantValidator') ↳ [ClientValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation.ClientValidator 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation\.ClientValidator') ↳ [DPoPTokenEndpointValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation.DPoPTokenEndpointValidator 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation\.DPoPTokenEndpointValidator') ↳ [RevokedSessionValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation.RevokedSessionValidator 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation\.RevokedSessionValidator') ↳ [SyncTokenContextValidatorBase](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation.SyncTokenContextValidatorBase 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation\.SyncTokenContextValidatorBase') ↳ [TokenContextValidatorComposite](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation.TokenContextValidatorComposite 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation\.TokenContextValidatorComposite') ### Methods ## ITokenContextValidator\.ValidateAsync\(TokenValidationContext\) Method {#Abblix.Oidc.Server.Endpoints.Token.Validation.ITokenContextValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.Token.Validation.TokenValidationContext)} Asynchronously validates the token request within the provided context, checking for compliance with the necessary validation rules such as client authentication, scope validation, grant validation, etc\. ```csharp System.Threading.Tasks.Task ValidateAsync(Abblix.Oidc.Server.Endpoints.Token.Validation.TokenValidationContext context); ``` #### Parameters ###### `context` [TokenValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation.TokenValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation\.TokenValidationContext') {#Abblix.Oidc.Server.Endpoints.Token.Validation.ITokenContextValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.Token.Validation.TokenValidationContext).context} The context containing the token request and related information that needs to be validated\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') containing error details if the validation fails; otherwise, returns null indicating that the validation was successful\. ## ITokenContextValidator\.ValidateAsync\(TokenValidationContext, CancellationToken\) Method {#Abblix.Oidc.Server.Endpoints.Token.Validation.ITokenContextValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.Token.Validation.TokenValidationContext,System.Threading.CancellationToken)} Asynchronously validates the token request within the provided context, checking for compliance with the necessary validation rules such as client authentication, scope validation, grant validation, etc\. ```csharp System.Threading.Tasks.Task ValidateAsync(Abblix.Oidc.Server.Endpoints.Token.Validation.TokenValidationContext context, System.Threading.CancellationToken cancellationToken); ``` #### Parameters ###### `context` [TokenValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation.TokenValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation\.TokenValidationContext') {#Abblix.Oidc.Server.Endpoints.Token.Validation.ITokenContextValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.Token.Validation.TokenValidationContext,System.Threading.CancellationToken).context} The context containing the token request and related information that needs to be validated\. ###### `cancellationToken` [System\.Threading\.CancellationToken](https://learn.microsoft.com/en-us/dotnet/api/system.threading.cancellationtoken 'System\.Threading\.CancellationToken') {#Abblix.Oidc.Server.Endpoints.Token.Validation.ITokenContextValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.Token.Validation.TokenValidationContext,System.Threading.CancellationToken).cancellationToken} #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') containing error details if the validation fails; otherwise, returns null indicating that the validation was successful\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation.ResourceValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation') ## ResourceValidator Class Provides validation for resource\-related data within token requests, ensuring that all requested resources are recognized and appropriately scoped according to OAuth 2\.0 and OpenID Connect standards\. ```csharp public class ResourceValidator : Abblix.Oidc.Server.Endpoints.Token.Validation.SyncTokenContextValidatorBase ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [SyncTokenContextValidatorBase](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation.SyncTokenContextValidatorBase 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation\.SyncTokenContextValidatorBase') → ResourceValidator ### Constructors ## ResourceValidator\(IResourceManager\) Constructor {#Abblix.Oidc.Server.Endpoints.Token.Validation.ResourceValidator.ResourceValidator(Abblix.Oidc.Server.Features.ResourceIndicators.IResourceManager)} Provides validation for resource\-related data within token requests, ensuring that all requested resources are recognized and appropriately scoped according to OAuth 2\.0 and OpenID Connect standards\. ```csharp public ResourceValidator(Abblix.Oidc.Server.Features.ResourceIndicators.IResourceManager resourceManager); ``` #### Parameters ###### `resourceManager` [IResourceManager](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ResourceIndicators.IResourceManager 'Abblix\.Oidc\.Server\.Features\.ResourceIndicators\.IResourceManager') {#Abblix.Oidc.Server.Endpoints.Token.Validation.ResourceValidator.ResourceValidator(Abblix.Oidc.Server.Features.ResourceIndicators.IResourceManager).resourceManager} The manager responsible for validating and managing resource definitions\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation.RevokedSessionValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation') ## RevokedSessionValidator Class Refuses a grant whose authentication session a revocation cutoff has caught\. ```csharp public class RevokedSessionValidator : Abblix.Oidc.Server.Endpoints.Token.Validation.ITokenContextValidator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → RevokedSessionValidator Implements [ITokenContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation.ITokenContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation\.ITokenContextValidator') ### Remarks The third place a revocation has to be read, and the only one that sees this case\. The token side compares issue times, and every token minted at redemption is new, so it passes\. The authorization endpoint judged this session when the grant was created and does not see it again\. What is left is the interval between authorizing and redeeming \- a minute for an authorization code by default, far longer for a device code or a back\-channel request \- and a grant redeemed inside it founds a refresh family that stays past the cutoff for its whole life, because rotation carries the first issue time forward\. A validator rather than a step in the processor, because the processor runs downstream of an irreversible spend: [AuthorizationCodeReusePreventingDecorator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.AuthorizationCodeReusePreventingDecorator 'Abblix\.Oidc\.Server\.Endpoints\.Token\.AuthorizationCodeReusePreventingDecorator') removes the authorization code before delegating, so a refusal there would burn a code the request never earned. Validation happens first. It asks only about grants that carry a session from an earlier request. The remaining grant types build their session during this one - a client credentials, jwt-bearer or token exchange request stamps `AuthenticationTime` from the current clock and generates the session identifier on the spot - so no cutoff can predate it, and asking would be two store reads that cannot answer yes. It would also put a subject from somebody else's namespace against our cutoffs: under client credentials the subject is the client identifier, and under the assertion grants it belongs to a federated issuer. ### Constructors ## RevokedSessionValidator\(IRevocationCutoffChecker\) Constructor {#Abblix.Oidc.Server.Endpoints.Token.Validation.RevokedSessionValidator.RevokedSessionValidator(Abblix.Oidc.Server.Features.Tokens.Revocation.IRevocationCutoffChecker)} Refuses a grant whose authentication session a revocation cutoff has caught\. ```csharp public RevokedSessionValidator(Abblix.Oidc.Server.Features.Tokens.Revocation.IRevocationCutoffChecker cutoffChecker); ``` #### Parameters ###### `cutoffChecker` [IRevocationCutoffChecker](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.Revocation.IRevocationCutoffChecker 'Abblix\.Oidc\.Server\.Features\.Tokens\.Revocation\.IRevocationCutoffChecker') {#Abblix.Oidc.Server.Endpoints.Token.Validation.RevokedSessionValidator.RevokedSessionValidator(Abblix.Oidc.Server.Features.Tokens.Revocation.IRevocationCutoffChecker).cutoffChecker} Decides whether a cutoff refuses the session behind the grant\. ### Remarks The third place a revocation has to be read, and the only one that sees this case\. The token side compares issue times, and every token minted at redemption is new, so it passes\. The authorization endpoint judged this session when the grant was created and does not see it again\. What is left is the interval between authorizing and redeeming \- a minute for an authorization code by default, far longer for a device code or a back\-channel request \- and a grant redeemed inside it founds a refresh family that stays past the cutoff for its whole life, because rotation carries the first issue time forward\. A validator rather than a step in the processor, because the processor runs downstream of an irreversible spend: [AuthorizationCodeReusePreventingDecorator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.AuthorizationCodeReusePreventingDecorator 'Abblix\.Oidc\.Server\.Endpoints\.Token\.AuthorizationCodeReusePreventingDecorator') removes the authorization code before delegating, so a refusal there would burn a code the request never earned. Validation happens first. It asks only about grants that carry a session from an earlier request. The remaining grant types build their session during this one - a client credentials, jwt-bearer or token exchange request stamps `AuthenticationTime` from the current clock and generates the session identifier on the spot - so no cutoff can predate it, and asking would be two store reads that cannot answer yes. It would also put a subject from somebody else's namespace against our cutoffs: under client credentials the subject is the client identifier, and under the assertion grants it belongs to a federated issuer. ### Methods ## RevokedSessionValidator\.ValidateAsync\(TokenValidationContext, CancellationToken\) Method {#Abblix.Oidc.Server.Endpoints.Token.Validation.RevokedSessionValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.Token.Validation.TokenValidationContext,System.Threading.CancellationToken)} Asynchronously validates the token request within the provided context, checking for compliance with the necessary validation rules such as client authentication, scope validation, grant validation, etc\. ```csharp public System.Threading.Tasks.Task ValidateAsync(Abblix.Oidc.Server.Endpoints.Token.Validation.TokenValidationContext context, System.Threading.CancellationToken cancellationToken); ``` #### Parameters ###### `context` [TokenValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation.TokenValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation\.TokenValidationContext') {#Abblix.Oidc.Server.Endpoints.Token.Validation.RevokedSessionValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.Token.Validation.TokenValidationContext,System.Threading.CancellationToken).context} The context containing the token request and related information that needs to be validated\. ###### `cancellationToken` [System\.Threading\.CancellationToken](https://learn.microsoft.com/en-us/dotnet/api/system.threading.cancellationtoken 'System\.Threading\.CancellationToken') {#Abblix.Oidc.Server.Endpoints.Token.Validation.RevokedSessionValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.Token.Validation.TokenValidationContext,System.Threading.CancellationToken).cancellationToken} Implements [ValidateAsync\(TokenValidationContext, CancellationToken\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation.ITokenContextValidator#Abblix.Oidc.Server.Endpoints.Token.Validation.ITokenContextValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.Token.Validation.TokenValidationContext,System.Threading.CancellationToken) 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation\.ITokenContextValidator\.ValidateAsync\(Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation\.TokenValidationContext, System\.Threading\.CancellationToken\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') containing error details if the validation fails; otherwise, returns null indicating that the validation was successful\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation.ScopeValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation') ## ScopeValidator Class Validates the scopes specified in token requests using a scope manager to ensure their validity and availability\. This validator checks whether each requested scope is recognized and authorized for use, ensuring that clients only receive permissions appropriate to their needs and in compliance with server policies\. ```csharp public class ScopeValidator : Abblix.Oidc.Server.Endpoints.Token.Validation.SyncTokenContextValidatorBase ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [SyncTokenContextValidatorBase](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation.SyncTokenContextValidatorBase 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation\.SyncTokenContextValidatorBase') → ScopeValidator ### Constructors ## ScopeValidator\(IScopeManager\) Constructor {#Abblix.Oidc.Server.Endpoints.Token.Validation.ScopeValidator.ScopeValidator(Abblix.Oidc.Server.Features.ScopeManagement.IScopeManager)} Validates the scopes specified in token requests using a scope manager to ensure their validity and availability\. This validator checks whether each requested scope is recognized and authorized for use, ensuring that clients only receive permissions appropriate to their needs and in compliance with server policies\. ```csharp public ScopeValidator(Abblix.Oidc.Server.Features.ScopeManagement.IScopeManager scopeManager); ``` #### Parameters ###### `scopeManager` [IScopeManager](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ScopeManagement.IScopeManager 'Abblix\.Oidc\.Server\.Features\.ScopeManagement\.IScopeManager') {#Abblix.Oidc.Server.Endpoints.Token.Validation.ScopeValidator.ScopeValidator(Abblix.Oidc.Server.Features.ScopeManagement.IScopeManager).scopeManager} The manager responsible for maintaining and validating scope definitions\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation.SyncTokenContextValidatorBase.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation') ## SyncTokenContextValidatorBase Class Provides a base class for implementing synchronous token context validators\. This class simplifies the creation of token context validators by offering a synchronous validation method that is automatically wrapped in an asynchronous call\. ```csharp public abstract class SyncTokenContextValidatorBase : Abblix.Oidc.Server.Endpoints.Token.Validation.ITokenContextValidator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → SyncTokenContextValidatorBase Derived ↳ [ResourceValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation.ResourceValidator 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation\.ResourceValidator') ↳ [ScopeValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation.ScopeValidator 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation\.ScopeValidator') Implements [ITokenContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation.ITokenContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation\.ITokenContextValidator') ### Methods ## SyncTokenContextValidatorBase\.ValidateAsync\(TokenValidationContext, CancellationToken\) Method {#Abblix.Oidc.Server.Endpoints.Token.Validation.SyncTokenContextValidatorBase.ValidateAsync(Abblix.Oidc.Server.Endpoints.Token.Validation.TokenValidationContext,System.Threading.CancellationToken)} Asynchronously validates the token request within the provided context by invoking the synchronous [Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation\.SyncTokenContextValidatorBase\.Validate\(Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation\.TokenValidationContext\)](https://learn.microsoft.com/en-us/dotnet/api/abblix.oidc.server.endpoints.token.validation.synctokencontextvalidatorbase.validate#abblix-oidc-server-endpoints-token-validation-synctokencontextvalidatorbase-validate(abblix-oidc-server-endpoints-token-validation-tokenvalidationcontext) 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation\.SyncTokenContextValidatorBase\.Validate\(Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation\.TokenValidationContext\)') method\. ```csharp public System.Threading.Tasks.Task ValidateAsync(Abblix.Oidc.Server.Endpoints.Token.Validation.TokenValidationContext context, System.Threading.CancellationToken cancellationToken); ``` #### Parameters ###### `context` [TokenValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation.TokenValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation\.TokenValidationContext') {#Abblix.Oidc.Server.Endpoints.Token.Validation.SyncTokenContextValidatorBase.ValidateAsync(Abblix.Oidc.Server.Endpoints.Token.Validation.TokenValidationContext,System.Threading.CancellationToken).context} The context containing the token request and related information that needs to be validated\. ###### `cancellationToken` [System\.Threading\.CancellationToken](https://learn.microsoft.com/en-us/dotnet/api/system.threading.cancellationtoken 'System\.Threading\.CancellationToken') {#Abblix.Oidc.Server.Endpoints.Token.Validation.SyncTokenContextValidatorBase.ValidateAsync(Abblix.Oidc.Server.Endpoints.Token.Validation.TokenValidationContext,System.Threading.CancellationToken).cancellationToken} Abandons the operation when the caller stops waiting\. Implements [ValidateAsync\(TokenValidationContext, CancellationToken\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation.ITokenContextValidator#Abblix.Oidc.Server.Endpoints.Token.Validation.ITokenContextValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.Token.Validation.TokenValidationContext,System.Threading.CancellationToken) 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation\.ITokenContextValidator\.ValidateAsync\(Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation\.TokenValidationContext, System\.Threading\.CancellationToken\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A [System\.Threading\.Tasks\.Task](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task 'System\.Threading\.Tasks\.Task') that resolves to a [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') containing error details if the validation fails; otherwise, resolves to null indicating that the validation was successful\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation.TokenContextValidatorComposite.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation') ## TokenContextValidatorComposite Class Represents a composite validator for token context validation, executing a sequence of individual validators\. This class allows multiple validators to be combined, each responsible for a specific validation step, and short\-circuits the validation process if any step fails\. ```csharp public class TokenContextValidatorComposite : Abblix.Oidc.Server.Endpoints.Token.Validation.ITokenContextValidator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → TokenContextValidatorComposite Implements [ITokenContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation.ITokenContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation\.ITokenContextValidator') ### Constructors ## TokenContextValidatorComposite\(ITokenContextValidator\[\]\) Constructor {#Abblix.Oidc.Server.Endpoints.Token.Validation.TokenContextValidatorComposite.TokenContextValidatorComposite(Abblix.Oidc.Server.Endpoints.Token.Validation.ITokenContextValidator[])} Represents a composite validator for token context validation, executing a sequence of individual validators\. This class allows multiple validators to be combined, each responsible for a specific validation step, and short\-circuits the validation process if any step fails\. ```csharp public TokenContextValidatorComposite(Abblix.Oidc.Server.Endpoints.Token.Validation.ITokenContextValidator[] validators); ``` #### Parameters ###### `validators` [ITokenContextValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation.ITokenContextValidator 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation\.ITokenContextValidator')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Oidc.Server.Endpoints.Token.Validation.TokenContextValidatorComposite.TokenContextValidatorComposite(Abblix.Oidc.Server.Endpoints.Token.Validation.ITokenContextValidator[]).validators} An array of validators representing the steps in the validation process\. ### Methods ## TokenContextValidatorComposite\.ValidateAsync\(TokenValidationContext, CancellationToken\) Method {#Abblix.Oidc.Server.Endpoints.Token.Validation.TokenContextValidatorComposite.ValidateAsync(Abblix.Oidc.Server.Endpoints.Token.Validation.TokenValidationContext,System.Threading.CancellationToken)} Asynchronously validates the token request by executing each validator in the sequence\. The validation process stops at the first encountered error and returns it\. If all validators succeed, the method returns null, indicating successful validation\. ```csharp public System.Threading.Tasks.Task ValidateAsync(Abblix.Oidc.Server.Endpoints.Token.Validation.TokenValidationContext context, System.Threading.CancellationToken cancellationToken); ``` #### Parameters ###### `context` [TokenValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation.TokenValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation\.TokenValidationContext') {#Abblix.Oidc.Server.Endpoints.Token.Validation.TokenContextValidatorComposite.ValidateAsync(Abblix.Oidc.Server.Endpoints.Token.Validation.TokenValidationContext,System.Threading.CancellationToken).context} The context containing the token request and related information that needs to be validated\. ###### `cancellationToken` [System\.Threading\.CancellationToken](https://learn.microsoft.com/en-us/dotnet/api/system.threading.cancellationtoken 'System\.Threading\.CancellationToken') {#Abblix.Oidc.Server.Endpoints.Token.Validation.TokenContextValidatorComposite.ValidateAsync(Abblix.Oidc.Server.Endpoints.Token.Validation.TokenValidationContext,System.Threading.CancellationToken).cancellationToken} Abandons the operation when the caller stops waiting\. Implements [ValidateAsync\(TokenValidationContext, CancellationToken\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation.ITokenContextValidator#Abblix.Oidc.Server.Endpoints.Token.Validation.ITokenContextValidator.ValidateAsync(Abblix.Oidc.Server.Endpoints.Token.Validation.TokenValidationContext,System.Threading.CancellationToken) 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation\.ITokenContextValidator\.ValidateAsync\(Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation\.TokenValidationContext, System\.Threading\.CancellationToken\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') containing error details if any validation step fails; otherwise, returns null indicating that all validation steps were successful\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation.TokenValidationContext.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation') ## TokenValidationContext Class Encapsulates the context required for validating token requests, including client and authorization grant details\. ```csharp public record TokenValidationContext : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → TokenValidationContext Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[TokenValidationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation.TokenValidationContext 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation\.TokenValidationContext')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Constructors ## TokenValidationContext\(TokenRequest, ClientRequest\) Constructor {#Abblix.Oidc.Server.Endpoints.Token.Validation.TokenValidationContext.TokenValidationContext(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Model.ClientRequest)} Encapsulates the context required for validating token requests, including client and authorization grant details\. ```csharp public TokenValidationContext(Abblix.Oidc.Server.Model.TokenRequest Request, Abblix.Oidc.Server.Model.ClientRequest ClientRequest); ``` #### Parameters ###### `Request` [TokenRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.TokenRequest 'Abblix\.Oidc\.Server\.Model\.TokenRequest') {#Abblix.Oidc.Server.Endpoints.Token.Validation.TokenValidationContext.TokenValidationContext(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Model.ClientRequest).Request} ###### `ClientRequest` [ClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRequest 'Abblix\.Oidc\.Server\.Model\.ClientRequest') {#Abblix.Oidc.Server.Endpoints.Token.Validation.TokenValidationContext.TokenValidationContext(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Model.ClientRequest).ClientRequest} ### Properties ## TokenValidationContext\.AuthorizedGrant Property {#Abblix.Oidc.Server.Endpoints.Token.Validation.TokenValidationContext.AuthorizedGrant} Represents the result of an authorized grant, containing both the session and context of the authorization\. This object is essential for ensuring that the grant is valid and for extracting any additional information needed for token generation\. ```csharp public Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant AuthorizedGrant { get; set; } ``` #### Property Value [AuthorizedGrant](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.AuthorizedGrant') #### Exceptions [System\.InvalidOperationException](https://learn.microsoft.com/en-us/dotnet/api/system.invalidoperationexception 'System\.InvalidOperationException') Thrown when trying to access this property before it is set\. ### Remarks Asserted by name rather than sworn to with a null\-forgiving initialiser, the way [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation.TokenValidationContext#Abblix.Oidc.Server.Endpoints.Token.Validation.TokenValidationContext.ClientInfo 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation\.TokenValidationContext\.ClientInfo') beside it already is\. The two properties are filled by one pipeline and had been expressing the same fact in opposite ways, and the readers did not believe the oath: the sender\-constraining checks reached this through a null\-conditional, so an unset grant did not fail \- it read as "no binding was committed" and waved the request through\. That is the wrong direction for a check whose whole purpose is to refuse a token redeemed without the key or certificate it was bound to \(RFC 9449 section 10, RFC 8705 section 4\)\. ## TokenValidationContext\.ClientInfo Property {#Abblix.Oidc.Server.Endpoints.Token.Validation.TokenValidationContext.ClientInfo} Information about the client making the request, derived from the client authentication process\. ```csharp public Abblix.Oidc.Server.Features.ClientInformation.ClientInfo ClientInfo { get; set; } ``` #### Property Value [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') #### Exceptions [System\.InvalidOperationException](https://learn.microsoft.com/en-us/dotnet/api/system.invalidoperationexception 'System\.InvalidOperationException') Thrown when trying to access this property before it is set\. ## TokenValidationContext\.ProofKeyThumbprint Property {#Abblix.Oidc.Server.Endpoints.Token.Validation.TokenValidationContext.ProofKeyThumbprint} RFC 7638 base64url\-encoded JWK thumbprint of the DPoP proof\-of\-possession key \(RFC 9449 §6\.1\) populated by the DPoP validator step when a valid proof accompanies the request\. Surfaces to the processor so the issued access token can carry `cnf.jkt`\. `null` when no proof was presented or DPoP is not in use\. ```csharp public string? ProofKeyThumbprint { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## TokenValidationContext\.Resources Property {#Abblix.Oidc.Server.Endpoints.Token.Validation.TokenValidationContext.Resources} Specifies additional resources that the client has requested or that have been included in the authorization\. These definitions provide context on the resources that are accessible with the issued token, enhancing the token's utility for fine\-grained access control\. ```csharp public Abblix.Oidc.Server.Common.Constants.ResourceDefinition[] Resources { get; set; } ``` #### Property Value [ResourceDefinition](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ResourceDefinition 'Abblix\.Oidc\.Server\.Common\.Constants\.ResourceDefinition')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') ## TokenValidationContext\.Scope Property {#Abblix.Oidc.Server.Endpoints.Token.Validation.TokenValidationContext.Scope} Defines the scope of access requested or authorized\. This array of scope definitions helps in determining the extent of access granted to the client and any constraints or conditions applied to the token\. ```csharp public Abblix.Oidc.Server.Common.Constants.ScopeDefinition[] Scope { get; set; } ``` #### Property Value [ScopeDefinition](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ScopeDefinition 'Abblix\.Oidc\.Server\.Common\.Constants\.ScopeDefinition')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ## Abblix\.Oidc\.Server\.Endpoints\.UserInfo Namespace | Classes | | | :--- | :--- | | [UserInfoHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.UserInfoHandler 'Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.UserInfoHandler') | Handles user information requests in an OpenID Connect compliant manner\. It ensures that requests for user info are correctly validated and processed, returning the requested user information if the request is authorized\. | | [UserInfoRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.UserInfoRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.UserInfoRequestProcessor') | Default [IUserInfoRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IUserInfoRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Interfaces\.IUserInfoRequestProcessor'): assembles the UserInfo claims set from [IUserClaimsProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.UserInfo.IUserClaimsProvider 'Abblix\.Oidc\.Server\.Features\.UserInfo\.IUserClaimsProvider'), filtered by the access token's authorized scopes and any `userinfo` entry of the OIDC Core §5\.5 `claims` request\. Returns [InvalidToken](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ErrorCodes#Abblix.Oidc.Server.Common.Constants.ErrorCodes.InvalidToken 'Abblix\.Oidc\.Server\.Common\.Constants\.ErrorCodes\.InvalidToken') if no claims are produced for the subject\. | | [UserInfoRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.UserInfoRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.UserInfoRequestValidator') | Validates a UserInfo request: extracts the access token \(per RFC 6750, either the `Authorization: Bearer` header or the `access_token` form/query parameter, but not both\), verifies its JWT signature and claims, asserts the `typ` header equals `at+jwt`, and resolves the originating authentication session, authorization context and client\. | --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.UserInfoHandler.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.UserInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo 'Abblix\.Oidc\.Server\.Endpoints\.UserInfo') ## UserInfoHandler Class Handles user information requests in an OpenID Connect compliant manner\. It ensures that requests for user info are correctly validated and processed, returning the requested user information if the request is authorized\. ```csharp public class UserInfoHandler : Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IUserInfoHandler ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → UserInfoHandler Implements [IUserInfoHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IUserInfoHandler 'Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Interfaces\.IUserInfoHandler') ### Constructors ## UserInfoHandler\(IUserInfoRequestValidator, IUserInfoRequestProcessor\) Constructor {#Abblix.Oidc.Server.Endpoints.UserInfo.UserInfoHandler.UserInfoHandler(Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IUserInfoRequestValidator,Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IUserInfoRequestProcessor)} Handles user information requests in an OpenID Connect compliant manner\. It ensures that requests for user info are correctly validated and processed, returning the requested user information if the request is authorized\. ```csharp public UserInfoHandler(Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IUserInfoRequestValidator validator, Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IUserInfoRequestProcessor processor); ``` #### Parameters ###### `validator` [IUserInfoRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IUserInfoRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Interfaces\.IUserInfoRequestValidator') {#Abblix.Oidc.Server.Endpoints.UserInfo.UserInfoHandler.UserInfoHandler(Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IUserInfoRequestValidator,Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IUserInfoRequestProcessor).validator} An implementation of [IUserInfoRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IUserInfoRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Interfaces\.IUserInfoRequestValidator') responsible for validating user info requests against OpenID Connect specifications\. ###### `processor` [IUserInfoRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IUserInfoRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Interfaces\.IUserInfoRequestProcessor') {#Abblix.Oidc.Server.Endpoints.UserInfo.UserInfoHandler.UserInfoHandler(Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IUserInfoRequestValidator,Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IUserInfoRequestProcessor).processor} An implementation of [IUserInfoRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IUserInfoRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Interfaces\.IUserInfoRequestProcessor') responsible for processing validated requests and retrieving user information\. ### Methods ## UserInfoHandler\.HandleAsync\(UserInfoRequest, ClientRequest\) Method {#Abblix.Oidc.Server.Endpoints.UserInfo.UserInfoHandler.HandleAsync(Abblix.Oidc.Server.Model.UserInfoRequest,Abblix.Oidc.Server.Model.ClientRequest)} Asynchronously processes a user info request by first validating it and then, if validation is successful, retrieving the requested user information\. ```csharp public System.Threading.Tasks.Task> HandleAsync(Abblix.Oidc.Server.Model.UserInfoRequest userInfoRequest, Abblix.Oidc.Server.Model.ClientRequest clientRequest); ``` #### Parameters ###### `userInfoRequest` [UserInfoRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.UserInfoRequest 'Abblix\.Oidc\.Server\.Model\.UserInfoRequest') {#Abblix.Oidc.Server.Endpoints.UserInfo.UserInfoHandler.HandleAsync(Abblix.Oidc.Server.Model.UserInfoRequest,Abblix.Oidc.Server.Model.ClientRequest).userInfoRequest} The user info request containing necessary parameters such as the access token\. ###### `clientRequest` [ClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRequest 'Abblix\.Oidc\.Server\.Model\.ClientRequest') {#Abblix.Oidc.Server.Endpoints.UserInfo.UserInfoHandler.HandleAsync(Abblix.Oidc.Server.Model.UserInfoRequest,Abblix.Oidc.Server.Model.ClientRequest).clientRequest} Additional information about the client making the request, useful for contextual validation\. Implements [HandleAsync\(UserInfoRequest, ClientRequest\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IUserInfoHandler#Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IUserInfoHandler.HandleAsync(Abblix.Oidc.Server.Model.UserInfoRequest,Abblix.Oidc.Server.Model.ClientRequest) 'Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Interfaces\.IUserInfoHandler\.HandleAsync\(Abblix\.Oidc\.Server\.Model\.UserInfoRequest, Abblix\.Oidc\.Server\.Model\.ClientRequest\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[UserInfoFoundResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.UserInfoFoundResponse 'Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Interfaces\.UserInfoFoundResponse')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A [System\.Threading\.Tasks\.Task](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task 'System\.Threading\.Tasks\.Task') that resolves to a [UserInfoFoundResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.UserInfoFoundResponse 'Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Interfaces\.UserInfoFoundResponse'), which contains the requested user information in case of a valid request, or an [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') detailing the reason for failure\. ### Remarks This method is pivotal for ensuring that only authenticated and authorized requests gain access to sensitive user information, in line with OpenID Connect protocols\. It leverages the validator to ensure requests meet OIDC standards and the processor to fetch and return the relevant user information securely\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.UserInfoRequestProcessor.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.UserInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo 'Abblix\.Oidc\.Server\.Endpoints\.UserInfo') ## UserInfoRequestProcessor Class Default [IUserInfoRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IUserInfoRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Interfaces\.IUserInfoRequestProcessor'): assembles the UserInfo claims set from [IUserClaimsProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.UserInfo.IUserClaimsProvider 'Abblix\.Oidc\.Server\.Features\.UserInfo\.IUserClaimsProvider'), filtered by the access token's authorized scopes and any `userinfo` entry of the OIDC Core §5\.5 `claims` request\. Returns [InvalidToken](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ErrorCodes#Abblix.Oidc.Server.Common.Constants.ErrorCodes.InvalidToken 'Abblix\.Oidc\.Server\.Common\.Constants\.ErrorCodes\.InvalidToken') if no claims are produced for the subject\. ```csharp public class UserInfoRequestProcessor : Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IUserInfoRequestProcessor ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → UserInfoRequestProcessor Implements [IUserInfoRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IUserInfoRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Interfaces\.IUserInfoRequestProcessor') ### Constructors ## UserInfoRequestProcessor\(IIssuerProvider, IUserClaimsProvider\) Constructor {#Abblix.Oidc.Server.Endpoints.UserInfo.UserInfoRequestProcessor.UserInfoRequestProcessor(Abblix.Oidc.Server.Features.Issuer.IIssuerProvider,Abblix.Oidc.Server.Features.UserInfo.IUserClaimsProvider)} Default [IUserInfoRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IUserInfoRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Interfaces\.IUserInfoRequestProcessor'): assembles the UserInfo claims set from [IUserClaimsProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.UserInfo.IUserClaimsProvider 'Abblix\.Oidc\.Server\.Features\.UserInfo\.IUserClaimsProvider'), filtered by the access token's authorized scopes and any `userinfo` entry of the OIDC Core §5\.5 `claims` request\. Returns [InvalidToken](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ErrorCodes#Abblix.Oidc.Server.Common.Constants.ErrorCodes.InvalidToken 'Abblix\.Oidc\.Server\.Common\.Constants\.ErrorCodes\.InvalidToken') if no claims are produced for the subject\. ```csharp public UserInfoRequestProcessor(Abblix.Oidc.Server.Features.Issuer.IIssuerProvider issuerProvider, Abblix.Oidc.Server.Features.UserInfo.IUserClaimsProvider userClaimsProvider); ``` #### Parameters ###### `issuerProvider` [IIssuerProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Issuer.IIssuerProvider 'Abblix\.Oidc\.Server\.Features\.Issuer\.IIssuerProvider') {#Abblix.Oidc.Server.Endpoints.UserInfo.UserInfoRequestProcessor.UserInfoRequestProcessor(Abblix.Oidc.Server.Features.Issuer.IIssuerProvider,Abblix.Oidc.Server.Features.UserInfo.IUserClaimsProvider).issuerProvider} ###### `userClaimsProvider` [IUserClaimsProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.UserInfo.IUserClaimsProvider 'Abblix\.Oidc\.Server\.Features\.UserInfo\.IUserClaimsProvider') {#Abblix.Oidc.Server.Endpoints.UserInfo.UserInfoRequestProcessor.UserInfoRequestProcessor(Abblix.Oidc.Server.Features.Issuer.IIssuerProvider,Abblix.Oidc.Server.Features.UserInfo.IUserClaimsProvider).userClaimsProvider} ### Methods ## UserInfoRequestProcessor\.ProcessAsync\(ValidUserInfoRequest\) Method {#Abblix.Oidc.Server.Endpoints.UserInfo.UserInfoRequestProcessor.ProcessAsync(Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.ValidUserInfoRequest)} Asynchronously processes a valid user information request and returns a structured response containing the requested user information\. ```csharp public System.Threading.Tasks.Task> ProcessAsync(Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.ValidUserInfoRequest request); ``` #### Parameters ###### `request` [ValidUserInfoRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.ValidUserInfoRequest 'Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Interfaces\.ValidUserInfoRequest') {#Abblix.Oidc.Server.Endpoints.UserInfo.UserInfoRequestProcessor.ProcessAsync(Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.ValidUserInfoRequest).request} The valid user information request containing the authentication session, authorization context and client information necessary to determine the scope and specifics of the requested claims\. Implements [ProcessAsync\(ValidUserInfoRequest\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IUserInfoRequestProcessor#Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IUserInfoRequestProcessor.ProcessAsync(Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.ValidUserInfoRequest) 'Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Interfaces\.IUserInfoRequestProcessor\.ProcessAsync\(Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Interfaces\.ValidUserInfoRequest\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[UserInfoFoundResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.UserInfoFoundResponse 'Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Interfaces\.UserInfoFoundResponse')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A [System\.Threading\.Tasks\.Task](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task 'System\.Threading\.Tasks\.Task') representing the asynchronous operation, which upon completion will yield a [Result<TSuccess,TFailure>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2') encapsulating either the user's claims or an error response\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.UserInfoRequestValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.UserInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo 'Abblix\.Oidc\.Server\.Endpoints\.UserInfo') ## UserInfoRequestValidator Class Validates a UserInfo request: extracts the access token \(per RFC 6750, either the `Authorization: Bearer` header or the `access_token` form/query parameter, but not both\), verifies its JWT signature and claims, asserts the `typ` header equals `at+jwt`, and resolves the originating authentication session, authorization context and client\. ```csharp public class UserInfoRequestValidator : Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IUserInfoRequestValidator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → UserInfoRequestValidator Implements [IUserInfoRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IUserInfoRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Interfaces\.IUserInfoRequestValidator') ### Constructors ## UserInfoRequestValidator\(IAuthServiceJwtValidator, IAccessTokenService, IClientInfoProvider, IDPoPUserInfoValidator, IMtlsUserInfoValidator\) Constructor {#Abblix.Oidc.Server.Endpoints.UserInfo.UserInfoRequestValidator.UserInfoRequestValidator(Abblix.Oidc.Server.Features.Tokens.Validation.IAuthServiceJwtValidator,Abblix.Oidc.Server.Features.Tokens.IAccessTokenService,Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider,Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IDPoPUserInfoValidator,Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IMtlsUserInfoValidator)} Validates a UserInfo request: extracts the access token \(per RFC 6750, either the `Authorization: Bearer` header or the `access_token` form/query parameter, but not both\), verifies its JWT signature and claims, asserts the `typ` header equals `at+jwt`, and resolves the originating authentication session, authorization context and client\. ```csharp public UserInfoRequestValidator(Abblix.Oidc.Server.Features.Tokens.Validation.IAuthServiceJwtValidator jwtValidator, Abblix.Oidc.Server.Features.Tokens.IAccessTokenService accessTokenService, Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider clientInfoProvider, Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IDPoPUserInfoValidator dpopValidator, Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IMtlsUserInfoValidator mtlsValidator); ``` #### Parameters ###### `jwtValidator` [IAuthServiceJwtValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.Validation.IAuthServiceJwtValidator 'Abblix\.Oidc\.Server\.Features\.Tokens\.Validation\.IAuthServiceJwtValidator') {#Abblix.Oidc.Server.Endpoints.UserInfo.UserInfoRequestValidator.UserInfoRequestValidator(Abblix.Oidc.Server.Features.Tokens.Validation.IAuthServiceJwtValidator,Abblix.Oidc.Server.Features.Tokens.IAccessTokenService,Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider,Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IDPoPUserInfoValidator,Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IMtlsUserInfoValidator).jwtValidator} Validates access\-token JWTs issued by this authorization server\. ###### `accessTokenService` [IAccessTokenService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.IAccessTokenService 'Abblix\.Oidc\.Server\.Features\.Tokens\.IAccessTokenService') {#Abblix.Oidc.Server.Endpoints.UserInfo.UserInfoRequestValidator.UserInfoRequestValidator(Abblix.Oidc.Server.Features.Tokens.Validation.IAuthServiceJwtValidator,Abblix.Oidc.Server.Features.Tokens.IAccessTokenService,Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider,Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IDPoPUserInfoValidator,Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IMtlsUserInfoValidator).accessTokenService} Resolves an [AuthSession](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.UserAuthentication.AuthSession 'Abblix\.Oidc\.Server\.Features\.UserAuthentication\.AuthSession') and [AuthorizationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.AuthorizationContext 'Abblix\.Oidc\.Server\.Common\.AuthorizationContext') from the access token\. ###### `clientInfoProvider` [IClientInfoProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.IClientInfoProvider') {#Abblix.Oidc.Server.Endpoints.UserInfo.UserInfoRequestValidator.UserInfoRequestValidator(Abblix.Oidc.Server.Features.Tokens.Validation.IAuthServiceJwtValidator,Abblix.Oidc.Server.Features.Tokens.IAccessTokenService,Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider,Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IDPoPUserInfoValidator,Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IMtlsUserInfoValidator).clientInfoProvider} Loads the [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') for the token's client\. ###### `dpopValidator` [IDPoPUserInfoValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IDPoPUserInfoValidator 'Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Interfaces\.IDPoPUserInfoValidator') {#Abblix.Oidc.Server.Endpoints.UserInfo.UserInfoRequestValidator.UserInfoRequestValidator(Abblix.Oidc.Server.Features.Tokens.Validation.IAuthServiceJwtValidator,Abblix.Oidc.Server.Features.Tokens.IAccessTokenService,Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider,Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IDPoPUserInfoValidator,Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IMtlsUserInfoValidator).dpopValidator} RFC 9449 §7 DPoP resource\-server\-side validator that enforces the proof\-of\-possession binding when the access token carries a `cnf.jkt` confirmation\. ###### `mtlsValidator` [IMtlsUserInfoValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IMtlsUserInfoValidator 'Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Interfaces\.IMtlsUserInfoValidator') {#Abblix.Oidc.Server.Endpoints.UserInfo.UserInfoRequestValidator.UserInfoRequestValidator(Abblix.Oidc.Server.Features.Tokens.Validation.IAuthServiceJwtValidator,Abblix.Oidc.Server.Features.Tokens.IAccessTokenService,Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider,Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IDPoPUserInfoValidator,Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IMtlsUserInfoValidator).mtlsValidator} RFC 8705 §3 mutual\-TLS resource\-server\-side validator that enforces the certificate binding when the access token carries a `cnf.x5t#S256` confirmation\. ### Methods ## UserInfoRequestValidator\.ValidateAsync\(UserInfoRequest, ClientRequest\) Method {#Abblix.Oidc.Server.Endpoints.UserInfo.UserInfoRequestValidator.ValidateAsync(Abblix.Oidc.Server.Model.UserInfoRequest,Abblix.Oidc.Server.Model.ClientRequest)} Asynchronously validates a user information request and determines its validity based on the provided access token and request parameters\. ```csharp public System.Threading.Tasks.Task> ValidateAsync(Abblix.Oidc.Server.Model.UserInfoRequest userInfoRequest, Abblix.Oidc.Server.Model.ClientRequest clientRequest); ``` #### Parameters ###### `userInfoRequest` [UserInfoRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.UserInfoRequest 'Abblix\.Oidc\.Server\.Model\.UserInfoRequest') {#Abblix.Oidc.Server.Endpoints.UserInfo.UserInfoRequestValidator.ValidateAsync(Abblix.Oidc.Server.Model.UserInfoRequest,Abblix.Oidc.Server.Model.ClientRequest).userInfoRequest} The user info request to validate\. ###### `clientRequest` [ClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRequest 'Abblix\.Oidc\.Server\.Model\.ClientRequest') {#Abblix.Oidc.Server.Endpoints.UserInfo.UserInfoRequestValidator.ValidateAsync(Abblix.Oidc.Server.Model.UserInfoRequest,Abblix.Oidc.Server.Model.ClientRequest).clientRequest} Additional client request information for contextual validation\. Implements [ValidateAsync\(UserInfoRequest, ClientRequest\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IUserInfoRequestValidator#Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IUserInfoRequestValidator.ValidateAsync(Abblix.Oidc.Server.Model.UserInfoRequest,Abblix.Oidc.Server.Model.ClientRequest) 'Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Interfaces\.IUserInfoRequestValidator\.ValidateAsync\(Abblix\.Oidc\.Server\.Model\.UserInfoRequest, Abblix\.Oidc\.Server\.Model\.ClientRequest\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[ValidUserInfoRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.ValidUserInfoRequest 'Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Interfaces\.ValidUserInfoRequest')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A [System\.Threading\.Tasks\.Task](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task 'System\.Threading\.Tasks\.Task') representing the asynchronous operation, which upon completion will yield a [Result<TSuccess,TFailure>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ## Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Interfaces Namespace | Classes | | | :--- | :--- | | [UserInfoFoundResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.UserInfoFoundResponse 'Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Interfaces\.UserInfoFoundResponse') | Represents a successful response containing the found user information\. | | [ValidUserInfoRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.ValidUserInfoRequest 'Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Interfaces\.ValidUserInfoRequest') | Represents a valid user info request with associated authentication and authorization details\. | | Interfaces | | | :--- | :--- | | [IDPoPUserInfoValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IDPoPUserInfoValidator 'Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Interfaces\.IDPoPUserInfoValidator') | Validates the DPoP\-binding contract on a UserInfo request per RFC 9449 §7\.1: when the inbound access token is DPoP\-bound \(carries `cnf.jkt`\), the request MUST present `Authorization: DPoP ` together with a valid `DPoP` header proof whose key thumbprint matches the access token's `cnf.jkt` and whose `ath` claim equals `Base64Url(SHA-256(access_token))`\. Unbound \(Bearer\) access tokens passed via the Bearer scheme bypass the check\. | | [IMtlsUserInfoValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IMtlsUserInfoValidator 'Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Interfaces\.IMtlsUserInfoValidator') | Validates the mutual\-TLS certificate\-binding contract on a UserInfo request per RFC 8705 §3: when the inbound access token is certificate\-bound \(carries `cnf.x5t#S256`\), the protected resource MUST obtain the client certificate used for mutual TLS and verify that its SHA\-256 thumbprint matches the bound value, rejecting the request otherwise\. Unbound access tokens bypass the check\. Sibling of [IDPoPUserInfoValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IDPoPUserInfoValidator 'Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Interfaces\.IDPoPUserInfoValidator'): the two proof\-of\-possession mechanisms \(DPoP `cnf.jkt` and mTLS `cnf.x5t#S256`\) are independent and a token carrying both must satisfy each\. | | [IUserInfoHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IUserInfoHandler 'Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Interfaces\.IUserInfoHandler') | Endpoint contract for the OpenID Connect UserInfo endpoint \(OIDC Core 1\.0 §5\.3\), which returns claims about the authenticated end\-user identified by the bearer access token presented per RFC 6750\. | | [IUserInfoRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IUserInfoRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Interfaces\.IUserInfoRequestProcessor') | Generates a response containing information about a user account\. | | [IUserInfoRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IUserInfoRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Interfaces\.IUserInfoRequestValidator') | Parses and validates an access token provided in a user info request\. | --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IDPoPUserInfoValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Interfaces') ## IDPoPUserInfoValidator Interface Validates the DPoP\-binding contract on a UserInfo request per RFC 9449 §7\.1: when the inbound access token is DPoP\-bound \(carries `cnf.jkt`\), the request MUST present `Authorization: DPoP ` together with a valid `DPoP` header proof whose key thumbprint matches the access token's `cnf.jkt` and whose `ath` claim equals `Base64Url(SHA-256(access_token))`\. Unbound \(Bearer\) access tokens passed via the Bearer scheme bypass the check\. ```csharp public interface IDPoPUserInfoValidator ``` Derived ↳ [DPoPUserInfoValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Validation.DPoPUserInfoValidator 'Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Validation\.DPoPUserInfoValidator') ### Methods ## IDPoPUserInfoValidator\.ValidateAsync\(ClientRequest, JsonWebToken, string\) Method {#Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IDPoPUserInfoValidator.ValidateAsync(Abblix.Oidc.Server.Model.ClientRequest,Abblix.Jwt.JsonWebToken,string)} Returns `null` on success, an [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') describing the binding failure otherwise\. The typed subclasses [InvalidDPoPProofError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.InvalidDPoPProofError 'Abblix\.Oidc\.Server\.Common\.InvalidDPoPProofError') and [UseDPoPNonceError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.UseDPoPNonceError 'Abblix\.Oidc\.Server\.Common\.UseDPoPNonceError') let the response formatter pattern\-match for the RFC 9449 §7\.1 `WWW-Authenticate: DPoP` challenge or the §8 nonce response header attachment\. ```csharp System.Threading.Tasks.Task ValidateAsync(Abblix.Oidc.Server.Model.ClientRequest clientRequest, Abblix.Jwt.JsonWebToken accessToken, string rawAccessToken); ``` #### Parameters ###### `clientRequest` [ClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRequest 'Abblix\.Oidc\.Server\.Model\.ClientRequest') {#Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IDPoPUserInfoValidator.ValidateAsync(Abblix.Oidc.Server.Model.ClientRequest,Abblix.Jwt.JsonWebToken,string).clientRequest} Carries the `Authorization` scheme \+ token plus the optional `DPoP` proof header\. ###### `accessToken` [JsonWebToken](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebToken 'Abblix\.Jwt\.JsonWebToken') {#Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IDPoPUserInfoValidator.ValidateAsync(Abblix.Oidc.Server.Model.ClientRequest,Abblix.Jwt.JsonWebToken,string).accessToken} The parsed access\-token JWT whose `cnf.jkt` \(when present\) the proof must match\. ###### `rawAccessToken` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IDPoPUserInfoValidator.ValidateAsync(Abblix.Oidc.Server.Model.ClientRequest,Abblix.Jwt.JsonWebToken,string).rawAccessToken} The original on\-the\-wire access\-token string used to compute `ath = Base64Url(SHA-256(access_token))`\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IMtlsUserInfoValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Interfaces') ## IMtlsUserInfoValidator Interface Validates the mutual\-TLS certificate\-binding contract on a UserInfo request per RFC 8705 §3: when the inbound access token is certificate\-bound \(carries `cnf.x5t#S256`\), the protected resource MUST obtain the client certificate used for mutual TLS and verify that its SHA\-256 thumbprint matches the bound value, rejecting the request otherwise\. Unbound access tokens bypass the check\. Sibling of [IDPoPUserInfoValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IDPoPUserInfoValidator 'Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Interfaces\.IDPoPUserInfoValidator'): the two proof\-of\-possession mechanisms \(DPoP `cnf.jkt` and mTLS `cnf.x5t#S256`\) are independent and a token carrying both must satisfy each\. ```csharp public interface IMtlsUserInfoValidator ``` Derived ↳ [MtlsUserInfoValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Validation.MtlsUserInfoValidator 'Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Validation\.MtlsUserInfoValidator') ### Methods ## IMtlsUserInfoValidator\.Validate\(ClientRequest, JsonWebToken\) Method {#Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IMtlsUserInfoValidator.Validate(Abblix.Oidc.Server.Model.ClientRequest,Abblix.Jwt.JsonWebToken)} Returns `null` when the binding holds \(or the token is not certificate\-bound\), and an [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') with `invalid_token` when the token is bound but the presented certificate is absent or its thumbprint does not match `cnf.x5t#S256` \(RFC 8705 §3 \- HTTP 401, per RFC 6750\)\. ```csharp Abblix.Oidc.Server.Common.OidcError? Validate(Abblix.Oidc.Server.Model.ClientRequest clientRequest, Abblix.Jwt.JsonWebToken accessToken); ``` #### Parameters ###### `clientRequest` [ClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRequest 'Abblix\.Oidc\.Server\.Model\.ClientRequest') {#Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IMtlsUserInfoValidator.Validate(Abblix.Oidc.Server.Model.ClientRequest,Abblix.Jwt.JsonWebToken).clientRequest} Carries the client certificate presented on the mutual\-TLS connection \(when any\)\. ###### `accessToken` [JsonWebToken](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebToken 'Abblix\.Jwt\.JsonWebToken') {#Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IMtlsUserInfoValidator.Validate(Abblix.Oidc.Server.Model.ClientRequest,Abblix.Jwt.JsonWebToken).accessToken} The parsed access\-token JWT whose `cnf.x5t#S256` \(when present\) the presented certificate must match\. #### Returns [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IUserInfoHandler.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Interfaces') ## IUserInfoHandler Interface Endpoint contract for the OpenID Connect UserInfo endpoint \(OIDC Core 1\.0 §5\.3\), which returns claims about the authenticated end\-user identified by the bearer access token presented per RFC 6750\. ```csharp public interface IUserInfoHandler ``` Derived ↳ [UserInfoHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.UserInfoHandler 'Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.UserInfoHandler') ### Methods ## IUserInfoHandler\.HandleAsync\(UserInfoRequest, ClientRequest\) Method {#Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IUserInfoHandler.HandleAsync(Abblix.Oidc.Server.Model.UserInfoRequest,Abblix.Oidc.Server.Model.ClientRequest)} Asynchronously handles a UserInfo request, validating the request for authorization and processing it to return the requested user information\. ```csharp System.Threading.Tasks.Task> HandleAsync(Abblix.Oidc.Server.Model.UserInfoRequest userInfoRequest, Abblix.Oidc.Server.Model.ClientRequest clientRequest); ``` #### Parameters ###### `userInfoRequest` [UserInfoRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.UserInfoRequest 'Abblix\.Oidc\.Server\.Model\.UserInfoRequest') {#Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IUserInfoHandler.HandleAsync(Abblix.Oidc.Server.Model.UserInfoRequest,Abblix.Oidc.Server.Model.ClientRequest).userInfoRequest} The user info request containing the access token and possibly other parameters defining the scope of information requested\. ###### `clientRequest` [ClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRequest 'Abblix\.Oidc\.Server\.Model\.ClientRequest') {#Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IUserInfoHandler.HandleAsync(Abblix.Oidc.Server.Model.UserInfoRequest,Abblix.Oidc.Server.Model.ClientRequest).clientRequest} Additional client\-specific request information that may be necessary for processing the request in certain contexts\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[UserInfoFoundResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.UserInfoFoundResponse 'Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Interfaces\.UserInfoFoundResponse')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A [System\.Threading\.Tasks\.Task](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task 'System\.Threading\.Tasks\.Task') that resolves to a [Result<TSuccess,TFailure>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2'), which contains the user information if the request is authorized and valid, or an error response indicating why the request could not be fulfilled\. ### Remarks This method plays a crucial role in the OAuth 2\.0 and OIDC ecosystems by enabling secure access to user information based on authorized requests\. Implementations should ensure that the access token provided in the UserInfo request is validated and that any returned information is consistent with the scopes granted during the authorization process\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IUserInfoRequestProcessor.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Interfaces') ## IUserInfoRequestProcessor Interface Generates a response containing information about a user account\. ```csharp public interface IUserInfoRequestProcessor ``` Derived ↳ [UserInfoRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.UserInfoRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.UserInfoRequestProcessor') ### Methods ## IUserInfoRequestProcessor\.ProcessAsync\(ValidUserInfoRequest\) Method {#Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IUserInfoRequestProcessor.ProcessAsync(Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.ValidUserInfoRequest)} Asynchronously processes a valid user info request and generates a user info response\. ```csharp System.Threading.Tasks.Task> ProcessAsync(Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.ValidUserInfoRequest request); ``` #### Parameters ###### `request` [ValidUserInfoRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.ValidUserInfoRequest 'Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Interfaces\.ValidUserInfoRequest') {#Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IUserInfoRequestProcessor.ProcessAsync(Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.ValidUserInfoRequest).request} The valid user info request to process\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[UserInfoFoundResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.UserInfoFoundResponse 'Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Interfaces\.UserInfoFoundResponse')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A [System\.Threading\.Tasks\.Task](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task 'System\.Threading\.Tasks\.Task') representing the asynchronous operation, which upon completion will yield a [Result<TSuccess,TFailure>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IUserInfoRequestValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Interfaces') ## IUserInfoRequestValidator Interface Parses and validates an access token provided in a user info request\. ```csharp public interface IUserInfoRequestValidator ``` Derived ↳ [UserInfoRequestValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.UserInfoRequestValidator 'Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.UserInfoRequestValidator') ### Methods ## IUserInfoRequestValidator\.ValidateAsync\(UserInfoRequest, ClientRequest\) Method {#Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IUserInfoRequestValidator.ValidateAsync(Abblix.Oidc.Server.Model.UserInfoRequest,Abblix.Oidc.Server.Model.ClientRequest)} Asynchronously validates a user info request and generates a validation result\. ```csharp System.Threading.Tasks.Task> ValidateAsync(Abblix.Oidc.Server.Model.UserInfoRequest userInfoRequest, Abblix.Oidc.Server.Model.ClientRequest clientRequest); ``` #### Parameters ###### `userInfoRequest` [UserInfoRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.UserInfoRequest 'Abblix\.Oidc\.Server\.Model\.UserInfoRequest') {#Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IUserInfoRequestValidator.ValidateAsync(Abblix.Oidc.Server.Model.UserInfoRequest,Abblix.Oidc.Server.Model.ClientRequest).userInfoRequest} The user info request to validate\. ###### `clientRequest` [ClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRequest 'Abblix\.Oidc\.Server\.Model\.ClientRequest') {#Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IUserInfoRequestValidator.ValidateAsync(Abblix.Oidc.Server.Model.UserInfoRequest,Abblix.Oidc.Server.Model.ClientRequest).clientRequest} Additional client request information for contextual validation\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[ValidUserInfoRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.ValidUserInfoRequest 'Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Interfaces\.ValidUserInfoRequest')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A [System\.Threading\.Tasks\.Task](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task 'System\.Threading\.Tasks\.Task') representing the asynchronous operation, which upon completion will yield a [Result<TSuccess,TFailure>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.UserInfoFoundResponse.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Interfaces') ## UserInfoFoundResponse Class Represents a successful response containing the found user information\. ```csharp public record UserInfoFoundResponse : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → UserInfoFoundResponse Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[UserInfoFoundResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.UserInfoFoundResponse 'Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Interfaces\.UserInfoFoundResponse')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Constructors ## UserInfoFoundResponse\(JsonObject, ClientInfo, string\) Constructor {#Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.UserInfoFoundResponse.UserInfoFoundResponse(System.Text.Json.Nodes.JsonObject,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,string)} Represents a successful response containing the found user information\. ```csharp public UserInfoFoundResponse(System.Text.Json.Nodes.JsonObject User, Abblix.Oidc.Server.Features.ClientInformation.ClientInfo ClientInfo, string Issuer); ``` #### Parameters ###### `User` [System\.Text\.Json\.Nodes\.JsonObject](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonobject 'System\.Text\.Json\.Nodes\.JsonObject') {#Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.UserInfoFoundResponse.UserInfoFoundResponse(System.Text.Json.Nodes.JsonObject,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,string).User} The collection of JWT claims associated with the user\. ###### `ClientInfo` [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') {#Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.UserInfoFoundResponse.UserInfoFoundResponse(System.Text.Json.Nodes.JsonObject,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,string).ClientInfo} Information about the client making the request\. ###### `Issuer` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.UserInfoFoundResponse.UserInfoFoundResponse(System.Text.Json.Nodes.JsonObject,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,string).Issuer} The issuer identifier\. ### Properties ## UserInfoFoundResponse\.ClientInfo Property {#Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.UserInfoFoundResponse.ClientInfo} Information about the client making the request\. ```csharp public Abblix.Oidc.Server.Features.ClientInformation.ClientInfo ClientInfo { get; init; } ``` #### Property Value [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') ## UserInfoFoundResponse\.Issuer Property {#Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.UserInfoFoundResponse.Issuer} The issuer identifier\. ```csharp public string Issuer { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## UserInfoFoundResponse\.User Property {#Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.UserInfoFoundResponse.User} The collection of JWT claims associated with the user\. ```csharp public System.Text.Json.Nodes.JsonObject User { get; init; } ``` #### Property Value [System\.Text\.Json\.Nodes\.JsonObject](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonobject 'System\.Text\.Json\.Nodes\.JsonObject') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.ValidUserInfoRequest.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces 'Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Interfaces') ## ValidUserInfoRequest Class Represents a valid user info request with associated authentication and authorization details\. ```csharp public record ValidUserInfoRequest : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ValidUserInfoRequest Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[ValidUserInfoRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.ValidUserInfoRequest 'Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Interfaces\.ValidUserInfoRequest')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Constructors ## ValidUserInfoRequest\(UserInfoRequest, AuthSession, AuthorizationContext, ClientInfo\) Constructor {#Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.ValidUserInfoRequest.ValidUserInfoRequest(Abblix.Oidc.Server.Model.UserInfoRequest,Abblix.Oidc.Server.Features.UserAuthentication.AuthSession,Abblix.Oidc.Server.Common.AuthorizationContext,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo)} Represents a valid user info request with associated authentication and authorization details\. ```csharp public ValidUserInfoRequest(Abblix.Oidc.Server.Model.UserInfoRequest Model, Abblix.Oidc.Server.Features.UserAuthentication.AuthSession AuthSession, Abblix.Oidc.Server.Common.AuthorizationContext AuthContext, Abblix.Oidc.Server.Features.ClientInformation.ClientInfo ClientInfo); ``` #### Parameters ###### `Model` [UserInfoRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.UserInfoRequest 'Abblix\.Oidc\.Server\.Model\.UserInfoRequest') {#Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.ValidUserInfoRequest.ValidUserInfoRequest(Abblix.Oidc.Server.Model.UserInfoRequest,Abblix.Oidc.Server.Features.UserAuthentication.AuthSession,Abblix.Oidc.Server.Common.AuthorizationContext,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo).Model} The user info request model\. ###### `AuthSession` [AuthSession](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.UserAuthentication.AuthSession 'Abblix\.Oidc\.Server\.Features\.UserAuthentication\.AuthSession') {#Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.ValidUserInfoRequest.ValidUserInfoRequest(Abblix.Oidc.Server.Model.UserInfoRequest,Abblix.Oidc.Server.Features.UserAuthentication.AuthSession,Abblix.Oidc.Server.Common.AuthorizationContext,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo).AuthSession} The authentication session associated with the request\. ###### `AuthContext` [AuthorizationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.AuthorizationContext 'Abblix\.Oidc\.Server\.Common\.AuthorizationContext') {#Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.ValidUserInfoRequest.ValidUserInfoRequest(Abblix.Oidc.Server.Model.UserInfoRequest,Abblix.Oidc.Server.Features.UserAuthentication.AuthSession,Abblix.Oidc.Server.Common.AuthorizationContext,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo).AuthContext} The authorization context of the request\. ###### `ClientInfo` [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') {#Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.ValidUserInfoRequest.ValidUserInfoRequest(Abblix.Oidc.Server.Model.UserInfoRequest,Abblix.Oidc.Server.Features.UserAuthentication.AuthSession,Abblix.Oidc.Server.Common.AuthorizationContext,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo).ClientInfo} The client information for the request\. ### Properties ## ValidUserInfoRequest\.AuthContext Property {#Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.ValidUserInfoRequest.AuthContext} The authorization context of the request\. ```csharp public Abblix.Oidc.Server.Common.AuthorizationContext AuthContext { get; init; } ``` #### Property Value [AuthorizationContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.AuthorizationContext 'Abblix\.Oidc\.Server\.Common\.AuthorizationContext') ## ValidUserInfoRequest\.AuthSession Property {#Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.ValidUserInfoRequest.AuthSession} The authentication session associated with the request\. ```csharp public Abblix.Oidc.Server.Features.UserAuthentication.AuthSession AuthSession { get; init; } ``` #### Property Value [AuthSession](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.UserAuthentication.AuthSession 'Abblix\.Oidc\.Server\.Features\.UserAuthentication\.AuthSession') ## ValidUserInfoRequest\.ClientInfo Property {#Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.ValidUserInfoRequest.ClientInfo} The client information for the request\. ```csharp public Abblix.Oidc.Server.Features.ClientInformation.ClientInfo ClientInfo { get; init; } ``` #### Property Value [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') ## ValidUserInfoRequest\.Model Property {#Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.ValidUserInfoRequest.Model} The user info request model\. ```csharp public Abblix.Oidc.Server.Model.UserInfoRequest Model { get; init; } ``` #### Property Value [UserInfoRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.UserInfoRequest 'Abblix\.Oidc\.Server\.Model\.UserInfoRequest') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Validation.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ## Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Validation Namespace | Classes | | | :--- | :--- | | [DPoPUserInfoValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Validation.DPoPUserInfoValidator 'Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Validation\.DPoPUserInfoValidator') | Resource\-server\-side enforcement of RFC 9449 DPoP at the UserInfo endpoint\. Mirrors the shape of [DPoPTokenEndpointValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation.DPoPTokenEndpointValidator 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation\.DPoPTokenEndpointValidator') so the branching logic stays symmetric across endpoints; differences are limited to the trigger \(`cnf.jkt` on the inbound access token\) and the error envelope \(typed [InvalidDPoPProofError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.InvalidDPoPProofError 'Abblix\.Oidc\.Server\.Common\.InvalidDPoPProofError') / [UseDPoPNonceError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.UseDPoPNonceError 'Abblix\.Oidc\.Server\.Common\.UseDPoPNonceError') so the response formatter can emit the §7\.1 `WWW-Authenticate: DPoP` challenge\)\. | | [MtlsUserInfoValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Validation.MtlsUserInfoValidator 'Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Validation\.MtlsUserInfoValidator') | Resource\-server\-side enforcement of RFC 8705 §3 mutual\-TLS certificate\-bound access tokens at the UserInfo endpoint\. Mirrors the role of [DPoPUserInfoValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Validation.DPoPUserInfoValidator 'Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Validation\.DPoPUserInfoValidator') for the `cnf.x5t#S256` binding: when the access token is certificate\-bound, the SHA\-256 thumbprint of the certificate presented on the mutual\-TLS connection MUST match the bound value, otherwise the request is rejected with `invalid_token` \(HTTP 401, per RFC 6750\)\. | --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Validation.DPoPUserInfoValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Validation 'Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Validation') ## DPoPUserInfoValidator Class Resource\-server\-side enforcement of RFC 9449 DPoP at the UserInfo endpoint\. Mirrors the shape of [DPoPTokenEndpointValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation.DPoPTokenEndpointValidator 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation\.DPoPTokenEndpointValidator') so the branching logic stays symmetric across endpoints; differences are limited to the trigger \(`cnf.jkt` on the inbound access token\) and the error envelope \(typed [InvalidDPoPProofError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.InvalidDPoPProofError 'Abblix\.Oidc\.Server\.Common\.InvalidDPoPProofError') / [UseDPoPNonceError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.UseDPoPNonceError 'Abblix\.Oidc\.Server\.Common\.UseDPoPNonceError') so the response formatter can emit the §7\.1 `WWW-Authenticate: DPoP` challenge\)\. ```csharp public class DPoPUserInfoValidator : Abblix.Oidc.Server.Features.DPoP.DPoPNonceValidator, Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IDPoPUserInfoValidator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [DPoPNonceValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DPoP.DPoPNonceValidator 'Abblix\.Oidc\.Server\.Features\.DPoP\.DPoPNonceValidator') → DPoPUserInfoValidator Implements [IDPoPUserInfoValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IDPoPUserInfoValidator 'Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Interfaces\.IDPoPUserInfoValidator') ### Constructors ## DPoPUserInfoValidator\(ILogger\, IProofValidator, INonceService, IOptionsMonitor\\) Constructor {#Abblix.Oidc.Server.Endpoints.UserInfo.Validation.DPoPUserInfoValidator.DPoPUserInfoValidator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.UserInfo.Validation.DPoPUserInfoValidator_,Abblix.Oidc.Server.Features.DPoP.IProofValidator,Abblix.Oidc.Server.Features.Nonces.INonceService,Microsoft.Extensions.Options.IOptionsMonitor_Abblix.Oidc.Server.Common.Configuration.OidcOptions_)} Resource\-server\-side enforcement of RFC 9449 DPoP at the UserInfo endpoint\. Mirrors the shape of [DPoPTokenEndpointValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation.DPoPTokenEndpointValidator 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation\.DPoPTokenEndpointValidator') so the branching logic stays symmetric across endpoints; differences are limited to the trigger \(`cnf.jkt` on the inbound access token\) and the error envelope \(typed [InvalidDPoPProofError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.InvalidDPoPProofError 'Abblix\.Oidc\.Server\.Common\.InvalidDPoPProofError') / [UseDPoPNonceError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.UseDPoPNonceError 'Abblix\.Oidc\.Server\.Common\.UseDPoPNonceError') so the response formatter can emit the §7\.1 `WWW-Authenticate: DPoP` challenge\)\. ```csharp public DPoPUserInfoValidator(Microsoft.Extensions.Logging.ILogger logger, Abblix.Oidc.Server.Features.DPoP.IProofValidator proofValidator, Abblix.Oidc.Server.Features.Nonces.INonceService nonceService, Microsoft.Extensions.Options.IOptionsMonitor options); ``` #### Parameters ###### `logger` [Microsoft\.Extensions\.Logging\.ILogger<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1')[DPoPUserInfoValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Validation.DPoPUserInfoValidator 'Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Validation\.DPoPUserInfoValidator')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1') {#Abblix.Oidc.Server.Endpoints.UserInfo.Validation.DPoPUserInfoValidator.DPoPUserInfoValidator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.UserInfo.Validation.DPoPUserInfoValidator_,Abblix.Oidc.Server.Features.DPoP.IProofValidator,Abblix.Oidc.Server.Features.Nonces.INonceService,Microsoft.Extensions.Options.IOptionsMonitor_Abblix.Oidc.Server.Common.Configuration.OidcOptions_).logger} ###### `proofValidator` [IProofValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DPoP.IProofValidator 'Abblix\.Oidc\.Server\.Features\.DPoP\.IProofValidator') {#Abblix.Oidc.Server.Endpoints.UserInfo.Validation.DPoPUserInfoValidator.DPoPUserInfoValidator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.UserInfo.Validation.DPoPUserInfoValidator_,Abblix.Oidc.Server.Features.DPoP.IProofValidator,Abblix.Oidc.Server.Features.Nonces.INonceService,Microsoft.Extensions.Options.IOptionsMonitor_Abblix.Oidc.Server.Common.Configuration.OidcOptions_).proofValidator} ###### `nonceService` [INonceService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Nonces.INonceService 'Abblix\.Oidc\.Server\.Features\.Nonces\.INonceService') {#Abblix.Oidc.Server.Endpoints.UserInfo.Validation.DPoPUserInfoValidator.DPoPUserInfoValidator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.UserInfo.Validation.DPoPUserInfoValidator_,Abblix.Oidc.Server.Features.DPoP.IProofValidator,Abblix.Oidc.Server.Features.Nonces.INonceService,Microsoft.Extensions.Options.IOptionsMonitor_Abblix.Oidc.Server.Common.Configuration.OidcOptions_).nonceService} ###### `options` [Microsoft\.Extensions\.Options\.IOptionsMonitor<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptionsmonitor-1 'Microsoft\.Extensions\.Options\.IOptionsMonitor\`1')[OidcOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptionsmonitor-1 'Microsoft\.Extensions\.Options\.IOptionsMonitor\`1') {#Abblix.Oidc.Server.Endpoints.UserInfo.Validation.DPoPUserInfoValidator.DPoPUserInfoValidator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Endpoints.UserInfo.Validation.DPoPUserInfoValidator_,Abblix.Oidc.Server.Features.DPoP.IProofValidator,Abblix.Oidc.Server.Features.Nonces.INonceService,Microsoft.Extensions.Options.IOptionsMonitor_Abblix.Oidc.Server.Common.Configuration.OidcOptions_).options} ### Methods ## DPoPUserInfoValidator\.ValidateAsync\(ClientRequest, JsonWebToken, string\) Method {#Abblix.Oidc.Server.Endpoints.UserInfo.Validation.DPoPUserInfoValidator.ValidateAsync(Abblix.Oidc.Server.Model.ClientRequest,Abblix.Jwt.JsonWebToken,string)} Returns `null` on success, an [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') describing the binding failure otherwise\. The typed subclasses [InvalidDPoPProofError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.InvalidDPoPProofError 'Abblix\.Oidc\.Server\.Common\.InvalidDPoPProofError') and [UseDPoPNonceError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.UseDPoPNonceError 'Abblix\.Oidc\.Server\.Common\.UseDPoPNonceError') let the response formatter pattern\-match for the RFC 9449 §7\.1 `WWW-Authenticate: DPoP` challenge or the §8 nonce response header attachment\. ```csharp public System.Threading.Tasks.Task ValidateAsync(Abblix.Oidc.Server.Model.ClientRequest clientRequest, Abblix.Jwt.JsonWebToken accessToken, string rawAccessToken); ``` #### Parameters ###### `clientRequest` [ClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRequest 'Abblix\.Oidc\.Server\.Model\.ClientRequest') {#Abblix.Oidc.Server.Endpoints.UserInfo.Validation.DPoPUserInfoValidator.ValidateAsync(Abblix.Oidc.Server.Model.ClientRequest,Abblix.Jwt.JsonWebToken,string).clientRequest} Carries the `Authorization` scheme \+ token plus the optional `DPoP` proof header\. ###### `accessToken` [JsonWebToken](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebToken 'Abblix\.Jwt\.JsonWebToken') {#Abblix.Oidc.Server.Endpoints.UserInfo.Validation.DPoPUserInfoValidator.ValidateAsync(Abblix.Oidc.Server.Model.ClientRequest,Abblix.Jwt.JsonWebToken,string).accessToken} The parsed access\-token JWT whose `cnf.jkt` \(when present\) the proof must match\. ###### `rawAccessToken` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Endpoints.UserInfo.Validation.DPoPUserInfoValidator.ValidateAsync(Abblix.Oidc.Server.Model.ClientRequest,Abblix.Jwt.JsonWebToken,string).rawAccessToken} The original on\-the\-wire access\-token string used to compute `ath = Base64Url(SHA-256(access_token))`\. Implements [ValidateAsync\(ClientRequest, JsonWebToken, string\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IDPoPUserInfoValidator#Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IDPoPUserInfoValidator.ValidateAsync(Abblix.Oidc.Server.Model.ClientRequest,Abblix.Jwt.JsonWebToken,string) 'Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Interfaces\.IDPoPUserInfoValidator\.ValidateAsync\(Abblix\.Oidc\.Server\.Model\.ClientRequest, Abblix\.Jwt\.JsonWebToken, string\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Validation.MtlsUserInfoValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Validation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Validation 'Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Validation') ## MtlsUserInfoValidator Class Resource\-server\-side enforcement of RFC 8705 §3 mutual\-TLS certificate\-bound access tokens at the UserInfo endpoint\. Mirrors the role of [DPoPUserInfoValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Validation.DPoPUserInfoValidator 'Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Validation\.DPoPUserInfoValidator') for the `cnf.x5t#S256` binding: when the access token is certificate\-bound, the SHA\-256 thumbprint of the certificate presented on the mutual\-TLS connection MUST match the bound value, otherwise the request is rejected with `invalid_token` \(HTTP 401, per RFC 6750\)\. ```csharp public class MtlsUserInfoValidator : Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IMtlsUserInfoValidator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → MtlsUserInfoValidator Implements [IMtlsUserInfoValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IMtlsUserInfoValidator 'Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Interfaces\.IMtlsUserInfoValidator') ### Methods ## MtlsUserInfoValidator\.Validate\(ClientRequest, JsonWebToken\) Method {#Abblix.Oidc.Server.Endpoints.UserInfo.Validation.MtlsUserInfoValidator.Validate(Abblix.Oidc.Server.Model.ClientRequest,Abblix.Jwt.JsonWebToken)} Returns `null` when the binding holds \(or the token is not certificate\-bound\), and an [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') with `invalid_token` when the token is bound but the presented certificate is absent or its thumbprint does not match `cnf.x5t#S256` \(RFC 8705 §3 \- HTTP 401, per RFC 6750\)\. ```csharp public Abblix.Oidc.Server.Common.OidcError? Validate(Abblix.Oidc.Server.Model.ClientRequest clientRequest, Abblix.Jwt.JsonWebToken accessToken); ``` #### Parameters ###### `clientRequest` [ClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRequest 'Abblix\.Oidc\.Server\.Model\.ClientRequest') {#Abblix.Oidc.Server.Endpoints.UserInfo.Validation.MtlsUserInfoValidator.Validate(Abblix.Oidc.Server.Model.ClientRequest,Abblix.Jwt.JsonWebToken).clientRequest} Carries the client certificate presented on the mutual\-TLS connection \(when any\)\. ###### `accessToken` [JsonWebToken](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebToken 'Abblix\.Jwt\.JsonWebToken') {#Abblix.Oidc.Server.Endpoints.UserInfo.Validation.MtlsUserInfoValidator.Validate(Abblix.Oidc.Server.Model.ClientRequest,Abblix.Jwt.JsonWebToken).accessToken} The parsed access\-token JWT whose `cnf.x5t#S256` \(when present\) the presented certificate must match\. Implements [Validate\(ClientRequest, JsonWebToken\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IMtlsUserInfoValidator#Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IMtlsUserInfoValidator.Validate(Abblix.Oidc.Server.Model.ClientRequest,Abblix.Jwt.JsonWebToken) 'Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Interfaces\.IMtlsUserInfoValidator\.Validate\(Abblix\.Oidc\.Server\.Model\.ClientRequest, Abblix\.Jwt\.JsonWebToken\)') #### Returns [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ## Abblix\.Oidc\.Server\.Features Namespace | Classes | | | :--- | :--- | | [ServiceCollectionExtensions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ServiceCollectionExtensions 'Abblix\.Oidc\.Server\.Features\.ServiceCollectionExtensions') | Provides extension methods to [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') for configuring OpenID Connect \(OIDC\) server services\. | --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ServiceCollectionExtensions.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features 'Abblix\.Oidc\.Server\.Features') ## ServiceCollectionExtensions Class Provides extension methods to [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') for configuring OpenID Connect \(OIDC\) server services\. ```csharp public static class ServiceCollectionExtensions ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ServiceCollectionExtensions ### Methods ## ServiceCollectionExtensions\.AddAccessToken\(this IServiceCollection\) Method {#Abblix.Oidc.Server.Features.ServiceCollectionExtensions.AddAccessToken(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection)} This method adds a service responsible for generating, validating, and managing access tokens\. Access tokens are crucial for securing API endpoints, as they provide a mechanism to verify that a request is authorized to access specific resources\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection AddAccessToken(this Microsoft.Extensions.DependencyInjection.IServiceCollection services); ``` #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.Oidc.Server.Features.ServiceCollectionExtensions.AddAccessToken(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).services} The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') to configure with token\-related services\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') so that additional calls can be chained\. ## ServiceCollectionExtensions\.AddAuthServiceJwt\(this IServiceCollection\) Method {#Abblix.Oidc.Server.Features.ServiceCollectionExtensions.AddAuthServiceJwt(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection)} Registers JWT formatting and validation services for authentication within the specified [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection')\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection AddAuthServiceJwt(this Microsoft.Extensions.DependencyInjection.IServiceCollection services); ``` #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.Oidc.Server.Features.ServiceCollectionExtensions.AddAuthServiceJwt(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).services} The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') to add the JWT authentication services to\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') for chaining further service registrations\. ## ServiceCollectionExtensions\.AddBackChannelAuthentication\(this IServiceCollection\) Method {#Abblix.Oidc.Server.Features.ServiceCollectionExtensions.AddBackChannelAuthentication(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection)} Opts the server into Client\-Initiated Backchannel Authentication \(CIBA\)\. This single call registers the CIBA feature services, the CIBA grant handler, the backchannel endpoint services and re\-enables the [BackChannelAuthentication](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcEndpoints#Abblix.Oidc.Server.Common.Configuration.OidcEndpoints.BackChannelAuthentication 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcEndpoints\.BackChannelAuthentication') flag, which is off in the default [EnabledEndpoints](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions#Abblix.Oidc.Server.Common.Configuration.OidcOptions.EnabledEndpoints 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions\.EnabledEndpoints')\. A server that never calls this method exposes no backchannel endpoint and runs no CIBA grant\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection AddBackChannelAuthentication(this Microsoft.Extensions.DependencyInjection.IServiceCollection services); ``` #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.Oidc.Server.Features.ServiceCollectionExtensions.AddBackChannelAuthentication(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).services} The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') to configure\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') The configured [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection')\. ### Remarks Call this \before\`AddOidcCore`/`AddOidcServices`: the CIBA grant handler must be registered before `AddAuthorizationGrants()` composes the grant handlers at the end of `AddOidcCore`, otherwise it is registered beside the composite and the token endpoint resolves the wrong single `IAuthorizationGrantHandler`\. ## ServiceCollectionExtensions\.AddBackChannelLogout\(this IServiceCollection\) Method {#Abblix.Oidc.Server.Features.ServiceCollectionExtensions.AddBackChannelLogout(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection)} Adds the necessary services for back\-channel logout functionality to the specified [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection')\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection AddBackChannelLogout(this Microsoft.Extensions.DependencyInjection.IServiceCollection services); ``` #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.Oidc.Server.Features.ServiceCollectionExtensions.AddBackChannelLogout(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).services} #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') ## ServiceCollectionExtensions\.AddCheckSession\(this IServiceCollection\) Method {#Abblix.Oidc.Server.Features.ServiceCollectionExtensions.AddCheckSession(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection)} Opts the server into the OpenID Connect Session Management check\-session endpoint\. This single call registers the check\-session handler and re\-enables the [CheckSession](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcEndpoints#Abblix.Oidc.Server.Common.Configuration.OidcEndpoints.CheckSession 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcEndpoints\.CheckSession') flag, which is off in the default [EnabledEndpoints](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions#Abblix.Oidc.Server.Common.Configuration.OidcOptions.EnabledEndpoints 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions\.EnabledEndpoints')\. Many SPAs do not use the session\-management iframe, so it is opt\-in: a server that never calls this method exposes no check\-session endpoint and does not advertise it in discovery\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection AddCheckSession(this Microsoft.Extensions.DependencyInjection.IServiceCollection services); ``` #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.Oidc.Server.Features.ServiceCollectionExtensions.AddCheckSession(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).services} The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') to configure\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') The configured [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection')\. ## ServiceCollectionExtensions\.AddClientAuthentication\(this IServiceCollection\) Method {#Abblix.Oidc.Server.Features.ServiceCollectionExtensions.AddClientAuthentication(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection)} Registers client authentication services with the provided [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection')\. This setup includes various authenticators for supporting different client authentication methods such as none, client secret post, client secret basic, private key JWT, and potentially others\. It enables the application to handle client authentication according to the OAuth 2\.0 and OpenID Connect standards\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection AddClientAuthentication(this Microsoft.Extensions.DependencyInjection.IServiceCollection services); ``` #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.Oidc.Server.Features.ServiceCollectionExtensions.AddClientAuthentication(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).services} The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') to add the client authentication services to\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') so that additional calls can be chained\. ## ServiceCollectionExtensions\.AddClientInformation\(this IServiceCollection\) Method {#Abblix.Oidc.Server.Features.ServiceCollectionExtensions.AddClientInformation(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection)} Configures services related to client information management\. This includes registering the client information storage mechanism, which serves as the provider and manager for client information, as well as the provider for client keys\. This setup is crucial for the OIDC server to manage and validate client identities and their corresponding secrets or keys\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection AddClientInformation(this Microsoft.Extensions.DependencyInjection.IServiceCollection services); ``` #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.Oidc.Server.Features.ServiceCollectionExtensions.AddClientInformation(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).services} The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') to add the services to\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') so that additional calls can be chained\. ## ServiceCollectionExtensions\.AddClientJwt\(this IServiceCollection\) Method {#Abblix.Oidc.Server.Features.ServiceCollectionExtensions.AddClientJwt(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection)} Registers services for validating and formatting JWTs used in client authentication scenarios within the specified [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection')\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection AddClientJwt(this Microsoft.Extensions.DependencyInjection.IServiceCollection services); ``` #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.Oidc.Server.Features.ServiceCollectionExtensions.AddClientJwt(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).services} The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') to add the client JWT validation and formatting services to\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') for chaining further service registrations\. ### Remarks This method adds services to the [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') that are responsible for validating and formatting JWTs used specifically in client authentication\. These services ensure that JWTs conform to the required standards, include all necessary claims, and are properly validated for client authentication processes\. ## ServiceCollectionExtensions\.AddCommonServices\(this IServiceCollection\) Method {#Abblix.Oidc.Server.Features.ServiceCollectionExtensions.AddCommonServices(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection)} Registers common services required by the application, like system clock, hashing services, etc\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection AddCommonServices(this Microsoft.Extensions.DependencyInjection.IServiceCollection services); ``` #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.Oidc.Server.Features.ServiceCollectionExtensions.AddCommonServices(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).services} The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') to add the services to\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') with the common services registered\. ## ServiceCollectionExtensions\.AddDeviceAuthorization\(this IServiceCollection\) Method {#Abblix.Oidc.Server.Features.ServiceCollectionExtensions.AddDeviceAuthorization(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection)} Opts the server into the Device Authorization Grant \(RFC 8628\)\. This single call registers the device feature services, the device endpoint \(handler, validators, options validator\) and re\-enables the [DeviceAuthorization](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcEndpoints#Abblix.Oidc.Server.Common.Configuration.OidcEndpoints.DeviceAuthorization 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcEndpoints\.DeviceAuthorization') flag, which is off in the default [EnabledEndpoints](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions#Abblix.Oidc.Server.Common.Configuration.OidcOptions.EnabledEndpoints 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions\.EnabledEndpoints')\. A server that never calls this method exposes no device endpoint and runs no device options validation\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection AddDeviceAuthorization(this Microsoft.Extensions.DependencyInjection.IServiceCollection services); ``` #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.Oidc.Server.Features.ServiceCollectionExtensions.AddDeviceAuthorization(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).services} The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') to configure\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') The configured [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection')\. ### Remarks Call this \before\`AddOidcCore`/`AddOidcServices`: the device\-code grant handler must be registered before `AddAuthorizationGrants()` composes the grant handlers at the end of `AddOidcCore`, otherwise it is registered beside the composite and the token endpoint resolves the wrong single `IAuthorizationGrantHandler`\. ## ServiceCollectionExtensions\.AddDPoP\(this IServiceCollection\) Method {#Abblix.Oidc.Server.Features.ServiceCollectionExtensions.AddDPoP(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection)} Registers the OAuth 2\.0 DPoP \(RFC 9449\) infrastructure: the proof validator, the JWT replay cache it depends on \(via defensive `TryAdd` so DPoP\-only deployments do not need to enable JWT Bearer just to get the cache\), and the shared nonce\-service via [AddNonces\(this IServiceCollection\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ServiceCollectionExtensions#Abblix.Oidc.Server.Features.ServiceCollectionExtensions.AddNonces(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection) 'Abblix\.Oidc\.Server\.Features\.ServiceCollectionExtensions\.AddNonces\(this Microsoft\.Extensions\.DependencyInjection\.IServiceCollection\)')\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection AddDPoP(this Microsoft.Extensions.DependencyInjection.IServiceCollection services); ``` #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.Oidc.Server.Features.ServiceCollectionExtensions.AddDPoP(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).services} The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') to configure\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') so additional calls can be chained\. ## ServiceCollectionExtensions\.AddDynamicClientRegistration\(this IServiceCollection\) Method {#Abblix.Oidc.Server.Features.ServiceCollectionExtensions.AddDynamicClientRegistration(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection)} Opts the server into Dynamic Client Registration \(RFC 7591 / RFC 7592\)\. This single call registers the registration, read, update and remove handlers and their validators, and re\-enables the [RegisterClient](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcEndpoints#Abblix.Oidc.Server.Common.Configuration.OidcEndpoints.RegisterClient 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcEndpoints\.RegisterClient') flag, which is off in the default [EnabledEndpoints](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions#Abblix.Oidc.Server.Common.Configuration.OidcOptions.EnabledEndpoints 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions\.EnabledEndpoints')\. Open registration widens the attack surface, so it is opt\-in: a server that never calls this method exposes no registration endpoint and does not advertise it in discovery\. New\-client defaults are taken from [NewClientOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions#Abblix.Oidc.Server.Common.Configuration.OidcOptions.NewClientOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions\.NewClientOptions')\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection AddDynamicClientRegistration(this Microsoft.Extensions.DependencyInjection.IServiceCollection services); ``` #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.Oidc.Server.Features.ServiceCollectionExtensions.AddDynamicClientRegistration(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).services} The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') to configure\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') The configured [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection')\. ## ServiceCollectionExtensions\.AddFrontChannelLogout\(this IServiceCollection\) Method {#Abblix.Oidc.Server.Features.ServiceCollectionExtensions.AddFrontChannelLogout(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection)} Adds the necessary services for front\-channel logout functionality to the specified [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection')\. Front\-channel logout is typically used for web\-based applications where the logout request is sent directly from the user's browser to the identity provider and other logged\-in services\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection AddFrontChannelLogout(this Microsoft.Extensions.DependencyInjection.IServiceCollection services); ``` #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.Oidc.Server.Features.ServiceCollectionExtensions.AddFrontChannelLogout(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).services} #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') ## ServiceCollectionExtensions\.AddIdentityToken\(this IServiceCollection\) Method {#Abblix.Oidc.Server.Features.ServiceCollectionExtensions.AddIdentityToken(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection)} This method adds a service that handles identity tokens, which are used to convey the identity of the authenticated user to the application\. Identity tokens typically contain claims about the user, such as their name or role, which can be used for user interface customization and access control decisions\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection AddIdentityToken(this Microsoft.Extensions.DependencyInjection.IServiceCollection services); ``` #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.Oidc.Server.Features.ServiceCollectionExtensions.AddIdentityToken(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).services} The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') to configure with token\-related services\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') so that additional calls can be chained\. ## ServiceCollectionExtensions\.AddIntrospection\(this IServiceCollection\) Method {#Abblix.Oidc.Server.Features.ServiceCollectionExtensions.AddIntrospection(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection)} Opts the server into the OAuth 2\.0 Token Introspection endpoint \(RFC 7662\)\. This single call registers the introspection handler, validator and processor and re\-enables the [Introspection](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcEndpoints#Abblix.Oidc.Server.Common.Configuration.OidcEndpoints.Introspection 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcEndpoints\.Introspection') flag, which is off in the default [EnabledEndpoints](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions#Abblix.Oidc.Server.Common.Configuration.OidcOptions.EnabledEndpoints 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions\.EnabledEndpoints')\. Introspection is chiefly needed by resource servers validating opaque tokens; a server issuing self\-contained JWTs often does not need it, so it is opt\-in\. A server that never calls this method exposes no introspection endpoint and does not advertise it in discovery\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection AddIntrospection(this Microsoft.Extensions.DependencyInjection.IServiceCollection services); ``` #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.Oidc.Server.Features.ServiceCollectionExtensions.AddIntrospection(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).services} The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') to configure\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') The configured [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection')\. ## ServiceCollectionExtensions\.AddIssuer\(this IServiceCollection\) Method {#Abblix.Oidc.Server.Features.ServiceCollectionExtensions.AddIssuer(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection)} Configures the issuer provider service to dynamically determine the issuer URI based on application settings\. If an issuer is preconfigured in the options, a preconfigured issuer provider is used\. Otherwise, a request\-based issuer provider is utilized to determine the issuer URI dynamically, allowing for flexible deployment scenarios\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection AddIssuer(this Microsoft.Extensions.DependencyInjection.IServiceCollection services); ``` #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.Oidc.Server.Features.ServiceCollectionExtensions.AddIssuer(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).services} The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') to add the issuer provider to\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') The modified [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') with the issuer provider configured\. ## ServiceCollectionExtensions\.AddLicense\(this IServiceCollection, string\) Method {#Abblix.Oidc.Server.Features.ServiceCollectionExtensions.AddLicense(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,string)} Registers the license JWT provider using a provided static license JWT string\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection AddLicense(this Microsoft.Extensions.DependencyInjection.IServiceCollection services, string licenseJwt); ``` #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.Oidc.Server.Features.ServiceCollectionExtensions.AddLicense(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,string).services} The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') to add the license provider to\. ###### `licenseJwt` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.ServiceCollectionExtensions.AddLicense(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,string).licenseJwt} The license JWT string to be used for OIDC service configuration validation\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') for chaining further configurations\. ### Remarks This method allows for direct specification of the license JWT, bypassing options configuration\. It utilizes the [StaticLicenseJwtProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Licensing.StaticLicenseJwtProvider 'Abblix\.Oidc\.Server\.Features\.Licensing\.StaticLicenseJwtProvider') to supply the license JWT directly to the OIDC service\. This approach is particularly useful in scenarios where the license JWT is obtained programmatically or from external sources not tied to the application's static configuration\. ## ServiceCollectionExtensions\.AddLicenseFromOptions\(this IServiceCollection\) Method {#Abblix.Oidc.Server.Features.ServiceCollectionExtensions.AddLicenseFromOptions(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection)} Registers the license JWT provider using options configuration to obtain the license JWT\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection AddLicenseFromOptions(this Microsoft.Extensions.DependencyInjection.IServiceCollection services); ``` #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.Oidc.Server.Features.ServiceCollectionExtensions.AddLicenseFromOptions(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).services} The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') to add the license provider to\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') for chaining further configurations\. ### Remarks This method configures the OIDC service's licensing by using the [OptionsLicenseJwtProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Licensing.OptionsLicenseJwtProvider 'Abblix\.Oidc\.Server\.Features\.Licensing\.OptionsLicenseJwtProvider'), which retrieves the license JWT from application settings or options\. It's suitable for scenarios where the license JWT is configured through application settings \(e\.g\., appsettings\.json or environment variables\)\. ## ServiceCollectionExtensions\.AddLogoutNotification\(this IServiceCollection\) Method {#Abblix.Oidc.Server.Features.ServiceCollectionExtensions.AddLogoutNotification(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection)} Configures services for logout notification mechanisms within the application\. This method sets up both front\-channel and back\-channel logout capabilities, allowing the application to notify clients about logout events through direct user agent redirection or server\-to\-server communication, respectively\. It integrates a composite logout notifier that aggregates both mechanisms to provide a unified approach to logout notifications\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection AddLogoutNotification(this Microsoft.Extensions.DependencyInjection.IServiceCollection services); ``` #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.Oidc.Server.Features.ServiceCollectionExtensions.AddLogoutNotification(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).services} The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') to add the logout notification services to\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') so that additional calls can be chained\. ## ServiceCollectionExtensions\.AddNonces\(this IServiceCollection\) Method {#Abblix.Oidc.Server.Features.ServiceCollectionExtensions.AddNonces(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection)} Registers the generic stateless\-nonce service\. The default [RollingHmacNonceService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Nonces.RollingHmacNonceService 'Abblix\.Oidc\.Server\.Features\.Nonces\.RollingHmacNonceService') implementation is shared across any feature that needs server\-issued, time\-bounded opaque tokens \(DPoP\-Nonce per RFC 9449 §8 / §9 is the current consumer; future candidates include state\-parameter validation and challenge\-response patterns\)\. Idempotent via `TryAdd` so feature\-level `Add*` methods can declare the dependency without contention\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection AddNonces(this Microsoft.Extensions.DependencyInjection.IServiceCollection services); ``` #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.Oidc.Server.Features.ServiceCollectionExtensions.AddNonces(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).services} The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') to configure\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') so additional calls can be chained\. ## ServiceCollectionExtensions\.AddPairwiseSubjectIdentifiers\(this IServiceCollection\) Method {#Abblix.Oidc.Server.Features.ServiceCollectionExtensions.AddPairwiseSubjectIdentifiers(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection)} Wires pairwise subject identifiers over settings the host has already bound, and refuses an unusable seal key before the host serves anything\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection AddPairwiseSubjectIdentifiers(this Microsoft.Extensions.DependencyInjection.IServiceCollection services); ``` #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.Oidc.Server.Features.ServiceCollectionExtensions.AddPairwiseSubjectIdentifiers(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).services} The service collection the host bound its settings into\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') ### Remarks The way to configure this from a file: the host binds the section \- `services.Configure`, or `AddOptions().Bind()` \- and this call judges the result\. The library takes no dependency on the configuration stack for it, which is why the binding stays the host's\. Riding the options pipeline is what buys the timing: its validators run before the host starts the service that opens the port, so a deployment whose seal key will not do never serves a request\. An unusable key reaching the container instead surfaces as a 500 from the token endpoint the first time a pairwise identifier is minted, which names neither the setting nor the deployment that changed it\. This is also the only shape that judges the instance actually IN USE\. A check over an argument judges what it was handed, and the overload above registers with `TryAddSingleton`, so a host that brought its own settings keeps them\. ## ServiceCollectionExtensions\.AddPairwiseSubjectIdentifiers\(this IServiceCollection, PairwiseSubjectSettings\) Method {#Abblix.Oidc.Server.Features.ServiceCollectionExtensions.AddPairwiseSubjectIdentifiers(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,Abblix.Oidc.Server.Features.PairwiseIdentifiers.PairwiseSubjectSettings)} Registers pairwise subject identifier settings, enabling reversible per\-sector subject conversion for clients with SubjectType=pairwise\. The salt and hash algorithm key a deterministic authenticated\-encryption seal that produces stable, per\-sector pseudonyms the server can open back to the real subject, per OpenID Connect Core Section 8\.1\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection AddPairwiseSubjectIdentifiers(this Microsoft.Extensions.DependencyInjection.IServiceCollection services, Abblix.Oidc.Server.Features.PairwiseIdentifiers.PairwiseSubjectSettings settings); ``` #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.Oidc.Server.Features.ServiceCollectionExtensions.AddPairwiseSubjectIdentifiers(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,Abblix.Oidc.Server.Features.PairwiseIdentifiers.PairwiseSubjectSettings).services} The service collection to register settings into\. ###### `settings` [PairwiseSubjectSettings](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.PairwiseIdentifiers.PairwiseSubjectSettings 'Abblix\.Oidc\.Server\.Features\.PairwiseIdentifiers\.PairwiseSubjectSettings') {#Abblix.Oidc.Server.Features.ServiceCollectionExtensions.AddPairwiseSubjectIdentifiers(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,Abblix.Oidc.Server.Features.PairwiseIdentifiers.PairwiseSubjectSettings).settings} The pairwise subject settings containing the seal key \(salt\) and hash algorithm\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') #### Exceptions [System\.ArgumentException](https://learn.microsoft.com/en-us/dotnet/api/system.argumentexception 'System\.ArgumentException') The salt is missing, not valid base64, or too short\. ### Remarks Judged here as well as by [Salt](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.PairwiseIdentifiers.PairwiseSubjectSettings#Abblix.Oidc.Server.Features.PairwiseIdentifiers.PairwiseSubjectSettings.Salt 'Abblix\.Oidc\.Server\.Features\.PairwiseIdentifiers\.PairwiseSubjectSettings\.Salt'), and the two answer about different instances rather than about one fact twice\. The property covers every instance somebody WRITES \- an object initialiser, a `with` expression \- and it is the only place that can, since the extension registers with `TryAddSingleton` and a host's own instance wins\. It cannot cover an instance the configuration binder BUILDS\. `required` is a compiler rule: the binder constructs the object and then sets only the properties whose keys are present, so an absent `Pairwise:Salt` never enters the accessor and the seal key is null with nothing raised \- measured, not assumed\. Left to reach the container that way, it surfaces as a 500 from the token endpoint the first time a pairwise identifier is minted, which is the failure this check exists to move to startup\. ## ServiceCollectionExtensions\.AddRandomGenerators\(this IServiceCollection\) Method {#Abblix.Oidc.Server.Features.ServiceCollectionExtensions.AddRandomGenerators(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection)} Adds singleton services for generating random client IDs, client secrets, token IDs, and session IDs to the specified [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection')\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection AddRandomGenerators(this Microsoft.Extensions.DependencyInjection.IServiceCollection services); ``` #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.Oidc.Server.Features.ServiceCollectionExtensions.AddRandomGenerators(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).services} #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') ## ServiceCollectionExtensions\.AddRefreshToken\(this IServiceCollection\) Method {#Abblix.Oidc.Server.Features.ServiceCollectionExtensions.AddRefreshToken(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection)} This method adds a service that manages the lifecycle of refresh tokens, including their creation, validation, and revocation\. Refresh tokens are used to obtain new access tokens without requiring the user to re\-authenticate, enhancing the user experience by providing seamless session continuity\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection AddRefreshToken(this Microsoft.Extensions.DependencyInjection.IServiceCollection services); ``` #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.Oidc.Server.Features.ServiceCollectionExtensions.AddRefreshToken(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).services} The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') to configure with token\-related services\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') so that additional calls can be chained\. ## ServiceCollectionExtensions\.AddRequestObject\(this IServiceCollection\) Method {#Abblix.Oidc.Server.Features.ServiceCollectionExtensions.AddRequestObject(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection)} Adds request object fetching capabilities to the dependency injection container\. Registers services required for processing JWT request objects, including their validation and binding to the appropriate request properties\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection AddRequestObject(this Microsoft.Extensions.DependencyInjection.IServiceCollection services); ``` #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.Oidc.Server.Features.ServiceCollectionExtensions.AddRequestObject(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).services} The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') to which the user claims provider services will be added\. This collection is a mechanism for adding and retrieving dependencies in \.NET applications, often used to configure dependency injection in ASP\.NET Core applications\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') The updated [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') after adding the services, allowing for further modifications and additions to be chained\. ## ServiceCollectionExtensions\.AddRevocation\(this IServiceCollection\) Method {#Abblix.Oidc.Server.Features.ServiceCollectionExtensions.AddRevocation(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection)} Opts the server into the OAuth 2\.0 Token Revocation endpoint \(RFC 7009\)\. This single call registers the revocation handler, validator and processor and re\-enables the [Revocation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcEndpoints#Abblix.Oidc.Server.Common.Configuration.OidcEndpoints.Revocation 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcEndpoints\.Revocation') flag, which is off in the default [EnabledEndpoints](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions#Abblix.Oidc.Server.Common.Configuration.OidcOptions.EnabledEndpoints 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions\.EnabledEndpoints')\. This governs only the public `/revoke` endpoint; the internal token\-revocation machinery that refresh\-token rotation, logout and initial\-access\-token invalidation depend on is always registered and is unaffected\. A server that never calls this method exposes no revocation endpoint and does not advertise it in discovery\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection AddRevocation(this Microsoft.Extensions.DependencyInjection.IServiceCollection services); ``` #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.Oidc.Server.Features.ServiceCollectionExtensions.AddRevocation(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).services} The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') to configure\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') The configured [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection')\. ## ServiceCollectionExtensions\.AddSecureHttpFetch\(this IServiceCollection, Action\\) Method {#Abblix.Oidc.Server.Features.ServiceCollectionExtensions.AddSecureHttpFetch(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,System.Action_Abblix.Oidc.Server.Features.SecureHttpFetch.SecureHttpFetchOptions_)} Registers secure HTTP fetching services with SSRF \(Server\-Side Request Forgery\) protection\. This method configures the HTTP client for fetching external content \(such as sector identifier URIs and request URIs\) and decorates it with validation to prevent SSRF attacks\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection AddSecureHttpFetch(this Microsoft.Extensions.DependencyInjection.IServiceCollection services, System.Action? configure=null); ``` #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.Oidc.Server.Features.ServiceCollectionExtensions.AddSecureHttpFetch(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,System.Action_Abblix.Oidc.Server.Features.SecureHttpFetch.SecureHttpFetchOptions_).services} The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') to configure\. ###### `configure` [System\.Action<](https://learn.microsoft.com/en-us/dotnet/api/system.action-1 'System\.Action\`1')[SecureHttpFetchOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.SecureHttpFetch.SecureHttpFetchOptions 'Abblix\.Oidc\.Server\.Features\.SecureHttpFetch\.SecureHttpFetchOptions')[>](https://learn.microsoft.com/en-us/dotnet/api/system.action-1 'System\.Action\`1') {#Abblix.Oidc.Server.Features.ServiceCollectionExtensions.AddSecureHttpFetch(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,System.Action_Abblix.Oidc.Server.Features.SecureHttpFetch.SecureHttpFetchOptions_).configure} Optional configuration action to customize [SecureHttpFetchOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.SecureHttpFetch.SecureHttpFetchOptions 'Abblix\.Oidc\.Server\.Features\.SecureHttpFetch\.SecureHttpFetchOptions')\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') The configured [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection')\. ### Remarks The registered services include: \- A typed HTTP client \([SecureHttpFetcher](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.SecureHttpFetch.SecureHttpFetcher 'Abblix\.Oidc\.Server\.Features\.SecureHttpFetch\.SecureHttpFetcher')\) for making secure HTTP requests \- A custom message handler \([SsrfValidatingHttpMessageHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.SecureHttpFetch.SsrfValidatingHttpMessageHandler 'Abblix\.Oidc\.Server\.Features\.SecureHttpFetch\.SsrfValidatingHttpMessageHandler')\) that provides comprehensive SSRF protection The SSRF protection includes: \- Blocking requests to internal hostnames \(localhost, internal, etc\.\) \- Blocking requests to internal TLDs \(\.local, \.internal, etc\.\) \- DNS resolution and blocking of private/reserved IP address ranges \- Re\-validation of DNS before HTTP request to prevent DNS rebinding attacks \(TOCTOU\) \- HTTP redirect disabling to prevent redirect\-based SSRF bypass \- Response size and timeout limits \(configurable via [SecureHttpFetchOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.SecureHttpFetch.SecureHttpFetchOptions 'Abblix\.Oidc\.Server\.Features\.SecureHttpFetch\.SecureHttpFetchOptions')\) The multi\-layered protection strategy follows OWASP SSRF Prevention guidelines and provides defense\-in\-depth against various SSRF attack vectors including DNS rebinding and redirect\-based bypasses\. ## ServiceCollectionExtensions\.AddSessionManagement\(this IServiceCollection\) Method {#Abblix.Oidc.Server.Features.ServiceCollectionExtensions.AddSessionManagement(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection)} Adds services related to session management and decorates the authorization request processor within the specified [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection')\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection AddSessionManagement(this Microsoft.Extensions.DependencyInjection.IServiceCollection services); ``` #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.Oidc.Server.Features.ServiceCollectionExtensions.AddSessionManagement(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).services} #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') ## ServiceCollectionExtensions\.AddStorages\(this IServiceCollection\) Method {#Abblix.Oidc.Server.Features.ServiceCollectionExtensions.AddStorages(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection)} Registers services for various storage functionalities related to the OAuth 2\.0 and OpenID Connect flows within the application\. This method configures essential storage services that manage authorization codes and authorization requests, ensuring their persistence and accessibility across the application\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection AddStorages(this Microsoft.Extensions.DependencyInjection.IServiceCollection services); ``` #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.Oidc.Server.Features.ServiceCollectionExtensions.AddStorages(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).services} The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') to which the storage services will be added\. This collection is crucial for configuring dependency injection in ASP\.NET Core applications, allowing services to be added, managed, and retrieved throughout the application lifecycle\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') The modified [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') after adding the storage services, permitting additional configurations to be chained\. ## ServiceCollectionExtensions\.AddTokenRevocation\(this IServiceCollection\) Method {#Abblix.Oidc.Server.Features.ServiceCollectionExtensions.AddTokenRevocation(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection)} Decorates the JSON Web Token validator service with a token status validator to support token revocation within the specified [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection')\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection AddTokenRevocation(this Microsoft.Extensions.DependencyInjection.IServiceCollection services); ``` #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.Oidc.Server.Features.ServiceCollectionExtensions.AddTokenRevocation(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).services} The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') to add token revocation support to\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') for chaining further service registrations\. ### Remarks This method enhances the application's security by decorating the [IJsonWebTokenValidator](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.IJsonWebTokenValidator 'Abblix\.Jwt\.IJsonWebTokenValidator') service with [TokenStatusValidatorDecorator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.Revocation.TokenStatusValidatorDecorator 'Abblix\.Oidc\.Server\.Features\.Tokens\.Revocation\.TokenStatusValidatorDecorator')\. This decoration adds the capability to check the revocation status of tokens, allowing the application to reject tokens that have been revoked\. This is crucial for maintaining the integrity and security of the application's authentication system, particularly in response to security incidents or user logout events\. ## ServiceCollectionExtensions\.AddTokenServices\(this IServiceCollection\) Method {#Abblix.Oidc.Server.Features.ServiceCollectionExtensions.AddTokenServices(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection)} Configures token services including token creation, authentication, client\-specific JWT handling, and token revocation within the specified [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection')\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection AddTokenServices(this Microsoft.Extensions.DependencyInjection.IServiceCollection services); ``` #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.Oidc.Server.Features.ServiceCollectionExtensions.AddTokenServices(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).services} The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') to configure with token\-related services\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') so that additional calls can be chained\. ### Remarks This method aggregates the setup of multiple services related to tokens, enhancing the application's security infrastructure by providing comprehensive support for JWT \(JSON Web Tokens\) and token lifecycle management\. It includes the configuration of: \- General token services for managing the creation and validation of tokens\. \- Authentication services that leverage JWT for securing user authentication processes\. \- Client JWT services, tailored for handling JWTs in client\-specific contexts\. \- Token revocation services to facilitate the process of invalidating tokens when necessary, such as during logout or when a security breach is detected\. The integration of these services ensures a robust and scalable approach to handling tokens, which are critical for secure communication and access control within modern web applications\. ## ServiceCollectionExtensions\.AddUserInfo\(this IServiceCollection\) Method {#Abblix.Oidc.Server.Features.ServiceCollectionExtensions.AddUserInfo(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection)} Registers services related to user claims management into the provided [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection')\. This method sets up essential services required for processing and handling user claims based on authentication sessions and authorization requests, facilitating the integration of user\-specific data into tokens or responses\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection AddUserInfo(this Microsoft.Extensions.DependencyInjection.IServiceCollection services); ``` #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.Oidc.Server.Features.ServiceCollectionExtensions.AddUserInfo(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).services} The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') to which the user claims provider services will be added\. This collection is a mechanism for adding and retrieving dependencies in \.NET applications, often used to configure dependency injection in ASP\.NET Core applications\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') The updated [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') after adding the services, allowing for further modifications and additions to be chained\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ## Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication Namespace | Classes | | | :--- | :--- | | [AuthenticationRequestIdGenerator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationRequestIdGenerator 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.AuthenticationRequestIdGenerator') | Generates a unique authentication request ID using a cryptographically secure random number generator\. This ID is encoded for safe use in URLs and is typically used in backchannel authentication flows\. | | [BackChannelAuthenticationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.BackChannelAuthenticationRequest') | Represents a backchannel authentication request as part of the Client\-Initiated Backchannel Authentication \(CIBA\) protocol\. This request facilitates the authentication of users without requiring immediate interaction with their devices, allowing for a more flexible and user\-friendly authentication experience\. | | [BackChannelNotificationTransport](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelNotificationTransport 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.BackChannelNotificationTransport') | The HTTP transport CIBA ping and push notifications travel on, to the endpoint a client registered\. | | [BackChannelRequestStorage](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelRequestStorage 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.BackChannelRequestStorage') | Implements the storage of backchannel authentication requests, allowing for persistence and retrieval of authentication request data in the context of Client\-Initiated Backchannel Authentication \(CIBA\)\. | | [HttpNotificationDeliveryService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.HttpNotificationDeliveryService 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.HttpNotificationDeliveryService') | HTTP\-based implementation of backchannel notification service for CIBA ping and push modes\. Sends HTTP POST notifications to client endpoints with authentication request status updates or token delivery\. | | [InMemoryLongPollingService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.InMemoryLongPollingService 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.InMemoryLongPollingService') | In\-memory implementation of backchannel authentication status notifier using TaskCompletionSource\. Suitable for single\-server deployments or development environments\. | | Enums | | | :--- | :--- | | [BackChannelAuthenticationStatus](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationStatus 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.BackChannelAuthenticationStatus') | Represents the various states of a backchannel authentication request\. This enumeration defines the possible statuses that an authentication request can have, facilitating the management of the authentication process in Client\-Initiated Backchannel Authentication \(CIBA\)\. | --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationRequestIdGenerator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication') ## AuthenticationRequestIdGenerator Class Generates a unique authentication request ID using a cryptographically secure random number generator\. This ID is encoded for safe use in URLs and is typically used in backchannel authentication flows\. ```csharp public class AuthenticationRequestIdGenerator : Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IAuthenticationRequestIdGenerator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → AuthenticationRequestIdGenerator Implements [IAuthenticationRequestIdGenerator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IAuthenticationRequestIdGenerator 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces\.IAuthenticationRequestIdGenerator') ### Constructors ## AuthenticationRequestIdGenerator\(IOptions\\) Constructor {#Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationRequestIdGenerator.AuthenticationRequestIdGenerator(Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_)} Generates a unique authentication request ID using a cryptographically secure random number generator\. This ID is encoded for safe use in URLs and is typically used in backchannel authentication flows\. ```csharp public AuthenticationRequestIdGenerator(Microsoft.Extensions.Options.IOptions options); ``` #### Parameters ###### `options` [Microsoft\.Extensions\.Options\.IOptions<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptions-1 'Microsoft\.Extensions\.Options\.IOptions\`1')[OidcOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptions-1 'Microsoft\.Extensions\.Options\.IOptions\`1') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationRequestIdGenerator.AuthenticationRequestIdGenerator(Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_).options} The configuration options for OIDC, including settings for backchannel authentication\. ### Methods ## AuthenticationRequestIdGenerator\.GenerateAuthenticationRequestId\(\) Method {#Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationRequestIdGenerator.GenerateAuthenticationRequestId()} Generates a unique authentication request ID by creating a cryptographically secure random byte array and encoding it for safe use in URLs\. ```csharp public string GenerateAuthenticationRequestId(); ``` Implements [GenerateAuthenticationRequestId\(\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IAuthenticationRequestIdGenerator#Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IAuthenticationRequestIdGenerator.GenerateAuthenticationRequestId() 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces\.IAuthenticationRequestIdGenerator\.GenerateAuthenticationRequestId\(\)') #### Returns [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') A URL\-safe, base64\-encoded authentication request ID\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication') ## BackChannelAuthenticationRequest Class Represents a backchannel authentication request as part of the Client\-Initiated Backchannel Authentication \(CIBA\) protocol\. This request facilitates the authentication of users without requiring immediate interaction with their devices, allowing for a more flexible and user\-friendly authentication experience\. ```csharp public record BackChannelAuthenticationRequest : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → BackChannelAuthenticationRequest Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[BackChannelAuthenticationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.BackChannelAuthenticationRequest')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Constructors ## BackChannelAuthenticationRequest\(AuthorizedGrant, DateTimeOffset\) Constructor {#Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest.BackChannelAuthenticationRequest(Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant,System.DateTimeOffset)} Represents a backchannel authentication request as part of the Client\-Initiated Backchannel Authentication \(CIBA\) protocol\. This request facilitates the authentication of users without requiring immediate interaction with their devices, allowing for a more flexible and user\-friendly authentication experience\. ```csharp public BackChannelAuthenticationRequest(Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant AuthorizedGrant, System.DateTimeOffset ExpiresAt); ``` #### Parameters ###### `AuthorizedGrant` [AuthorizedGrant](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.AuthorizedGrant') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest.BackChannelAuthenticationRequest(Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant,System.DateTimeOffset).AuthorizedGrant} The authorized grant associated with this authentication request, containing details about the user's authorization context\. ###### `ExpiresAt` [System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest.BackChannelAuthenticationRequest(Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant,System.DateTimeOffset).ExpiresAt} The absolute time when this backchannel authentication request expires\. ### Properties ## BackChannelAuthenticationRequest\.AuthorizedGrant Property {#Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest.AuthorizedGrant} The authorized grant associated with this authentication request, containing details about the user's authorization context\. ```csharp public Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant AuthorizedGrant { get; init; } ``` #### Property Value [AuthorizedGrant](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.AuthorizedGrant') ## BackChannelAuthenticationRequest\.ClientNotificationEndpoint Property {#Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest.ClientNotificationEndpoint} The client notification endpoint for ping mode\. Populated from client configuration when ping mode is used\. ```csharp public System.Uri? ClientNotificationEndpoint { get; set; } ``` #### Property Value [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri') ## BackChannelAuthenticationRequest\.ClientNotificationToken Property {#Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest.ClientNotificationToken} The client notification token for ping mode\. Provided by the client in the authentication request for secure notification delivery\. ```csharp public string? ClientNotificationToken { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## BackChannelAuthenticationRequest\.ExpiresAt Property {#Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest.ExpiresAt} The absolute time when this backchannel authentication request expires\. ```csharp public System.DateTimeOffset ExpiresAt { get; init; } ``` #### Property Value [System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset') ## BackChannelAuthenticationRequest\.NextPollAt Property {#Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest.NextPollAt} Specifies the next time the client should poll for updates regarding the authentication request\. This helps manage the timing of polling requests efficiently\. ```csharp public System.Nullable NextPollAt { get; set; } ``` #### Property Value [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') ## BackChannelAuthenticationRequest\.RequestedAuthorizationDetails Property {#Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest.RequestedAuthorizationDetails} The RFC 9396 `authorization_details` the client asked for, as the request\-time validators left them\. EMPTY when the request carried none; `null` only on a request stored before this field existed, which is why the two are not the same answer\. ```csharp public System.Text.Json.Nodes.JsonArray? RequestedAuthorizationDetails { get; set; } ``` #### Property Value [System\.Text\.Json\.Nodes\.JsonArray](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonarray 'System\.Text\.Json\.Nodes\.JsonArray') ### Remarks Kept apart from the array on [AuthorizedGrant](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest#Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest.AuthorizedGrant 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.BackChannelAuthenticationRequest\.AuthorizedGrant'), which is what will be issued\. The two are the same until the end user answers: a host whose device UI let them approve part of the request replaces the grant's context before completing, and this is what that answer is judged against\. Recorded rather than derived, for the reason [RequestedSubjects](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest#Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest.RequestedSubjects 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.BackChannelAuthenticationRequest\.RequestedSubjects') is: in a decoupled flow the answer arrives long after the request, through [CompleteAsync\(string, BackChannelAuthenticationRequest, TimeSpan\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IAuthenticationCompletionHandler#Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IAuthenticationCompletionHandler.CompleteAsync(string,Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest,System.TimeSpan) 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces\.IAuthenticationCompletionHandler\.CompleteAsync\(string, Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.BackChannelAuthenticationRequest, System\.TimeSpan\)'), and by then the only copy of what was asked for would be the one the host has just overwritten. ## BackChannelAuthenticationRequest\.RequestedSubjects Property {#Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest.RequestedSubjects} The end users the request will accept, spelled as the requesting client sees them, or `null` when it named nobody in particular\. An empty array accepts nobody\. ```csharp public string[]? RequestedSubjects { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') ### Remarks Recorded here rather than compared once and discarded, because in a decoupled flow the end user authenticates long after the request was made: the session that answers it arrives through [CompleteAsync\(string, BackChannelAuthenticationRequest, TimeSpan\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IAuthenticationCompletionHandler#Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IAuthenticationCompletionHandler.CompleteAsync(string,Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest,System.TimeSpan) 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces\.IAuthenticationCompletionHandler\.CompleteAsync\(string, Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.BackChannelAuthenticationRequest, System\.TimeSpan\)'), and OpenID Connect Core 1\.0 Section 3\.1\.2\.2 forbids answering for anyone else\. Without this the comparison would have nothing left to compare against by the time there is a session to judge\. A set rather than a name, because the two parameters that can name an end user do not agree on the shape: an `id_token_hint` names one, and a `claims` request may list several it would accept. Section 3.1.2.2 puts both under a single requirement, so both land here. ## BackChannelAuthenticationRequest\.Status Property {#Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest.Status} Indicates the current status of the backchannel authentication request\. Defaults to Pending, reflecting that the request has not yet been resolved\. ```csharp public Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationStatus Status { get; set; } ``` #### Property Value [BackChannelAuthenticationStatus](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationStatus 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.BackChannelAuthenticationStatus') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationStatus.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication') ## BackChannelAuthenticationStatus Enum Represents the various states of a backchannel authentication request\. This enumeration defines the possible statuses that an authentication request can have, facilitating the management of the authentication process in Client\-Initiated Backchannel Authentication \(CIBA\)\. ```csharp public enum BackChannelAuthenticationStatus ``` ### Fields ###### `Pending` 0 {#Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationStatus.Pending} Indicates that the authentication request is pending and has not yet been processed\. ###### `Denied` 1 {#Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationStatus.Denied} Indicates that the authentication request has been denied, either by the user or the system\. ###### `Authenticated` 2 {#Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationStatus.Authenticated} Indicates that the authentication request has been successfully authenticated\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelNotificationTransport.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication') ## BackChannelNotificationTransport Class The HTTP transport CIBA ping and push notifications travel on, to the endpoint a client registered\. ```csharp public static class BackChannelNotificationTransport ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → BackChannelNotificationTransport ### Fields ## BackChannelNotificationTransport\.HttpClientName Field {#Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelNotificationTransport.HttpClientName} The name the transport's client is registered under, published so a host can configure it without copying the string: `services.AddHttpClient(BackChannelNotificationTransport.HttpClientName)` reaches the same client the delivery service resolves, and whatever it chains \- a resilience pipeline, a proxy \- applies to every notification\. ```csharp public const string HttpClientName = "HttpNotificationDeliveryService"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks Whatever a host chains runs OUTSIDE the SSRF validation, because that validation is the client's primary handler and therefore the innermost one\. So every attempt a resilience pipeline makes is validated afresh \- which is what the address of a client\-supplied endpoint requires, since it can start resolving to an internal one between attempts \- and no ordering of the host's own calls can move the check out of the way\. The value is the delivery service's type name because that is what shipped, and a host already configuring the client spells it literally. Changing it would break such a host in the one way nothing reports: the configuration would bind to a client no longer resolved, leaving the build green and the pipeline gone. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelRequestStorage.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication') ## BackChannelRequestStorage Class Implements the storage of backchannel authentication requests, allowing for persistence and retrieval of authentication request data in the context of Client\-Initiated Backchannel Authentication \(CIBA\)\. ```csharp public class BackChannelRequestStorage : Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → BackChannelRequestStorage Implements [IBackChannelRequestStorage](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces\.IBackChannelRequestStorage') ### Constructors ## BackChannelRequestStorage\(IEntityStorage, IAuthenticationRequestIdGenerator, IEntityStorageKeyFactory\) Constructor {#Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelRequestStorage.BackChannelRequestStorage(Abblix.Oidc.Server.Features.Storages.IEntityStorage,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IAuthenticationRequestIdGenerator,Abblix.Oidc.Server.Features.Storages.IEntityStorageKeyFactory)} Implements the storage of backchannel authentication requests, allowing for persistence and retrieval of authentication request data in the context of Client\-Initiated Backchannel Authentication \(CIBA\)\. ```csharp public BackChannelRequestStorage(Abblix.Oidc.Server.Features.Storages.IEntityStorage storage, Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IAuthenticationRequestIdGenerator authenticationRequestIdGenerator, Abblix.Oidc.Server.Features.Storages.IEntityStorageKeyFactory keyFactory); ``` #### Parameters ###### `storage` [IEntityStorage](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Storages.IEntityStorage 'Abblix\.Oidc\.Server\.Features\.Storages\.IEntityStorage') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelRequestStorage.BackChannelRequestStorage(Abblix.Oidc.Server.Features.Storages.IEntityStorage,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IAuthenticationRequestIdGenerator,Abblix.Oidc.Server.Features.Storages.IEntityStorageKeyFactory).storage} The storage system used for persisting authentication requests\. ###### `authenticationRequestIdGenerator` [IAuthenticationRequestIdGenerator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IAuthenticationRequestIdGenerator 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces\.IAuthenticationRequestIdGenerator') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelRequestStorage.BackChannelRequestStorage(Abblix.Oidc.Server.Features.Storages.IEntityStorage,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IAuthenticationRequestIdGenerator,Abblix.Oidc.Server.Features.Storages.IEntityStorageKeyFactory).authenticationRequestIdGenerator} Generator for creating unique authentication request IDs\. ###### `keyFactory` [IEntityStorageKeyFactory](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Storages.IEntityStorageKeyFactory 'Abblix\.Oidc\.Server\.Features\.Storages\.IEntityStorageKeyFactory') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelRequestStorage.BackChannelRequestStorage(Abblix.Oidc.Server.Features.Storages.IEntityStorage,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IAuthenticationRequestIdGenerator,Abblix.Oidc.Server.Features.Storages.IEntityStorageKeyFactory).keyFactory} The factory for generating standardized storage keys\. ### Methods ## BackChannelRequestStorage\.StoreAsync\(BackChannelAuthenticationRequest, TimeSpan\) Method {#Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelRequestStorage.StoreAsync(Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest,System.TimeSpan)} Asynchronously stores a backchannel authentication request and generates a unique identifier for it\. This method also sets an expiration duration for the stored request\. ```csharp public System.Threading.Tasks.Task StoreAsync(Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest authenticationRequest, System.TimeSpan expiresIn); ``` #### Parameters ###### `authenticationRequest` [BackChannelAuthenticationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.BackChannelAuthenticationRequest') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelRequestStorage.StoreAsync(Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest,System.TimeSpan).authenticationRequest} The backchannel authentication request to store\. ###### `expiresIn` [System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelRequestStorage.StoreAsync(Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest,System.TimeSpan).expiresIn} The duration after which the stored request will expire\. Implements [StoreAsync\(BackChannelAuthenticationRequest, TimeSpan\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage#Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage.StoreAsync(Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest,System.TimeSpan) 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces\.IBackChannelRequestStorage\.StoreAsync\(Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.BackChannelAuthenticationRequest, System\.TimeSpan\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task that returns the unique ID of the stored authentication request\. ## BackChannelRequestStorage\.TryGetAsync\(string\) Method {#Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelRequestStorage.TryGetAsync(string)} Tries to retrieve a backchannel authentication request by its unique identifier\. ```csharp public System.Threading.Tasks.Task TryGetAsync(string authenticationRequestId); ``` #### Parameters ###### `authenticationRequestId` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelRequestStorage.TryGetAsync(string).authenticationRequestId} The unique identifier of the authentication request to retrieve\. Implements [TryGetAsync\(string\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage#Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage.TryGetAsync(string) 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces\.IBackChannelRequestStorage\.TryGetAsync\(string\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[BackChannelAuthenticationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.BackChannelAuthenticationRequest')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task that returns the authentication request if found; otherwise, null\. ## BackChannelRequestStorage\.TryRemoveAsync\(string\) Method {#Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelRequestStorage.TryRemoveAsync(string)} Retrieves and removes a backchannel authentication request from storage, through the store's claim protocol\. The claim is what keeps two polls from both being told they took the same request; the per\-key gate around the removal is what keeps a contended key from ending with NEITHER of them told\. The value is read under that same hold, so a poll is handed the bytes the removal took rather than the ones it read on its way in\. That is the whole of what the hold buys, and it is narrower than "no write is lost". Only the read and the removal are inside it: [UpdateAsync\(string, BackChannelAuthenticationRequest, TimeSpan\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelRequestStorage#Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelRequestStorage.UpdateAsync(string,Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest,System.TimeSpan) 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.BackChannelRequestStorage\.UpdateAsync\(string, Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.BackChannelAuthenticationRequest, System\.TimeSpan\)') is a plain set on this key and takes no gate, so a write from the CIBA grant handler's next-poll bump can still land after the in-gate read and be destroyed by the removal without ever being seen - which that handler's own remarks already treat as an ordinary race. Closing THAT needs the writers to take the gate too, not a wider claim here. ```csharp public System.Threading.Tasks.Task TryRemoveAsync(string authenticationRequestId); ``` #### Parameters ###### `authenticationRequestId` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelRequestStorage.TryRemoveAsync(string).authenticationRequestId} The unique identifier of the authentication request to remove\. Implements [TryRemoveAsync\(string\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage#Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage.TryRemoveAsync(string) 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces\.IBackChannelRequestStorage\.TryRemoveAsync\(string\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[BackChannelAuthenticationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.BackChannelAuthenticationRequest')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task that returns the authentication request when this caller removed it and still held its own claim afterwards\. Null otherwise, and that covers more than a competitor: the request not being there, and a claim that expired while a store call was in flight \- the second on one caller with nobody to lose to, its outcome being the request gone with nobody able to be told they took it\. A store call that fails after the removal raises instead of answering\. ## BackChannelRequestStorage\.UpdateAsync\(string, BackChannelAuthenticationRequest, TimeSpan\) Method {#Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelRequestStorage.UpdateAsync(string,Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest,System.TimeSpan)} Updates an existing backchannel authentication request in storage\. Used in ping mode to update request status when user completes authentication\. ```csharp public System.Threading.Tasks.Task UpdateAsync(string requestId, Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest request, System.TimeSpan expiresIn); ``` #### Parameters ###### `requestId` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelRequestStorage.UpdateAsync(string,Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest,System.TimeSpan).requestId} The unique identifier of the authentication request to update\. ###### `request` [BackChannelAuthenticationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.BackChannelAuthenticationRequest') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelRequestStorage.UpdateAsync(string,Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest,System.TimeSpan).request} The updated authentication request data\. ###### `expiresIn` [System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelRequestStorage.UpdateAsync(string,Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest,System.TimeSpan).expiresIn} The duration after which the request expires\. Implements [UpdateAsync\(string, BackChannelAuthenticationRequest, TimeSpan\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage#Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage.UpdateAsync(string,Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest,System.TimeSpan) 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces\.IBackChannelRequestStorage\.UpdateAsync\(string, Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.BackChannelAuthenticationRequest, System\.TimeSpan\)') #### Returns [System\.Threading\.Tasks\.Task](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task 'System\.Threading\.Tasks\.Task') A task that completes when the request is updated in storage\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.HttpNotificationDeliveryService.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication') ## HttpNotificationDeliveryService Class HTTP\-based implementation of backchannel notification service for CIBA ping and push modes\. Sends HTTP POST notifications to client endpoints with authentication request status updates or token delivery\. ```csharp public class HttpNotificationDeliveryService : Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.INotificationDeliveryService ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → HttpNotificationDeliveryService Implements [INotificationDeliveryService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.INotificationDeliveryService 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces\.INotificationDeliveryService') ### Remarks Delivery is a single attempt, deliberately: a notification is best\-effort, and what a failed one costs is the client waiting out its own timeout rather than a lost protocol state\. A deployment that wants more configures the named client \- see [HttpClientName](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelNotificationTransport#Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelNotificationTransport.HttpClientName 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.BackChannelNotificationTransport\.HttpClientName') \- and gets retries without this type holding any state\. ### Constructors ## HttpNotificationDeliveryService\(ILogger\, IHttpClientFactory\) Constructor {#Abblix.Oidc.Server.Features.BackChannelAuthentication.HttpNotificationDeliveryService.HttpNotificationDeliveryService(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.BackChannelAuthentication.HttpNotificationDeliveryService_,System.Net.Http.IHttpClientFactory)} HTTP\-based implementation of backchannel notification service for CIBA ping and push modes\. Sends HTTP POST notifications to client endpoints with authentication request status updates or token delivery\. ```csharp public HttpNotificationDeliveryService(Microsoft.Extensions.Logging.ILogger logger, System.Net.Http.IHttpClientFactory httpClientFactory); ``` #### Parameters ###### `logger` [Microsoft\.Extensions\.Logging\.ILogger<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1')[HttpNotificationDeliveryService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.HttpNotificationDeliveryService 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.HttpNotificationDeliveryService')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.HttpNotificationDeliveryService.HttpNotificationDeliveryService(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.BackChannelAuthentication.HttpNotificationDeliveryService_,System.Net.Http.IHttpClientFactory).logger} Logger for tracking notification attempts and failures\. ###### `httpClientFactory` [System\.Net\.Http\.IHttpClientFactory](https://learn.microsoft.com/en-us/dotnet/api/system.net.http.ihttpclientfactory 'System\.Net\.Http\.IHttpClientFactory') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.HttpNotificationDeliveryService.HttpNotificationDeliveryService(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.BackChannelAuthentication.HttpNotificationDeliveryService_,System.Net.Http.IHttpClientFactory).httpClientFactory} Factory for creating HTTP clients\. ### Remarks Delivery is a single attempt, deliberately: a notification is best\-effort, and what a failed one costs is the client waiting out its own timeout rather than a lost protocol state\. A deployment that wants more configures the named client \- see [HttpClientName](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelNotificationTransport#Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelNotificationTransport.HttpClientName 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.BackChannelNotificationTransport\.HttpClientName') \- and gets retries without this type holding any state\. ### Methods ## HttpNotificationDeliveryService\.SendAsync\(Uri, string, IBackChannelNotificationRequest, string\) Method {#Abblix.Oidc.Server.Features.BackChannelAuthentication.HttpNotificationDeliveryService.SendAsync(System.Uri,string,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelNotificationRequest,string)} Sends an HTTP POST notification to the client's registered endpoint\. ```csharp public System.Threading.Tasks.Task SendAsync(System.Uri clientNotificationEndpoint, string clientNotificationToken, Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelNotificationRequest payload, string mode); ``` #### Parameters ###### `clientNotificationEndpoint` [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.HttpNotificationDeliveryService.SendAsync(System.Uri,string,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelNotificationRequest,string).clientNotificationEndpoint} The client's registered notification endpoint URL\. ###### `clientNotificationToken` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.HttpNotificationDeliveryService.SendAsync(System.Uri,string,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelNotificationRequest,string).clientNotificationToken} Bearer token for authenticating the notification request\. ###### `payload` [IBackChannelNotificationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelNotificationRequest 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces\.IBackChannelNotificationRequest') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.HttpNotificationDeliveryService.SendAsync(System.Uri,string,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelNotificationRequest,string).payload} The notification payload to send\. ###### `mode` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.HttpNotificationDeliveryService.SendAsync(System.Uri,string,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelNotificationRequest,string).mode} The CIBA mode \(ping or push\) for logging purposes\. Implements [SendAsync\(Uri, string, IBackChannelNotificationRequest, string\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.INotificationDeliveryService#Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.INotificationDeliveryService.SendAsync(System.Uri,string,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelNotificationRequest,string) 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces\.INotificationDeliveryService\.SendAsync\(System\.Uri, string, Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces\.IBackChannelNotificationRequest, string\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') `true` if the endpoint returned a success status; otherwise `false`\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.InMemoryLongPollingService.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication') ## InMemoryLongPollingService Class In\-memory implementation of backchannel authentication status notifier using TaskCompletionSource\. Suitable for single\-server deployments or development environments\. ```csharp public class InMemoryLongPollingService : Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelLongPollingService ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → InMemoryLongPollingService Implements [IBackChannelLongPollingService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelLongPollingService 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces\.IBackChannelLongPollingService') ### Remarks This implementation uses an in-memory dictionary of TaskCompletionSource objects to coordinate between authentication completion and waiting token requests. When authentication status changes, all waiting tasks are signaled via TaskCompletionSource.SetResult(). Characteristics: - Thread-safe using ConcurrentDictionary - Automatic cleanup of completed waiters - Supports multiple simultaneous waiters per auth_req_id - Memory efficient (only stores active waiters) - NOT suitable for multi-server deployments (notifications are local only) For Multi-Server Deployments: Use a distributed implementation based on Redis Pub/Sub, SignalR backplane, or message queue. ### Constructors ## InMemoryLongPollingService\(ILogger\\) Constructor {#Abblix.Oidc.Server.Features.BackChannelAuthentication.InMemoryLongPollingService.InMemoryLongPollingService(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.BackChannelAuthentication.InMemoryLongPollingService_)} In\-memory implementation of backchannel authentication status notifier using TaskCompletionSource\. Suitable for single\-server deployments or development environments\. ```csharp public InMemoryLongPollingService(Microsoft.Extensions.Logging.ILogger logger); ``` #### Parameters ###### `logger` [Microsoft\.Extensions\.Logging\.ILogger<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1')[InMemoryLongPollingService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.InMemoryLongPollingService 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.InMemoryLongPollingService')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.InMemoryLongPollingService.InMemoryLongPollingService(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.BackChannelAuthentication.InMemoryLongPollingService_).logger} ### Remarks This implementation uses an in-memory dictionary of TaskCompletionSource objects to coordinate between authentication completion and waiting token requests. When authentication status changes, all waiting tasks are signaled via TaskCompletionSource.SetResult(). Characteristics: - Thread-safe using ConcurrentDictionary - Automatic cleanup of completed waiters - Supports multiple simultaneous waiters per auth_req_id - Memory efficient (only stores active waiters) - NOT suitable for multi-server deployments (notifications are local only) For Multi-Server Deployments: Use a distributed implementation based on Redis Pub/Sub, SignalR backplane, or message queue. ### Methods ## InMemoryLongPollingService\.NotifyStatusChangeAsync\(string, BackChannelAuthenticationStatus\) Method {#Abblix.Oidc.Server.Features.BackChannelAuthentication.InMemoryLongPollingService.NotifyStatusChangeAsync(string,Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationStatus)} Notifies all waiting requests that the authentication status has changed\. Signals all TaskCompletionSource objects waiting for this auth\_req\_id\. ```csharp public System.Threading.Tasks.Task NotifyStatusChangeAsync(string authenticationRequestId, Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationStatus newStatus); ``` #### Parameters ###### `authenticationRequestId` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.InMemoryLongPollingService.NotifyStatusChangeAsync(string,Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationStatus).authenticationRequestId} ###### `newStatus` [BackChannelAuthenticationStatus](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationStatus 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.BackChannelAuthenticationStatus') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.InMemoryLongPollingService.NotifyStatusChangeAsync(string,Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationStatus).newStatus} Implements [NotifyStatusChangeAsync\(string, BackChannelAuthenticationStatus\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelLongPollingService#Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelLongPollingService.NotifyStatusChangeAsync(string,Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationStatus) 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces\.IBackChannelLongPollingService\.NotifyStatusChangeAsync\(string, Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.BackChannelAuthenticationStatus\)') #### Returns [System\.Threading\.Tasks\.Task](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task 'System\.Threading\.Tasks\.Task') ## InMemoryLongPollingService\.WaitForStatusChangeAsync\(string, TimeSpan, CancellationToken\) Method {#Abblix.Oidc.Server.Features.BackChannelAuthentication.InMemoryLongPollingService.WaitForStatusChangeAsync(string,System.TimeSpan,System.Threading.CancellationToken)} Waits for a status change notification for the specified authentication request\. Uses TaskCompletionSource to efficiently wait without blocking threads\. ```csharp public System.Threading.Tasks.Task WaitForStatusChangeAsync(string authenticationRequestId, System.TimeSpan timeout, System.Threading.CancellationToken cancellationToken=default(System.Threading.CancellationToken)); ``` #### Parameters ###### `authenticationRequestId` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.InMemoryLongPollingService.WaitForStatusChangeAsync(string,System.TimeSpan,System.Threading.CancellationToken).authenticationRequestId} ###### `timeout` [System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.InMemoryLongPollingService.WaitForStatusChangeAsync(string,System.TimeSpan,System.Threading.CancellationToken).timeout} ###### `cancellationToken` [System\.Threading\.CancellationToken](https://learn.microsoft.com/en-us/dotnet/api/system.threading.cancellationtoken 'System\.Threading\.CancellationToken') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.InMemoryLongPollingService.WaitForStatusChangeAsync(string,System.TimeSpan,System.Threading.CancellationToken).cancellationToken} Implements [WaitForStatusChangeAsync\(string, TimeSpan, CancellationToken\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelLongPollingService#Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelLongPollingService.WaitForStatusChangeAsync(string,System.TimeSpan,System.Threading.CancellationToken) 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces\.IBackChannelLongPollingService\.WaitForStatusChangeAsync\(string, System\.TimeSpan, System\.Threading\.CancellationToken\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ## Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.AuthenticationNotifiers Namespace | Classes | | | :--- | :--- | | [AuthenticationCompletionHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.AuthenticationCompletionHandler 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.AuthenticationNotifiers\.AuthenticationCompletionHandler') | Abstract base class for CIBA authentication completion handlers\. Provides common functionality for validation, status management, and delivery orchestration\. Derived classes implement specific token delivery modes \(poll, ping, push\) per CIBA specification\. | | [AuthenticationCompletionRouter](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.AuthenticationCompletionRouter 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.AuthenticationNotifiers\.AuthenticationCompletionRouter') | Routes CIBA authentication completion to the appropriate mode\-specific handler \(PollModeCompletionHandler, PingModeCompletionHandler, or PushModeCompletionHandler\) based on the client's configured backchannel\_token\_delivery\_mode\. | | [PingModeCompletionHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.PingModeCompletionHandler 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.AuthenticationNotifiers\.PingModeCompletionHandler') | Handles CIBA ping mode token delivery where the client receives a notification that authentication is complete and can then retrieve tokens from the token endpoint\. In ping mode, the authenticated request is stored and a notification is sent to the client's registered endpoint\. | | [PollModeCompletionHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.PollModeCompletionHandler 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.AuthenticationNotifiers\.PollModeCompletionHandler') | Handles CIBA poll mode token delivery where the client periodically polls the token endpoint to retrieve tokens\. In poll mode, the authenticated request is stored and remains available until the client retrieves it or it expires\. Supports optional long\-polling to reduce polling frequency and improve efficiency\. | | [PushModeCompletionHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.PushModeCompletionHandler 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.AuthenticationNotifiers\.PushModeCompletionHandler') | Handles CIBA push mode token delivery where tokens are sent directly to the client's notification endpoint immediately upon authentication completion\. In push mode, tokens are generated, delivered via HTTP POST, and the request is removed from storage \- except when the delivery itself fails, which is the one outcome that leaves the record behind\. | --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.AuthenticationCompletionHandler.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.AuthenticationNotifiers](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.AuthenticationNotifiers') ## AuthenticationCompletionHandler Class Abstract base class for CIBA authentication completion handlers\. Provides common functionality for validation, status management, and delivery orchestration\. Derived classes implement specific token delivery modes \(poll, ping, push\) per CIBA specification\. ```csharp public abstract class AuthenticationCompletionHandler ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → AuthenticationCompletionHandler Derived ↳ [PingModeCompletionHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.PingModeCompletionHandler 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.AuthenticationNotifiers\.PingModeCompletionHandler') ↳ [PollModeCompletionHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.PollModeCompletionHandler 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.AuthenticationNotifiers\.PollModeCompletionHandler') ↳ [PushModeCompletionHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.PushModeCompletionHandler 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.AuthenticationNotifiers\.PushModeCompletionHandler') ### Remarks Do not add a converter\-less constructor overload for the convenience of a derived class: it would compile and silently lose the comparison in [CompleteAuthenticationAsync\(string, BackChannelAuthenticationRequest, ClientInfo, TimeSpan\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.AuthenticationCompletionHandler#Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.AuthenticationCompletionHandler.CompleteAuthenticationAsync(string,Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.TimeSpan) 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.AuthenticationNotifiers\.AuthenticationCompletionHandler\.CompleteAuthenticationAsync\(string, Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.BackChannelAuthenticationRequest, Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo, System\.TimeSpan\)'), which is what keeps a request from being answered for an end user it did not name\. ### Methods ## AuthenticationCompletionHandler\.CompleteAuthenticationAsync\(string, BackChannelAuthenticationRequest, ClientInfo, TimeSpan\) Method {#Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.AuthenticationCompletionHandler.CompleteAuthenticationAsync(string,Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.TimeSpan)} Completes the authentication process by marking the request as authenticated and delegating to the mode\-specific delivery implementation\. ```csharp public System.Threading.Tasks.Task CompleteAuthenticationAsync(string authenticationRequestId, Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest request, Abblix.Oidc.Server.Features.ClientInformation.ClientInfo clientInfo, System.TimeSpan expiresIn); ``` #### Parameters ###### `authenticationRequestId` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.AuthenticationCompletionHandler.CompleteAuthenticationAsync(string,Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.TimeSpan).authenticationRequestId} The auth\_req\_id identifying the authentication request\. ###### `request` [BackChannelAuthenticationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.BackChannelAuthenticationRequest') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.AuthenticationCompletionHandler.CompleteAuthenticationAsync(string,Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.TimeSpan).request} The authentication request carrying the grant the end user approved\. Its own Status is not read: whether this request may still be answered is decided from the STORED record, so a caller cannot make the decision by setting a field on its own copy\. ###### `clientInfo` [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.AuthenticationCompletionHandler.CompleteAuthenticationAsync(string,Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.TimeSpan).clientInfo} Client information including delivery mode configuration\. ###### `expiresIn` [System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.AuthenticationCompletionHandler.CompleteAuthenticationAsync(string,Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,System.TimeSpan).expiresIn} How long the authenticated request remains valid\. #### Returns [System\.Threading\.Tasks\.Task](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task 'System\.Threading\.Tasks\.Task') A task representing the asynchronous authentication completion operation\. #### Exceptions [System\.InvalidOperationException](https://learn.microsoft.com/en-us/dotnet/api/system.invalidoperationexception 'System\.InvalidOperationException') The store does not hold a PENDING record under this identifier\. The full statement of the condition, and why it is stated that way rather than as a list of causes, is on [CompleteAsync\(string, BackChannelAuthenticationRequest, TimeSpan\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IAuthenticationCompletionHandler#Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IAuthenticationCompletionHandler.CompleteAsync(string,Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest,System.TimeSpan) 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces\.IAuthenticationCompletionHandler\.CompleteAsync\(string, Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.BackChannelAuthenticationRequest, System\.TimeSpan\)')\. ### Remarks This method: - Refuses unless the STORED record reads Pending - Refuses an answer from somebody other than the end user the request named, by denying or removing according to the mode - Sets the request status to Authenticated - Delegates to HandleDeliveryAsync for mode-specific token delivery (poll/ping/push) Called by AuthenticationCompletionRouter after determining the appropriate delivery mode handler\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.AuthenticationCompletionRouter.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.AuthenticationNotifiers](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.AuthenticationNotifiers') ## AuthenticationCompletionRouter Class Routes CIBA authentication completion to the appropriate mode\-specific handler \(PollModeCompletionHandler, PingModeCompletionHandler, or PushModeCompletionHandler\) based on the client's configured backchannel\_token\_delivery\_mode\. ```csharp public class AuthenticationCompletionRouter : Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IAuthenticationCompletionHandler ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → AuthenticationCompletionRouter Implements [IAuthenticationCompletionHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IAuthenticationCompletionHandler 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces\.IAuthenticationCompletionHandler') ### Constructors ## AuthenticationCompletionRouter\(ILogger\, IClientInfoProvider, IServiceProvider\) Constructor {#Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.AuthenticationCompletionRouter.AuthenticationCompletionRouter(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.AuthenticationCompletionRouter_,Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider,System.IServiceProvider)} Routes CIBA authentication completion to the appropriate mode\-specific handler \(PollModeCompletionHandler, PingModeCompletionHandler, or PushModeCompletionHandler\) based on the client's configured backchannel\_token\_delivery\_mode\. ```csharp public AuthenticationCompletionRouter(Microsoft.Extensions.Logging.ILogger logger, Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider clientInfoProvider, System.IServiceProvider serviceProvider); ``` #### Parameters ###### `logger` [Microsoft\.Extensions\.Logging\.ILogger<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1')[AuthenticationCompletionRouter](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.AuthenticationCompletionRouter 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.AuthenticationNotifiers\.AuthenticationCompletionRouter')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.AuthenticationCompletionRouter.AuthenticationCompletionRouter(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.AuthenticationCompletionRouter_,Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider,System.IServiceProvider).logger} Logger for tracking completion events\. ###### `clientInfoProvider` [IClientInfoProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.IClientInfoProvider') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.AuthenticationCompletionRouter.AuthenticationCompletionRouter(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.AuthenticationCompletionRouter_,Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider,System.IServiceProvider).clientInfoProvider} Provider for retrieving client information\. ###### `serviceProvider` [System\.IServiceProvider](https://learn.microsoft.com/en-us/dotnet/api/system.iserviceprovider 'System\.IServiceProvider') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.AuthenticationCompletionRouter.AuthenticationCompletionRouter(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.AuthenticationCompletionRouter_,Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider,System.IServiceProvider).serviceProvider} Service provider for resolving mode\-specific handlers using keyed services\. ### Properties ## AuthenticationCompletionRouter\.TokenDeliveryModesSupported Property {#Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.AuthenticationCompletionRouter.TokenDeliveryModesSupported} Gets the list of supported token delivery modes by checking which handlers are registered in DI\. This ensures the discovery document accurately reflects available functionality\. ```csharp public System.Collections.Generic.IEnumerable TokenDeliveryModesSupported { get; } ``` Implements [TokenDeliveryModesSupported](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IAuthenticationCompletionHandler#Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IAuthenticationCompletionHandler.TokenDeliveryModesSupported 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces\.IAuthenticationCompletionHandler\.TokenDeliveryModesSupported') #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ### Methods ## AuthenticationCompletionRouter\.CompleteAsync\(string, BackChannelAuthenticationRequest, TimeSpan\) Method {#Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.AuthenticationCompletionRouter.CompleteAsync(string,Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest,System.TimeSpan)} Completes the authentication process and handles token delivery based on the client's configured delivery mode\. Automatically selects the appropriate handler implementation\. ```csharp public System.Threading.Tasks.Task CompleteAsync(string authenticationRequestId, Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest request, System.TimeSpan expiresIn); ``` #### Parameters ###### `authenticationRequestId` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.AuthenticationCompletionRouter.CompleteAsync(string,Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest,System.TimeSpan).authenticationRequestId} The auth\_req\_id to complete\. ###### `request` [BackChannelAuthenticationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.BackChannelAuthenticationRequest') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.AuthenticationCompletionRouter.CompleteAsync(string,Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest,System.TimeSpan).request} The authentication request to mark as completed\. ###### `expiresIn` [System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.AuthenticationCompletionRouter.CompleteAsync(string,Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest,System.TimeSpan).expiresIn} How long the authenticated request remains valid for token retrieval\. Implements [CompleteAsync\(string, BackChannelAuthenticationRequest, TimeSpan\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IAuthenticationCompletionHandler#Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IAuthenticationCompletionHandler.CompleteAsync(string,Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest,System.TimeSpan) 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces\.IAuthenticationCompletionHandler\.CompleteAsync\(string, Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.BackChannelAuthenticationRequest, System\.TimeSpan\)') #### Returns [System\.Threading\.Tasks\.Task](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task 'System\.Threading\.Tasks\.Task') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.PingModeCompletionHandler.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.AuthenticationNotifiers](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.AuthenticationNotifiers') ## PingModeCompletionHandler Class Handles CIBA ping mode token delivery where the client receives a notification that authentication is complete and can then retrieve tokens from the token endpoint\. In ping mode, the authenticated request is stored and a notification is sent to the client's registered endpoint\. ```csharp public class PingModeCompletionHandler : Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.AuthenticationCompletionHandler ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [AuthenticationCompletionHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.AuthenticationCompletionHandler 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.AuthenticationNotifiers\.AuthenticationCompletionHandler') → PingModeCompletionHandler ### Constructors ## PingModeCompletionHandler\(ILogger\, IBackChannelRequestStorage, ISubjectTypeConverter, INotificationDeliveryService, IBackChannelLongPollingService\) Constructor {#Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.PingModeCompletionHandler.PingModeCompletionHandler(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.PingModeCompletionHandler_,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage,Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.INotificationDeliveryService,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelLongPollingService)} Handles CIBA ping mode token delivery where the client receives a notification that authentication is complete and can then retrieve tokens from the token endpoint\. In ping mode, the authenticated request is stored and a notification is sent to the client's registered endpoint\. ```csharp public PingModeCompletionHandler(Microsoft.Extensions.Logging.ILogger logger, Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage storage, Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter subjectTypeConverter, Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.INotificationDeliveryService notificationService, Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelLongPollingService? statusNotifier=null); ``` #### Parameters ###### `logger` [Microsoft\.Extensions\.Logging\.ILogger<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1')[PingModeCompletionHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.PingModeCompletionHandler 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.AuthenticationNotifiers\.PingModeCompletionHandler')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.PingModeCompletionHandler.PingModeCompletionHandler(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.PingModeCompletionHandler_,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage,Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.INotificationDeliveryService,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelLongPollingService).logger} Logger for tracking notification events\. ###### `storage` [IBackChannelRequestStorage](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces\.IBackChannelRequestStorage') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.PingModeCompletionHandler.PingModeCompletionHandler(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.PingModeCompletionHandler_,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage,Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.INotificationDeliveryService,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelLongPollingService).storage} Storage for authentication requests\. ###### `subjectTypeConverter` [ISubjectTypeConverter](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter 'Abblix\.Oidc\.Server\.Features\.PairwiseIdentifiers\.ISubjectTypeConverter') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.PingModeCompletionHandler.PingModeCompletionHandler(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.PingModeCompletionHandler_,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage,Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.INotificationDeliveryService,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelLongPollingService).subjectTypeConverter} Seals a session's subject the way the requesting client sees it, so the end user who authenticated can be compared against the one the request named\. ###### `notificationService` [INotificationDeliveryService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.INotificationDeliveryService 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces\.INotificationDeliveryService') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.PingModeCompletionHandler.PingModeCompletionHandler(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.PingModeCompletionHandler_,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage,Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.INotificationDeliveryService,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelLongPollingService).notificationService} Service for sending ping notifications\. ###### `statusNotifier` [IBackChannelLongPollingService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelLongPollingService 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces\.IBackChannelLongPollingService') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.PingModeCompletionHandler.PingModeCompletionHandler(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.PingModeCompletionHandler_,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage,Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.INotificationDeliveryService,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelLongPollingService).statusNotifier} Wakes a client waiting on a long poll\. A ping client polls the token endpoint the same way a poll client does, and the long\-poll gate does not read the delivery mode \- so one that polls before its notification arrives waits, and is woken from here\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.PollModeCompletionHandler.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.AuthenticationNotifiers](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.AuthenticationNotifiers') ## PollModeCompletionHandler Class Handles CIBA poll mode token delivery where the client periodically polls the token endpoint to retrieve tokens\. In poll mode, the authenticated request is stored and remains available until the client retrieves it or it expires\. Supports optional long\-polling to reduce polling frequency and improve efficiency\. ```csharp public class PollModeCompletionHandler : Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.AuthenticationCompletionHandler ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [AuthenticationCompletionHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.AuthenticationCompletionHandler 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.AuthenticationNotifiers\.AuthenticationCompletionHandler') → PollModeCompletionHandler ### Constructors ## PollModeCompletionHandler\(ILogger\, IBackChannelRequestStorage, ISubjectTypeConverter, IBackChannelLongPollingService\) Constructor {#Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.PollModeCompletionHandler.PollModeCompletionHandler(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.PollModeCompletionHandler_,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage,Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelLongPollingService)} Handles CIBA poll mode token delivery where the client periodically polls the token endpoint to retrieve tokens\. In poll mode, the authenticated request is stored and remains available until the client retrieves it or it expires\. Supports optional long\-polling to reduce polling frequency and improve efficiency\. ```csharp public PollModeCompletionHandler(Microsoft.Extensions.Logging.ILogger logger, Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage storage, Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter subjectTypeConverter, Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelLongPollingService? statusNotifier); ``` #### Parameters ###### `logger` [Microsoft\.Extensions\.Logging\.ILogger<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1')[PollModeCompletionHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.PollModeCompletionHandler 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.AuthenticationNotifiers\.PollModeCompletionHandler')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.PollModeCompletionHandler.PollModeCompletionHandler(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.PollModeCompletionHandler_,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage,Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelLongPollingService).logger} Logger for tracking notification events\. ###### `storage` [IBackChannelRequestStorage](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces\.IBackChannelRequestStorage') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.PollModeCompletionHandler.PollModeCompletionHandler(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.PollModeCompletionHandler_,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage,Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelLongPollingService).storage} Storage for authentication requests\. ###### `subjectTypeConverter` [ISubjectTypeConverter](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter 'Abblix\.Oidc\.Server\.Features\.PairwiseIdentifiers\.ISubjectTypeConverter') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.PollModeCompletionHandler.PollModeCompletionHandler(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.PollModeCompletionHandler_,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage,Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelLongPollingService).subjectTypeConverter} Seals a session's subject the way the requesting client sees it, so the end user who authenticated can be compared against the one the request named\. ###### `statusNotifier` [IBackChannelLongPollingService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelLongPollingService 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces\.IBackChannelLongPollingService') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.PollModeCompletionHandler.PollModeCompletionHandler(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.PollModeCompletionHandler_,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage,Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelLongPollingService).statusNotifier} Wakes a client waiting on a long poll\. Nullable because a deployment may register none, NOT because long\-polling is off: the default registration is unconditional, so this is normally present even where the setting is disabled \- the waiting is what the setting decides, and a notification nobody waits for is a no\-op\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.PushModeCompletionHandler.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.AuthenticationNotifiers](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.AuthenticationNotifiers') ## PushModeCompletionHandler Class Handles CIBA push mode token delivery where tokens are sent directly to the client's notification endpoint immediately upon authentication completion\. In push mode, tokens are generated, delivered via HTTP POST, and the request is removed from storage \- except when the delivery itself fails, which is the one outcome that leaves the record behind\. ```csharp public class PushModeCompletionHandler : Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.AuthenticationCompletionHandler ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [AuthenticationCompletionHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.AuthenticationCompletionHandler 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.AuthenticationNotifiers\.AuthenticationCompletionHandler') → PushModeCompletionHandler ### Constructors ## PushModeCompletionHandler\(ILogger\, IBackChannelRequestStorage, ISubjectTypeConverter, INotificationDeliveryService, ITokenRequestProcessor, IAuthorizationDetailsPolicy\) Constructor {#Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.PushModeCompletionHandler.PushModeCompletionHandler(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.PushModeCompletionHandler_,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage,Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.INotificationDeliveryService,Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenRequestProcessor,Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy)} Handles CIBA push mode token delivery where tokens are sent directly to the client's notification endpoint immediately upon authentication completion\. In push mode, tokens are generated, delivered via HTTP POST, and the request is removed from storage \- except when the delivery itself fails, which is the one outcome that leaves the record behind\. ```csharp public PushModeCompletionHandler(Microsoft.Extensions.Logging.ILogger logger, Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage storage, Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter subjectTypeConverter, Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.INotificationDeliveryService notificationService, Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenRequestProcessor tokenRequestProcessor, Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy authorizationDetailsPolicy); ``` #### Parameters ###### `logger` [Microsoft\.Extensions\.Logging\.ILogger<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1')[PushModeCompletionHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.PushModeCompletionHandler 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.AuthenticationNotifiers\.PushModeCompletionHandler')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.PushModeCompletionHandler.PushModeCompletionHandler(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.PushModeCompletionHandler_,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage,Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.INotificationDeliveryService,Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenRequestProcessor,Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy).logger} Logger for tracking notification events\. ###### `storage` [IBackChannelRequestStorage](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces\.IBackChannelRequestStorage') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.PushModeCompletionHandler.PushModeCompletionHandler(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.PushModeCompletionHandler_,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage,Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.INotificationDeliveryService,Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenRequestProcessor,Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy).storage} Storage for authentication requests\. ###### `subjectTypeConverter` [ISubjectTypeConverter](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter 'Abblix\.Oidc\.Server\.Features\.PairwiseIdentifiers\.ISubjectTypeConverter') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.PushModeCompletionHandler.PushModeCompletionHandler(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.PushModeCompletionHandler_,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage,Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.INotificationDeliveryService,Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenRequestProcessor,Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy).subjectTypeConverter} Seals a session's subject the way the requesting client sees it, so the end user who authenticated can be compared against the one the request named\. ###### `notificationService` [INotificationDeliveryService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.INotificationDeliveryService 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces\.INotificationDeliveryService') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.PushModeCompletionHandler.PushModeCompletionHandler(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.PushModeCompletionHandler_,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage,Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.INotificationDeliveryService,Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenRequestProcessor,Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy).notificationService} Service for delivering tokens to client endpoint\. ###### `tokenRequestProcessor` [ITokenRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.ITokenRequestProcessor') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.PushModeCompletionHandler.PushModeCompletionHandler(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.PushModeCompletionHandler_,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage,Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.INotificationDeliveryService,Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenRequestProcessor,Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy).tokenRequestProcessor} Processor for generating tokens\. ###### `authorizationDetailsPolicy` [IAuthorizationDetailsPolicy](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy 'Abblix\.Oidc\.Server\.Features\.RichAuthorizationRequests\.IAuthorizationDetailsPolicy') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.PushModeCompletionHandler.PushModeCompletionHandler(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.PushModeCompletionHandler_,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage,Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.INotificationDeliveryService,Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenRequestProcessor,Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy).authorizationDetailsPolicy} The per\-type validators, asked before delivery whether the grant the host completed with is still one the deployment will issue\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.GrantProcessors.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ## Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.GrantProcessors Namespace | Classes | | | :--- | :--- | | [PingModeGrantProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.GrantProcessors.PingModeGrantProcessor 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.GrantProcessors\.PingModeGrantProcessor') | Handles CIBA ping mode token retrieval at the token endpoint\. In ping mode, the server notifies the client, then the client makes a single token request\. The auth\_req\_id is single\-use \- CIBA Core 1\.0 Section 10\.1\.1: "Once redeemed for a successful token response, the auth\_req\_id value that was used is no longer valid" \- so the grant is removed from storage on retrieval, identically to poll mode, whose token response the same section defines\. | | [PollModeGrantProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.GrantProcessors.PollModeGrantProcessor 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.GrantProcessors\.PollModeGrantProcessor') | Handles CIBA poll mode token retrieval at the token endpoint\. In poll mode, clients repeatedly poll until authentication completes\. The stored request is claimed on retrieval \- read and removed in one protocol \- so that a poll told it took the request is the only poll that can be told so\. That narrows the window in which two polls both issue rather than closing it; the method below says what its refusal covers\. | | [PushModeGrantProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.GrantProcessors.PushModeGrantProcessor 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.GrantProcessors\.PushModeGrantProcessor') | Handles CIBA push mode token retrieval validation at the token endpoint\. In push mode, tokens are delivered directly to the client's notification endpoint\. Push mode clients should NEVER poll the token endpoint \- this is an error\. | --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.GrantProcessors.PingModeGrantProcessor.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.GrantProcessors](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.GrantProcessors 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.GrantProcessors') ## PingModeGrantProcessor Class Handles CIBA ping mode token retrieval at the token endpoint\. In ping mode, the server notifies the client, then the client makes a single token request\. The auth\_req\_id is single\-use \- CIBA Core 1\.0 Section 10\.1\.1: "Once redeemed for a successful token response, the auth\_req\_id value that was used is no longer valid" \- so the grant is removed from storage on retrieval, identically to poll mode, whose token response the same section defines\. ```csharp public class PingModeGrantProcessor : Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelGrantProcessor ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → PingModeGrantProcessor Implements [IBackChannelGrantProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelGrantProcessor 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces\.IBackChannelGrantProcessor') ### Constructors ## PingModeGrantProcessor\(IBackChannelRequestStorage\) Constructor {#Abblix.Oidc.Server.Features.BackChannelAuthentication.GrantProcessors.PingModeGrantProcessor.PingModeGrantProcessor(Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage)} Handles CIBA ping mode token retrieval at the token endpoint\. In ping mode, the server notifies the client, then the client makes a single token request\. The auth\_req\_id is single\-use \- CIBA Core 1\.0 Section 10\.1\.1: "Once redeemed for a successful token response, the auth\_req\_id value that was used is no longer valid" \- so the grant is removed from storage on retrieval, identically to poll mode, whose token response the same section defines\. ```csharp public PingModeGrantProcessor(Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage storage); ``` #### Parameters ###### `storage` [IBackChannelRequestStorage](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces\.IBackChannelRequestStorage') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.GrantProcessors.PingModeGrantProcessor.PingModeGrantProcessor(Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage).storage} Storage for backchannel authentication requests\. ### Methods ## PingModeGrantProcessor\.ProcessAuthenticatedRequestAsync\(string, BackChannelAuthenticationRequest\) Method {#Abblix.Oidc.Server.Features.BackChannelAuthentication.GrantProcessors.PingModeGrantProcessor.ProcessAuthenticatedRequestAsync(string,Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest)} Removes the authentication request from storage under the store's per\-key gate and returns its authorized grant\. Because the auth\_req\_id can be used only once \(CIBA Core 1\.0 Section 10\.1\.1\), a retrieval that does not come back with the request is rejected with `invalid_grant` rather than re\-issuing tokens\. Which is the right answer to give the caller, and not a diagnosis: the request comes back only when this caller ran the protocol to the end with its own claim still in the store, and every way short of that is one answer\. A store call that fails after the removal produces neither \- it raises, and the caller is handed an exception instead of a result\. ```csharp public System.Threading.Tasks.Task> ProcessAuthenticatedRequestAsync(string authenticationRequestId, Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest request); ``` #### Parameters ###### `authenticationRequestId` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.GrantProcessors.PingModeGrantProcessor.ProcessAuthenticatedRequestAsync(string,Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest).authenticationRequestId} ###### `request` [BackChannelAuthenticationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.BackChannelAuthenticationRequest') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.GrantProcessors.PingModeGrantProcessor.ProcessAuthenticatedRequestAsync(string,Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest).request} Implements [ProcessAuthenticatedRequestAsync\(string, BackChannelAuthenticationRequest\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelGrantProcessor#Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelGrantProcessor.ProcessAuthenticatedRequestAsync(string,Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest) 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces\.IBackChannelGrantProcessor\.ProcessAuthenticatedRequestAsync\(string, Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.BackChannelAuthenticationRequest\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[AuthorizedGrant](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.AuthorizedGrant')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') ## PingModeGrantProcessor\.ValidateTokenEndpointAccess\(\) Method {#Abblix.Oidc.Server.Features.BackChannelAuthentication.GrantProcessors.PingModeGrantProcessor.ValidateTokenEndpointAccess()} Ping mode clients are allowed to call the token endpoint after the ping notification arrives, so this always returns `null` \(no error\)\. ```csharp public Abblix.Oidc.Server.Common.OidcError? ValidateTokenEndpointAccess(); ``` Implements [ValidateTokenEndpointAccess\(\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelGrantProcessor#Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelGrantProcessor.ValidateTokenEndpointAccess() 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces\.IBackChannelGrantProcessor\.ValidateTokenEndpointAccess\(\)') #### Returns [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.GrantProcessors.PollModeGrantProcessor.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.GrantProcessors](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.GrantProcessors 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.GrantProcessors') ## PollModeGrantProcessor Class Handles CIBA poll mode token retrieval at the token endpoint\. In poll mode, clients repeatedly poll until authentication completes\. The stored request is claimed on retrieval \- read and removed in one protocol \- so that a poll told it took the request is the only poll that can be told so\. That narrows the window in which two polls both issue rather than closing it; the method below says what its refusal covers\. ```csharp public class PollModeGrantProcessor : Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelGrantProcessor ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → PollModeGrantProcessor Implements [IBackChannelGrantProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelGrantProcessor 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces\.IBackChannelGrantProcessor') ### Constructors ## PollModeGrantProcessor\(IBackChannelRequestStorage\) Constructor {#Abblix.Oidc.Server.Features.BackChannelAuthentication.GrantProcessors.PollModeGrantProcessor.PollModeGrantProcessor(Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage)} Handles CIBA poll mode token retrieval at the token endpoint\. In poll mode, clients repeatedly poll until authentication completes\. The stored request is claimed on retrieval \- read and removed in one protocol \- so that a poll told it took the request is the only poll that can be told so\. That narrows the window in which two polls both issue rather than closing it; the method below says what its refusal covers\. ```csharp public PollModeGrantProcessor(Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage storage); ``` #### Parameters ###### `storage` [IBackChannelRequestStorage](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces\.IBackChannelRequestStorage') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.GrantProcessors.PollModeGrantProcessor.PollModeGrantProcessor(Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage).storage} Storage for backchannel authentication requests\. ### Methods ## PollModeGrantProcessor\.ProcessAuthenticatedRequestAsync\(string, BackChannelAuthenticationRequest\) Method {#Abblix.Oidc.Server.Features.BackChannelAuthentication.GrantProcessors.PollModeGrantProcessor.ProcessAuthenticatedRequestAsync(string,Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest)} Removes the authentication request from storage through the store's claim protocol and returns its authorized grant\. A removal that does not come back with the request is answered `invalid_grant` rather than re\-issuing tokens\. That is the right answer and not a diagnosis: the request comes back only when this caller ran the protocol to the end with its own claim still in the store, and every way short of that is one answer\. A store fault after the removal is not among them at all \- it raises past this method\. ```csharp public System.Threading.Tasks.Task> ProcessAuthenticatedRequestAsync(string authenticationRequestId, Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest request); ``` #### Parameters ###### `authenticationRequestId` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.GrantProcessors.PollModeGrantProcessor.ProcessAuthenticatedRequestAsync(string,Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest).authenticationRequestId} ###### `request` [BackChannelAuthenticationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.BackChannelAuthenticationRequest') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.GrantProcessors.PollModeGrantProcessor.ProcessAuthenticatedRequestAsync(string,Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest).request} Implements [ProcessAuthenticatedRequestAsync\(string, BackChannelAuthenticationRequest\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelGrantProcessor#Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelGrantProcessor.ProcessAuthenticatedRequestAsync(string,Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest) 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces\.IBackChannelGrantProcessor\.ProcessAuthenticatedRequestAsync\(string, Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.BackChannelAuthenticationRequest\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[AuthorizedGrant](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.AuthorizedGrant')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') ## PollModeGrantProcessor\.ValidateTokenEndpointAccess\(\) Method {#Abblix.Oidc.Server.Features.BackChannelAuthentication.GrantProcessors.PollModeGrantProcessor.ValidateTokenEndpointAccess()} Poll mode clients are expected to poll the token endpoint, so this always returns `null` \(no error\)\. ```csharp public Abblix.Oidc.Server.Common.OidcError? ValidateTokenEndpointAccess(); ``` Implements [ValidateTokenEndpointAccess\(\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelGrantProcessor#Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelGrantProcessor.ValidateTokenEndpointAccess() 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces\.IBackChannelGrantProcessor\.ValidateTokenEndpointAccess\(\)') #### Returns [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.GrantProcessors.PushModeGrantProcessor.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.GrantProcessors](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.GrantProcessors 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.GrantProcessors') ## PushModeGrantProcessor Class Handles CIBA push mode token retrieval validation at the token endpoint\. In push mode, tokens are delivered directly to the client's notification endpoint\. Push mode clients should NEVER poll the token endpoint \- this is an error\. ```csharp public class PushModeGrantProcessor : Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelGrantProcessor ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → PushModeGrantProcessor Implements [IBackChannelGrantProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelGrantProcessor 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces\.IBackChannelGrantProcessor') ### Methods ## PushModeGrantProcessor\.ProcessAuthenticatedRequestAsync\(string, BackChannelAuthenticationRequest\) Method {#Abblix.Oidc.Server.Features.BackChannelAuthentication.GrantProcessors.PushModeGrantProcessor.ProcessAuthenticatedRequestAsync(string,Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest)} Defensive fallback that returns `invalid_grant`\. In practice this method is unreachable because [ValidateTokenEndpointAccess\(\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.GrantProcessors.PushModeGrantProcessor#Abblix.Oidc.Server.Features.BackChannelAuthentication.GrantProcessors.PushModeGrantProcessor.ValidateTokenEndpointAccess() 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.GrantProcessors\.PushModeGrantProcessor\.ValidateTokenEndpointAccess\(\)') short\-circuits push\-mode token\-endpoint requests\. ```csharp public System.Threading.Tasks.Task> ProcessAuthenticatedRequestAsync(string authenticationRequestId, Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest request); ``` #### Parameters ###### `authenticationRequestId` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.GrantProcessors.PushModeGrantProcessor.ProcessAuthenticatedRequestAsync(string,Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest).authenticationRequestId} ###### `request` [BackChannelAuthenticationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.BackChannelAuthenticationRequest') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.GrantProcessors.PushModeGrantProcessor.ProcessAuthenticatedRequestAsync(string,Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest).request} Implements [ProcessAuthenticatedRequestAsync\(string, BackChannelAuthenticationRequest\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelGrantProcessor#Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelGrantProcessor.ProcessAuthenticatedRequestAsync(string,Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest) 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces\.IBackChannelGrantProcessor\.ProcessAuthenticatedRequestAsync\(string, Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.BackChannelAuthenticationRequest\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[AuthorizedGrant](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.AuthorizedGrant')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') ## PushModeGrantProcessor\.ValidateTokenEndpointAccess\(\) Method {#Abblix.Oidc.Server.Features.BackChannelAuthentication.GrantProcessors.PushModeGrantProcessor.ValidateTokenEndpointAccess()} Push mode delivers tokens directly to the client's notification endpoint, so any call to the token endpoint with a push\-mode `auth_req_id` is a protocol error and is rejected with `invalid_grant`\. ```csharp public Abblix.Oidc.Server.Common.OidcError ValidateTokenEndpointAccess(); ``` Implements [ValidateTokenEndpointAccess\(\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelGrantProcessor#Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelGrantProcessor.ValidateTokenEndpointAccess() 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces\.IBackChannelGrantProcessor\.ValidateTokenEndpointAccess\(\)') #### Returns [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ## Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces Namespace | Interfaces | | | :--- | :--- | | [IAuthenticationCompletionHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IAuthenticationCompletionHandler 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces\.IAuthenticationCompletionHandler') | Handles CIBA authentication completion by routing to the appropriate delivery mode handler \(poll, ping, or push\) based on the client's configured backchannel\_token\_delivery\_mode\. | | [IAuthenticationRequestIdGenerator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IAuthenticationRequestIdGenerator 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces\.IAuthenticationRequestIdGenerator') | Defines the contract for generating unique authentication request identifiers in the context of a backchannel or other authentication flows\. This identifier is used to track and reference individual authentication requests\. | | [IBackChannelGrantProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelGrantProcessor 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces\.IBackChannelGrantProcessor') | Defines mode\-specific processing logic for handling authenticated CIBA requests at the token endpoint\. Different delivery modes \(poll, ping, push\) have different requirements for token retrieval\. | | [IBackChannelLongPollingService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelLongPollingService 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces\.IBackChannelLongPollingService') | Provides signaling infrastructure for CIBA poll mode long\-polling, allowing token endpoint requests to wait for authentication completion rather than immediately returning authorization\_pending\. | | [IBackChannelNotificationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelNotificationRequest 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces\.IBackChannelNotificationRequest') | Common shape of the JSON body the authorization server posts to the client's `client_notification_endpoint` in CIBA ping and push modes\. The `auth_req_id` is always present; push payloads add the issued tokens\. | | [IBackChannelRequestStorage](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces\.IBackChannelRequestStorage') | Defines the contract for a storage system responsible for persisting and retrieving backchannel authentication requests in the context of Client\-Initiated Backchannel Authentication \(CIBA\)\. | | [INotificationDeliveryService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.INotificationDeliveryService 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces\.INotificationDeliveryService') | Provides HTTP\-based notification services for CIBA ping and push modes\. | | [IUserDeviceAuthenticationHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IUserDeviceAuthenticationHandler 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces\.IUserDeviceAuthenticationHandler') | Defines the contract for initiating user authentication on a device in the context of a backchannel authentication flow\. This interface is responsible for handling the initiation of the authentication process for the end\-user on their device, based on a validated backchannel authentication request\. | --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IAuthenticationCompletionHandler.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces') ## IAuthenticationCompletionHandler Interface Handles CIBA authentication completion by routing to the appropriate delivery mode handler \(poll, ping, or push\) based on the client's configured backchannel\_token\_delivery\_mode\. ```csharp public interface IAuthenticationCompletionHandler ``` Derived ↳ [AuthenticationCompletionRouter](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.AuthenticationCompletionRouter 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.AuthenticationNotifiers\.AuthenticationCompletionRouter') ### Properties ## IAuthenticationCompletionHandler\.TokenDeliveryModesSupported Property {#Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IAuthenticationCompletionHandler.TokenDeliveryModesSupported} Token delivery modes \(poll, ping, push\) for which a handler is registered with the DI container\. Used to populate the discovery document's `backchannel_token_delivery_modes_supported` field so it reflects only modes the host actually supports\. ```csharp System.Collections.Generic.IEnumerable TokenDeliveryModesSupported { get; } ``` #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ### Methods ## IAuthenticationCompletionHandler\.CompleteAsync\(string, BackChannelAuthenticationRequest, TimeSpan\) Method {#Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IAuthenticationCompletionHandler.CompleteAsync(string,Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest,System.TimeSpan)} Completes the authentication process and handles token delivery according to the client's configured delivery mode\. ```csharp System.Threading.Tasks.Task CompleteAsync(string authenticationRequestId, Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest request, System.TimeSpan expiresIn); ``` #### Parameters ###### `authenticationRequestId` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IAuthenticationCompletionHandler.CompleteAsync(string,Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest,System.TimeSpan).authenticationRequestId} The auth\_req\_id identifying the authentication request\. ###### `request` [BackChannelAuthenticationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.BackChannelAuthenticationRequest') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IAuthenticationCompletionHandler.CompleteAsync(string,Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest,System.TimeSpan).request} The authentication request carrying the grant the end user approved\. Its own Status is not read: whether this request may still be answered is decided from the STORED record, so a caller cannot make the decision by setting a field on its own copy\. ###### `expiresIn` [System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IAuthenticationCompletionHandler.CompleteAsync(string,Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest,System.TimeSpan).expiresIn} How long the authenticated request remains valid for token retrieval\. #### Returns [System\.Threading\.Tasks\.Task](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task 'System\.Threading\.Tasks\.Task') A task representing the asynchronous completion operation\. #### Exceptions [System\.InvalidOperationException](https://learn.microsoft.com/en-us/dotnet/api/system.invalidoperationexception 'System\.InvalidOperationException') The store does not hold a PENDING record under this identifier\. Stated as what must be true rather than as a list of causes, because the causes are more numerous than they look and this seam cannot tell them apart: the request may have been answered, refused or expired, its record may have been redeemed and removed by a poll, removed by push's own refusal path after a configuration fault where nothing was answered at all, evicted, or never stored\. A host that persists the status itself before calling lands here too, on its FIRST completion and with nothing over\-granted\. Completing a request that is not pending would deliver a second answer for one authentication. Recovering from a failed delivery therefore means asking the end user again, not repeating the call. ### Remarks This method automatically: - Retrieves client information to determine the delivery mode - Selects the appropriate handler (PollModeCompletionHandler, PingModeCompletionHandler, or PushModeCompletionHandler) - Delegates to the mode-specific implementation for token delivery --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IAuthenticationRequestIdGenerator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces') ## IAuthenticationRequestIdGenerator Interface Defines the contract for generating unique authentication request identifiers in the context of a backchannel or other authentication flows\. This identifier is used to track and reference individual authentication requests\. ```csharp public interface IAuthenticationRequestIdGenerator ``` Derived ↳ [AuthenticationRequestIdGenerator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationRequestIdGenerator 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.AuthenticationRequestIdGenerator') ### Methods ## IAuthenticationRequestIdGenerator\.GenerateAuthenticationRequestId\(\) Method {#Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IAuthenticationRequestIdGenerator.GenerateAuthenticationRequestId()} Generates a unique authentication request ID, which is used to identify a specific authentication request during the backchannel authentication flow or similar processes\. ```csharp string GenerateAuthenticationRequestId(); ``` #### Returns [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') The generated authentication request ID as a string\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelGrantProcessor.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces') ## IBackChannelGrantProcessor Interface Defines mode\-specific processing logic for handling authenticated CIBA requests at the token endpoint\. Different delivery modes \(poll, ping, push\) have different requirements for token retrieval\. ```csharp public interface IBackChannelGrantProcessor ``` Derived ↳ [PingModeGrantProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.GrantProcessors.PingModeGrantProcessor 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.GrantProcessors\.PingModeGrantProcessor') ↳ [PollModeGrantProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.GrantProcessors.PollModeGrantProcessor 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.GrantProcessors\.PollModeGrantProcessor') ↳ [PushModeGrantProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.GrantProcessors.PushModeGrantProcessor 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.GrantProcessors\.PushModeGrantProcessor') ### Methods ## IBackChannelGrantProcessor\.ProcessAuthenticatedRequestAsync\(string, BackChannelAuthenticationRequest\) Method {#Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelGrantProcessor.ProcessAuthenticatedRequestAsync(string,Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest)} Validates whether the client is allowed to retrieve tokens via the token endpoint for this delivery mode, and performs any mode\-specific post\-retrieval actions \(e\.g\., removing from storage\)\. ```csharp System.Threading.Tasks.Task> ProcessAuthenticatedRequestAsync(string authenticationRequestId, Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest request); ``` #### Parameters ###### `authenticationRequestId` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelGrantProcessor.ProcessAuthenticatedRequestAsync(string,Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest).authenticationRequestId} The authentication request identifier\. ###### `request` [BackChannelAuthenticationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.BackChannelAuthenticationRequest') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelGrantProcessor.ProcessAuthenticatedRequestAsync(string,Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest).request} The authenticated CIBA request from storage\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[AuthorizedGrant](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.AuthorizedGrant')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') Either the authorized grant if retrieval is allowed and successful, or an error indicating why token retrieval is not permitted for this mode\. ## IBackChannelGrantProcessor\.ValidateTokenEndpointAccess\(\) Method {#Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelGrantProcessor.ValidateTokenEndpointAccess()} Validates that a token request is allowed for this delivery mode\. For example, push mode clients should never poll the token endpoint\. ```csharp Abblix.Oidc.Server.Common.OidcError? ValidateTokenEndpointAccess(); ``` #### Returns [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError') Null if the request is valid for this mode, or an error if the client is attempting an operation not allowed by their delivery mode\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelLongPollingService.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces') ## IBackChannelLongPollingService Interface Provides signaling infrastructure for CIBA poll mode long\-polling, allowing token endpoint requests to wait for authentication completion rather than immediately returning authorization\_pending\. ```csharp public interface IBackChannelLongPollingService ``` Derived ↳ [InMemoryLongPollingService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.InMemoryLongPollingService 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.InMemoryLongPollingService') ### Remarks This interface supports the optional long-polling feature of CIBA poll mode. When long-polling is enabled, token endpoint requests for pending authentication requests are held open (up to a timeout) instead of immediately returning authorization_pending. When the user completes authentication, all waiting requests for that auth_req_id are notified and can immediately return the tokens. Benefits of Long-Polling: - Reduced latency: Tokens returned immediately when authentication completes (0-1 second vs 0-5 seconds) - Reduced server load: Fewer HTTP requests (1-4 per minute vs 12 per minute with 5-second polling) - Better user experience: Faster token delivery without constant polling overhead Implementation Patterns: - In-memory: Use events/TaskCompletionSource for single-server deployments - Distributed: Use Redis Pub/Sub, SignalR, or message queue for multi-server deployments Example Flow: ```csharp // 1. Client requests token (status = Pending) // 2. Server holds connection and waits var statusChange = await longPollingSignaler.WaitForStatusChangeAsync(authReqId, timeout, cancellationToken); // 3. Meanwhile: User authenticates on device // 4. The completion handler signals the change - approval and refusal alike, in poll and in ping. // Push writes through the same place and wakes nobody, because nothing hands push a notifier and // its clients are refused at the token endpoint, so none of them is ever waiting. await longPollingSignaler.NotifyStatusChangeAsync(authReqId, BackChannelAuthenticationStatus.Authenticated); // 5. Waiting request wakes up, checks storage, returns tokens ``` ### Methods ## IBackChannelLongPollingService\.NotifyStatusChangeAsync\(string, BackChannelAuthenticationStatus\) Method {#Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelLongPollingService.NotifyStatusChangeAsync(string,Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationStatus)} Notifies all waiting requests that the authentication status has changed for the specified request\. This immediately releases any long\-polling token requests waiting for this auth\_req\_id\. ```csharp System.Threading.Tasks.Task NotifyStatusChangeAsync(string authenticationRequestId, Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationStatus newStatus); ``` #### Parameters ###### `authenticationRequestId` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelLongPollingService.NotifyStatusChangeAsync(string,Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationStatus).authenticationRequestId} The unique identifier of the authentication request that changed\. ###### `newStatus` [BackChannelAuthenticationStatus](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationStatus 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.BackChannelAuthenticationStatus') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelLongPollingService.NotifyStatusChangeAsync(string,Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationStatus).newStatus} The new authentication status \(for logging/diagnostics only\)\. #### Returns [System\.Threading\.Tasks\.Task](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task 'System\.Threading\.Tasks\.Task') A task that completes when all waiting requests have been notified\. ### Remarks Call this whenever a request leaves the Pending state, and note which of those transitions are yours to signal rather than the library's. - Authenticated and Denied through the completion handler are signalled by the handler itself, in poll and ping alike - a host that completes through [IAuthenticationCompletionHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IAuthenticationCompletionHandler 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces\.IAuthenticationCompletionHandler') needs nothing more. Ping is on that list because a ping client polls the token endpoint too, and the long-poll gate does not read the delivery mode; push is not, because its token endpoint refuses the client outright, so no push client is ever a waiter. - A status the host writes to storage itself is the host's to signal. The denial pattern documented on [IUserDeviceAuthenticationHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IUserDeviceAuthenticationHandler 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces\.IUserDeviceAuthenticationHandler') is exactly this case: it updates the stored record directly, so nothing in the library sees the change and a waiter sleeps until its own window runs out. - Expiry is signalled by nobody, and a waiter is NOT told about it: when its window runs out it is answered `authorization_pending`, and it learns the request expired on the poll after that, from the record being gone. The grant handler does compare the stored expiry against the clock and remove the record, so there is a place a signal could be sent from; nothing sends one today. It's safe to call this even if no requests are waiting - it's a no-op in that case. ## IBackChannelLongPollingService\.WaitForStatusChangeAsync\(string, TimeSpan, CancellationToken\) Method {#Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelLongPollingService.WaitForStatusChangeAsync(string,System.TimeSpan,System.Threading.CancellationToken)} Waits for a status change notification for the specified authentication request\. Returns immediately if a notification is received, or after timeout if no change occurs\. ```csharp System.Threading.Tasks.Task WaitForStatusChangeAsync(string authenticationRequestId, System.TimeSpan timeout, System.Threading.CancellationToken cancellationToken=default(System.Threading.CancellationToken)); ``` #### Parameters ###### `authenticationRequestId` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelLongPollingService.WaitForStatusChangeAsync(string,System.TimeSpan,System.Threading.CancellationToken).authenticationRequestId} The unique identifier of the authentication request to wait for\. ###### `timeout` [System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelLongPollingService.WaitForStatusChangeAsync(string,System.TimeSpan,System.Threading.CancellationToken).timeout} Maximum time to wait for a status change\. ###### `cancellationToken` [System\.Threading\.CancellationToken](https://learn.microsoft.com/en-us/dotnet/api/system.threading.cancellationtoken 'System\.Threading\.CancellationToken') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelLongPollingService.WaitForStatusChangeAsync(string,System.TimeSpan,System.Threading.CancellationToken).cancellationToken} Cancellation token to abort the wait operation\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task that completes when either: \- A status change notification is received \(returns true\) \- The timeout expires \(returns false\) \- The cancellation token is triggered \(throws OperationCanceledException\) ### Remarks This method does NOT return the new status \- it only signals that a change occurred\. The caller must retrieve the updated status from storage\. Multiple callers can wait for the same auth\_req\_id simultaneously \(e\.g\., if client retries\)\. All waiters will be notified when status changes\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelNotificationRequest.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces') ## IBackChannelNotificationRequest Interface Common shape of the JSON body the authorization server posts to the client's `client_notification_endpoint` in CIBA ping and push modes\. The `auth_req_id` is always present; push payloads add the issued tokens\. ```csharp public interface IBackChannelNotificationRequest ``` Derived ↳ [BackChannelPingNotificationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.BackChannelPingNotificationRequest 'Abblix\.Oidc\.Server\.Model\.BackChannelPingNotificationRequest') ↳ [BackChannelPushNotificationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.BackChannelPushNotificationRequest 'Abblix\.Oidc\.Server\.Model\.BackChannelPushNotificationRequest') ### Properties ## IBackChannelNotificationRequest\.AuthenticationRequestId Property {#Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelNotificationRequest.AuthenticationRequestId} The `auth_req_id` the notification refers to, allowing the client to correlate the callback with the originating CIBA authentication request\. ```csharp string AuthenticationRequestId { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces') ## IBackChannelRequestStorage Interface Defines the contract for a storage system responsible for persisting and retrieving backchannel authentication requests in the context of Client\-Initiated Backchannel Authentication \(CIBA\)\. ```csharp public interface IBackChannelRequestStorage ``` Derived ↳ [BackChannelRequestStorage](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelRequestStorage 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.BackChannelRequestStorage') ### Methods ## IBackChannelRequestStorage\.StoreAsync\(BackChannelAuthenticationRequest, TimeSpan\) Method {#Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage.StoreAsync(Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest,System.TimeSpan)} Asynchronously stores a backchannel authentication request in the storage system\. This method saves the provided authentication request and sets its expiration based on the specified duration\. ```csharp System.Threading.Tasks.Task StoreAsync(Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest authenticationRequest, System.TimeSpan expiresIn); ``` #### Parameters ###### `authenticationRequest` [BackChannelAuthenticationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.BackChannelAuthenticationRequest') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage.StoreAsync(Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest,System.TimeSpan).authenticationRequest} The backchannel authentication request to store\. ###### `expiresIn` [System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage.StoreAsync(Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest,System.TimeSpan).expiresIn} The duration after which the stored request will expire\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task that returns the ID of the stored authentication request\. ## IBackChannelRequestStorage\.TryGetAsync\(string\) Method {#Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage.TryGetAsync(string)} Tries to retrieve a backchannel authentication request by its unique identifier\. This method checks if a request exists for the specified ID and returns it if found\. ```csharp System.Threading.Tasks.Task TryGetAsync(string authenticationRequestId); ``` #### Parameters ###### `authenticationRequestId` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage.TryGetAsync(string).authenticationRequestId} The unique identifier of the authentication request to retrieve\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[BackChannelAuthenticationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.BackChannelAuthenticationRequest')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task that returns the authentication request if found; otherwise, null\. ## IBackChannelRequestStorage\.TryRemoveAsync\(string\) Method {#Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage.TryRemoveAsync(string)} Claims a backchannel authentication request, retrieving and removing it in one protocol, so that a caller told it took the request is the only caller that can be told so\. It narrows the window in which two polls both retrieve one request rather than closing it; the returns block below says what the claim covers and what it does not\. ```csharp System.Threading.Tasks.Task TryRemoveAsync(string authenticationRequestId); ``` #### Parameters ###### `authenticationRequestId` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage.TryRemoveAsync(string).authenticationRequestId} The unique identifier of the authentication request to remove\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[BackChannelAuthenticationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.BackChannelAuthenticationRequest')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task that returns the authentication request when this caller removed it and still held its own claim afterwards\. Null otherwise, which covers the request not being there, another caller having taken it, and a claim that expired mid\-protocol \- the last on one caller with nobody to lose to, and its outcome is the request gone with nobody able to be told they took it\. A store call that fails after the removal raises instead of answering\. ## IBackChannelRequestStorage\.UpdateAsync\(string, BackChannelAuthenticationRequest, TimeSpan\) Method {#Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage.UpdateAsync(string,Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest,System.TimeSpan)} Updates an existing backchannel authentication request in storage\. Used in ping mode to update request status when user completes authentication\. ```csharp System.Threading.Tasks.Task UpdateAsync(string requestId, Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest request, System.TimeSpan expiresIn); ``` #### Parameters ###### `requestId` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage.UpdateAsync(string,Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest,System.TimeSpan).requestId} The unique identifier of the authentication request to update\. ###### `request` [BackChannelAuthenticationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.BackChannelAuthenticationRequest') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage.UpdateAsync(string,Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest,System.TimeSpan).request} The updated authentication request data\. ###### `expiresIn` [System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage.UpdateAsync(string,Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest,System.TimeSpan).expiresIn} The duration after which the request expires\. #### Returns [System\.Threading\.Tasks\.Task](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task 'System\.Threading\.Tasks\.Task') A task that completes when the request is updated in storage\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.INotificationDeliveryService.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces') ## INotificationDeliveryService Interface Provides HTTP\-based notification services for CIBA ping and push modes\. ```csharp public interface INotificationDeliveryService ``` Derived ↳ [HttpNotificationDeliveryService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.HttpNotificationDeliveryService 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.HttpNotificationDeliveryService') ### Remarks This interface supports both CIBA notification modes by sending HTTP POST requests with a notification payload to the client's registered endpoint. - Ping Mode: Sends auth_req_id to notify client that tokens are ready for retrieval. - Push Mode: Delivers complete token response directly to client endpoint. ### Methods ## INotificationDeliveryService\.SendAsync\(Uri, string, IBackChannelNotificationRequest, string\) Method {#Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.INotificationDeliveryService.SendAsync(System.Uri,string,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelNotificationRequest,string)} Sends an HTTP POST notification to the client's registered endpoint\. ```csharp System.Threading.Tasks.Task SendAsync(System.Uri clientNotificationEndpoint, string clientNotificationToken, Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelNotificationRequest payload, string mode); ``` #### Parameters ###### `clientNotificationEndpoint` [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.INotificationDeliveryService.SendAsync(System.Uri,string,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelNotificationRequest,string).clientNotificationEndpoint} The HTTPS URL of the client's notification endpoint\. ###### `clientNotificationToken` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.INotificationDeliveryService.SendAsync(System.Uri,string,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelNotificationRequest,string).clientNotificationToken} Bearer token for authenticating the notification request\. ###### `payload` [IBackChannelNotificationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelNotificationRequest 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces\.IBackChannelNotificationRequest') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.INotificationDeliveryService.SendAsync(System.Uri,string,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelNotificationRequest,string).payload} The notification payload to send \(e\.g\., ping notification or push token delivery\)\. ###### `mode` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.INotificationDeliveryService.SendAsync(System.Uri,string,Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelNotificationRequest,string).mode} The CIBA mode \(e\.g\., "ping" or "push"\) for logging purposes\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') `true` if the client endpoint accepted the notification \(2xx response\); `false` if delivery failed \(non\-success status or transport error\)\. On `false` push keeps the stored record, and it is not a resumable delivery. The tokens were minted and are gone; nothing retries them. The record reads Authenticated, written before the mint, so a LATER completion of the same request is refused - the recovery is to ask the end user, not to resend from what is left. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IUserDeviceAuthenticationHandler.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces') ## IUserDeviceAuthenticationHandler Interface Defines the contract for initiating user authentication on a device in the context of a backchannel authentication flow\. This interface is responsible for handling the initiation of the authentication process for the end\-user on their device, based on a validated backchannel authentication request\. ```csharp public interface IUserDeviceAuthenticationHandler ``` ### Remarks Implementation Guide: Implement this interface to integrate your authentication mechanism with CIBA. Your implementation should: - Send authentication request to user's device (push notification, SMS, email, etc.) - Display binding_message if present in the request - Handle user approval/denial asynchronously - Update authentication status when user responds Example Implementation with Ping Mode Support: ```csharp public class MyUserDeviceAuthenticationHandler : IUserDeviceAuthenticationHandler { private readonly IBackChannelRequestStorage _storage; private readonly IAuthenticationCompletionHandler _completion; private readonly ISessionIdGenerator _sessionIdGenerator; private readonly IMyPushNotificationService _pushService; private readonly IBackChannelLongPollingService? _longPolling; public async Task> InitiateAuthenticationAsync( ValidBackChannelAuthenticationRequest request) { // Extract user hint and send authentication request to their device var userIdentifier = ExtractUserIdentifier(request); var bindingMessage = request.Model.BindingMessage; // Send push notification to user's device await _pushService.SendAuthRequestAsync(userIdentifier, bindingMessage); // Return pending - authentication completes asynchronously // User will approve/deny on their device return new OidcError(ErrorCodes.AuthorizationPending, "Waiting for user approval"); } // Called when user approves on their device public async Task OnUserApprovedAsync(string authReqId, string userId) { // Retrieve the stored authentication request var storedRequest = await _storage.TryGetAsync(authReqId); if (storedRequest == null) return; // Create authenticated session var authSession = new AuthSession( userId, SessionId: _sessionIdGenerator.GenerateSessionId(), AuthenticationTime: DateTimeOffset.UtcNow, IdentityProvider: "local"); // Carry the end user's answer on the grant. AuthorizedGrant is a positional member of the // record, so it is init-only and a `with` expression is how it is replaced; the copy carries // every other member unchanged. // // Nothing needs to touch Status ON THIS PATH - the denial below is a different one, and it // never calls CompleteAsync. A host that does set it on its own copy changes nothing // either way: completion reads the STORED record and writes whatever it decides itself. var authenticated = storedRequest with { AuthorizedGrant = new AuthorizedGrant(authSession, storedRequest.AuthorizedGrant.Context), }; // Completion selects the mode-specific handler from the client's registered delivery mode // (PollModeCompletionHandler, PingModeCompletionHandler or PushModeCompletionHandler). await _completion.CompleteAsync( authReqId, authenticated, TimeSpan.FromMinutes(5)); } // Called when user denies on their device public async Task OnUserDeniedAsync(string authReqId) { var storedRequest = await _storage.TryGetAsync(authReqId); if (storedRequest == null) return; storedRequest.Status = BackChannelAuthenticationStatus.Denied; await _storage.UpdateAsync(authReqId, storedRequest, TimeSpan.FromMinutes(5)); // Writing the status is not telling anybody. A poll-mode client waiting on a long poll is // woken by IBackChannelLongPollingService, which nothing in the library calls for a status // the host wrote itself - so without this the user's refusal answers only when the waiter's // window runs out. Inject the notifier where the deployment registered one. if (_longPolling != null) await _longPolling.NotifyStatusChangeAsync(authReqId, storedRequest.Status); } } ``` Token Delivery Modes: The [CompleteAsync\(string, BackChannelAuthenticationRequest, TimeSpan\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IAuthenticationCompletionHandler#Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IAuthenticationCompletionHandler.CompleteAsync(string,Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest,System.TimeSpan) 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces\.IAuthenticationCompletionHandler\.CompleteAsync\(string, Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.BackChannelAuthenticationRequest, System\.TimeSpan\)') method automatically handles mode-specific behavior based on the client's registered `backchannel_token_delivery_mode`: - Poll Mode: Stores the authenticated request in [IBackChannelRequestStorage](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces\.IBackChannelRequestStorage'). No token exists yet - the client polls the token endpoint with its `auth_req_id`, and the tokens are minted there when it redeems. - Ping Mode: Stores the authenticated request as poll mode does, then sends an HTTP POST notification via [INotificationDeliveryService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.INotificationDeliveryService 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces\.INotificationDeliveryService') to the client's `client_notification_endpoint` carrying the `auth_req_id`. The tokens are minted at the token endpoint when the client redeems, exactly as in poll mode. - Push Mode: Generates tokens via [ITokenRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.ITokenRequestProcessor') and delivers them directly via [INotificationDeliveryService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.INotificationDeliveryService 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces\.INotificationDeliveryService') to the client's `client_notification_endpoint`. This is the only mode where the tokens exist before the client asks for them, and the request is removed once they are delivered, because a push client never comes to the token endpoint. CIBA Core 1.0 does not require that removal - it says nothing about what the OP keeps - so it is this library's choice. Partial consent (RFC 9396 authorization_details): The grant carried on the stored request is what will be issued, so an end user who approved part of what the client asked for is expressed by replacing its `AuthorizationContext` before completing: keep the entries they agreed to, drop the ones they refused, and hand the result to [CompleteAsync\(string, BackChannelAuthenticationRequest, TimeSpan\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IAuthenticationCompletionHandler#Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IAuthenticationCompletionHandler.CompleteAsync(string,Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest,System.TimeSpan) 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces\.IAuthenticationCompletionHandler\.CompleteAsync\(string, Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.BackChannelAuthenticationRequest, System\.TimeSpan\)'). The example above copies the context unchanged, which is the "they agreed to all of it" case. This is the only moment such an answer exists. [InitiateAuthenticationAsync\(ValidBackChannelAuthenticationRequest\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IUserDeviceAuthenticationHandler#Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IUserDeviceAuthenticationHandler.InitiateAuthenticationAsync(Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.ValidBackChannelAuthenticationRequest) 'Abblix\.Oidc\.Server\.Features\.BackChannelAuthentication\.Interfaces\.IUserDeviceAuthenticationHandler\.InitiateAuthenticationAsync\(Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Interfaces\.ValidBackChannelAuthenticationRequest\)') runs before the end user has seen anything - the session it returns names who is about to be reached, and the request is stored pending either way - so there is nothing to narrow there. Narrowing is yours to decide; widening is refused. Completion compares the grant's `authorization_details` types against what the client actually sent, and a type the request never carried denies the request rather than issuing it. RFC 9396 §7 has the server return what was granted, which is only meaningful while "granted" stays inside "requested". Additional Key Points: - Binding Message: Display request.Model.BindingMessage to user for transaction confirmation - User Code: If request.Model.UserCode is present, require user to confirm it - Authentication: All notifications use Bearer token from `client_notification_token` Security contract - user_code verification (CIBA Core 1.0 §7.1): The library validates only the presence of `user_code` when the provider and client require it (see [UserCodeValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.UserCodeValidator 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Validation\.UserCodeValidator')); it deliberately does not - and cannot - verify the code's value, because the secret is known only to the end-user and the user's authentication device, which this handler owns. Your implementation therefore MUST verify `request.Model.UserCode` against the user's actual code as part of the device interaction, and MUST NOT return a successful [AuthSession](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.UserAuthentication.AuthSession 'Abblix\.Oidc\.Server\.Features\.UserAuthentication\.AuthSession') unless that check passed. A wrong or absent code MUST resolve to a failed [Result<TSuccess,TFailure>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2') (typically `access_denied`). Treating presence-validation as sufficient leaves the code unenforced and defeats its purpose. ### Methods ## IUserDeviceAuthenticationHandler\.InitiateAuthenticationAsync\(ValidBackChannelAuthenticationRequest\) Method {#Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IUserDeviceAuthenticationHandler.InitiateAuthenticationAsync(Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.ValidBackChannelAuthenticationRequest)} Initiates the authentication process for the user on their device, based on a validated backchannel authentication request\. This may involve sending a notification to the user's device, starting an out\-of\-band authentication process, or performing other steps required to authenticate the user asynchronously\. ```csharp System.Threading.Tasks.Task> InitiateAuthenticationAsync(Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.ValidBackChannelAuthenticationRequest request); ``` #### Parameters ###### `request` [ValidBackChannelAuthenticationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.ValidBackChannelAuthenticationRequest 'Abblix\.Oidc\.Server\.Endpoints\.BackChannelAuthentication\.Interfaces\.ValidBackChannelAuthenticationRequest') {#Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IUserDeviceAuthenticationHandler.InitiateAuthenticationAsync(Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.ValidBackChannelAuthenticationRequest).request} The validated backchannel authentication request containing user and client information required to initiate the authentication process\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[AuthSession](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.UserAuthentication.AuthSession 'Abblix\.Oidc\.Server\.Features\.UserAuthentication\.AuthSession')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A [System\.Threading\.Tasks\.Task](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task 'System\.Threading\.Tasks\.Task') representing the asynchronous operation to initiate the authentication process\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ## Abblix\.Oidc\.Server\.Features\.ClientAuthentication Namespace | Classes | | | :--- | :--- | | [ClientSecretAuthenticator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.ClientSecretAuthenticator 'Abblix\.Oidc\.Server\.Features\.ClientAuthentication\.ClientSecretAuthenticator') | Serves as a base class for client authentication, utilizing client ID and secret\. It validates clients against a known list of clients, ensuring that the client secret provided during the authentication process matches the stored secret for the client\. This class supports various hash algorithms for secure secret comparison and handles client secret expiration\. | | [ClientSecretBasicAuthenticator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.ClientSecretBasicAuthenticator 'Abblix\.Oidc\.Server\.Features\.ClientAuthentication\.ClientSecretBasicAuthenticator') | Implements an authentication of a client request by HTTP 'Authorization' header using the 'Basic' scheme\. This authentication method follows the standards outlined in RFC 7617\. | | [ClientSecretJwtAuthenticator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.ClientSecretJwtAuthenticator 'Abblix\.Oidc\.Server\.Features\.ClientAuthentication\.ClientSecretJwtAuthenticator') | Authenticates client requests using the client\_secret\_jwt authentication method\. This method is used in scenarios where the client signs a JWT with its secret as a means of authentication\. | | [ClientSecretPostAuthenticator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.ClientSecretPostAuthenticator 'Abblix\.Oidc\.Server\.Features\.ClientAuthentication\.ClientSecretPostAuthenticator') | Implements an authentication of a client request by extracting client credentials \(client\_id and client\_secret\) from the request body\. This approach is typically used in OAuth 2\.0 client credential flows where the client submits its credentials as part of the request body\. | | [JwtAssertionAuthenticatorBase](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.JwtAssertionAuthenticatorBase 'Abblix\.Oidc\.Server\.Features\.ClientAuthentication\.JwtAssertionAuthenticatorBase') | Base class for JWT assertion\-based client authenticators, providing common validation logic for both private\_key\_jwt and client\_secret\_jwt authentication methods\. | | [NoneClientAuthenticator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.NoneClientAuthenticator 'Abblix\.Oidc\.Server\.Features\.ClientAuthentication\.NoneClientAuthenticator') | Authenticates clients that are configured as public, without requiring client secrets\. | | [PrivateKeyJwtAuthenticator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.PrivateKeyJwtAuthenticator 'Abblix\.Oidc\.Server\.Features\.ClientAuthentication\.PrivateKeyJwtAuthenticator') | Authenticates clients using the Private Key JWT method, verifying the client's identity through a signed JWT that the client provides\. This method is suitable for clients that can securely store and use private keys\. | | [TlsClientAuthenticator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.TlsClientAuthenticator 'Abblix\.Oidc\.Server\.Features\.ClientAuthentication\.TlsClientAuthenticator') | Implements RFC 8705 self\-signed TLS client authentication \(self\_signed\_tls\_client\_auth\)\. Validates the presented client certificate by matching its public key against the client's registered JWKS \(jwks or jwks\_uri\)\. If matched and the client's configured token endpoint auth method is `self_signed_tls_client_auth`, the client is authenticated\. | | [TlsMetadataClientAuthenticator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.TlsMetadataClientAuthenticator 'Abblix\.Oidc\.Server\.Features\.ClientAuthentication\.TlsMetadataClientAuthenticator') | RFC 8705 tls\_client\_auth authenticator\. Matches presented client certificate against client metadata: subject DN and/or Subject Alternative Name entries\. | | Interfaces | | | :--- | :--- | | [IClientAuthenticator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator 'Abblix\.Oidc\.Server\.Features\.ClientAuthentication\.IClientAuthenticator') | Defines the interface for client authentication, supporting various authentication methods during OAuth flows\. | --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.ClientSecretAuthenticator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.ClientAuthentication](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication 'Abblix\.Oidc\.Server\.Features\.ClientAuthentication') ## ClientSecretAuthenticator Class Serves as a base class for client authentication, utilizing client ID and secret\. It validates clients against a known list of clients, ensuring that the client secret provided during the authentication process matches the stored secret for the client\. This class supports various hash algorithms for secure secret comparison and handles client secret expiration\. ```csharp public abstract class ClientSecretAuthenticator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ClientSecretAuthenticator Derived ↳ [ClientSecretBasicAuthenticator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.ClientSecretBasicAuthenticator 'Abblix\.Oidc\.Server\.Features\.ClientAuthentication\.ClientSecretBasicAuthenticator') ↳ [ClientSecretPostAuthenticator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.ClientSecretPostAuthenticator 'Abblix\.Oidc\.Server\.Features\.ClientAuthentication\.ClientSecretPostAuthenticator') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.ClientSecretBasicAuthenticator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.ClientAuthentication](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication 'Abblix\.Oidc\.Server\.Features\.ClientAuthentication') ## ClientSecretBasicAuthenticator Class Implements an authentication of a client request by HTTP 'Authorization' header using the 'Basic' scheme\. This authentication method follows the standards outlined in RFC 7617\. ```csharp public class ClientSecretBasicAuthenticator : Abblix.Oidc.Server.Features.ClientAuthentication.ClientSecretAuthenticator, Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [ClientSecretAuthenticator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.ClientSecretAuthenticator 'Abblix\.Oidc\.Server\.Features\.ClientAuthentication\.ClientSecretAuthenticator') → ClientSecretBasicAuthenticator Implements [IClientAuthenticator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator 'Abblix\.Oidc\.Server\.Features\.ClientAuthentication\.IClientAuthenticator') ### Constructors ## ClientSecretBasicAuthenticator\(ILogger\, IClientInfoProvider, TimeProvider, IHashService\) Constructor {#Abblix.Oidc.Server.Features.ClientAuthentication.ClientSecretBasicAuthenticator.ClientSecretBasicAuthenticator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.ClientAuthentication.ClientSecretBasicAuthenticator_,Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider,System.TimeProvider,Abblix.Oidc.Server.Features.Hashing.IHashService)} Implements an authentication of a client request by HTTP 'Authorization' header using the 'Basic' scheme\. This authentication method follows the standards outlined in RFC 7617\. ```csharp public ClientSecretBasicAuthenticator(Microsoft.Extensions.Logging.ILogger logger, Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider clientInfoProvider, System.TimeProvider clock, Abblix.Oidc.Server.Features.Hashing.IHashService hashService); ``` #### Parameters ###### `logger` [Microsoft\.Extensions\.Logging\.ILogger<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1')[ClientSecretBasicAuthenticator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.ClientSecretBasicAuthenticator 'Abblix\.Oidc\.Server\.Features\.ClientAuthentication\.ClientSecretBasicAuthenticator')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1') {#Abblix.Oidc.Server.Features.ClientAuthentication.ClientSecretBasicAuthenticator.ClientSecretBasicAuthenticator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.ClientAuthentication.ClientSecretBasicAuthenticator_,Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider,System.TimeProvider,Abblix.Oidc.Server.Features.Hashing.IHashService).logger} ###### `clientInfoProvider` [IClientInfoProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.IClientInfoProvider') {#Abblix.Oidc.Server.Features.ClientAuthentication.ClientSecretBasicAuthenticator.ClientSecretBasicAuthenticator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.ClientAuthentication.ClientSecretBasicAuthenticator_,Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider,System.TimeProvider,Abblix.Oidc.Server.Features.Hashing.IHashService).clientInfoProvider} ###### `clock` [System\.TimeProvider](https://learn.microsoft.com/en-us/dotnet/api/system.timeprovider 'System\.TimeProvider') {#Abblix.Oidc.Server.Features.ClientAuthentication.ClientSecretBasicAuthenticator.ClientSecretBasicAuthenticator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.ClientAuthentication.ClientSecretBasicAuthenticator_,Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider,System.TimeProvider,Abblix.Oidc.Server.Features.Hashing.IHashService).clock} ###### `hashService` [IHashService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Hashing.IHashService 'Abblix\.Oidc\.Server\.Features\.Hashing\.IHashService') {#Abblix.Oidc.Server.Features.ClientAuthentication.ClientSecretBasicAuthenticator.ClientSecretBasicAuthenticator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.ClientAuthentication.ClientSecretBasicAuthenticator_,Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider,System.TimeProvider,Abblix.Oidc.Server.Features.Hashing.IHashService).hashService} ### Properties ## ClientSecretBasicAuthenticator\.ClientAuthenticationMethodsSupported Property {#Abblix.Oidc.Server.Features.ClientAuthentication.ClientSecretBasicAuthenticator.ClientAuthenticationMethodsSupported} Specifies the client authentication method this authenticator supports, which is 'client\_secret\_basic'\. This indicates that the authenticator handles client authentication using the Basic Authentication scheme, as defined in RFC 7617, where the client ID and secret are passed in the 'Authorization' header encoded in Base64 format\. ```csharp public System.Collections.Generic.IEnumerable ClientAuthenticationMethodsSupported { get; } ``` Implements [ClientAuthenticationMethodsSupported](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator#Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator.ClientAuthenticationMethodsSupported 'Abblix\.Oidc\.Server\.Features\.ClientAuthentication\.IClientAuthenticator\.ClientAuthenticationMethodsSupported') #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ### Methods ## ClientSecretBasicAuthenticator\.TryAuthenticateClientAsync\(ClientRequest\) Method {#Abblix.Oidc.Server.Features.ClientAuthentication.ClientSecretBasicAuthenticator.TryAuthenticateClientAsync(Abblix.Oidc.Server.Model.ClientRequest)} Tries to authenticate a client based on the 'Basic' authentication scheme\. This method extracts the Base64\-encoded credentials from the 'Authorization' header of the request, decodes them, and attempts to authenticate the client using the extracted credentials\. It adheres to the user\-id and password format as outlined in RFC 7617, Section 2\.1, where the first colon in the credentials string separates the user\-id \(client ID\) and the password \(client secret\)\. ```csharp public System.Threading.Tasks.Task TryAuthenticateClientAsync(Abblix.Oidc.Server.Model.ClientRequest request); ``` #### Parameters ###### `request` [ClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRequest 'Abblix\.Oidc\.Server\.Model\.ClientRequest') {#Abblix.Oidc.Server.Features.ClientAuthentication.ClientSecretBasicAuthenticator.TryAuthenticateClientAsync(Abblix.Oidc.Server.Model.ClientRequest).request} The client request containing the authentication information in the 'Authorization' header\. Implements [TryAuthenticateClientAsync\(ClientRequest\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator#Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator.TryAuthenticateClientAsync(Abblix.Oidc.Server.Model.ClientRequest) 'Abblix\.Oidc\.Server\.Features\.ClientAuthentication\.IClientAuthenticator\.TryAuthenticateClientAsync\(Abblix\.Oidc\.Server\.Model\.ClientRequest\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A [System\.Threading\.Tasks\.Task](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task 'System\.Threading\.Tasks\.Task') representing the asynchronous operation, which upon completion will yield the authenticated [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') or null if authentication fails\. If the 'Authorization' header is missing, malformed, or does not follow the Basic authentication scheme, the method returns null\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.ClientSecretJwtAuthenticator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.ClientAuthentication](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication 'Abblix\.Oidc\.Server\.Features\.ClientAuthentication') ## ClientSecretJwtAuthenticator Class Authenticates client requests using the client\_secret\_jwt authentication method\. This method is used in scenarios where the client signs a JWT with its secret as a means of authentication\. ```csharp public class ClientSecretJwtAuthenticator : Abblix.Oidc.Server.Features.ClientAuthentication.JwtAssertionAuthenticatorBase ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [JwtAssertionAuthenticatorBase](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.JwtAssertionAuthenticatorBase 'Abblix\.Oidc\.Server\.Features\.ClientAuthentication\.JwtAssertionAuthenticatorBase') → ClientSecretJwtAuthenticator ### Constructors ## ClientSecretJwtAuthenticator\(ILogger\, IJsonWebTokenValidator, IClientInfoProvider, IRequestInfoProvider, TimeProvider, IReplayCache, IIssuerProvider, IOptions\\) Constructor {#Abblix.Oidc.Server.Features.ClientAuthentication.ClientSecretJwtAuthenticator.ClientSecretJwtAuthenticator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.ClientAuthentication.ClientSecretJwtAuthenticator_,Abblix.Jwt.IJsonWebTokenValidator,Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider,Abblix.Oidc.Server.Common.Interfaces.IRequestInfoProvider,System.TimeProvider,Abblix.Jwt.ReplayPrevention.IReplayCache,Abblix.Oidc.Server.Features.Issuer.IIssuerProvider,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_)} Authenticates client requests using the client\_secret\_jwt authentication method\. This method is used in scenarios where the client signs a JWT with its secret as a means of authentication\. ```csharp public ClientSecretJwtAuthenticator(Microsoft.Extensions.Logging.ILogger logger, Abblix.Jwt.IJsonWebTokenValidator tokenValidator, Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider clientInfoProvider, Abblix.Oidc.Server.Common.Interfaces.IRequestInfoProvider requestInfoProvider, System.TimeProvider clock, Abblix.Jwt.ReplayPrevention.IReplayCache replayCache, Abblix.Oidc.Server.Features.Issuer.IIssuerProvider issuerProvider, Microsoft.Extensions.Options.IOptions options); ``` #### Parameters ###### `logger` [Microsoft\.Extensions\.Logging\.ILogger<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1')[ClientSecretJwtAuthenticator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.ClientSecretJwtAuthenticator 'Abblix\.Oidc\.Server\.Features\.ClientAuthentication\.ClientSecretJwtAuthenticator')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1') {#Abblix.Oidc.Server.Features.ClientAuthentication.ClientSecretJwtAuthenticator.ClientSecretJwtAuthenticator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.ClientAuthentication.ClientSecretJwtAuthenticator_,Abblix.Jwt.IJsonWebTokenValidator,Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider,Abblix.Oidc.Server.Common.Interfaces.IRequestInfoProvider,System.TimeProvider,Abblix.Jwt.ReplayPrevention.IReplayCache,Abblix.Oidc.Server.Features.Issuer.IIssuerProvider,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_).logger} Logger for recording the authentication process and any issues encountered\. ###### `tokenValidator` [IJsonWebTokenValidator](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.IJsonWebTokenValidator 'Abblix\.Jwt\.IJsonWebTokenValidator') {#Abblix.Oidc.Server.Features.ClientAuthentication.ClientSecretJwtAuthenticator.ClientSecretJwtAuthenticator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.ClientAuthentication.ClientSecretJwtAuthenticator_,Abblix.Jwt.IJsonWebTokenValidator,Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider,Abblix.Oidc.Server.Common.Interfaces.IRequestInfoProvider,System.TimeProvider,Abblix.Jwt.ReplayPrevention.IReplayCache,Abblix.Oidc.Server.Features.Issuer.IIssuerProvider,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_).tokenValidator} Validator for JSON Web Tokens\. ###### `clientInfoProvider` [IClientInfoProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.IClientInfoProvider') {#Abblix.Oidc.Server.Features.ClientAuthentication.ClientSecretJwtAuthenticator.ClientSecretJwtAuthenticator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.ClientAuthentication.ClientSecretJwtAuthenticator_,Abblix.Jwt.IJsonWebTokenValidator,Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider,Abblix.Oidc.Server.Common.Interfaces.IRequestInfoProvider,System.TimeProvider,Abblix.Jwt.ReplayPrevention.IReplayCache,Abblix.Oidc.Server.Features.Issuer.IIssuerProvider,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_).clientInfoProvider} Provider for retrieving client information\. ###### `requestInfoProvider` [IRequestInfoProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IRequestInfoProvider 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IRequestInfoProvider') {#Abblix.Oidc.Server.Features.ClientAuthentication.ClientSecretJwtAuthenticator.ClientSecretJwtAuthenticator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.ClientAuthentication.ClientSecretJwtAuthenticator_,Abblix.Jwt.IJsonWebTokenValidator,Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider,Abblix.Oidc.Server.Common.Interfaces.IRequestInfoProvider,System.TimeProvider,Abblix.Jwt.ReplayPrevention.IReplayCache,Abblix.Oidc.Server.Features.Issuer.IIssuerProvider,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_).requestInfoProvider} Provider for retrieving request information\. ###### `clock` [System\.TimeProvider](https://learn.microsoft.com/en-us/dotnet/api/system.timeprovider 'System\.TimeProvider') {#Abblix.Oidc.Server.Features.ClientAuthentication.ClientSecretJwtAuthenticator.ClientSecretJwtAuthenticator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.ClientAuthentication.ClientSecretJwtAuthenticator_,Abblix.Jwt.IJsonWebTokenValidator,Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider,Abblix.Oidc.Server.Common.Interfaces.IRequestInfoProvider,System.TimeProvider,Abblix.Jwt.ReplayPrevention.IReplayCache,Abblix.Oidc.Server.Features.Issuer.IIssuerProvider,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_).clock} Time provider for checking secret expiration\. ###### `replayCache` [IReplayCache](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ReplayPrevention.IReplayCache 'Abblix\.Jwt\.ReplayPrevention\.IReplayCache') {#Abblix.Oidc.Server.Features.ClientAuthentication.ClientSecretJwtAuthenticator.ClientSecretJwtAuthenticator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.ClientAuthentication.ClientSecretJwtAuthenticator_,Abblix.Jwt.IJsonWebTokenValidator,Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider,Abblix.Oidc.Server.Common.Interfaces.IRequestInfoProvider,System.TimeProvider,Abblix.Jwt.ReplayPrevention.IReplayCache,Abblix.Oidc.Server.Features.Issuer.IIssuerProvider,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_).replayCache} Replay cache that records assertion jti values and atomically rejects reuse\. ###### `issuerProvider` [IIssuerProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Issuer.IIssuerProvider 'Abblix\.Oidc\.Server\.Features\.Issuer\.IIssuerProvider') {#Abblix.Oidc.Server.Features.ClientAuthentication.ClientSecretJwtAuthenticator.ClientSecretJwtAuthenticator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.ClientAuthentication.ClientSecretJwtAuthenticator_,Abblix.Jwt.IJsonWebTokenValidator,Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider,Abblix.Oidc.Server.Common.Interfaces.IRequestInfoProvider,System.TimeProvider,Abblix.Jwt.ReplayPrevention.IReplayCache,Abblix.Oidc.Server.Features.Issuer.IIssuerProvider,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_).issuerProvider} Supplies the issuer identifier a profile\-governed assertion must name\. ###### `options` [Microsoft\.Extensions\.Options\.IOptions<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptions-1 'Microsoft\.Extensions\.Options\.IOptions\`1')[OidcOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptions-1 'Microsoft\.Extensions\.Options\.IOptions\`1') {#Abblix.Oidc.Server.Features.ClientAuthentication.ClientSecretJwtAuthenticator.ClientSecretJwtAuthenticator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.ClientAuthentication.ClientSecretJwtAuthenticator_,Abblix.Jwt.IJsonWebTokenValidator,Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider,Abblix.Oidc.Server.Common.Interfaces.IRequestInfoProvider,System.TimeProvider,Abblix.Jwt.ReplayPrevention.IReplayCache,Abblix.Oidc.Server.Features.Issuer.IIssuerProvider,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_).options} Supplies the server\-wide default security profile\. ### Properties ## ClientSecretJwtAuthenticator\.ClientAuthenticationMethodsSupported Property {#Abblix.Oidc.Server.Features.ClientAuthentication.ClientSecretJwtAuthenticator.ClientAuthenticationMethodsSupported} Specifies the client authentication method this authenticator supports, which is 'client\_secret\_jwt'\. This indicates that the authenticator handles client authentication using JSON Web Tokens \(JWT\) for the client secret, as defined in the OpenID Connect specification\. It involves using JWTs as client credentials for authentication, where the JWT assertion is signed by the client's secret key\. ```csharp public override System.Collections.Generic.IEnumerable ClientAuthenticationMethodsSupported { get; } ``` Implements [ClientAuthenticationMethodsSupported](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator#Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator.ClientAuthenticationMethodsSupported 'Abblix\.Oidc\.Server\.Features\.ClientAuthentication\.IClientAuthenticator\.ClientAuthenticationMethodsSupported') #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.ClientSecretPostAuthenticator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.ClientAuthentication](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication 'Abblix\.Oidc\.Server\.Features\.ClientAuthentication') ## ClientSecretPostAuthenticator Class Implements an authentication of a client request by extracting client credentials \(client\_id and client\_secret\) from the request body\. This approach is typically used in OAuth 2\.0 client credential flows where the client submits its credentials as part of the request body\. ```csharp public class ClientSecretPostAuthenticator : Abblix.Oidc.Server.Features.ClientAuthentication.ClientSecretAuthenticator, Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [ClientSecretAuthenticator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.ClientSecretAuthenticator 'Abblix\.Oidc\.Server\.Features\.ClientAuthentication\.ClientSecretAuthenticator') → ClientSecretPostAuthenticator Implements [IClientAuthenticator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator 'Abblix\.Oidc\.Server\.Features\.ClientAuthentication\.IClientAuthenticator') ### Constructors ## ClientSecretPostAuthenticator\(ILogger\, IClientInfoProvider, TimeProvider, IHashService\) Constructor {#Abblix.Oidc.Server.Features.ClientAuthentication.ClientSecretPostAuthenticator.ClientSecretPostAuthenticator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.ClientAuthentication.ClientSecretPostAuthenticator_,Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider,System.TimeProvider,Abblix.Oidc.Server.Features.Hashing.IHashService)} Implements an authentication of a client request by extracting client credentials \(client\_id and client\_secret\) from the request body\. This approach is typically used in OAuth 2\.0 client credential flows where the client submits its credentials as part of the request body\. ```csharp public ClientSecretPostAuthenticator(Microsoft.Extensions.Logging.ILogger logger, Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider clientInfoProvider, System.TimeProvider clock, Abblix.Oidc.Server.Features.Hashing.IHashService hashService); ``` #### Parameters ###### `logger` [Microsoft\.Extensions\.Logging\.ILogger<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1')[ClientSecretPostAuthenticator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.ClientSecretPostAuthenticator 'Abblix\.Oidc\.Server\.Features\.ClientAuthentication\.ClientSecretPostAuthenticator')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1') {#Abblix.Oidc.Server.Features.ClientAuthentication.ClientSecretPostAuthenticator.ClientSecretPostAuthenticator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.ClientAuthentication.ClientSecretPostAuthenticator_,Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider,System.TimeProvider,Abblix.Oidc.Server.Features.Hashing.IHashService).logger} ###### `clientInfoProvider` [IClientInfoProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.IClientInfoProvider') {#Abblix.Oidc.Server.Features.ClientAuthentication.ClientSecretPostAuthenticator.ClientSecretPostAuthenticator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.ClientAuthentication.ClientSecretPostAuthenticator_,Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider,System.TimeProvider,Abblix.Oidc.Server.Features.Hashing.IHashService).clientInfoProvider} ###### `clock` [System\.TimeProvider](https://learn.microsoft.com/en-us/dotnet/api/system.timeprovider 'System\.TimeProvider') {#Abblix.Oidc.Server.Features.ClientAuthentication.ClientSecretPostAuthenticator.ClientSecretPostAuthenticator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.ClientAuthentication.ClientSecretPostAuthenticator_,Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider,System.TimeProvider,Abblix.Oidc.Server.Features.Hashing.IHashService).clock} ###### `hashService` [IHashService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Hashing.IHashService 'Abblix\.Oidc\.Server\.Features\.Hashing\.IHashService') {#Abblix.Oidc.Server.Features.ClientAuthentication.ClientSecretPostAuthenticator.ClientSecretPostAuthenticator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.ClientAuthentication.ClientSecretPostAuthenticator_,Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider,System.TimeProvider,Abblix.Oidc.Server.Features.Hashing.IHashService).hashService} ### Properties ## ClientSecretPostAuthenticator\.ClientAuthenticationMethodsSupported Property {#Abblix.Oidc.Server.Features.ClientAuthentication.ClientSecretPostAuthenticator.ClientAuthenticationMethodsSupported} Specifies the client authentication method this authenticator supports, which is 'client\_secret\_post'\. This property indicates that the authenticator is designed to handle client authentication where the client secret is sent in the request body parameters\. It is a straightforward method for clients to authenticate with the authorization server by including the client\_id and client\_secret in the body of the HTTP request\. ```csharp public System.Collections.Generic.IEnumerable ClientAuthenticationMethodsSupported { get; } ``` Implements [ClientAuthenticationMethodsSupported](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator#Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator.ClientAuthenticationMethodsSupported 'Abblix\.Oidc\.Server\.Features\.ClientAuthentication\.IClientAuthenticator\.ClientAuthenticationMethodsSupported') #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ### Methods ## ClientSecretPostAuthenticator\.TryAuthenticateClientAsync\(ClientRequest\) Method {#Abblix.Oidc.Server.Features.ClientAuthentication.ClientSecretPostAuthenticator.TryAuthenticateClientAsync(Abblix.Oidc.Server.Model.ClientRequest)} Asynchronously tries to authenticate a client based on credentials \(client\_id and client\_secret\) provided in the request body\. The method delegates to [Abblix\.Oidc\.Server\.Features\.ClientAuthentication\.ClientSecretAuthenticator\.TryAuthenticateAsync\(System\.String,System\.String,System\.String\)](https://learn.microsoft.com/en-us/dotnet/api/abblix.oidc.server.features.clientauthentication.clientsecretauthenticator.tryauthenticateasync#abblix-oidc-server-features-clientauthentication-clientsecretauthenticator-tryauthenticateasync(system-string-system-string-system-string) 'Abblix\.Oidc\.Server\.Features\.ClientAuthentication\.ClientSecretAuthenticator\.TryAuthenticateAsync\(System\.String,System\.String,System\.String\)') with the extracted client\_id and client\_secret\. ```csharp public System.Threading.Tasks.Task TryAuthenticateClientAsync(Abblix.Oidc.Server.Model.ClientRequest request); ``` #### Parameters ###### `request` [ClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRequest 'Abblix\.Oidc\.Server\.Model\.ClientRequest') {#Abblix.Oidc.Server.Features.ClientAuthentication.ClientSecretPostAuthenticator.TryAuthenticateClientAsync(Abblix.Oidc.Server.Model.ClientRequest).request} The client request containing the client\_id and client\_secret for authentication\. Implements [TryAuthenticateClientAsync\(ClientRequest\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator#Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator.TryAuthenticateClientAsync(Abblix.Oidc.Server.Model.ClientRequest) 'Abblix\.Oidc\.Server\.Features\.ClientAuthentication\.IClientAuthenticator\.TryAuthenticateClientAsync\(Abblix\.Oidc\.Server\.Model\.ClientRequest\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A [System\.Threading\.Tasks\.Task](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task 'System\.Threading\.Tasks\.Task') representing the asynchronous operation, which upon completion will yield the authenticated [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') or null if authentication fails\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.ClientAuthentication](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication 'Abblix\.Oidc\.Server\.Features\.ClientAuthentication') ## IClientAuthenticator Interface Defines the interface for client authentication, supporting various authentication methods during OAuth flows\. ```csharp public interface IClientAuthenticator ``` Derived ↳ [ClientSecretBasicAuthenticator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.ClientSecretBasicAuthenticator 'Abblix\.Oidc\.Server\.Features\.ClientAuthentication\.ClientSecretBasicAuthenticator') ↳ [ClientSecretPostAuthenticator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.ClientSecretPostAuthenticator 'Abblix\.Oidc\.Server\.Features\.ClientAuthentication\.ClientSecretPostAuthenticator') ↳ [JwtAssertionAuthenticatorBase](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.JwtAssertionAuthenticatorBase 'Abblix\.Oidc\.Server\.Features\.ClientAuthentication\.JwtAssertionAuthenticatorBase') ↳ [NoneClientAuthenticator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.NoneClientAuthenticator 'Abblix\.Oidc\.Server\.Features\.ClientAuthentication\.NoneClientAuthenticator') ↳ [TlsClientAuthenticator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.TlsClientAuthenticator 'Abblix\.Oidc\.Server\.Features\.ClientAuthentication\.TlsClientAuthenticator') ↳ [TlsMetadataClientAuthenticator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.TlsMetadataClientAuthenticator 'Abblix\.Oidc\.Server\.Features\.ClientAuthentication\.TlsMetadataClientAuthenticator') ### Properties ## IClientAuthenticator\.ClientAuthenticationMethodsSupported Property {#Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator.ClientAuthenticationMethodsSupported} Specifies the authentication methods supported by this authenticator\. This property should return a value that identifies the authentication scheme \(e\.g\., "client\_secret\_basic", "private\_key\_jwt"\) supported by the implementer\. ```csharp System.Collections.Generic.IEnumerable ClientAuthenticationMethodsSupported { get; } ``` #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ### Methods ## IClientAuthenticator\.TryAuthenticateClientAsync\(ClientRequest\) Method {#Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator.TryAuthenticateClientAsync(Abblix.Oidc.Server.Model.ClientRequest)} Attempts to authenticate a client based on the provided request\. It verifies the client's credentials and determines the authenticity of the client\. ```csharp System.Threading.Tasks.Task TryAuthenticateClientAsync(Abblix.Oidc.Server.Model.ClientRequest request); ``` #### Parameters ###### `request` [ClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRequest 'Abblix\.Oidc\.Server\.Model\.ClientRequest') {#Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator.TryAuthenticateClientAsync(Abblix.Oidc.Server.Model.ClientRequest).request} The client request containing authentication information\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task that resolves to the authenticated [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') if successful, or null if authentication fails\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.JwtAssertionAuthenticatorBase.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.ClientAuthentication](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication 'Abblix\.Oidc\.Server\.Features\.ClientAuthentication') ## JwtAssertionAuthenticatorBase Class Base class for JWT assertion\-based client authenticators, providing common validation logic for both private\_key\_jwt and client\_secret\_jwt authentication methods\. ```csharp public abstract class JwtAssertionAuthenticatorBase : Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → JwtAssertionAuthenticatorBase Derived ↳ [ClientSecretJwtAuthenticator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.ClientSecretJwtAuthenticator 'Abblix\.Oidc\.Server\.Features\.ClientAuthentication\.ClientSecretJwtAuthenticator') ↳ [PrivateKeyJwtAuthenticator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.PrivateKeyJwtAuthenticator 'Abblix\.Oidc\.Server\.Features\.ClientAuthentication\.PrivateKeyJwtAuthenticator') Implements [IClientAuthenticator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator 'Abblix\.Oidc\.Server\.Features\.ClientAuthentication\.IClientAuthenticator') ### Properties ## JwtAssertionAuthenticatorBase\.ClientAuthenticationMethodsSupported Property {#Abblix.Oidc.Server.Features.ClientAuthentication.JwtAssertionAuthenticatorBase.ClientAuthenticationMethodsSupported} Specifies the client authentication methods supported by this authenticator\. ```csharp public abstract System.Collections.Generic.IEnumerable ClientAuthenticationMethodsSupported { get; } ``` Implements [ClientAuthenticationMethodsSupported](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator#Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator.ClientAuthenticationMethodsSupported 'Abblix\.Oidc\.Server\.Features\.ClientAuthentication\.IClientAuthenticator\.ClientAuthenticationMethodsSupported') #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ### Methods ## JwtAssertionAuthenticatorBase\.TryAuthenticateClientAsync\(ClientRequest\) Method {#Abblix.Oidc.Server.Features.ClientAuthentication.JwtAssertionAuthenticatorBase.TryAuthenticateClientAsync(Abblix.Oidc.Server.Model.ClientRequest)} Attempts to authenticate a client using JWT assertion by validating the JWT provided in the client request\. ```csharp public System.Threading.Tasks.Task TryAuthenticateClientAsync(Abblix.Oidc.Server.Model.ClientRequest request); ``` #### Parameters ###### `request` [ClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRequest 'Abblix\.Oidc\.Server\.Model\.ClientRequest') {#Abblix.Oidc.Server.Features.ClientAuthentication.JwtAssertionAuthenticatorBase.TryAuthenticateClientAsync(Abblix.Oidc.Server.Model.ClientRequest).request} The client request containing the JWT to authenticate\. Implements [TryAuthenticateClientAsync\(ClientRequest\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator#Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator.TryAuthenticateClientAsync(Abblix.Oidc.Server.Model.ClientRequest) 'Abblix\.Oidc\.Server\.Features\.ClientAuthentication\.IClientAuthenticator\.TryAuthenticateClientAsync\(Abblix\.Oidc\.Server\.Model\.ClientRequest\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') The authenticated [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo'), or null if authentication fails\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.NoneClientAuthenticator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.ClientAuthentication](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication 'Abblix\.Oidc\.Server\.Features\.ClientAuthentication') ## NoneClientAuthenticator Class Authenticates clients that are configured as public, without requiring client secrets\. ```csharp public class NoneClientAuthenticator : Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → NoneClientAuthenticator Implements [IClientAuthenticator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator 'Abblix\.Oidc\.Server\.Features\.ClientAuthentication\.IClientAuthenticator') ### Remarks This authenticator is designed for public clients where client secrets cannot be securely stored\. It ensures that only clients marked as public in the configuration are allowed to proceed without client authentication\. This approach is typically used in scenarios where the client application runs in an environment that cannot securely maintain a secret, such as single\-page applications or native mobile apps\. ### Constructors ## NoneClientAuthenticator\(ILogger\, IClientInfoProvider\) Constructor {#Abblix.Oidc.Server.Features.ClientAuthentication.NoneClientAuthenticator.NoneClientAuthenticator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.ClientAuthentication.NoneClientAuthenticator_,Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider)} Authenticates clients that are configured as public, without requiring client secrets\. ```csharp public NoneClientAuthenticator(Microsoft.Extensions.Logging.ILogger logger, Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider clientInfoProvider); ``` #### Parameters ###### `logger` [Microsoft\.Extensions\.Logging\.ILogger<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1')[NoneClientAuthenticator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.NoneClientAuthenticator 'Abblix\.Oidc\.Server\.Features\.ClientAuthentication\.NoneClientAuthenticator')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1') {#Abblix.Oidc.Server.Features.ClientAuthentication.NoneClientAuthenticator.NoneClientAuthenticator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.ClientAuthentication.NoneClientAuthenticator_,Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider).logger} The logger for logging authentication events\. ###### `clientInfoProvider` [IClientInfoProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.IClientInfoProvider') {#Abblix.Oidc.Server.Features.ClientAuthentication.NoneClientAuthenticator.NoneClientAuthenticator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.ClientAuthentication.NoneClientAuthenticator_,Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider).clientInfoProvider} The provider for retrieving client information\. ### Remarks This authenticator is designed for public clients where client secrets cannot be securely stored\. It ensures that only clients marked as public in the configuration are allowed to proceed without client authentication\. This approach is typically used in scenarios where the client application runs in an environment that cannot securely maintain a secret, such as single\-page applications or native mobile apps\. ### Properties ## NoneClientAuthenticator\.ClientAuthenticationMethodsSupported Property {#Abblix.Oidc.Server.Features.ClientAuthentication.NoneClientAuthenticator.ClientAuthenticationMethodsSupported} Indicates the client authentication method supported by this authenticator\. For this authenticator, no client authentication is required, aligning with scenarios where client authentication is deemed unnecessary or where anonymous access is permitted\. ```csharp public System.Collections.Generic.IEnumerable ClientAuthenticationMethodsSupported { get; } ``` Implements [ClientAuthenticationMethodsSupported](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator#Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator.ClientAuthenticationMethodsSupported 'Abblix\.Oidc\.Server\.Features\.ClientAuthentication\.IClientAuthenticator\.ClientAuthenticationMethodsSupported') #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ### Methods ## NoneClientAuthenticator\.TryAuthenticateClientAsync\(ClientRequest\) Method {#Abblix.Oidc.Server.Features.ClientAuthentication.NoneClientAuthenticator.TryAuthenticateClientAsync(Abblix.Oidc.Server.Model.ClientRequest)} Attempts to authenticate a client based solely on its ID, without requiring a client secret\. ```csharp public System.Threading.Tasks.Task TryAuthenticateClientAsync(Abblix.Oidc.Server.Model.ClientRequest request); ``` #### Parameters ###### `request` [ClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRequest 'Abblix\.Oidc\.Server\.Model\.ClientRequest') {#Abblix.Oidc.Server.Features.ClientAuthentication.NoneClientAuthenticator.TryAuthenticateClientAsync(Abblix.Oidc.Server.Model.ClientRequest).request} The client request containing the client's ID\. Implements [TryAuthenticateClientAsync\(ClientRequest\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator#Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator.TryAuthenticateClientAsync(Abblix.Oidc.Server.Model.ClientRequest) 'Abblix\.Oidc\.Server\.Features\.ClientAuthentication\.IClientAuthenticator\.TryAuthenticateClientAsync\(Abblix\.Oidc\.Server\.Model\.ClientRequest\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task that returns the authenticated [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') if successful, or null if authentication fails\. ### Remarks This method is suitable for public clients where a secret is not issued or cannot be securely stored\. It verifies the existence of the client and ensures it is marked as a public client in the configuration\. Clients not meeting these criteria are not authenticated\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.PrivateKeyJwtAuthenticator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.ClientAuthentication](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication 'Abblix\.Oidc\.Server\.Features\.ClientAuthentication') ## PrivateKeyJwtAuthenticator Class Authenticates clients using the Private Key JWT method, verifying the client's identity through a signed JWT that the client provides\. This method is suitable for clients that can securely store and use private keys\. ```csharp public class PrivateKeyJwtAuthenticator : Abblix.Oidc.Server.Features.ClientAuthentication.JwtAssertionAuthenticatorBase ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [JwtAssertionAuthenticatorBase](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.JwtAssertionAuthenticatorBase 'Abblix\.Oidc\.Server\.Features\.ClientAuthentication\.JwtAssertionAuthenticatorBase') → PrivateKeyJwtAuthenticator ### Constructors ## PrivateKeyJwtAuthenticator\(ILogger\, IReplayCache, IServiceProvider, IIssuerProvider, IOptions\, TimeProvider\) Constructor {#Abblix.Oidc.Server.Features.ClientAuthentication.PrivateKeyJwtAuthenticator.PrivateKeyJwtAuthenticator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.ClientAuthentication.PrivateKeyJwtAuthenticator_,Abblix.Jwt.ReplayPrevention.IReplayCache,System.IServiceProvider,Abblix.Oidc.Server.Features.Issuer.IIssuerProvider,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,System.TimeProvider)} Authenticates clients using the Private Key JWT method, verifying the client's identity through a signed JWT that the client provides\. This method is suitable for clients that can securely store and use private keys\. ```csharp public PrivateKeyJwtAuthenticator(Microsoft.Extensions.Logging.ILogger logger, Abblix.Jwt.ReplayPrevention.IReplayCache replayCache, System.IServiceProvider serviceProvider, Abblix.Oidc.Server.Features.Issuer.IIssuerProvider issuerProvider, Microsoft.Extensions.Options.IOptions options, System.TimeProvider timeProvider); ``` #### Parameters ###### `logger` [Microsoft\.Extensions\.Logging\.ILogger<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1')[PrivateKeyJwtAuthenticator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.PrivateKeyJwtAuthenticator 'Abblix\.Oidc\.Server\.Features\.ClientAuthentication\.PrivateKeyJwtAuthenticator')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1') {#Abblix.Oidc.Server.Features.ClientAuthentication.PrivateKeyJwtAuthenticator.PrivateKeyJwtAuthenticator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.ClientAuthentication.PrivateKeyJwtAuthenticator_,Abblix.Jwt.ReplayPrevention.IReplayCache,System.IServiceProvider,Abblix.Oidc.Server.Features.Issuer.IIssuerProvider,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,System.TimeProvider).logger} Logger for recording the authentication process and any issues encountered\. ###### `replayCache` [IReplayCache](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ReplayPrevention.IReplayCache 'Abblix\.Jwt\.ReplayPrevention\.IReplayCache') {#Abblix.Oidc.Server.Features.ClientAuthentication.PrivateKeyJwtAuthenticator.PrivateKeyJwtAuthenticator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.ClientAuthentication.PrivateKeyJwtAuthenticator_,Abblix.Jwt.ReplayPrevention.IReplayCache,System.IServiceProvider,Abblix.Oidc.Server.Features.Issuer.IIssuerProvider,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,System.TimeProvider).replayCache} Replay cache that records assertion jti values and atomically rejects reuse\. ###### `serviceProvider` [System\.IServiceProvider](https://learn.microsoft.com/en-us/dotnet/api/system.iserviceprovider 'System\.IServiceProvider') {#Abblix.Oidc.Server.Features.ClientAuthentication.PrivateKeyJwtAuthenticator.PrivateKeyJwtAuthenticator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.ClientAuthentication.PrivateKeyJwtAuthenticator_,Abblix.Jwt.ReplayPrevention.IReplayCache,System.IServiceProvider,Abblix.Oidc.Server.Features.Issuer.IIssuerProvider,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,System.TimeProvider).serviceProvider} Service provider used to resolve scoped dependencies\. ###### `issuerProvider` [IIssuerProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Issuer.IIssuerProvider 'Abblix\.Oidc\.Server\.Features\.Issuer\.IIssuerProvider') {#Abblix.Oidc.Server.Features.ClientAuthentication.PrivateKeyJwtAuthenticator.PrivateKeyJwtAuthenticator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.ClientAuthentication.PrivateKeyJwtAuthenticator_,Abblix.Jwt.ReplayPrevention.IReplayCache,System.IServiceProvider,Abblix.Oidc.Server.Features.Issuer.IIssuerProvider,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,System.TimeProvider).issuerProvider} Supplies the issuer identifier a profile\-governed assertion must name\. ###### `options` [Microsoft\.Extensions\.Options\.IOptions<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptions-1 'Microsoft\.Extensions\.Options\.IOptions\`1')[OidcOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptions-1 'Microsoft\.Extensions\.Options\.IOptions\`1') {#Abblix.Oidc.Server.Features.ClientAuthentication.PrivateKeyJwtAuthenticator.PrivateKeyJwtAuthenticator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.ClientAuthentication.PrivateKeyJwtAuthenticator_,Abblix.Jwt.ReplayPrevention.IReplayCache,System.IServiceProvider,Abblix.Oidc.Server.Features.Issuer.IIssuerProvider,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,System.TimeProvider).options} Supplies the server\-wide default security profile\. ###### `timeProvider` [System\.TimeProvider](https://learn.microsoft.com/en-us/dotnet/api/system.timeprovider 'System\.TimeProvider') {#Abblix.Oidc.Server.Features.ClientAuthentication.PrivateKeyJwtAuthenticator.PrivateKeyJwtAuthenticator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.ClientAuthentication.PrivateKeyJwtAuthenticator_,Abblix.Jwt.ReplayPrevention.IReplayCache,System.IServiceProvider,Abblix.Oidc.Server.Features.Issuer.IIssuerProvider,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,System.TimeProvider).timeProvider} Judges the assertion's timestamps against the client's own profile\. ### Properties ## PrivateKeyJwtAuthenticator\.ClientAuthenticationMethodsSupported Property {#Abblix.Oidc.Server.Features.ClientAuthentication.PrivateKeyJwtAuthenticator.ClientAuthenticationMethodsSupported} Indicates the client authentication method supported by this authenticator\. This method uses private keys and JSON Web Tokens \(JWT\) for client authentication, allowing clients to assert their identity through the use of asymmetric key cryptography\. It is designed for environments where the client can securely hold a private key\. ```csharp public override System.Collections.Generic.IEnumerable ClientAuthenticationMethodsSupported { get; } ``` Implements [ClientAuthenticationMethodsSupported](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator#Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator.ClientAuthenticationMethodsSupported 'Abblix\.Oidc\.Server\.Features\.ClientAuthentication\.IClientAuthenticator\.ClientAuthenticationMethodsSupported') #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.TlsClientAuthenticator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.ClientAuthentication](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication 'Abblix\.Oidc\.Server\.Features\.ClientAuthentication') ## TlsClientAuthenticator Class Implements RFC 8705 self\-signed TLS client authentication \(self\_signed\_tls\_client\_auth\)\. Validates the presented client certificate by matching its public key against the client's registered JWKS \(jwks or jwks\_uri\)\. If matched and the client's configured token endpoint auth method is `self_signed_tls_client_auth`, the client is authenticated\. ```csharp public class TlsClientAuthenticator : Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → TlsClientAuthenticator Implements [IClientAuthenticator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator 'Abblix\.Oidc\.Server\.Features\.ClientAuthentication\.IClientAuthenticator') ### Constructors ## TlsClientAuthenticator\(ILogger\, IClientInfoProvider, IClientKeysProvider\) Constructor {#Abblix.Oidc.Server.Features.ClientAuthentication.TlsClientAuthenticator.TlsClientAuthenticator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.ClientAuthentication.TlsClientAuthenticator_,Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider,Abblix.Oidc.Server.Features.ClientInformation.IClientKeysProvider)} Implements RFC 8705 self\-signed TLS client authentication \(self\_signed\_tls\_client\_auth\)\. Validates the presented client certificate by matching its public key against the client's registered JWKS \(jwks or jwks\_uri\)\. If matched and the client's configured token endpoint auth method is `self_signed_tls_client_auth`, the client is authenticated\. ```csharp public TlsClientAuthenticator(Microsoft.Extensions.Logging.ILogger logger, Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider clientInfoProvider, Abblix.Oidc.Server.Features.ClientInformation.IClientKeysProvider clientKeysProvider); ``` #### Parameters ###### `logger` [Microsoft\.Extensions\.Logging\.ILogger<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1')[TlsClientAuthenticator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.TlsClientAuthenticator 'Abblix\.Oidc\.Server\.Features\.ClientAuthentication\.TlsClientAuthenticator')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1') {#Abblix.Oidc.Server.Features.ClientAuthentication.TlsClientAuthenticator.TlsClientAuthenticator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.ClientAuthentication.TlsClientAuthenticator_,Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider,Abblix.Oidc.Server.Features.ClientInformation.IClientKeysProvider).logger} ###### `clientInfoProvider` [IClientInfoProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.IClientInfoProvider') {#Abblix.Oidc.Server.Features.ClientAuthentication.TlsClientAuthenticator.TlsClientAuthenticator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.ClientAuthentication.TlsClientAuthenticator_,Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider,Abblix.Oidc.Server.Features.ClientInformation.IClientKeysProvider).clientInfoProvider} ###### `clientKeysProvider` [IClientKeysProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.IClientKeysProvider 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.IClientKeysProvider') {#Abblix.Oidc.Server.Features.ClientAuthentication.TlsClientAuthenticator.TlsClientAuthenticator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.ClientAuthentication.TlsClientAuthenticator_,Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider,Abblix.Oidc.Server.Features.ClientInformation.IClientKeysProvider).clientKeysProvider} ### Properties ## TlsClientAuthenticator\.ClientAuthenticationMethodsSupported Property {#Abblix.Oidc.Server.Features.ClientAuthentication.TlsClientAuthenticator.ClientAuthenticationMethodsSupported} Gets the collection of client authentication methods supported by this authenticator\. ```csharp public System.Collections.Generic.IEnumerable ClientAuthenticationMethodsSupported { get; } ``` Implements [ClientAuthenticationMethodsSupported](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator#Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator.ClientAuthenticationMethodsSupported 'Abblix\.Oidc\.Server\.Features\.ClientAuthentication\.IClientAuthenticator\.ClientAuthenticationMethodsSupported') #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') A collection containing [SelfSignedTlsClientAuth](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ClientAuthenticationMethods#Abblix.Oidc.Server.Common.Constants.ClientAuthenticationMethods.SelfSignedTlsClientAuth 'Abblix\.Oidc\.Server\.Common\.Constants\.ClientAuthenticationMethods\.SelfSignedTlsClientAuth')\. ### Methods ## TlsClientAuthenticator\.TryAuthenticateClientAsync\(ClientRequest\) Method {#Abblix.Oidc.Server.Features.ClientAuthentication.TlsClientAuthenticator.TryAuthenticateClientAsync(Abblix.Oidc.Server.Model.ClientRequest)} Attempts to authenticate a client using self\-signed TLS client authentication\. Validates the client certificate's public key against the client's registered JWKS\. ```csharp public System.Threading.Tasks.Task TryAuthenticateClientAsync(Abblix.Oidc.Server.Model.ClientRequest request); ``` #### Parameters ###### `request` [ClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRequest 'Abblix\.Oidc\.Server\.Model\.ClientRequest') {#Abblix.Oidc.Server.Features.ClientAuthentication.TlsClientAuthenticator.TryAuthenticateClientAsync(Abblix.Oidc.Server.Model.ClientRequest).request} The client request containing the certificate and client ID to authenticate\. Implements [TryAuthenticateClientAsync\(ClientRequest\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator#Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator.TryAuthenticateClientAsync(Abblix.Oidc.Server.Model.ClientRequest) 'Abblix\.Oidc\.Server\.Features\.ClientAuthentication\.IClientAuthenticator\.TryAuthenticateClientAsync\(Abblix\.Oidc\.Server\.Model\.ClientRequest\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task that returns the authenticated [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') if successful; otherwise, null\. Returns null if no certificate is provided, client not found, authentication method doesn't match, or certificate public key doesn't match any key in the client's JWKS\. ### Remarks This method implements RFC 8705 self\_signed\_tls\_client\_auth by: 1\. Verifying a client certificate is present 2\. Looking up client configuration by client\_id 3\. Checking the client uses self\_signed\_tls\_client\_auth method 4\. Extracting the public key from the certificate 5\. Comparing it against all keys in the client's JWKS \(jwks or jwks\_uri\) Supports both RSA and ECDSA certificates\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.TlsMetadataClientAuthenticator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.ClientAuthentication](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication 'Abblix\.Oidc\.Server\.Features\.ClientAuthentication') ## TlsMetadataClientAuthenticator Class RFC 8705 tls\_client\_auth authenticator\. Matches presented client certificate against client metadata: subject DN and/or Subject Alternative Name entries\. ```csharp public class TlsMetadataClientAuthenticator : Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → TlsMetadataClientAuthenticator Implements [IClientAuthenticator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator 'Abblix\.Oidc\.Server\.Features\.ClientAuthentication\.IClientAuthenticator') ### Constructors ## TlsMetadataClientAuthenticator\(ILogger\, IClientInfoProvider\) Constructor {#Abblix.Oidc.Server.Features.ClientAuthentication.TlsMetadataClientAuthenticator.TlsMetadataClientAuthenticator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.ClientAuthentication.TlsMetadataClientAuthenticator_,Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider)} RFC 8705 tls\_client\_auth authenticator\. Matches presented client certificate against client metadata: subject DN and/or Subject Alternative Name entries\. ```csharp public TlsMetadataClientAuthenticator(Microsoft.Extensions.Logging.ILogger logger, Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider clientInfoProvider); ``` #### Parameters ###### `logger` [Microsoft\.Extensions\.Logging\.ILogger<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1')[TlsMetadataClientAuthenticator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.TlsMetadataClientAuthenticator 'Abblix\.Oidc\.Server\.Features\.ClientAuthentication\.TlsMetadataClientAuthenticator')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1') {#Abblix.Oidc.Server.Features.ClientAuthentication.TlsMetadataClientAuthenticator.TlsMetadataClientAuthenticator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.ClientAuthentication.TlsMetadataClientAuthenticator_,Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider).logger} ###### `clientInfoProvider` [IClientInfoProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.IClientInfoProvider') {#Abblix.Oidc.Server.Features.ClientAuthentication.TlsMetadataClientAuthenticator.TlsMetadataClientAuthenticator(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.ClientAuthentication.TlsMetadataClientAuthenticator_,Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider).clientInfoProvider} ### Properties ## TlsMetadataClientAuthenticator\.ClientAuthenticationMethodsSupported Property {#Abblix.Oidc.Server.Features.ClientAuthentication.TlsMetadataClientAuthenticator.ClientAuthenticationMethodsSupported} Gets the collection of client authentication methods supported by this authenticator\. ```csharp public System.Collections.Generic.IEnumerable ClientAuthenticationMethodsSupported { get; } ``` Implements [ClientAuthenticationMethodsSupported](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator#Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator.ClientAuthenticationMethodsSupported 'Abblix\.Oidc\.Server\.Features\.ClientAuthentication\.IClientAuthenticator\.ClientAuthenticationMethodsSupported') #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') A collection containing [TlsClientAuth](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ClientAuthenticationMethods#Abblix.Oidc.Server.Common.Constants.ClientAuthenticationMethods.TlsClientAuth 'Abblix\.Oidc\.Server\.Common\.Constants\.ClientAuthenticationMethods\.TlsClientAuth')\. ### Methods ## TlsMetadataClientAuthenticator\.TryAuthenticateClientAsync\(ClientRequest\) Method {#Abblix.Oidc.Server.Features.ClientAuthentication.TlsMetadataClientAuthenticator.TryAuthenticateClientAsync(Abblix.Oidc.Server.Model.ClientRequest)} Attempts to authenticate a client using mutual TLS with metadata\-based certificate validation\. Validates the client certificate against configured Subject DN and/or Subject Alternative Name entries\. ```csharp public System.Threading.Tasks.Task TryAuthenticateClientAsync(Abblix.Oidc.Server.Model.ClientRequest request); ``` #### Parameters ###### `request` [ClientRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRequest 'Abblix\.Oidc\.Server\.Model\.ClientRequest') {#Abblix.Oidc.Server.Features.ClientAuthentication.TlsMetadataClientAuthenticator.TryAuthenticateClientAsync(Abblix.Oidc.Server.Model.ClientRequest).request} The client request containing the certificate and client ID to authenticate\. Implements [TryAuthenticateClientAsync\(ClientRequest\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator#Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator.TryAuthenticateClientAsync(Abblix.Oidc.Server.Model.ClientRequest) 'Abblix\.Oidc\.Server\.Features\.ClientAuthentication\.IClientAuthenticator\.TryAuthenticateClientAsync\(Abblix\.Oidc\.Server\.Model\.ClientRequest\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task that returns the authenticated [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') if successful; otherwise, null\. Returns null if no certificate is provided, client not found, authentication method doesn't match, or certificate validation fails\. ### Remarks This method implements RFC 8705 tls\_client\_auth by: 1\. Verifying a client certificate is present 2\. Looking up client configuration by client\_id 3\. Checking the client uses tls\_client\_auth method 4\. Validating certificate Subject DN \(if configured\) 5\. Validating certificate SAN entries \(if configured\) --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ## Abblix\.Oidc\.Server\.Features\.ClientInformation Namespace | Classes | | | :--- | :--- | | [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') | Contains information about a client in an OAuth2/OpenID Connect context\. | | [ClientKeysProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientKeysProvider 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientKeysProvider') | Facilitates the retrieval of JSON Web Keys \(JWKs\) for cryptographic operations, including encryption and signing\. This provider supports fetching keys from a client's JSON Web Key Set \(JWKS\) URL or directly from the client configuration\. | | [ClientSecret](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientSecret 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientSecret') | Encapsulates the details of a client secret used in OAuth2 and OpenID Connect authentication flows\. | | [OidcOptionsSecurityProfileValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.OidcOptionsSecurityProfileValidator 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.OidcOptionsSecurityProfileValidator') | Validates that every statically\-configured client whose effective profile mandates a control bundle has a configuration that can satisfy it, failing loudly the first time [OidcOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions') is resolved rather than letting a contradiction surface as a per\-request rejection at runtime\. A no\-op for deployments that select no profile, so existing configurations are unaffected\. | | [SecurityProfileConsistency](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileConsistency 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.SecurityProfileConsistency') | Checks whether a client's configuration can actually satisfy the profile it selects, so a contradiction surfaces loudly at registration or startup instead of as a per\-request rejection the operator has to reverse\-engineer\. The runtime validators already tighten a request to the profile; this is the fail\-loud companion that catches static configuration that can never produce a conformant flow in the first place\. | | [SecurityProfileRequirements](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileRequirements 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.SecurityProfileRequirements') | The bundle of controls a [ClientSecurityProfile](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ClientSecurityProfile 'Abblix\.Oidc\.Server\.Common\.Constants\.ClientSecurityProfile') forces on a client, expressed as individual flags the request\-pipeline validators consult\. This is the single place the profile\-to\-controls mapping lives, so a validator never needs to know what "FAPI 2\.0" means \- it only reads the one flag it owns \- and adding a future profile touches only [Resolve\(ClientSecurityProfile\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileRequirements#Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileRequirements.Resolve(Abblix.Oidc.Server.Common.Constants.ClientSecurityProfile) 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.SecurityProfileRequirements\.Resolve\(Abblix\.Oidc\.Server\.Common\.Constants\.ClientSecurityProfile\)')\. | | [TlsClientAuthOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.TlsClientAuthOptions 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.TlsClientAuthOptions') | RFC 8705 metadata for tls\_client\_auth method\. Defines match rules for Subject DN and/or Subject Alternative Name entries\. | | Interfaces | | | :--- | :--- | | [IClientInfoManager](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.IClientInfoManager 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.IClientInfoManager') | Defines operations for managing the lifecycle and information of OAuth 2\.0 clients in a storage system\. | | [IClientInfoProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.IClientInfoProvider') | Provides access to OAuth 2\.0 client information, enabling the retrieval of client details by client ID\. | | [IClientKeysProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.IClientKeysProvider 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.IClientKeysProvider') | Provides access to cryptographic keys for OpenID Connect clients, supporting token encryption and signature validation\. | --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.ClientInformation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation 'Abblix\.Oidc\.Server\.Features\.ClientInformation') ## ClientInfo Class Contains information about a client in an OAuth2/OpenID Connect context\. ```csharp public record ClientInfo : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ClientInfo Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Remarks This record encapsulates the details necessary to identify and configure the behavior of a client application within an OAuth2 or OpenID Connect framework\. It includes identifiers, secrets, and configuration options that dictate how the client interacts with the authorization server and is authenticated or authorized during the token issuance process\. ### Constructors ## ClientInfo\(string\) Constructor {#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.ClientInfo(string)} Contains information about a client in an OAuth2/OpenID Connect context\. ```csharp public ClientInfo(string ClientId); ``` #### Parameters ###### `ClientId` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.ClientInfo(string).ClientId} ### Remarks This record encapsulates the details necessary to identify and configure the behavior of a client application within an OAuth2 or OpenID Connect framework\. It includes identifiers, secrets, and configuration options that dictate how the client interacts with the authorization server and is authenticated or authorized during the token issuance process\. ### Properties ## ClientInfo\.AccessTokenExpiresIn Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.AccessTokenExpiresIn} Specifies the lifetime of access tokens issued to this client\. Shorter access token lifetimes reduce the risk of token leakage\. ```csharp public System.TimeSpan AccessTokenExpiresIn { get; set; } ``` #### Property Value [System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan') ## ClientInfo\.AllowCrossClientIntrospection Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.AllowCrossClientIntrospection} Marks this client as a protected resource entitled to introspect tokens issued to other clients\. RFC 7662 §4: the authorization server "SHOULD require protected resources to be specifically authorized to call the introspection endpoint"\. This is that authorization\. ```csharp public bool AllowCrossClientIntrospection { get; set; } ``` #### Property Value [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') ### Remarks Without it a caller may only ask about tokens issued to itself, which is the one caller RFC 7662 is not written for: §2\.1 has the protected resource make the call, and a protected resource is by construction not the client the token was issued to\. Such a caller would otherwise be told a live token does not exist, the answer §2\.2 reserves for a token that was never issued or that the caller may not ask about\. The response is narrowed for a token issued to somebody else: the end-user identifier and any claims beyond the members RFC 7662 §2.2 defines are withheld, per §5 - "omitting privacy-sensitive information from an introspection response is the simplest way of minimizing privacy issues". This is granted by the host, never through dynamic client registration\. A client may take a restriction upon itself, but a permission handed out on request is not a permission\. ## ClientInfo\.AllowCrossClientSubjectTokenExchange Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.AllowCrossClientSubjectTokenExchange} RFC 8693 §1\.3: by default this AS rejects a Token Exchange request where the `subject_token` was originally issued to a different client than the one presenting it \-\- the "confused deputy" anti\-pattern\. When this client is intended to operate as an audit broker / proxy that legitimately receives tokens issued to other clients, set this to `true` to opt out of the default check\. The opt\-out also covers a subject\_token whose origin cannot be determined at all, which is otherwise refused: a client trusted to present tokens issued to others is equally trusted to present one whose issuer cannot be read\. ```csharp public bool AllowCrossClientSubjectTokenExchange { get; set; } ``` #### Property Value [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') ## ClientInfo\.AllowedGrantTypes Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.AllowedGrantTypes} Defines the response types that the client is permitted to use, or null when the client does not state them and the default in [EffectiveResponseTypes](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.EffectiveResponseTypes 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo\.EffectiveResponseTypes') applies\. This controls how tokens are issued in response to an authorization request\. ```csharp public string[]? AllowedGrantTypes { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') ### Remarks Null and empty mean different things\. Null is "not stated", and the default applies\. An empty list is stated: it allows nothing, and it is how a client is switched off without being removed from the registry\. Null rather than a defaulted value on purpose, so that a registry kept in configuration says what the client may do and nothing else\. The \.NET configuration binder adds to a collection a property already holds instead of replacing it, so a default stored here would arrive on every bound client on top of what the file lists, silently and in the direction of more permission\. Read [EffectiveResponseTypes](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.EffectiveResponseTypes 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo\.EffectiveResponseTypes') to decide anything\. ## ClientInfo\.AllowedResponseModes Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.AllowedResponseModes} Optionally restricts the `response_mode` values this client may use, pinning the channel through which the authorization response is delivered\. When set to a non\-empty list, a request is rejected unless its effective response mode \(the explicit `response_mode`, or the flow default when the parameter is omitted\) is a member of the list, compared by exact, case\-sensitive string match\. This lets a host close a response\-mode downgrade: a client the host intends to run with [FormPost](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ResponseModes#Abblix.Oidc.Server.Common.Constants.ResponseModes.FormPost 'Abblix\.Oidc\.Server\.Common\.Constants\.ResponseModes\.FormPost') cannot be driven with `fragment` or `query` on a crafted request, nor by omitting the parameter to inherit the flow default\. The restriction is applied on top of, and after, the flow\-compatibility check\. When `null` or empty \(the default\) it imposes no per\-client restriction\. There is no registered DCR metadata parameter for it, so the list is host\-side configuration only\. ```csharp public string[]? AllowedResponseModes { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') ## ClientInfo\.AllowedResponseTypes Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.AllowedResponseTypes} Defines the response types that the client is permitted to use, or null when the client does not state them and the default in [EffectiveResponseTypes](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.EffectiveResponseTypes 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo\.EffectiveResponseTypes') applies\. This controls how tokens are issued in response to an authorization request\. ```csharp public string[][]? AllowedResponseTypes { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') ### Remarks Null and empty mean different things\. Null is "not stated", and the default applies\. An empty list is stated: it allows nothing, and it is how a client is switched off without being removed from the registry\. Null rather than a defaulted value on purpose, so that a registry kept in configuration says what the client may do and nothing else\. The \.NET configuration binder adds to a collection a property already holds instead of replacing it, so a default stored here would arrive on every bound client on top of what the file lists, silently and in the direction of more permission\. Read [EffectiveResponseTypes](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.EffectiveResponseTypes 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo\.EffectiveResponseTypes') to decide anything\. ## ClientInfo\.AllowedScopes Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.AllowedScopes} The scope values the client is allowed to request per RFC 7591 Section 2\. ```csharp public string[]? AllowedScopes { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') ## ClientInfo\.ApplicationType Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.ApplicationType} Describes the type of application represented by the client, such as "web" or "native"\. ```csharp public string ApplicationType { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ClientInfo\.AuthorizationCodeExpiresIn Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.AuthorizationCodeExpiresIn} The validity period of an authorization code issued to this client\. Shorter durations are recommended for higher security\. ```csharp public System.TimeSpan AuthorizationCodeExpiresIn { get; set; } ``` #### Property Value [System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan') ## ClientInfo\.AuthorizationDetailsTypes Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.AuthorizationDetailsTypes} RFC 9396 §10: the client's per\-client allowlist of authorization\-detail `type` values it may use in `authorization_details` requests\. DCR\-exposed \(`authorization_details_types`\)\. Semantics: - `null` - no per-client constraint; the client may use any `type` the server understands. - Empty array - the client cannot use RAR; every `authorization_details` entry is rejected at request time regardless of `type`. - Non-empty array - only the listed `type` values are accepted for this client; entries with other types are rejected with `invalid_authorization_details`. ```csharp public string[]? AuthorizationDetailsTypes { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') ## ClientInfo\.AuthorizationEncryptedResponseAlgorithm Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.AuthorizationEncryptedResponseAlgorithm} JARM \(`authorization_encrypted_response_alg`\): the JWE key\-management algorithm used to encrypt authorization responses for this client\. When set, the signed response JWT is additionally encrypted \(a Nested JWT\)\. `null` means no encryption is performed\. ```csharp public string? AuthorizationEncryptedResponseAlgorithm { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ClientInfo\.AuthorizationEncryptedResponseEncryption Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.AuthorizationEncryptedResponseEncryption} JARM \(`authorization_encrypted_response_enc`\): the JWE content\-encryption algorithm used to encrypt authorization responses for this client\. Only meaningful when [AuthorizationEncryptedResponseAlgorithm](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.AuthorizationEncryptedResponseAlgorithm 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo\.AuthorizationEncryptedResponseAlgorithm') is set\. ```csharp public string? AuthorizationEncryptedResponseEncryption { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ClientInfo\.AuthorizationSignedResponseAlgorithm Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.AuthorizationSignedResponseAlgorithm} JARM \(`authorization_signed_response_alg`\): the JWS algorithm used to sign authorization responses packed into a JWT for this client\. Defaults to [RS256](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.SigningAlgorithms#Abblix.Jwt.SigningAlgorithms.RS256 'Abblix\.Jwt\.SigningAlgorithms\.RS256') per JARM §3; the algorithm `none` is not permitted\. Only consulted when the client requests a JWT response mode\. ```csharp public string AuthorizationSignedResponseAlgorithm { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ClientInfo\.BackChannelAuthenticationRequestSigningAlg Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.BackChannelAuthenticationRequestSigningAlg} The signing algorithm used for backchannel authentication requests sent to this client\. ```csharp public string? BackChannelAuthenticationRequestSigningAlg { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ClientInfo\.BackChannelClientNotificationEndpoint Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.BackChannelClientNotificationEndpoint} The endpoint where backchannel client notifications are sent for this client\. ```csharp public System.Uri? BackChannelClientNotificationEndpoint { get; set; } ``` #### Property Value [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri') ## ClientInfo\.BackChannelLogout Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.BackChannelLogout} Options for configuring back\-channel logout behavior, enabling the server to directly notify the client of logout events\. ```csharp public Abblix.Oidc.Server.Common.Configuration.BackChannelLogoutOptions? BackChannelLogout { get; set; } ``` #### Property Value [BackChannelLogoutOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.BackChannelLogoutOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.BackChannelLogoutOptions') ## ClientInfo\.BackChannelTokenDeliveryMode Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.BackChannelTokenDeliveryMode} The backchannel token delivery mode to be used by this client\. This determines how tokens are delivered during backchannel authentication\. ```csharp public string? BackChannelTokenDeliveryMode { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ClientInfo\.BackChannelUserCodeParameter Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.BackChannelUserCodeParameter} Indicates whether the backchannel authentication process supports user codes for this client\. ```csharp public bool BackChannelUserCodeParameter { get; set; } ``` #### Property Value [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') ## ClientInfo\.ClientId Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.ClientId} Identifies the client's unique identifier as recognized by the authorization server\. It is used in various OAuth 2\.0 and OpenID Connect flows to represent the client application\. ```csharp public string ClientId { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ClientInfo\.ClientName Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.ClientName} A human\-readable name for the client application, which can be displayed to users during the authorization process\. ```csharp public string? ClientName { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ClientInfo\.ClientSecrets Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.ClientSecrets} A collection of secrets associated with the client, used for authenticating the client to the authorization server\. Multiple secrets can be provided for added security\. ```csharp public Abblix.Oidc.Server.Features.ClientInformation.ClientSecret[]? ClientSecrets { get; set; } ``` #### Property Value [ClientSecret](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientSecret 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientSecret')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') ## ClientInfo\.ClientType Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.ClientType} Classifies the client based on its ability to securely maintain a client secret\. Derived from [TokenEndpointAuthMethod](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.TokenEndpointAuthMethod 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo\.TokenEndpointAuthMethod'): `none` yields [Public](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ClientType#Abblix.Oidc.Server.Common.Constants.ClientType.Public 'Abblix\.Oidc\.Server\.Common\.Constants\.ClientType\.Public'); any other authentication method \(secrets, keys, certificates\) yields [Confidential](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ClientType#Abblix.Oidc.Server.Common.Constants.ClientType.Confidential 'Abblix\.Oidc\.Server\.Common\.Constants\.ClientType\.Confidential')\. ```csharp public Abblix.Oidc.Server.Common.Constants.ClientType ClientType { get; } ``` #### Property Value [ClientType](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ClientType 'Abblix\.Oidc\.Server\.Common\.Constants\.ClientType') ### Remarks The catch\-all arm is the rule, not a fallback: the set of authentication methods is open, since a host registers its own [IClientAuthenticator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator 'Abblix\.Oidc\.Server\.Features\.ClientAuthentication\.IClientAuthenticator') implementations, and a method this library has never heard of still carries a credential\. Enumerating the known methods here would classify every host\-added one as public\. ## ClientInfo\.ClientUri Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.ClientUri} A URL pointing to a web page providing information about the client application\. This is typically used to offer additional context to users during the authorization process\. ```csharp public System.Uri? ClientUri { get; set; } ``` #### Property Value [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri') ## ClientInfo\.Contacts Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.Contacts} An array of contact email addresses associated with the client, primarily used for support purposes\. ```csharp public string[]? Contacts { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') ## ClientInfo\.DefaultAcrValues Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.DefaultAcrValues} Specifies the default Authentication Context Class Reference \(ACR\) values for the client\. These values indicate the types of authentication methods or levels of assurance required\. ```csharp public string[]? DefaultAcrValues { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') ## ClientInfo\.DefaultMaxAge Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.DefaultMaxAge} The maximum time in seconds since the user's authentication that the client accepts\. Requests exceeding this time will require re\-authentication of the user\. ```csharp public System.Nullable DefaultMaxAge { get; set; } ``` #### Property Value [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') ## ClientInfo\.EffectiveGrantTypes Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.EffectiveGrantTypes} The grant types this client may actually use: what it states, or the authorization code grant when it states nothing\. A client that states an empty list gets an empty list, which permits no grant at all\. ```csharp public string[] EffectiveGrantTypes { get; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') ## ClientInfo\.EffectiveResponseTypes Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.EffectiveResponseTypes} The response types this client may actually use: what it states, or the authorization code response when it states nothing\. A client that states an empty list gets an empty list, which permits no authorization request at all\. ```csharp public string[][] EffectiveResponseTypes { get; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') ## ClientInfo\.ExpiresAfter Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.ExpiresAfter} Expiration time for this dynamically registered client in distributed cache\. If not set, the default expiration configured in the server settings is used\. Implements pseudo\-sliding expiration: TTL is reset on each access\. ```csharp public System.Nullable ExpiresAfter { get; set; } ``` #### Property Value [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') ## ClientInfo\.ForceAuthorizationDetailsInIdentityToken Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.ForceAuthorizationDetailsInIdentityToken} When `true`, the `authorization_details` claim is emitted on the ID token for this client in addition to the access token and introspection response\. Default `false`\. RFC 9396 is silent on id\_token; default\-off preserves role separation between identity assertion \(id\_token\) and authorization payload \(access token \+ introspection\)\. Host\-controlled behavioural extension \- NOT exposed via DCR \(no OIDC wire metadata for this\), mirroring the [ForceUserClaimsInIdentityToken](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.ForceUserClaimsInIdentityToken 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo\.ForceUserClaimsInIdentityToken') precedent\. ```csharp public bool ForceAuthorizationDetailsInIdentityToken { get; set; } ``` #### Property Value [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') ## ClientInfo\.ForceUserClaimsInIdentityToken Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.ForceUserClaimsInIdentityToken} Controls whether claims about the authenticated user are included directly in the identity token instead of being obtained separately via the UserInfo endpoint\. ```csharp public bool ForceUserClaimsInIdentityToken { get; set; } ``` #### Property Value [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') ## ClientInfo\.FrontChannelLogout Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.FrontChannelLogout} Options for configuring front\-channel logout behavior, allowing the client to participate in logout requests initiated by other clients\. ```csharp public Abblix.Oidc.Server.Common.Configuration.FrontChannelLogoutOptions? FrontChannelLogout { get; set; } ``` #### Property Value [FrontChannelLogoutOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.FrontChannelLogoutOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.FrontChannelLogoutOptions') ## ClientInfo\.IdentityTokenEncryptedResponseAlgorithm Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.IdentityTokenEncryptedResponseAlgorithm} Specifies the algorithm used to encrypt identity tokens issued to the client\. ```csharp public string? IdentityTokenEncryptedResponseAlgorithm { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ClientInfo\.IdentityTokenEncryptedResponseEncryption Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.IdentityTokenEncryptedResponseEncryption} Specifies the encryption method used to encrypt identity tokens issued to the client\. ```csharp public string? IdentityTokenEncryptedResponseEncryption { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ClientInfo\.IdentityTokenExpiresIn Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.IdentityTokenExpiresIn} Determines the validity period of identity tokens issued to this client\. Shorter durations enhance security by reducing the window of misuse\. ```csharp public System.TimeSpan IdentityTokenExpiresIn { get; set; } ``` #### Property Value [System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan') ## ClientInfo\.IdentityTokenSignedResponseAlgorithm Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.IdentityTokenSignedResponseAlgorithm} Specifies the algorithm that must be used for signing identity token responses issued to this client\. Per Back\-Channel Logout 1\.0 §2\.4 logout tokens are signed in the same manner as ID Tokens, so this value also serves as the default signing algorithm for back\-channel logout tokens unless [LogoutTokenSignedResponseAlgorithm](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.LogoutTokenSignedResponseAlgorithm 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo\.LogoutTokenSignedResponseAlgorithm') overrides it\. ```csharp public string IdentityTokenSignedResponseAlgorithm { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ClientInfo\.InitiateLoginUri Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.InitiateLoginUri} A URI that allows third\-party sites to initiate a login by the client, facilitating integrations and single sign\-on scenarios\. ```csharp public System.Uri? InitiateLoginUri { get; set; } ``` #### Property Value [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri') ## ClientInfo\.IntrospectionEncryptedResponseAlgorithm Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.IntrospectionEncryptedResponseAlgorithm} RFC 9701 \(`introspection_encrypted_response_alg`\): the key\-management algorithm used to encrypt introspection\-response JWTs returned to the client\. ```csharp public string? IntrospectionEncryptedResponseAlgorithm { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ClientInfo\.IntrospectionEncryptedResponseEncryption Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.IntrospectionEncryptedResponseEncryption} RFC 9701 \(`introspection_encrypted_response_enc`\): the content\-encryption algorithm used to encrypt introspection\-response JWTs returned to the client\. ```csharp public string? IntrospectionEncryptedResponseEncryption { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ClientInfo\.IntrospectionSignedResponseAlgorithm Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.IntrospectionSignedResponseAlgorithm} RFC 9701 \(`introspection_signed_response_alg`\): the JWS algorithm used to sign introspection responses returned to this client as a JWT\. [None](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.SigningAlgorithms#Abblix.Jwt.SigningAlgorithms.None 'Abblix\.Jwt\.SigningAlgorithms\.None') \(the default\) means the client receives a plain JSON introspection response; any other value opts the client into a signed JWT response\. ```csharp public string IntrospectionSignedResponseAlgorithm { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ClientInfo\.Jwks Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.Jwks} The set of JSON Web Keys used by the client, typically for signing request objects and decrypting identity tokens or encrypted user information\. ```csharp public Abblix.Jwt.JsonWebKeySet? Jwks { get; set; } ``` #### Property Value [JsonWebKeySet](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKeySet 'Abblix\.Jwt\.JsonWebKeySet') ## ClientInfo\.JwksUri Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.JwksUri} The publicly accessible URL where the client's JSON Web Key Set \(JWKS\) can be retrieved\. ```csharp public System.Uri? JwksUri { get; set; } ``` #### Property Value [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri') ## ClientInfo\.LogoUri Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.LogoUri} A URL pointing to an image file representing the client's logo, which can be displayed in user interfaces during authorization\. ```csharp public System.Uri? LogoUri { get; set; } ``` #### Property Value [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri') ## ClientInfo\.LogoutTokenSignedResponseAlgorithm Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.LogoutTokenSignedResponseAlgorithm} The algorithm used to sign back\-channel logout tokens issued to this client\. When null \(the default\), the value of [IdentityTokenSignedResponseAlgorithm](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.IdentityTokenSignedResponseAlgorithm 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo\.IdentityTokenSignedResponseAlgorithm') applies \- Back\-Channel Logout 1\.0 §2\.4 signs logout tokens in the same manner as ID Tokens, and this property makes that otherwise implicit coupling visible and overridable per client\. There is no registered DCR metadata parameter for it, so the override is host\-side configuration only\. ```csharp public string? LogoutTokenSignedResponseAlgorithm { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ClientInfo\.OfflineAccessAllowed Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.OfflineAccessAllowed} Allows the client to request tokens that enable access to the user's resources while they’re offline\. ```csharp public System.Nullable OfflineAccessAllowed { get; set; } ``` #### Property Value [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') ## ClientInfo\.ParseLoginHintTokenAsJwt Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.ParseLoginHintTokenAsJwt} Indicates whether the login hint token should be parsed and validated as a JSON Web Token \(JWT\)\. ```csharp public bool ParseLoginHintTokenAsJwt { get; set; } ``` #### Property Value [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') ### Remarks If this property is set to `false`, it means the login hint token is not in JWT format\. In this case, the client is responsible for parsing and validating the token as part of the validation flow, as the authorization server will not handle its validation automatically\. ## ClientInfo\.PkceRequired Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.PkceRequired} Indicates whether the client is to use Proof Key for Code Exchange \(PKCE\) in the authorization code flow, enhancing security for public clients\. ```csharp public System.Nullable PkceRequired { get; set; } ``` #### Property Value [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') ## ClientInfo\.PlainPkceAllowed Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.PlainPkceAllowed} Indicates if the client is allowed to use the "plain" method for PKCE\. It is recommended to use stronger methods like "S256" for enhanced security\. ```csharp public bool PlainPkceAllowed { get; set; } ``` #### Property Value [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') ## ClientInfo\.PolicyUri Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.PolicyUri} A URL pointing to the client's policy documentation, providing transparency on how user data is handled and protected\. ```csharp public System.Uri? PolicyUri { get; set; } ``` #### Property Value [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri') ## ClientInfo\.PostLogoutRedirectUris Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.PostLogoutRedirectUris} Specifies the URIs where the user\-agent can be redirected after logging out from the client application\. This allows for a seamless user experience upon logout\. ```csharp public System.Uri[] PostLogoutRedirectUris { get; set; } ``` #### Property Value [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') ## ClientInfo\.RedirectUris Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.RedirectUris} Specifies the URIs where the user\-agent can be redirected after authorization\. These URIs must be pre\-registered and match the redirect URI provided in the authorization request\. ```csharp public System.Uri[] RedirectUris { get; set; } ``` #### Property Value [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') ## ClientInfo\.RefreshToken Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.RefreshToken} Configures the behavior and properties of refresh tokens issued to this client, such as their expiration and renewal policies\. ```csharp public Abblix.Oidc.Server.Common.Configuration.RefreshTokenOptions RefreshToken { get; set; } ``` #### Property Value [RefreshTokenOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.RefreshTokenOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.RefreshTokenOptions') ## ClientInfo\.RequestObjectEncryptionAlgorithm Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.RequestObjectEncryptionAlgorithm} Specifies the algorithm required for encrypting request objects sent to the authorization server\. ```csharp public string? RequestObjectEncryptionAlgorithm { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ClientInfo\.RequestObjectEncryptionMethod Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.RequestObjectEncryptionMethod} Specifies the encryption method required for encrypting request objects sent to the authorization server\. ```csharp public string? RequestObjectEncryptionMethod { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ClientInfo\.RequestObjectSigningAlgorithm Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.RequestObjectSigningAlgorithm} Specifies the algorithm required for signing request objects sent to the authorization server\. ```csharp public string? RequestObjectSigningAlgorithm { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ClientInfo\.RequestUris Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.RequestUris} The list of allowed URI values to validate the `request_uri` parameter in authorization requests\. ```csharp public System.Uri[] RequestUris { get; set; } ``` #### Property Value [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') ### Remarks The `request_uri` parameter references a pre\-hosted authorization request object\. This property specifies the valid URIs that can be included in the `request_uri` parameter\. By defining this list, the server ensures that only pre\-approved and secure URIs are accepted, mitigating risks such as unauthorized or malicious requests\. ## ClientInfo\.RequireAuthTime Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.RequireAuthTime} Indicates whether the authorization server must include the \`auth\_time\` claim in the ID token\. ```csharp public System.Nullable RequireAuthTime { get; set; } ``` #### Property Value [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') ## ClientInfo\.RequireDPoP Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.RequireDPoP} RFC 9449 §5\.2 client metadata \(`dpop_bound_access_tokens`\): when `true`, the client MUST present a valid DPoP proof on the token endpoint and the issued access token will be DPoP\-bound \(`cnf.jkt`\)\. When `false`, DPoP is opportunistic \- a valid proof still binds the token, otherwise a Bearer token is issued\. ```csharp public bool RequireDPoP { get; set; } ``` #### Property Value [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') ## ClientInfo\.RequirePushedAuthorizationRequests Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.RequirePushedAuthorizationRequests} RFC 9126 §6 client metadata \(`require_pushed_authorization_requests`\): when `true`, a pushed authorization request is the only way this client may start an authorization flow \- a request arriving at the authorization endpoint without a PAR\-issued request URI is rejected even when the server\-wide requirement is off\. FAPI\-grade clients set this so a granular server\-side toggle cannot silently weaken them\. ```csharp public bool RequirePushedAuthorizationRequests { get; set; } ``` #### Property Value [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') ## ClientInfo\.RequireSignedRequestObject Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.RequireSignedRequestObject} RFC 9101 §10\.5 client metadata \(`require_signed_request_object`\): when `true`, this client must deliver its authorization request parameters as a signed request object \(via the request parameter or a pushed authorization request\) \- plain\-parameter requests and unsigned request objects are rejected\. ```csharp public bool RequireSignedRequestObject { get; set; } ``` #### Property Value [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') ## ClientInfo\.ResourceLocations Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.ResourceLocations} The locations this client answers for when it acts as a resource server, matched against the RFC 9396 §2\.2 `locations` of an `authorization_details` entry\. Introspecting a token issued to somebody else returns the entries addressed to one of these, and nothing when the list is absent\. ```csharp public System.Uri[]? ResourceLocations { get; set; } ``` #### Property Value [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') ### Remarks RFC 9396 §9 obliges the server to make the granted details available to the resource server enforcing them, and allows either channel: the access token, or the introspection response\. A deployment whose access tokens are readable by their audience needs neither this member nor the disclosure, since the details ride in the token\. One encrypting them to its own keys has only introspection left, and this is how a resource server names itself for it\. Absent by default, so no existing deployment starts disclosing anything. Matching is TEXTUAL and exact. RFC 9396 §12 requires it: "No additional transformation or normalization is to be done in evaluating equivalence of string values". A location is therefore compared to what is written here character for character, so a trailing slash, a spelled-out default port or a different case is a different location. Write the value exactly as the clients spell it in `locations`. The type is [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri') so a value that is not one is refused where it was written, not silently never matched. That catches most of what a typo produces and not all of it: a missing scheme with a port (`payments.example.com:8443`) parses, with the whole name read as the scheme and an empty host, and then matches nothing. ## ClientInfo\.SectorIdentifier Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.SectorIdentifier} Used in conjunction with pairwise subject identifiers to calculate the subject value returned to the client\. This field is particularly relevant to ensuring user privacy by providing a different subject identifier to each client, even if it's the same end\-user\. It typically contains a URL or a unique identifier representing the client's sector\. ```csharp public string? SectorIdentifier { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ClientInfo\.SecurityProfile Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.SecurityProfile} A named security profile this client asks to be held to, ON TOP of whatever the deployment demands of every client\. [Fapi2](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ClientSecurityProfile#Abblix.Oidc.Server.Common.Constants.ClientSecurityProfile.Fapi2 'Abblix\.Oidc\.Server\.Common\.Constants\.ClientSecurityProfile\.Fapi2') forces the FAPI 2\.0 control bundle \(PKCE restricted to `S256`, Pushed Authorization Requests, sender\-constrained tokens, code\-only responses\) and prevents the individual toggles above from weakening it\. It can only tighten\. [None](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ClientSecurityProfile#Abblix.Oidc.Server.Common.Constants.ClientSecurityProfile.None 'Abblix\.Oidc\.Server\.Common\.Constants\.ClientSecurityProfile\.None') names no controls of its own and therefore changes nothing where the deployment names some: a server\-wide profile is a floor every client stands on, so no registration can take a client out from under it\. That matters because such a registration would not read as a decision to weaken the server, and one of them is enough to leave a deployment serving a client under none of the controls it turned on\. `null` \(the default\) states no preference and leaves the client on [DefaultSecurityProfile](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions#Abblix.Oidc.Server.Common.Configuration.OidcOptions.DefaultSecurityProfile 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions\.DefaultSecurityProfile') alone\. ```csharp public System.Nullable SecurityProfile { get; set; } ``` #### Property Value [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[ClientSecurityProfile](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ClientSecurityProfile 'Abblix\.Oidc\.Server\.Common\.Constants\.ClientSecurityProfile')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') ## ClientInfo\.SoftwareId Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.SoftwareId} A unique identifier for the client software per RFC 7591 Section 2\. ```csharp public string? SoftwareId { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ClientInfo\.SoftwareVersion Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.SoftwareVersion} A version identifier for the client software per RFC 7591 Section 2\. ```csharp public string? SoftwareVersion { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ClientInfo\.SubjectType Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.SubjectType} Specifies the subject identifier type requested by the client\. This influences how the authorization server represents the authenticated user's identity to the client, affecting privacy and uniqueness across different clients\. Common types include "public" and "pairwise"\. ```csharp public string? SubjectType { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ClientInfo\.TermsOfServiceUri Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.TermsOfServiceUri} A URL pointing to the client's terms of service, outlining the legal agreement between the user and the service provider\. ```csharp public System.Uri? TermsOfServiceUri { get; set; } ``` #### Property Value [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri') ## ClientInfo\.TlsClientAuth Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.TlsClientAuth} TLS client authentication metadata \(RFC 8705\) for tls\_client\_auth method\. ```csharp public Abblix.Oidc.Server.Features.ClientInformation.TlsClientAuthOptions? TlsClientAuth { get; set; } ``` #### Property Value [TlsClientAuthOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.TlsClientAuthOptions 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.TlsClientAuthOptions') ## ClientInfo\.TlsClientCertificateBoundAccessTokens Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.TlsClientCertificateBoundAccessTokens} RFC 8705 §3\.4 client metadata \(`tls_client_certificate_bound_access_tokens`\): when `true`, access tokens issued to this client are certificate\-bound whenever the token request arrives over mutual TLS \- independently of the client authentication method, which is what distinguishes this flag from the implicit binding the mTLS authentication methods already get\. ```csharp public bool TlsClientCertificateBoundAccessTokens { get; set; } ``` #### Property Value [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') ## ClientInfo\.TokenEndpointAuthMethod Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.TokenEndpointAuthMethod} Describes how the client authenticates to the token endpoint per RFC 6749 §2\.3 / OIDC Core §9\. Common values include `client_secret_basic`, `client_secret_post`, `private_key_jwt`, `client_secret_jwt`, `tls_client_auth` \(RFC 8705\), and `none` \(public clients\)\. Drives the value of [ClientType](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.ClientType 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo\.ClientType')\. ```csharp public string TokenEndpointAuthMethod { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ClientInfo\.TokenEndpointAuthSigningAlgorithm Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.TokenEndpointAuthSigningAlgorithm} Specifies the algorithm used to sign client authentication requests at the token endpoint\. ```csharp public string? TokenEndpointAuthSigningAlgorithm { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ClientInfo\.TokenExchangeAllowedAudiences Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.TokenExchangeAllowedAudiences} RFC 8693 §2\.1 per\-client allowlist of `audience` values this client may request when exchanging a token\. The requested audience is written into the issued token's `aud` claim, so without a constraint a client could mint a token for any target service it names\. This allowlist is therefore \default\-deny\, unlike the unconstrained\-by\-default [TokenExchangeAllowedSubjectTokenTypes](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.TokenExchangeAllowedSubjectTokenTypes 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo\.TokenExchangeAllowedSubjectTokenTypes'): - `null` or empty array: the client may not request any `audience` -- a Token Exchange request carrying one is rejected with `invalid_target`. - Non-empty array: allowlist -- only the listed audience values are accepted; any other is rejected with `invalid_target`. A request that omits `audience` is unaffected\. ```csharp public string[]? TokenExchangeAllowedAudiences { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') ## ClientInfo\.TokenExchangeAllowedSubjectTokenTypes Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.TokenExchangeAllowedSubjectTokenTypes} RFC 8693 §2\.1 per\-client allowlist of `subject_token_type` URIs this client may submit to the Token Exchange grant\. Independent of [EffectiveGrantTypes](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.EffectiveGrantTypes 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo\.EffectiveGrantTypes') \-\- a client must have `urn:ietf:params:oauth:grant-type:token-exchange` in [EffectiveGrantTypes](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.EffectiveGrantTypes 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo\.EffectiveGrantTypes') to invoke the grant, and the requested `subject_token_type` must additionally satisfy this allowlist\. - `null`: no constraint (any of [TokenExchangeTokenTypes](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.TokenExchangeTokenTypes 'Abblix\.Oidc\.Server\.Common\.Constants\.TokenExchangeTokenTypes') the AS can validate is accepted). - Empty array: forbidden -- every Token Exchange request from this client is rejected with `invalid_request` regardless of `subject_token_type`. - Non-empty array: allowlist -- only the listed type URIs are accepted; any other is rejected. Mirrors the [AuthorizationDetailsTypes](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.AuthorizationDetailsTypes 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo\.AuthorizationDetailsTypes') tri\-state pattern\. ```csharp public string[]? TokenExchangeAllowedSubjectTokenTypes { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') ## ClientInfo\.UserInfoEncryptedResponseAlgorithm Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.UserInfoEncryptedResponseAlgorithm} Specifies the algorithm used to encrypt UserInfo responses returned to the client\. ```csharp public string? UserInfoEncryptedResponseAlgorithm { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ClientInfo\.UserInfoEncryptedResponseEncryption Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.UserInfoEncryptedResponseEncryption} Specifies the encryption method used to encrypt UserInfo responses returned to the client\. ```csharp public string? UserInfoEncryptedResponseEncryption { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ClientInfo\.UserInfoSignedResponseAlgorithm Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.UserInfoSignedResponseAlgorithm} Determines the algorithm used for signing responses from the UserInfo endpoint\. This can enhance the security of transmitted user information\. ```csharp public string UserInfoSignedResponseAlgorithm { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientKeysProvider.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.ClientInformation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation 'Abblix\.Oidc\.Server\.Features\.ClientInformation') ## ClientKeysProvider Class Facilitates the retrieval of JSON Web Keys \(JWKs\) for cryptographic operations, including encryption and signing\. This provider supports fetching keys from a client's JSON Web Key Set \(JWKS\) URL or directly from the client configuration\. ```csharp public class ClientKeysProvider : Abblix.Oidc.Server.Features.ClientInformation.IClientKeysProvider ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ClientKeysProvider Implements [IClientKeysProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.IClientKeysProvider 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.IClientKeysProvider') ### Constructors ## ClientKeysProvider\(ILogger\, IServiceProvider\) Constructor {#Abblix.Oidc.Server.Features.ClientInformation.ClientKeysProvider.ClientKeysProvider(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.ClientInformation.ClientKeysProvider_,System.IServiceProvider)} Facilitates the retrieval of JSON Web Keys \(JWKs\) for cryptographic operations, including encryption and signing\. This provider supports fetching keys from a client's JSON Web Key Set \(JWKS\) URL or directly from the client configuration\. ```csharp public ClientKeysProvider(Microsoft.Extensions.Logging.ILogger logger, System.IServiceProvider serviceProvider); ``` #### Parameters ###### `logger` [Microsoft\.Extensions\.Logging\.ILogger<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1')[ClientKeysProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientKeysProvider 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientKeysProvider')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1') {#Abblix.Oidc.Server.Features.ClientInformation.ClientKeysProvider.ClientKeysProvider(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.ClientInformation.ClientKeysProvider_,System.IServiceProvider).logger} Logger for capturing any operational logs\. ###### `serviceProvider` [System\.IServiceProvider](https://learn.microsoft.com/en-us/dotnet/api/system.iserviceprovider 'System\.IServiceProvider') {#Abblix.Oidc.Server.Features.ClientInformation.ClientKeysProvider.ClientKeysProvider(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.ClientInformation.ClientKeysProvider_,System.IServiceProvider).serviceProvider} Service provider used to resolve scoped dependencies like ISecureHttpFetcher\. ### Methods ## ClientKeysProvider\.GetEncryptionKeys\(ClientInfo\) Method {#Abblix.Oidc.Server.Features.ClientInformation.ClientKeysProvider.GetEncryptionKeys(Abblix.Oidc.Server.Features.ClientInformation.ClientInfo)} Retrieves the encryption keys associated with a specific client\. ```csharp public System.Collections.Generic.IAsyncEnumerable GetEncryptionKeys(Abblix.Oidc.Server.Features.ClientInformation.ClientInfo clientInfo); ``` #### Parameters ###### `clientInfo` [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') {#Abblix.Oidc.Server.Features.ClientInformation.ClientKeysProvider.GetEncryptionKeys(Abblix.Oidc.Server.Features.ClientInformation.ClientInfo).clientInfo} Client information containing either JWKS or a JWKS URI\. Implements [GetEncryptionKeys\(ClientInfo\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.IClientKeysProvider#Abblix.Oidc.Server.Features.ClientInformation.IClientKeysProvider.GetEncryptionKeys(Abblix.Oidc.Server.Features.ClientInformation.ClientInfo) 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.IClientKeysProvider\.GetEncryptionKeys\(Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo\)') #### Returns [System\.Collections\.Generic\.IAsyncEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.iasyncenumerable-1 'System\.Collections\.Generic\.IAsyncEnumerable\`1')[JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.iasyncenumerable-1 'System\.Collections\.Generic\.IAsyncEnumerable\`1') A collection of encryption keys as an asynchronous enumerable\. ## ClientKeysProvider\.GetSigningKeys\(ClientInfo\) Method {#Abblix.Oidc.Server.Features.ClientInformation.ClientKeysProvider.GetSigningKeys(Abblix.Oidc.Server.Features.ClientInformation.ClientInfo)} Retrieves the signing keys associated with a specific client\. ```csharp public System.Collections.Generic.IAsyncEnumerable GetSigningKeys(Abblix.Oidc.Server.Features.ClientInformation.ClientInfo clientInfo); ``` #### Parameters ###### `clientInfo` [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') {#Abblix.Oidc.Server.Features.ClientInformation.ClientKeysProvider.GetSigningKeys(Abblix.Oidc.Server.Features.ClientInformation.ClientInfo).clientInfo} Client information containing either JWKS or a JWKS URI\. Implements [GetSigningKeys\(ClientInfo\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.IClientKeysProvider#Abblix.Oidc.Server.Features.ClientInformation.IClientKeysProvider.GetSigningKeys(Abblix.Oidc.Server.Features.ClientInformation.ClientInfo) 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.IClientKeysProvider\.GetSigningKeys\(Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo\)') #### Returns [System\.Collections\.Generic\.IAsyncEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.iasyncenumerable-1 'System\.Collections\.Generic\.IAsyncEnumerable\`1')[JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.iasyncenumerable-1 'System\.Collections\.Generic\.IAsyncEnumerable\`1') A collection of signing keys as an asynchronous enumerable\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientSecret.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.ClientInformation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation 'Abblix\.Oidc\.Server\.Features\.ClientInformation') ## ClientSecret Class Encapsulates the details of a client secret used in OAuth2 and OpenID Connect authentication flows\. ```csharp public record ClientSecret : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ClientSecret Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[ClientSecret](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientSecret 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientSecret')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Remarks Client secrets are critical for the security of client applications, especially those that authenticate in a server\-side context\. This record stores hashed versions of the secret to enhance security by avoiding the storage of plain\-text secrets\. For client\_secret\_jwt authentication method, the raw value must also be stored to validate HMAC\-signed JWTs\. ### Properties ## ClientSecret\.ExpiresAt Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientSecret.ExpiresAt} The expiration date and time for the client secret\. Secrets past this date are considered invalid and cannot be used for authentication\. ```csharp public System.Nullable ExpiresAt { get; init; } ``` #### Property Value [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') ### Remarks Setting an expiration date for client secrets is a best practice that helps mitigate the risk of secret compromise over time\. It encourages regular rotation of secrets to maintain the security integrity of client applications\. ## ClientSecret\.Sha256Hash Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientSecret.Sha256Hash} The SHA\-256 hash of the client secret\. This property is used to securely store and verify the secret without needing to store the plain text value\. ```csharp public byte[]? Sha256Hash { get; init; } ``` #### Property Value [System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') ### Remarks The SHA\-256 hash provides a secure way to handle client secrets, allowing for their verification during the authentication process without risking exposure\. ## ClientSecret\.Sha256HashBase64 Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientSecret.Sha256HashBase64} [Sha256Hash](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientSecret#Abblix.Oidc.Server.Features.ClientInformation.ClientSecret.Sha256Hash 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientSecret\.Sha256Hash') written as a single Base64 string, for a registry that lives in configuration\. ```csharp public string? Sha256HashBase64 { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks The \.NET configuration binder treats a byte array as a collection to fill element by element, so a hash has no scalar form to bind to without this alias: a settings file would have to spell the value out one byte per key\. Setting either member sets the hash; reading returns whatever [Sha256Hash](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientSecret#Abblix.Oidc.Server.Features.ClientInformation.ClientSecret.Sha256Hash 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientSecret\.Sha256Hash') holds, so the two can never disagree\. ## ClientSecret\.Sha256HashHex Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientSecret.Sha256HashHex} [Sha256Hash](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientSecret#Abblix.Oidc.Server.Features.ClientInformation.ClientSecret.Sha256Hash 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientSecret\.Sha256Hash') written as a single hexadecimal string, which is the form command\-line digest tools print and the form most people paste\. ```csharp public string? Sha256HashHex { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks The same alias as [Sha256HashBase64](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientSecret#Abblix.Oidc.Server.Features.ClientInformation.ClientSecret.Sha256HashBase64 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientSecret\.Sha256HashBase64') in the other common notation\. Reading returns upper case; either case is accepted when writing\. ## ClientSecret\.Sha512Hash Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientSecret.Sha512Hash} The SHA\-512 hash of the client secret\. This property offers an additional layer of security by using a stronger hashing algorithm compared to SHA\-256\. ```csharp public byte[]? Sha512Hash { get; init; } ``` #### Property Value [System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') ### Remarks SHA\-512 hashes are more resistant to brute\-force attacks due to their larger size and complexity\. This property is optional and can be used in systems requiring heightened security measures\. ## ClientSecret\.Sha512HashBase64 Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientSecret.Sha512HashBase64} [Sha256Hash](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientSecret#Abblix.Oidc.Server.Features.ClientInformation.ClientSecret.Sha256Hash 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientSecret\.Sha256Hash') written as a single Base64 string, for a registry that lives in configuration\. ```csharp public string? Sha512HashBase64 { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks The \.NET configuration binder treats a byte array as a collection to fill element by element, so a hash has no scalar form to bind to without this alias: a settings file would have to spell the value out one byte per key\. Setting either member sets the hash; reading returns whatever [Sha256Hash](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientSecret#Abblix.Oidc.Server.Features.ClientInformation.ClientSecret.Sha256Hash 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientSecret\.Sha256Hash') holds, so the two can never disagree\. ## ClientSecret\.Sha512HashHex Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientSecret.Sha512HashHex} [Sha256Hash](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientSecret#Abblix.Oidc.Server.Features.ClientInformation.ClientSecret.Sha256Hash 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientSecret\.Sha256Hash') written as a single hexadecimal string, which is the form command\-line digest tools print and the form most people paste\. ```csharp public string? Sha512HashHex { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks The same alias as [Sha256HashBase64](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientSecret#Abblix.Oidc.Server.Features.ClientInformation.ClientSecret.Sha256HashBase64 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientSecret\.Sha256HashBase64') in the other common notation\. Reading returns upper case; either case is accepted when writing\. ## ClientSecret\.Value Property {#Abblix.Oidc.Server.Features.ClientInformation.ClientSecret.Value} The plain\-text value of the client secret\. This property is required for authentication methods that need the raw secret value, such as client\_secret\_jwt \(which uses HMAC signatures\)\. ```csharp public string? Value { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks While storing plain\-text secrets poses security risks, some authentication methods like client\_secret\_jwt require access to the original value to create HMAC signatures for validation\. This value should be stored securely and access should be restricted\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.IClientInfoManager.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.ClientInformation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation 'Abblix\.Oidc\.Server\.Features\.ClientInformation') ## IClientInfoManager Interface Defines operations for managing the lifecycle and information of OAuth 2\.0 clients in a storage system\. ```csharp public interface IClientInfoManager ``` ### Remarks Implementations of this interface are responsible for adding, updating, and removing client information, supporting dynamic client registration and management in OAuth 2\.0 and OpenID Connect environments\. ### Methods ## IClientInfoManager\.AddClientAsync\(ClientInfo\) Method {#Abblix.Oidc.Server.Features.ClientInformation.IClientInfoManager.AddClientAsync(Abblix.Oidc.Server.Features.ClientInformation.ClientInfo)} Asynchronously adds a new client and its corresponding information to the storage system\. ```csharp System.Threading.Tasks.Task AddClientAsync(Abblix.Oidc.Server.Features.ClientInformation.ClientInfo clientInfo); ``` #### Parameters ###### `clientInfo` [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') {#Abblix.Oidc.Server.Features.ClientInformation.IClientInfoManager.AddClientAsync(Abblix.Oidc.Server.Features.ClientInformation.ClientInfo).clientInfo} The detailed information about the client to be added\. #### Returns [System\.Threading\.Tasks\.Task](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task 'System\.Threading\.Tasks\.Task') A task representing the asynchronous operation, indicating the completion of the addition process\. ### Remarks This operation typically involves persisting the [clientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.IClientInfoManager#Abblix.Oidc.Server.Features.ClientInformation.IClientInfoManager.AddClientAsync(Abblix.Oidc.Server.Features.ClientInformation.ClientInfo).clientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.IClientInfoManager\.AddClientAsync\(Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo\)\.clientInfo') to a database or another form of storage, making the client available for OAuth 2\.0 and OpenID Connect authentication and authorization processes\. ## IClientInfoManager\.RemoveClientAsync\(string\) Method {#Abblix.Oidc.Server.Features.ClientInformation.IClientInfoManager.RemoveClientAsync(string)} Asynchronously removes an existing client and its information from the storage system\. ```csharp System.Threading.Tasks.Task RemoveClientAsync(string clientId); ``` #### Parameters ###### `clientId` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.ClientInformation.IClientInfoManager.RemoveClientAsync(string).clientId} The unique identifier of the client to be removed\. #### Returns [System\.Threading\.Tasks\.Task](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task 'System\.Threading\.Tasks\.Task') A task representing the asynchronous operation, indicating the completion of the removal process\. ### Remarks The removal process is critical for maintaining the integrity and security of the client registration system, allowing administrators to effectively manage the lifecycle of client applications\. ## IClientInfoManager\.UpdateClientAsync\(ClientInfo\) Method {#Abblix.Oidc.Server.Features.ClientInformation.IClientInfoManager.UpdateClientAsync(Abblix.Oidc.Server.Features.ClientInformation.ClientInfo)} Asynchronously updates an existing client's information in the storage system\. ```csharp System.Threading.Tasks.Task UpdateClientAsync(Abblix.Oidc.Server.Features.ClientInformation.ClientInfo clientInfo); ``` #### Parameters ###### `clientInfo` [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') {#Abblix.Oidc.Server.Features.ClientInformation.IClientInfoManager.UpdateClientAsync(Abblix.Oidc.Server.Features.ClientInformation.ClientInfo).clientInfo} The updated client information\. #### Returns [System\.Threading\.Tasks\.Task](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task 'System\.Threading\.Tasks\.Task') A task representing the asynchronous operation, indicating the completion of the update process\. ### Remarks This operation updates the client metadata per RFC 7592 Section 2 \(Client Update Request\)\. The client must already exist in the storage system\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.ClientInformation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation 'Abblix\.Oidc\.Server\.Features\.ClientInformation') ## IClientInfoProvider Interface Provides access to OAuth 2\.0 client information, enabling the retrieval of client details by client ID\. ```csharp public interface IClientInfoProvider ``` ### Remarks This interface is crucial for supporting OAuth 2\.0 and OpenID Connect operations, such as token issuance and validation, by allowing the system to retrieve the configuration and settings for registered clients\. It abstracts the underlying storage mechanism, whether it's a database, in\-memory collection, or an external service\. ### Methods ## IClientInfoProvider\.TryFindClientAsync\(string\) Method {#Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider.TryFindClientAsync(string)} Asynchronously attempts to find a client's information using its unique identifier\. ```csharp System.Threading.Tasks.Task TryFindClientAsync(string clientId); ``` #### Parameters ###### `clientId` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider.TryFindClientAsync(string).clientId} The unique identifier of the client whose information is being requested\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task that returns the client's information if found; otherwise, null\. This allows for non\-blocking queries to the underlying client information storage\. ### Remarks This method facilitates dynamic client management by enabling on\-demand lookup of client configurations during OAuth 2\.0 and OpenID Connect flows, supporting scenarios such as dynamic client registration and configuration updates\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.IClientKeysProvider.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.ClientInformation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation 'Abblix\.Oidc\.Server\.Features\.ClientInformation') ## IClientKeysProvider Interface Provides access to cryptographic keys for OpenID Connect clients, supporting token encryption and signature validation\. ```csharp public interface IClientKeysProvider ``` Derived ↳ [ClientKeysProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientKeysProvider 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientKeysProvider') ### Remarks This interface serves as a bridge between OAuth 2\.0/OpenID Connect clients and the cryptographic keys necessary for securing JWT tokens\. It enables dynamic retrieval of encryption and signing keys which can be used for token encryption, signature, and validation processes\. This approach supports scenarios where keys are rotated or updated without requiring service restarts or manual intervention\. ### Methods ## IClientKeysProvider\.GetEncryptionKeys\(ClientInfo\) Method {#Abblix.Oidc.Server.Features.ClientInformation.IClientKeysProvider.GetEncryptionKeys(Abblix.Oidc.Server.Features.ClientInformation.ClientInfo)} Retrieves the set of encryption keys associated with a given client, allowing the service to encrypt JWT tokens or other sensitive information intended for that client\. ```csharp System.Collections.Generic.IAsyncEnumerable GetEncryptionKeys(Abblix.Oidc.Server.Features.ClientInformation.ClientInfo clientInfo); ``` #### Parameters ###### `clientInfo` [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') {#Abblix.Oidc.Server.Features.ClientInformation.IClientKeysProvider.GetEncryptionKeys(Abblix.Oidc.Server.Features.ClientInformation.ClientInfo).clientInfo} The client's information, used to identify the correct set of encryption keys\. #### Returns [System\.Collections\.Generic\.IAsyncEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.iasyncenumerable-1 'System\.Collections\.Generic\.IAsyncEnumerable\`1')[JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.iasyncenumerable-1 'System\.Collections\.Generic\.IAsyncEnumerable\`1') An asynchronous stream \([System\.Collections\.Generic\.IAsyncEnumerable<>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.iasyncenumerable-1 'System\.Collections\.Generic\.IAsyncEnumerable\`1')\) of [JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey'), providing access to each key\. ### Remarks This method is essential for services that issue encrypted tokens or need to securely communicate with clients, ensuring that only the intended recipient can decrypt and access the transmitted information\. ## IClientKeysProvider\.GetSigningKeys\(ClientInfo\) Method {#Abblix.Oidc.Server.Features.ClientInformation.IClientKeysProvider.GetSigningKeys(Abblix.Oidc.Server.Features.ClientInformation.ClientInfo)} Retrieves the set of signing keys associated with a given client, enabling the service to validate signatures on JWT tokens or other signed payloads originating from that client\. ```csharp System.Collections.Generic.IAsyncEnumerable GetSigningKeys(Abblix.Oidc.Server.Features.ClientInformation.ClientInfo clientInfo); ``` #### Parameters ###### `clientInfo` [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') {#Abblix.Oidc.Server.Features.ClientInformation.IClientKeysProvider.GetSigningKeys(Abblix.Oidc.Server.Features.ClientInformation.ClientInfo).clientInfo} The client's information, used to identify the correct set of signing keys\. #### Returns [System\.Collections\.Generic\.IAsyncEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.iasyncenumerable-1 'System\.Collections\.Generic\.IAsyncEnumerable\`1')[JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.iasyncenumerable-1 'System\.Collections\.Generic\.IAsyncEnumerable\`1') An asynchronous stream \([System\.Collections\.Generic\.IAsyncEnumerable<>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.iasyncenumerable-1 'System\.Collections\.Generic\.IAsyncEnumerable\`1')\) of [JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey'), providing access to each key\. ### Remarks This method supports secure client\-server interactions by enabling the service to verify the authenticity of incoming signed data, ensuring it was not tampered with and was indeed issued by the claiming client\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.OidcOptionsSecurityProfileValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.ClientInformation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation 'Abblix\.Oidc\.Server\.Features\.ClientInformation') ## OidcOptionsSecurityProfileValidator Class Validates that every statically\-configured client whose effective profile mandates a control bundle has a configuration that can satisfy it, failing loudly the first time [OidcOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions') is resolved rather than letting a contradiction surface as a per\-request rejection at runtime\. A no\-op for deployments that select no profile, so existing configurations are unaffected\. ```csharp public class OidcOptionsSecurityProfileValidator : Microsoft.Extensions.Options.IValidateOptions ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → OidcOptionsSecurityProfileValidator Implements [Microsoft\.Extensions\.Options\.IValidateOptions<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ivalidateoptions-1 'Microsoft\.Extensions\.Options\.IValidateOptions\`1')[OidcOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ivalidateoptions-1 'Microsoft\.Extensions\.Options\.IValidateOptions\`1') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileConsistency.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.ClientInformation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation 'Abblix\.Oidc\.Server\.Features\.ClientInformation') ## SecurityProfileConsistency Class Checks whether a client's configuration can actually satisfy the profile it selects, so a contradiction surfaces loudly at registration or startup instead of as a per\-request rejection the operator has to reverse\-engineer\. The runtime validators already tighten a request to the profile; this is the fail\-loud companion that catches static configuration that can never produce a conformant flow in the first place\. ```csharp public static class SecurityProfileConsistency ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → SecurityProfileConsistency ### Methods ## SecurityProfileConsistency\.FindViolations\(IReadOnlyList\, string, SecurityProfileRequirements\) Method {#Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileConsistency.FindViolations(System.Collections.Generic.IReadOnlyList_string[]_,string,Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileRequirements)} Returns the human\-readable violations that prevent a client with the given registered response types from satisfying the effective profile, or an empty list when the configuration is self\-consistent\. The check operates on response types because that is the one part of a FAPI client the profile cannot silently fix at request time: a client that never permits the authorization\-code response type, or that permits an implicit/hybrid one, is misconfigured rather than merely tightened\. ```csharp public static System.Collections.Generic.IReadOnlyList FindViolations(System.Collections.Generic.IReadOnlyList allowedResponseTypes, string tokenEndpointAuthMethod, Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileRequirements requirements); ``` #### Parameters ###### `allowedResponseTypes` [System\.Collections\.Generic\.IReadOnlyList<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ireadonlylist-1 'System\.Collections\.Generic\.IReadOnlyList\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ireadonlylist-1 'System\.Collections\.Generic\.IReadOnlyList\`1') {#Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileConsistency.FindViolations(System.Collections.Generic.IReadOnlyList_string[]_,string,Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileRequirements).allowedResponseTypes} The response\-type combinations the client is registered for\. ###### `tokenEndpointAuthMethod` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileConsistency.FindViolations(System.Collections.Generic.IReadOnlyList_string[]_,string,Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileRequirements).tokenEndpointAuthMethod} How the client authenticates at the token endpoint\. ###### `requirements` [SecurityProfileRequirements](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileRequirements 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.SecurityProfileRequirements') {#Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileConsistency.FindViolations(System.Collections.Generic.IReadOnlyList_string[]_,string,Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileRequirements).requirements} The control bundle the client is held to, floor included\. #### Returns [System\.Collections\.Generic\.IReadOnlyList<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ireadonlylist-1 'System\.Collections\.Generic\.IReadOnlyList\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ireadonlylist-1 'System\.Collections\.Generic\.IReadOnlyList\`1') ### Remarks The BUNDLE rather than a profile name, because a client is held to the deployment's profile tightened by its own and no enum value names that combination\. Taking a name here would put the resolution inside this method, where it would silently undo whichever floor its caller had just applied \- and the two controls below are the ones nothing else enforces, so the gap would show up as a client authenticating with a shared secret under a profile that admits no such client\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileRequirements.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.ClientInformation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation 'Abblix\.Oidc\.Server\.Features\.ClientInformation') ## SecurityProfileRequirements Class The bundle of controls a [ClientSecurityProfile](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ClientSecurityProfile 'Abblix\.Oidc\.Server\.Common\.Constants\.ClientSecurityProfile') forces on a client, expressed as individual flags the request\-pipeline validators consult\. This is the single place the profile\-to\-controls mapping lives, so a validator never needs to know what "FAPI 2\.0" means \- it only reads the one flag it owns \- and adding a future profile touches only [Resolve\(ClientSecurityProfile\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileRequirements#Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileRequirements.Resolve(Abblix.Oidc.Server.Common.Constants.ClientSecurityProfile) 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.SecurityProfileRequirements\.Resolve\(Abblix\.Oidc\.Server\.Common\.Constants\.ClientSecurityProfile\)')\. ```csharp public sealed record SecurityProfileRequirements : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → SecurityProfileRequirements Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[SecurityProfileRequirements](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileRequirements 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.SecurityProfileRequirements')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Remarks A flag normally requires a control and never relaxes one, so a profile tightens a client and cannot weaken it\. That is what lets a granular toggle \(for example [PkceRequired](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.PkceRequired 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo\.PkceRequired') set to `false`\) coexist with a profile without silently downgrading it\. One flag goes the other way, and the exception is deliberate rather than an escape hatch\. [ForbidRefreshTokenRotation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileRequirements#Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileRequirements.ForbidRefreshTokenRotation 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.SecurityProfileRequirements\.ForbidRefreshTokenRotation') removes a control, because the specification it comes from replaces that control with two others instead of dropping protection: rotation earns nothing once the client is confidential and its tokens are bound to their sender, and it costs a user their session whenever a client fails to store the token it was handed\. A relaxing flag is therefore admissible only when the same profile carries the controls that stand in for what it removes, which [FindUnreplacedRelaxations\(\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileRequirements#Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileRequirements.FindUnreplacedRelaxations() 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.SecurityProfileRequirements\.FindUnreplacedRelaxations\(\)') checks for every profile at startup rather than leaving to review\. Every flag below names the validator that enforces it\. That coupling is documented here on purpose: the enforcement is distributed across the request pipeline, so a new flag added to a profile without a matching consumer would ship silently unenforced\. When adding a flag, wire a validator that reads it and a test that proves the control fires\. ### Properties ## SecurityProfileRequirements\.DefaultClockSkew Property {#Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileRequirements.DefaultClockSkew} The tolerance in force where a deployment names none of its own \- an answer this profile supplies rather than imposes: a deployment setting a value of its own wins over it, and is held only by [MaxClockSkew](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileRequirements#Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileRequirements.MaxClockSkew 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.SecurityProfileRequirements\.MaxClockSkew')\. ```csharp public Abblix.Jwt.ClockSkew DefaultClockSkew { get; init; } ``` #### Property Value [ClockSkew](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ClockSkew 'Abblix\.Jwt\.ClockSkew') ### Remarks Selecting no profile is a posture rather than the absence of one, and its answer is [Abblix\.Oidc\.Server\.Features\.ClientInformation\.SecurityProfileRequirements\.UnprofiledClockSkew](https://learn.microsoft.com/en-us/dotnet/api/abblix.oidc.server.features.clientinformation.securityprofilerequirements.unprofiledclockskew 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.SecurityProfileRequirements\.UnprofiledClockSkew'): an assertion arrives from an issuer whose clock this server does not run, and RFC 7523 Section 3 allows for that offset without naming a bound\. Where a profile bounds freshness the two halves part company: an expiry the client itself chose is a deadline this server has no reason to extend, because the grace exists for a clock that disagrees rather than for a token that is simply late\. ## SecurityProfileRequirements\.ForbidRefreshTokenRotation Property {#Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileRequirements.ForbidRefreshTokenRotation} The profile forbids refresh token rotation, which is the one flag that removes a control rather than requiring one\. See the remarks on this type for why that is admissible here and what stands in its place\. Enforced by `Features.Tokens.RefreshTokenService`\. ```csharp public bool ForbidRefreshTokenRotation { get; init; } ``` #### Property Value [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') ## SecurityProfileRequirements\.MaxClockSkew Property {#Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileRequirements.MaxClockSkew} The furthest either clock window may reach under this profile, or null where the profile puts no bound on them\. Read by every place that builds JWT validation parameters\. ```csharp public System.Nullable MaxClockSkew { get; init; } ``` #### Property Value [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') ### Remarks Unlike the flags around it this carries a VALUE, because the requirement names one and a boolean would leave each reader to remember it \- which is how two readers come to bound the same thing differently\. Null rather than a large number, so that a profile putting no bound on the future is the ABSENCE of one and cannot be mistaken for a generous bound somebody chose\. ## SecurityProfileRequirements\.RequireCodeResponseTypeOnly Property {#Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileRequirements.RequireCodeResponseTypeOnly} The profile permits only the authorization\-code response type, rejecting any implicit or hybrid response type that returns a token or id\_token from the authorization endpoint\. Enforced by `Endpoints.Authorization.Validation.FlowTypeValidator` at request time and by [SecurityProfileConsistency](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileConsistency 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.SecurityProfileConsistency') as a fail\-loud registration/startup check\. ```csharp public bool RequireCodeResponseTypeOnly { get; init; } ``` #### Property Value [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') ## SecurityProfileRequirements\.RequireConfidentialClient Property {#Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileRequirements.RequireConfidentialClient} The profile admits only confidential clients as defined by RFC 6749, so a client that authenticates with nothing at the token endpoint cannot be held to it\. Enforced by [SecurityProfileConsistency](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileConsistency 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.SecurityProfileConsistency') at registration and at startup\. ```csharp public bool RequireConfidentialClient { get; init; } ``` #### Property Value [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') ## SecurityProfileRequirements\.RequireIssuerAudienceInClientAssertion Property {#Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileRequirements.RequireIssuerAudienceInClientAssertion} The profile accepts only the server's issuer identifier, and only as a string, in the audience of a client authentication assertion, narrowing what the underlying specification otherwise permits\. Enforced by `Features.ClientAuthentication.JwtAssertionAuthenticatorBase`\. ```csharp public bool RequireIssuerAudienceInClientAssertion { get; init; } ``` #### Property Value [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') ## SecurityProfileRequirements\.RequireKeyBasedClientAuthentication Property {#Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileRequirements.RequireKeyBasedClientAuthentication} The profile admits only client authentication that proves possession of a key: mutual TLS \(RFC 8705 section 2\) or a private key JWT assertion \(OpenID Connect Core section 9\)\. Every method keyed on a shared secret is refused\. Enforced by [SecurityProfileConsistency](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileConsistency 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.SecurityProfileConsistency') at registration and at startup\. ```csharp public bool RequireKeyBasedClientAuthentication { get; init; } ``` #### Property Value [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') ## SecurityProfileRequirements\.RequirePkce Property {#Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileRequirements.RequirePkce} The profile mandates PKCE on every authorization request, even when the client's own [PkceRequired](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo#Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.PkceRequired 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo\.PkceRequired') is `false`\. Enforced by `Endpoints.Authorization.Validation.PkceValidator`\. ```csharp public bool RequirePkce { get; init; } ``` #### Property Value [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') ## SecurityProfileRequirements\.RequirePushedAuthorizationRequests Property {#Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileRequirements.RequirePushedAuthorizationRequests} The profile requires the client to start every authorization flow through a Pushed Authorization Request, independent of the server\-wide [RequirePushedAuthorizationRequests](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions#Abblix.Oidc.Server.Common.Configuration.OidcOptions.RequirePushedAuthorizationRequests 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions\.RequirePushedAuthorizationRequests') flag\. Enforced by `Endpoints.Authorization.RequestFetching.PushedRequestFetcher`\. ```csharp public bool RequirePushedAuthorizationRequests { get; init; } ``` #### Property Value [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') ## SecurityProfileRequirements\.RequireS256CodeChallenge Property {#Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileRequirements.RequireS256CodeChallenge} The profile restricts the PKCE code challenge method to exactly `S256`, rejecting both `plain` and the non\-standard `S512` extension\. FAPI 2\.0 names `S256`, and the IANA "PKCE Code Challenge Methods" registry defines only `plain` and `S256`, so a conformance suite never presents `S512`\. Enforced by `Endpoints.Authorization.Validation.PkceValidator`\. ```csharp public bool RequireS256CodeChallenge { get; init; } ``` #### Property Value [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') ## SecurityProfileRequirements\.RequireSenderConstrainedTokens Property {#Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileRequirements.RequireSenderConstrainedTokens} The profile requires a sender\-constrained access token, satisfied by either a DPoP proof \(RFC 9449\) or a certificate\-bound token over mutual TLS \(RFC 8705 section 3\)\. Enforced by `Endpoints.Token.Validation.DPoPTokenEndpointValidator`\. ```csharp public bool RequireSenderConstrainedTokens { get; init; } ``` #### Property Value [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') ## SecurityProfileRequirements\.RequireStrictRequestObjectProcessing Property {#Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileRequirements.RequireStrictRequestObjectProcessing} The profile requires strict RFC 9101 section 6\.3 request\-object processing: only the parameters inside the request object are used and any parameter passed outside it is ignored, instead of the OpenID Connect Core section 6\.1 merge behaviour\. FAPI 2\.0 mandates JWT\-Secured Authorization Requests with this exclusivity\. Enforced by `Features.RequestObject.RequestObjectFetcher`\. ```csharp public bool RequireStrictRequestObjectProcessing { get; init; } ``` #### Property Value [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') ### Methods ## SecurityProfileRequirements\.ClockSkewOrDefault\(Nullable\\) Method {#Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileRequirements.ClockSkewOrDefault(System.Nullable_Abblix.Jwt.ClockSkew_)} The tolerance that actually applies: what the caller configured where it configured anything, otherwise [DefaultClockSkew](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileRequirements#Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileRequirements.DefaultClockSkew 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.SecurityProfileRequirements\.DefaultClockSkew'), in either case held to [MaxClockSkew](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileRequirements#Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileRequirements.MaxClockSkew 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.SecurityProfileRequirements\.MaxClockSkew')\. ```csharp public Abblix.Jwt.ClockSkew ClockSkewOrDefault(System.Nullable configured=null); ``` #### Parameters ###### `configured` [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[ClockSkew](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ClockSkew 'Abblix\.Jwt\.ClockSkew')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') {#Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileRequirements.ClockSkewOrDefault(System.Nullable_Abblix.Jwt.ClockSkew_).configured} A tolerance the caller set, or null to take this profile's own\. #### Returns [ClockSkew](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ClockSkew 'Abblix\.Jwt\.ClockSkew') ### Remarks The bound is applied HERE rather than carried onward beside the value, so that no reader can take one without the other\. A ceiling travelling as a second field is a ceiling somebody forgets to pass, and the omission reads as a deployment allowed to be looser rather than as the mistake it is\. ## SecurityProfileRequirements\.FindUnreplacedRelaxations\(\) Method {#Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileRequirements.FindUnreplacedRelaxations()} Names every profile that removes a control without carrying the controls that stand in for it\. An empty list means each relaxation in this file is paid for\. ```csharp public static System.Collections.Generic.IReadOnlyList FindUnreplacedRelaxations(); ``` #### Returns [System\.Collections\.Generic\.IReadOnlyList<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ireadonlylist-1 'System\.Collections\.Generic\.IReadOnlyList\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ireadonlylist-1 'System\.Collections\.Generic\.IReadOnlyList\`1') ### Remarks This exists because a relaxing flag is one edit away from becoming an ordinary permission\. Someone adding a profile, or loosening an existing one, sees a set of booleans with no direction to them, and nothing in the type distinguishes the flag that removes protection from the nine that add it\. So the condition that makes the removal sound is stated as code and run at startup, where it can fail, rather than as a paragraph that can be skipped\. Refusing refresh token rotation is sound only alongside a confidential client and a sender\-constrained token, because those two are what make rotation redundant\. A profile carrying the relaxation without them would hand out long\-lived multi\-use refresh tokens to a client that may be public and whose tokens anyone may replay\. ## SecurityProfileRequirements\.For\(ClientInfo, ClientSecurityProfile\) Method {#Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileRequirements.For(Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,Abblix.Oidc.Server.Common.Constants.ClientSecurityProfile)} The control bundle a client is actually held to: what the deployment demands of everyone, tightened by whatever the client names for itself\. ```csharp public static Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileRequirements For(Abblix.Oidc.Server.Features.ClientInformation.ClientInfo client, Abblix.Oidc.Server.Common.Constants.ClientSecurityProfile defaultProfile); ``` #### Parameters ###### `client` [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') {#Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileRequirements.For(Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,Abblix.Oidc.Server.Common.Constants.ClientSecurityProfile).client} The client whose effective profile is being resolved\. ###### `defaultProfile` [ClientSecurityProfile](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ClientSecurityProfile 'Abblix\.Oidc\.Server\.Common\.Constants\.ClientSecurityProfile') {#Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileRequirements.For(Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,Abblix.Oidc.Server.Common.Constants.ClientSecurityProfile).defaultProfile} The profile the deployment holds every client to\. #### Returns [SecurityProfileRequirements](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileRequirements 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.SecurityProfileRequirements') ### Remarks A deployment\-wide profile is a FLOOR, not a default\. Turning one on is a statement about every client the server serves, so a client cannot step out from under it \- it can only ask for more\. The alternative reading, where a client naming a profile replaces the deployment's, makes the server\-wide setting a suggestion: one registration would quietly leave a FAPI 2\.0 deployment serving a client under none of its controls, and nothing about that registration would look like a decision to weaken the server\. The combination is per CONTROL rather than a choice between two bundles, because "stricter" is not a property a bundle has \- one profile can demand sender\-constrained tokens while another names a tighter clock window, and picking either bundle whole would drop the other's demand\. ## SecurityProfileRequirements\.Resolve\(ClientSecurityProfile\) Method {#Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileRequirements.Resolve(Abblix.Oidc.Server.Common.Constants.ClientSecurityProfile)} Returns the control bundle a given profile mandates\. ```csharp public static Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileRequirements Resolve(Abblix.Oidc.Server.Common.Constants.ClientSecurityProfile profile); ``` #### Parameters ###### `profile` [ClientSecurityProfile](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ClientSecurityProfile 'Abblix\.Oidc\.Server\.Common\.Constants\.ClientSecurityProfile') {#Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileRequirements.Resolve(Abblix.Oidc.Server.Common.Constants.ClientSecurityProfile).profile} #### Returns [SecurityProfileRequirements](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileRequirements 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.SecurityProfileRequirements') ### Remarks The default arm throws rather than answering [Abblix\.Oidc\.Server\.Features\.ClientInformation\.SecurityProfileRequirements\.NoneRequirements](https://learn.microsoft.com/en-us/dotnet/api/abblix.oidc.server.features.clientinformation.securityprofilerequirements.nonerequirements 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.SecurityProfileRequirements\.NoneRequirements')\. A profile added to the enum without a bundle here would otherwise resolve to no requirements at all, which is silently the weakest answer available and reads at every call site as a deliberate one\. A value the enum does not define is a different population and gets a different answer\. It arrives from outside \- a configuration binder takes a number outside the range as it stands, and a client store the host writes can hold anything \- so it is data rather than a mistake in this file, and the readers meeting it are handling a live request\. Throwing there turns a host's bad value into a 500 from the authorization and token endpoints, which is the reader's failure rather than the writer's\. It resolves to [Abblix\.Oidc\.Server\.Features\.ClientInformation\.SecurityProfileRequirements\.StrictestRequirements](https://learn.microsoft.com/en-us/dotnet/api/abblix.oidc.server.features.clientinformation.securityprofilerequirements.strictestrequirements 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.SecurityProfileRequirements\.StrictestRequirements') instead: nothing here can say what the value meant, and of the answers available only the strictest cannot quietly serve a client the deployment believed was constrained\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.TlsClientAuthOptions.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.ClientInformation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation 'Abblix\.Oidc\.Server\.Features\.ClientInformation') ## TlsClientAuthOptions Class RFC 8705 metadata for tls\_client\_auth method\. Defines match rules for Subject DN and/or Subject Alternative Name entries\. ```csharp public record TlsClientAuthOptions : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → TlsClientAuthOptions Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[TlsClientAuthOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.TlsClientAuthOptions 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.TlsClientAuthOptions')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Properties ## TlsClientAuthOptions\.SanDns Property {#Abblix.Oidc.Server.Features.ClientInformation.TlsClientAuthOptions.SanDns} Required DNS SAN entries\. ```csharp public string[]? SanDns { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') ## TlsClientAuthOptions\.SanEmails Property {#Abblix.Oidc.Server.Features.ClientInformation.TlsClientAuthOptions.SanEmails} Required email SAN entries \(RFC822Name\)\. ```csharp public string[]? SanEmails { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') ## TlsClientAuthOptions\.SanIps Property {#Abblix.Oidc.Server.Features.ClientInformation.TlsClientAuthOptions.SanIps} Required IP SAN entries \(string representation\)\. ```csharp public string[]? SanIps { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') ## TlsClientAuthOptions\.SanUris Property {#Abblix.Oidc.Server.Features.ClientInformation.TlsClientAuthOptions.SanUris} Required URI SAN entries\. ```csharp public System.Uri[]? SanUris { get; init; } ``` #### Property Value [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') ## TlsClientAuthOptions\.SubjectDn Property {#Abblix.Oidc.Server.Features.ClientInformation.TlsClientAuthOptions.SubjectDn} Exact Subject Distinguished Name \(RFC 4514\) that must be present on client cert\. ```csharp public string? SubjectDn { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Consents.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ## Abblix\.Oidc\.Server\.Features\.Consents Namespace | Classes | | | :--- | :--- | | [ConsentDefinition](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Consents.ConsentDefinition 'Abblix\.Oidc\.Server\.Features\.Consents\.ConsentDefinition') | Defines the details of user consents required for specific scopes and resources\. This record is used to manage and validate user consent for accessing specific scopes, resources, and RFC 9396 Rich Authorization Requests entries, ensuring that consent is explicitly granted according to the requirements of the application and compliance standards\. | | [NullConsentService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Consents.NullConsentService 'Abblix\.Oidc\.Server\.Features\.Consents\.NullConsentService') | Default no\-op consent provider that auto\-grants every requested scope and resource and never marks consent as pending\. Suitable for trusted first\-party deployments and as the starting placeholder during integration; replace with a host\-supplied implementation to honour OIDC Core §3\.1\.2\.4 \(authorization server obtains end\-user consent\)\. | | [PromptConsentDecorator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Consents.PromptConsentDecorator 'Abblix\.Oidc\.Server\.Features\.Consents\.PromptConsentDecorator') | Honours the OIDC Core §3\.1\.2\.1 `prompt=consent` parameter by short\-circuiting the wrapped [IUserConsentsProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Consents.IUserConsentsProvider 'Abblix\.Oidc\.Server\.Features\.Consents\.IUserConsentsProvider'): when the client explicitly requests consent re\-confirmation, every requested scope and resource is forced into the pending bucket so the consent UI is shown even if the user previously granted it\. For any other prompt value the decorator delegates to the inner provider unchanged\. | | [UserConsents](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Consents.UserConsents 'Abblix\.Oidc\.Server\.Features\.Consents\.UserConsents') | Represents the state of user consents in an authorization flow, categorizing them into granted, denied, and pending\. | | Interfaces | | | :--- | :--- | | [IUserConsentsProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Consents.IUserConsentsProvider 'Abblix\.Oidc\.Server\.Features\.Consents\.IUserConsentsProvider') | Defines an interface for a service that provides user consents\. This service is responsible for retrieving and managing user consent decisions related to authorization requests\. It ensures that the application adheres to user preferences and legal requirements concerning data access and processing\. | --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Consents.ConsentDefinition.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.Consents](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Consents 'Abblix\.Oidc\.Server\.Features\.Consents') ## ConsentDefinition Class Defines the details of user consents required for specific scopes and resources\. This record is used to manage and validate user consent for accessing specific scopes, resources, and RFC 9396 Rich Authorization Requests entries, ensuring that consent is explicitly granted according to the requirements of the application and compliance standards\. ```csharp public record ConsentDefinition : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ConsentDefinition Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[ConsentDefinition](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Consents.ConsentDefinition 'Abblix\.Oidc\.Server\.Features\.Consents\.ConsentDefinition')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Constructors ## ConsentDefinition\(ScopeDefinition\[\], ResourceDefinition\[\]\) Constructor {#Abblix.Oidc.Server.Features.Consents.ConsentDefinition.ConsentDefinition(Abblix.Oidc.Server.Common.Constants.ScopeDefinition[],Abblix.Oidc.Server.Common.Constants.ResourceDefinition[])} Defines the details of user consents required for specific scopes and resources\. This record is used to manage and validate user consent for accessing specific scopes, resources, and RFC 9396 Rich Authorization Requests entries, ensuring that consent is explicitly granted according to the requirements of the application and compliance standards\. ```csharp public ConsentDefinition(Abblix.Oidc.Server.Common.Constants.ScopeDefinition[] Scopes, Abblix.Oidc.Server.Common.Constants.ResourceDefinition[] Resources); ``` #### Parameters ###### `Scopes` [ScopeDefinition](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ScopeDefinition 'Abblix\.Oidc\.Server\.Common\.Constants\.ScopeDefinition')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Oidc.Server.Features.Consents.ConsentDefinition.ConsentDefinition(Abblix.Oidc.Server.Common.Constants.ScopeDefinition[],Abblix.Oidc.Server.Common.Constants.ResourceDefinition[]).Scopes} An array of [ScopeDefinition](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ScopeDefinition 'Abblix\.Oidc\.Server\.Common\.Constants\.ScopeDefinition') that represents the scopes for which user consent is needed\. ###### `Resources` [ResourceDefinition](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ResourceDefinition 'Abblix\.Oidc\.Server\.Common\.Constants\.ResourceDefinition')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Oidc.Server.Features.Consents.ConsentDefinition.ConsentDefinition(Abblix.Oidc.Server.Common.Constants.ScopeDefinition[],Abblix.Oidc.Server.Common.Constants.ResourceDefinition[]).Resources} An array of [ResourceDefinition](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ResourceDefinition 'Abblix\.Oidc\.Server\.Common\.Constants\.ResourceDefinition') that represents the resources for which user consent is needed\. ### Properties ## ConsentDefinition\.AuthorizationDetails Property {#Abblix.Oidc.Server.Features.Consents.ConsentDefinition.AuthorizationDetails} RFC 9396 `authorization_details` entries for which user consent is needed \(in [Pending](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Consents.UserConsents#Abblix.Oidc.Server.Features.Consents.UserConsents.Pending 'Abblix\.Oidc\.Server\.Features\.Consents\.UserConsents\.Pending')\) or has been granted \(in [Granted](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Consents.UserConsents#Abblix.Oidc.Server.Features.Consents.UserConsents.Granted 'Abblix\.Oidc\.Server\.Features\.Consents\.UserConsents\.Granted')\)\. `null` when the request did not include `authorization_details`\. ```csharp public System.Text.Json.Nodes.JsonArray? AuthorizationDetails { get; init; } ``` #### Property Value [System\.Text\.Json\.Nodes\.JsonArray](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonarray 'System\.Text\.Json\.Nodes\.JsonArray') ### Remarks The two sets are independent, so a decision is made per entry: an entry the user has approved goes to [Granted](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Consents.UserConsents#Abblix.Oidc.Server.Features.Consents.UserConsents.Granted 'Abblix\.Oidc\.Server\.Features\.Consents\.UserConsents\.Granted') while another from the same request is still waiting in [Pending](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Consents.UserConsents#Abblix.Oidc.Server.Features.Consents.UserConsents.Pending 'Abblix\.Oidc\.Server\.Features\.Consents\.UserConsents\.Pending')\. Anything left pending sends the request back for consent, and the screen is shown what is pending rather than what has already been granted\. A granted entry is whatever the provider returns, which RFC 9396 section 7.1 permits to differ from what was requested, in either direction: dropping an entry keeps it out of the issued token, editing one inside (an amount narrowed by a slider) is carried through as edited, and the section's own example is the opposite case, the server filling in the accounts a user picked. What is refused is a granted entry of a `type` the request did not carry; within an entry, the per-type validator decides. Only the authorization endpoint consults this. A backchannel authentication request has no consent seam at all, and the device flow surfaces the requested entries for the host to carry onto the grant itself. The storage is raw so that member order, type-specific payload and members this server does not model survive the round trip untouched. For rendering a consent screen, read the same entries as [AuthorizationDetail](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.AuthorizationDetail 'Abblix\.Jwt\.AuthorizationDetail') through `ToTypedArray()`: the typed view wraps these nodes rather than copying them, so it names the RFC 9396 section 2.2 common members without costing the rest. ## ConsentDefinition\.Resources Property {#Abblix.Oidc.Server.Features.Consents.ConsentDefinition.Resources} An array of [ResourceDefinition](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ResourceDefinition 'Abblix\.Oidc\.Server\.Common\.Constants\.ResourceDefinition') that represents the resources for which user consent is needed\. ```csharp public Abblix.Oidc.Server.Common.Constants.ResourceDefinition[] Resources { get; init; } ``` #### Property Value [ResourceDefinition](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ResourceDefinition 'Abblix\.Oidc\.Server\.Common\.Constants\.ResourceDefinition')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') ## ConsentDefinition\.Scopes Property {#Abblix.Oidc.Server.Features.Consents.ConsentDefinition.Scopes} An array of [ScopeDefinition](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ScopeDefinition 'Abblix\.Oidc\.Server\.Common\.Constants\.ScopeDefinition') that represents the scopes for which user consent is needed\. ```csharp public Abblix.Oidc.Server.Common.Constants.ScopeDefinition[] Scopes { get; init; } ``` #### Property Value [ScopeDefinition](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ScopeDefinition 'Abblix\.Oidc\.Server\.Common\.Constants\.ScopeDefinition')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Consents.IUserConsentsProvider.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.Consents](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Consents 'Abblix\.Oidc\.Server\.Features\.Consents') ## IUserConsentsProvider Interface Defines an interface for a service that provides user consents\. This service is responsible for retrieving and managing user consent decisions related to authorization requests\. It ensures that the application adheres to user preferences and legal requirements concerning data access and processing\. ```csharp public interface IUserConsentsProvider ``` Derived ↳ [NullConsentService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Consents.NullConsentService 'Abblix\.Oidc\.Server\.Features\.Consents\.NullConsentService') ↳ [PromptConsentDecorator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Consents.PromptConsentDecorator 'Abblix\.Oidc\.Server\.Features\.Consents\.PromptConsentDecorator') ### Methods ## IUserConsentsProvider\.GetUserConsentsAsync\(ValidAuthorizationRequest, AuthSession\) Method {#Abblix.Oidc.Server.Features.Consents.IUserConsentsProvider.GetUserConsentsAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest,Abblix.Oidc.Server.Features.UserAuthentication.AuthSession)} Asynchronously retrieves the user consents for a given authorization request and authentication session\. This method is essential for determining which scopes and resources the user has consented to, enabling the application to respect user permissions and comply with data protection regulations\. ```csharp System.Threading.Tasks.Task GetUserConsentsAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest request, Abblix.Oidc.Server.Features.UserAuthentication.AuthSession authSession); ``` #### Parameters ###### `request` [ValidAuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.ValidAuthorizationRequest') {#Abblix.Oidc.Server.Features.Consents.IUserConsentsProvider.GetUserConsentsAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest,Abblix.Oidc.Server.Features.UserAuthentication.AuthSession).request} The validated authorization request containing the scopes and resources for which consent may be required\. ###### `authSession` [AuthSession](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.UserAuthentication.AuthSession 'Abblix\.Oidc\.Server\.Features\.UserAuthentication\.AuthSession') {#Abblix.Oidc.Server.Features.Consents.IUserConsentsProvider.GetUserConsentsAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest,Abblix.Oidc.Server.Features.UserAuthentication.AuthSession).authSession} The current authentication session that provides context about the authenticated user, potentially influencing consent retrieval based on the user's settings or previous consent decisions\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[UserConsents](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Consents.UserConsents 'Abblix\.Oidc\.Server\.Features\.Consents\.UserConsents')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task that resolves to an instance of [UserConsents](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Consents.UserConsents 'Abblix\.Oidc\.Server\.Features\.Consents\.UserConsents'), containing detailed information about the consents granted or denied by the user\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Consents.NullConsentService.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.Consents](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Consents 'Abblix\.Oidc\.Server\.Features\.Consents') ## NullConsentService Class Default no\-op consent provider that auto\-grants every requested scope and resource and never marks consent as pending\. Suitable for trusted first\-party deployments and as the starting placeholder during integration; replace with a host\-supplied implementation to honour OIDC Core §3\.1\.2\.4 \(authorization server obtains end\-user consent\)\. ```csharp public class NullConsentService : Abblix.Oidc.Server.Features.Consents.IUserConsentsProvider ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → NullConsentService Implements [IUserConsentsProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Consents.IUserConsentsProvider 'Abblix\.Oidc\.Server\.Features\.Consents\.IUserConsentsProvider') ### Methods ## NullConsentService\.GetUserConsentsAsync\(ValidAuthorizationRequest, AuthSession\) Method {#Abblix.Oidc.Server.Features.Consents.NullConsentService.GetUserConsentsAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest,Abblix.Oidc.Server.Features.UserAuthentication.AuthSession)} Returns a [UserConsents](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Consents.UserConsents 'Abblix\.Oidc\.Server\.Features\.Consents\.UserConsents') with every requested scope and resource pre\-granted and nothing pending, so the authorization flow can proceed without prompting the user\. ```csharp public System.Threading.Tasks.Task GetUserConsentsAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest request, Abblix.Oidc.Server.Features.UserAuthentication.AuthSession authSession); ``` #### Parameters ###### `request` [ValidAuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.ValidAuthorizationRequest') {#Abblix.Oidc.Server.Features.Consents.NullConsentService.GetUserConsentsAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest,Abblix.Oidc.Server.Features.UserAuthentication.AuthSession).request} The validated authorization request for which to retrieve consents\. ###### `authSession` [AuthSession](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.UserAuthentication.AuthSession 'Abblix\.Oidc\.Server\.Features\.UserAuthentication\.AuthSession') {#Abblix.Oidc.Server.Features.Consents.NullConsentService.GetUserConsentsAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest,Abblix.Oidc.Server.Features.UserAuthentication.AuthSession).authSession} The authentication session associated with the request\. Implements [GetUserConsentsAsync\(ValidAuthorizationRequest, AuthSession\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Consents.IUserConsentsProvider#Abblix.Oidc.Server.Features.Consents.IUserConsentsProvider.GetUserConsentsAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest,Abblix.Oidc.Server.Features.UserAuthentication.AuthSession) 'Abblix\.Oidc\.Server\.Features\.Consents\.IUserConsentsProvider\.GetUserConsentsAsync\(Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.ValidAuthorizationRequest, Abblix\.Oidc\.Server\.Features\.UserAuthentication\.AuthSession\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[UserConsents](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Consents.UserConsents 'Abblix\.Oidc\.Server\.Features\.Consents\.UserConsents')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') ## NullConsentService\.IsConsentRequired\(ValidAuthorizationRequest, AuthSession\) Method {#Abblix.Oidc.Server.Features.Consents.NullConsentService.IsConsentRequired(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest,Abblix.Oidc.Server.Features.UserAuthentication.AuthSession)} Returns `false` for every request because [GetUserConsentsAsync\(ValidAuthorizationRequest, AuthSession\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Consents.NullConsentService#Abblix.Oidc.Server.Features.Consents.NullConsentService.GetUserConsentsAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest,Abblix.Oidc.Server.Features.UserAuthentication.AuthSession) 'Abblix\.Oidc\.Server\.Features\.Consents\.NullConsentService\.GetUserConsentsAsync\(Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.ValidAuthorizationRequest, Abblix\.Oidc\.Server\.Features\.UserAuthentication\.AuthSession\)') grants everything up\-front and leaves [Pending](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Consents.UserConsents#Abblix.Oidc.Server.Features.Consents.UserConsents.Pending 'Abblix\.Oidc\.Server\.Features\.Consents\.UserConsents\.Pending') empty\. ```csharp public System.Threading.Tasks.Task IsConsentRequired(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest request, Abblix.Oidc.Server.Features.UserAuthentication.AuthSession authSession); ``` #### Parameters ###### `request` [ValidAuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.ValidAuthorizationRequest') {#Abblix.Oidc.Server.Features.Consents.NullConsentService.IsConsentRequired(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest,Abblix.Oidc.Server.Features.UserAuthentication.AuthSession).request} The validated authorization request that might require consent\. ###### `authSession` [AuthSession](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.UserAuthentication.AuthSession 'Abblix\.Oidc\.Server\.Features\.UserAuthentication\.AuthSession') {#Abblix.Oidc.Server.Features.Consents.NullConsentService.IsConsentRequired(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest,Abblix.Oidc.Server.Features.UserAuthentication.AuthSession).authSession} The authentication session associated with the request\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Consents.PromptConsentDecorator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.Consents](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Consents 'Abblix\.Oidc\.Server\.Features\.Consents') ## PromptConsentDecorator Class Honours the OIDC Core §3\.1\.2\.1 `prompt=consent` parameter by short\-circuiting the wrapped [IUserConsentsProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Consents.IUserConsentsProvider 'Abblix\.Oidc\.Server\.Features\.Consents\.IUserConsentsProvider'): when the client explicitly requests consent re\-confirmation, every requested scope and resource is forced into the pending bucket so the consent UI is shown even if the user previously granted it\. For any other prompt value the decorator delegates to the inner provider unchanged\. ```csharp public class PromptConsentDecorator : Abblix.Oidc.Server.Features.Consents.IUserConsentsProvider ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → PromptConsentDecorator Implements [IUserConsentsProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Consents.IUserConsentsProvider 'Abblix\.Oidc\.Server\.Features\.Consents\.IUserConsentsProvider') ### Constructors ## PromptConsentDecorator\(IUserConsentsProvider\) Constructor {#Abblix.Oidc.Server.Features.Consents.PromptConsentDecorator.PromptConsentDecorator(Abblix.Oidc.Server.Features.Consents.IUserConsentsProvider)} Honours the OIDC Core §3\.1\.2\.1 `prompt=consent` parameter by short\-circuiting the wrapped [IUserConsentsProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Consents.IUserConsentsProvider 'Abblix\.Oidc\.Server\.Features\.Consents\.IUserConsentsProvider'): when the client explicitly requests consent re\-confirmation, every requested scope and resource is forced into the pending bucket so the consent UI is shown even if the user previously granted it\. For any other prompt value the decorator delegates to the inner provider unchanged\. ```csharp public PromptConsentDecorator(Abblix.Oidc.Server.Features.Consents.IUserConsentsProvider inner); ``` #### Parameters ###### `inner` [IUserConsentsProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Consents.IUserConsentsProvider 'Abblix\.Oidc\.Server\.Features\.Consents\.IUserConsentsProvider') {#Abblix.Oidc.Server.Features.Consents.PromptConsentDecorator.PromptConsentDecorator(Abblix.Oidc.Server.Features.Consents.IUserConsentsProvider).inner} The wrapped consent provider used when `prompt=consent` is not requested\. ### Methods ## PromptConsentDecorator\.GetUserConsentsAsync\(ValidAuthorizationRequest, AuthSession\) Method {#Abblix.Oidc.Server.Features.Consents.PromptConsentDecorator.GetUserConsentsAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest,Abblix.Oidc.Server.Features.UserAuthentication.AuthSession)} If the authorization request carries `prompt=consent`, returns all requested scopes and resources as [Pending](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Consents.UserConsents#Abblix.Oidc.Server.Features.Consents.UserConsents.Pending 'Abblix\.Oidc\.Server\.Features\.Consents\.UserConsents\.Pending') to force a fresh consent prompt; otherwise delegates to the wrapped provider\. ```csharp public System.Threading.Tasks.Task GetUserConsentsAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest request, Abblix.Oidc.Server.Features.UserAuthentication.AuthSession authSession); ``` #### Parameters ###### `request` [ValidAuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.ValidAuthorizationRequest') {#Abblix.Oidc.Server.Features.Consents.PromptConsentDecorator.GetUserConsentsAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest,Abblix.Oidc.Server.Features.UserAuthentication.AuthSession).request} The validated authorization request whose `prompt` parameter drives the decision\. ###### `authSession` [AuthSession](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.UserAuthentication.AuthSession 'Abblix\.Oidc\.Server\.Features\.UserAuthentication\.AuthSession') {#Abblix.Oidc.Server.Features.Consents.PromptConsentDecorator.GetUserConsentsAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest,Abblix.Oidc.Server.Features.UserAuthentication.AuthSession).authSession} The current authentication session forwarded to the inner provider\. Implements [GetUserConsentsAsync\(ValidAuthorizationRequest, AuthSession\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Consents.IUserConsentsProvider#Abblix.Oidc.Server.Features.Consents.IUserConsentsProvider.GetUserConsentsAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest,Abblix.Oidc.Server.Features.UserAuthentication.AuthSession) 'Abblix\.Oidc\.Server\.Features\.Consents\.IUserConsentsProvider\.GetUserConsentsAsync\(Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.ValidAuthorizationRequest, Abblix\.Oidc\.Server\.Features\.UserAuthentication\.AuthSession\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[UserConsents](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Consents.UserConsents 'Abblix\.Oidc\.Server\.Features\.Consents\.UserConsents')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Consents.UserConsents.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.Consents](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Consents 'Abblix\.Oidc\.Server\.Features\.Consents') ## UserConsents Class Represents the state of user consents in an authorization flow, categorizing them into granted, denied, and pending\. ```csharp public record UserConsents : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → UserConsents Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[UserConsents](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Consents.UserConsents 'Abblix\.Oidc\.Server\.Features\.Consents\.UserConsents')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Properties ## UserConsents\.Granted Property {#Abblix.Oidc.Server.Features.Consents.UserConsents.Granted} The consents that have been explicitly granted by the user\. These consents cover scopes and resources the user has agreed to provide access to\. ```csharp public Abblix.Oidc.Server.Features.Consents.ConsentDefinition Granted { get; init; } ``` #### Property Value [ConsentDefinition](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Consents.ConsentDefinition 'Abblix\.Oidc\.Server\.Features\.Consents\.ConsentDefinition') ## UserConsents\.Pending Property {#Abblix.Oidc.Server.Features.Consents.UserConsents.Pending} The consents that are still pending a decision by the user\. These include scopes and resources that have been requested but not yet explicitly approved or denied\. ```csharp public Abblix.Oidc.Server.Features.Consents.ConsentDefinition Pending { get; init; } ``` #### Property Value [ConsentDefinition](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Consents.ConsentDefinition 'Abblix\.Oidc\.Server\.Features\.Consents\.ConsentDefinition') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ## Abblix\.Oidc\.Server\.Features\.DeviceAuthorization Namespace | Classes | | | :--- | :--- | | [DeviceAuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationRequest 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.DeviceAuthorizationRequest') | Represents a stored device authorization request as defined in RFC 8628\. This record is used to persist the state of a device authorization flow between the initial request and when the user completes authentication\. | | [DeviceAuthorizationStorage](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationStorage 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.DeviceAuthorizationStorage') | Implements storage for device authorization requests as defined in RFC 8628\. Stores requests by device\_code \(for client polling\) with a secondary index by user\_code \(for user verification\)\. Redemption of a device code goes through the cache's claim protocol, which narrows the window in which two token requests both claim one code rather than closing it\. | | [DeviceCodeGenerator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceCodeGenerator 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.DeviceCodeGenerator') | Generates high\-entropy device codes for the Device Authorization Grant \(RFC 8628\)\. The device code is used by clients to poll the token endpoint\. | | [InvalidUserCode](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.InvalidUserCode 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.InvalidUserCode') | Indicates that the user code was not found or has expired\. | | [UserCodeAlreadyUsed](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeAlreadyUsed 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.UserCodeAlreadyUsed') | Indicates that the user code has already been used \(approved or denied\)\. | | [UserCodeGenerator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeGenerator 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.UserCodeGenerator') | Generates user codes for the Device Authorization Grant \(RFC 8628\)\. The alphabet used for code generation is configurable to support numeric, alphabetic, or alphanumeric codes\. | | [UserCodeNormalizer](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeNormalizer 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.UserCodeNormalizer') | Canonicalizes user\-entered user codes for the Device Authorization Grant \(RFC 8628\) following the input\-processing guidance in Section 6\.1: punctuation added for readability \(dashes, spaces\) and any other characters outside the configured alphabet are dropped, and case is folded when the alphabet is single\-case so that a user typing the equivalent lowercase \(or uppercase\) form is not rejected\. | | [UserCodeRateLimiter](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeRateLimiter 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.UserCodeRateLimiter') | Implements rate limiting for user code verification attempts to prevent brute force attacks\. Uses exponential backoff and per\-IP rate limiting as recommended by RFC 8628 Section 5\.1\. | | [UserCodeVerificationResult](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeVerificationResult 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.UserCodeVerificationResult') | Represents the result of a user code verification attempt\. This is a discriminated union with three concrete implementations\. | | [UserCodeVerificationService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeVerificationService 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.UserCodeVerificationService') | Implements the user code verification service for the Device Authorization Grant flow \(RFC 8628\)\. This service handles the verification, approval, and denial of device authorization requests with built\-in brute force protection\. | | [ValidUserCode](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.ValidUserCode 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.ValidUserCode') | Indicates that the user code was successfully verified and the request is pending authorization\. | | Enums | | | :--- | :--- | | [DeviceAuthorizationStatus](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationStatus 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.DeviceAuthorizationStatus') | Represents the various states of a device authorization request as defined in RFC 8628\. This enumeration defines the possible statuses that a device authorization request can have, facilitating the management of the device authorization flow\. | --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationRequest.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.DeviceAuthorization](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization') ## DeviceAuthorizationRequest Class Represents a stored device authorization request as defined in RFC 8628\. This record is used to persist the state of a device authorization flow between the initial request and when the user completes authentication\. ```csharp public record DeviceAuthorizationRequest : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → DeviceAuthorizationRequest Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[DeviceAuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationRequest 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.DeviceAuthorizationRequest')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Constructors ## DeviceAuthorizationRequest\(string, string\[\], Uri\[\], string\) Constructor {#Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationRequest.DeviceAuthorizationRequest(string,string[],System.Uri[],string)} Represents a stored device authorization request as defined in RFC 8628\. This record is used to persist the state of a device authorization flow between the initial request and when the user completes authentication\. ```csharp public DeviceAuthorizationRequest(string ClientId, string[] Scope, System.Uri[]? Resources, string UserCode); ``` #### Parameters ###### `ClientId` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationRequest.DeviceAuthorizationRequest(string,string[],System.Uri[],string).ClientId} The client identifier that initiated the device authorization request\. ###### `Scope` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationRequest.DeviceAuthorizationRequest(string,string[],System.Uri[],string).Scope} The requested scopes for the authorization\. ###### `Resources` [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationRequest.DeviceAuthorizationRequest(string,string[],System.Uri[],string).Resources} The requested resources \(RFC 8707\) for the authorization\. ###### `UserCode` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationRequest.DeviceAuthorizationRequest(string,string[],System.Uri[],string).UserCode} The user\-friendly code displayed to the user for verification\. ### Properties ## DeviceAuthorizationRequest\.AuthorizationDetails Property {#Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationRequest.AuthorizationDetails} RFC 9396 Section 3 Rich Authorization Requests array carried from the original `/device_authorization` request\. The host's user\-verification step reads this \(via [ValidUserCode](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.ValidUserCode 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.ValidUserCode')\) to render structured consent, then threads it into the [AuthorizedGrant](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationRequest#Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationRequest.AuthorizedGrant 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.DeviceAuthorizationRequest\.AuthorizedGrant')'s `AuthorizationContext` when approving; the eventual access token issued via the device\-code grant emits the claim byte\-exact\. ```csharp public System.Text.Json.Nodes.JsonArray? AuthorizationDetails { get; set; } ``` #### Property Value [System\.Text\.Json\.Nodes\.JsonArray](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonarray 'System\.Text\.Json\.Nodes\.JsonArray') ## DeviceAuthorizationRequest\.AuthorizedGrant Property {#Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationRequest.AuthorizedGrant} The authorized grant containing the user's authentication session and authorization context\. This is set when the user successfully authorizes the device\. ```csharp public Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant? AuthorizedGrant { get; set; } ``` #### Property Value [AuthorizedGrant](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.AuthorizedGrant') ## DeviceAuthorizationRequest\.ClientId Property {#Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationRequest.ClientId} The client identifier that initiated the device authorization request\. ```csharp public string ClientId { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## DeviceAuthorizationRequest\.ExpiresAt Property {#Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationRequest.ExpiresAt} The absolute time when this device authorization request expires \(RFC 8628 Section 3\.2 fixed lifetime\)\. Seeded by the storage on `StoreAsync` and used to cap the refreshed cache TTL at the remaining lifetime, so regular polling cannot extend the code\. ```csharp public System.DateTimeOffset ExpiresAt { get; set; } ``` #### Property Value [System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset') ## DeviceAuthorizationRequest\.NextPollAt Property {#Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationRequest.NextPollAt} Specifies the next time the client should poll for updates regarding the authorization request\. This helps manage the timing of polling requests and enforces rate limiting\. ```csharp public System.Nullable NextPollAt { get; set; } ``` #### Property Value [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') ## DeviceAuthorizationRequest\.Resources Property {#Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationRequest.Resources} The requested resources \(RFC 8707\) for the authorization\. ```csharp public System.Uri[]? Resources { get; init; } ``` #### Property Value [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') ## DeviceAuthorizationRequest\.Scope Property {#Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationRequest.Scope} The requested scopes for the authorization\. ```csharp public string[] Scope { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') ## DeviceAuthorizationRequest\.Status Property {#Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationRequest.Status} Indicates the current status of the device authorization request\. Defaults to Pending, reflecting that the user has not yet completed authentication\. ```csharp public Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationStatus Status { get; set; } ``` #### Property Value [DeviceAuthorizationStatus](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationStatus 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.DeviceAuthorizationStatus') ## DeviceAuthorizationRequest\.UserCode Property {#Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationRequest.UserCode} The user\-friendly code displayed to the user for verification\. ```csharp public string UserCode { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Methods ## DeviceAuthorizationRequest\.HasLifetimeLeft\(DateTimeOffset, TimeSpan\) Method {#Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationRequest.HasLifetimeLeft(System.DateTimeOffset,System.TimeSpan)} Whether the fixed lifetime still has time left at [now](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationRequest#Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationRequest.HasLifetimeLeft(System.DateTimeOffset,System.TimeSpan).now 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.DeviceAuthorizationRequest\.HasLifetimeLeft\(System\.DateTimeOffset, System\.TimeSpan\)\.now'), handing back how much\. ```csharp public bool HasLifetimeLeft(System.DateTimeOffset now, out System.TimeSpan remaining); ``` #### Parameters ###### `now` [System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset') {#Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationRequest.HasLifetimeLeft(System.DateTimeOffset,System.TimeSpan).now} The instant to judge against, from the caller's own time provider\. ###### `remaining` [System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan') {#Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationRequest.HasLifetimeLeft(System.DateTimeOffset,System.TimeSpan).remaining} How much lifetime is left; zero or negative when there is none\. #### Returns [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') `true` while the request can still be acted on\. ### Remarks The comparison sits here because it was being written out at each caller, and one of them forgot it: user code verification, the step the end user reaches first, decided on [Status](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationRequest#Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationRequest.Status 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.DeviceAuthorizationRequest\.Status') alone and answered a full result for a record the approval would then refuse\. It is now the only verdict on that boundary: [DeviceCodeGrantHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.DeviceCodeGrantHandler 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.DeviceCodeGrantHandler') asks this rather than comparing for itself, so the token endpoint and the three paths above cannot disagree about a code polled at exactly its expiry. What holds it is that relaxing this one predicate turns rows red on both sides of that seam - the two approval rows and the token endpoint's - rather than two comparisons happening to stay in step. It hands back the remaining time because the callers that act on the record need it: a decision is written with that as the cache TTL, so the code cannot be extended by being decided on. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationStatus.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.DeviceAuthorization](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization') ## DeviceAuthorizationStatus Enum Represents the various states of a device authorization request as defined in RFC 8628\. This enumeration defines the possible statuses that a device authorization request can have, facilitating the management of the device authorization flow\. ```csharp public enum DeviceAuthorizationStatus ``` ### Fields ###### `Pending` 0 {#Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationStatus.Pending} Indicates that the authorization request is pending and the user has not yet completed authentication\. The client should continue polling the token endpoint\. ###### `Denied` 1 {#Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationStatus.Denied} Indicates that the user has denied the authorization request\. The client will receive an access\_denied error when polling\. ###### `Authorized` 2 {#Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationStatus.Authorized} Indicates that the user has successfully authorized the device\. The client will receive tokens when polling the token endpoint\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationStorage.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.DeviceAuthorization](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization') ## DeviceAuthorizationStorage Class Implements storage for device authorization requests as defined in RFC 8628\. Stores requests by device\_code \(for client polling\) with a secondary index by user\_code \(for user verification\)\. Redemption of a device code goes through the cache's claim protocol, which narrows the window in which two token requests both claim one code rather than closing it\. ```csharp public class DeviceAuthorizationStorage : Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IDeviceAuthorizationStorage ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → DeviceAuthorizationStorage Implements [IDeviceAuthorizationStorage](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IDeviceAuthorizationStorage 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.Interfaces\.IDeviceAuthorizationStorage') ### Constructors ## DeviceAuthorizationStorage\(ILogger\, IDistributedCache, IBinarySerializer, IEntityStorageKeyFactory, TimeProvider\) Constructor {#Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationStorage.DeviceAuthorizationStorage(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationStorage_,Microsoft.Extensions.Caching.Distributed.IDistributedCache,Abblix.Oidc.Server.Common.Interfaces.IBinarySerializer,Abblix.Oidc.Server.Features.Storages.IEntityStorageKeyFactory,System.TimeProvider)} Implements storage for device authorization requests as defined in RFC 8628\. Stores requests by device\_code \(for client polling\) with a secondary index by user\_code \(for user verification\)\. Redemption of a device code goes through the cache's claim protocol, which narrows the window in which two token requests both claim one code rather than closing it\. ```csharp public DeviceAuthorizationStorage(Microsoft.Extensions.Logging.ILogger logger, Microsoft.Extensions.Caching.Distributed.IDistributedCache cache, Abblix.Oidc.Server.Common.Interfaces.IBinarySerializer serializer, Abblix.Oidc.Server.Features.Storages.IEntityStorageKeyFactory keyFactory, System.TimeProvider timeProvider); ``` #### Parameters ###### `logger` [Microsoft\.Extensions\.Logging\.ILogger<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1')[DeviceAuthorizationStorage](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationStorage 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.DeviceAuthorizationStorage')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1') {#Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationStorage.DeviceAuthorizationStorage(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationStorage_,Microsoft.Extensions.Caching.Distributed.IDistributedCache,Abblix.Oidc.Server.Common.Interfaces.IBinarySerializer,Abblix.Oidc.Server.Features.Storages.IEntityStorageKeyFactory,System.TimeProvider).logger} Records a secondary\-index entry left behind, which nothing else reports\. ###### `cache` [Microsoft\.Extensions\.Caching\.Distributed\.IDistributedCache](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.caching.distributed.idistributedcache 'Microsoft\.Extensions\.Caching\.Distributed\.IDistributedCache') {#Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationStorage.DeviceAuthorizationStorage(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationStorage_,Microsoft.Extensions.Caching.Distributed.IDistributedCache,Abblix.Oidc.Server.Common.Interfaces.IBinarySerializer,Abblix.Oidc.Server.Features.Storages.IEntityStorageKeyFactory,System.TimeProvider).cache} The distributed cache backend used for atomic operations\. ###### `serializer` [IBinarySerializer](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IBinarySerializer 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IBinarySerializer') {#Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationStorage.DeviceAuthorizationStorage(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationStorage_,Microsoft.Extensions.Caching.Distributed.IDistributedCache,Abblix.Oidc.Server.Common.Interfaces.IBinarySerializer,Abblix.Oidc.Server.Features.Storages.IEntityStorageKeyFactory,System.TimeProvider).serializer} The serializer for converting objects to/from binary format\. ###### `keyFactory` [IEntityStorageKeyFactory](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Storages.IEntityStorageKeyFactory 'Abblix\.Oidc\.Server\.Features\.Storages\.IEntityStorageKeyFactory') {#Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationStorage.DeviceAuthorizationStorage(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationStorage_,Microsoft.Extensions.Caching.Distributed.IDistributedCache,Abblix.Oidc.Server.Common.Interfaces.IBinarySerializer,Abblix.Oidc.Server.Features.Storages.IEntityStorageKeyFactory,System.TimeProvider).keyFactory} The factory for generating standardized storage keys\. ###### `timeProvider` [System\.TimeProvider](https://learn.microsoft.com/en-us/dotnet/api/system.timeprovider 'System\.TimeProvider') {#Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationStorage.DeviceAuthorizationStorage(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationStorage_,Microsoft.Extensions.Caching.Distributed.IDistributedCache,Abblix.Oidc.Server.Common.Interfaces.IBinarySerializer,Abblix.Oidc.Server.Features.Storages.IEntityStorageKeyFactory,System.TimeProvider).timeProvider} Provides the current time for seeding the request's absolute expiry\. ### Methods ## DeviceAuthorizationStorage\.RemoveAsync\(string\) Method {#Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationStorage.RemoveAsync(string)} Removes a device authorization request from storage using its device code\. ```csharp public System.Threading.Tasks.Task RemoveAsync(string deviceCode); ``` #### Parameters ###### `deviceCode` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationStorage.RemoveAsync(string).deviceCode} The device code identifier\. Implements [RemoveAsync\(string\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IDeviceAuthorizationStorage#Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IDeviceAuthorizationStorage.RemoveAsync(string) 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.Interfaces\.IDeviceAuthorizationStorage\.RemoveAsync\(string\)') #### Returns [System\.Threading\.Tasks\.Task](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task 'System\.Threading\.Tasks\.Task') A task that completes when the request is removed\. Tidying the secondary user\-code index is best\-effort and is logged rather than raised: it is not what the caller asked for, and a store deciding otherwise must not become a fault where a grant error belongs\. Removing the request itself is not guarded \- that IS what was asked, so a refusal there raises\. ## DeviceAuthorizationStorage\.StoreAsync\(string, DeviceAuthorizationRequest, TimeSpan\) Method {#Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationStorage.StoreAsync(string,Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationRequest,System.TimeSpan)} Stores a device authorization request with the specified device code\. ```csharp public System.Threading.Tasks.Task StoreAsync(string deviceCode, Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationRequest request, System.TimeSpan expiresIn); ``` #### Parameters ###### `deviceCode` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationStorage.StoreAsync(string,Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationRequest,System.TimeSpan).deviceCode} The unique device code identifier\. ###### `request` [DeviceAuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationRequest 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.DeviceAuthorizationRequest') {#Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationStorage.StoreAsync(string,Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationRequest,System.TimeSpan).request} The device authorization request to store\. ###### `expiresIn` [System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan') {#Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationStorage.StoreAsync(string,Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationRequest,System.TimeSpan).expiresIn} The duration after which the stored request will expire\. Implements [StoreAsync\(string, DeviceAuthorizationRequest, TimeSpan\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IDeviceAuthorizationStorage#Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IDeviceAuthorizationStorage.StoreAsync(string,Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationRequest,System.TimeSpan) 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.Interfaces\.IDeviceAuthorizationStorage\.StoreAsync\(string, Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.DeviceAuthorizationRequest, System\.TimeSpan\)') #### Returns [System\.Threading\.Tasks\.Task](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task 'System\.Threading\.Tasks\.Task') A task that completes when the request is stored\. ## DeviceAuthorizationStorage\.TryGetByDeviceCodeAsync\(string\) Method {#Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationStorage.TryGetByDeviceCodeAsync(string)} Tries to retrieve a device authorization request by its device code\. This is used by the client when polling the token endpoint\. ```csharp public System.Threading.Tasks.Task TryGetByDeviceCodeAsync(string deviceCode); ``` #### Parameters ###### `deviceCode` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationStorage.TryGetByDeviceCodeAsync(string).deviceCode} The device code identifier\. Implements [TryGetByDeviceCodeAsync\(string\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IDeviceAuthorizationStorage#Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IDeviceAuthorizationStorage.TryGetByDeviceCodeAsync(string) 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.Interfaces\.IDeviceAuthorizationStorage\.TryGetByDeviceCodeAsync\(string\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[DeviceAuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationRequest 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.DeviceAuthorizationRequest')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task that returns the device authorization request if found; otherwise, null\. ## DeviceAuthorizationStorage\.TryGetByUserCodeAsync\(string\) Method {#Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationStorage.TryGetByUserCodeAsync(string)} Tries to retrieve a device authorization request by its user code\. This is used during user verification to look up the pending request\. ```csharp public System.Threading.Tasks.Task> TryGetByUserCodeAsync(string userCode); ``` #### Parameters ###### `userCode` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationStorage.TryGetByUserCodeAsync(string).userCode} The user\-friendly verification code\. Implements [TryGetByUserCodeAsync\(string\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IDeviceAuthorizationStorage#Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IDeviceAuthorizationStorage.TryGetByUserCodeAsync(string) 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.Interfaces\.IDeviceAuthorizationStorage\.TryGetByUserCodeAsync\(string\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[<](https://learn.microsoft.com/en-us/dotnet/api/system.valuetuple 'System\.ValueTuple')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[,](https://learn.microsoft.com/en-us/dotnet/api/system.valuetuple 'System\.ValueTuple')[DeviceAuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationRequest 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.DeviceAuthorizationRequest')[>](https://learn.microsoft.com/en-us/dotnet/api/system.valuetuple 'System\.ValueTuple')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task that returns the device code and request if found; otherwise, null\. ## DeviceAuthorizationStorage\.TryRemoveAsync\(string, string\) Method {#Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationStorage.TryRemoveAsync(string,string)} Claims a device authorization request by device code, deciding presence and removing it in one protocol, so that a caller told it removed the request is the only caller that can be told so\. ```csharp public System.Threading.Tasks.Task TryRemoveAsync(string deviceCode, string userCode); ``` #### Parameters ###### `deviceCode` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationStorage.TryRemoveAsync(string,string).deviceCode} The device code identifying the authorization request to remove\. ###### `userCode` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationStorage.TryRemoveAsync(string,string).userCode} The user code of THAT request, used to find its secondary index entry\. Nothing here checks the two belong together \- this method never reads the record \- so a caller passing a code from a different request removes that other request's index entry instead, leaving a live request findable only by its device code\. Implements [TryRemoveAsync\(string, string\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IDeviceAuthorizationStorage#Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IDeviceAuthorizationStorage.TryRemoveAsync(string,string) 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.Interfaces\.IDeviceAuthorizationStorage\.TryRemoveAsync\(string, string\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task that completes when the operation finishes, containing true when this caller removed the request AND still held the claim afterwards\. False otherwise, which is wider than "another caller won or it was never there": the code can be consumed and the caller still told false, when the lock guarding the removal expires mid\-protocol\. The extension's remarks carry that condition\. The index cleanup that runs after the claim cannot change that answer either way. Removing the user-code index is a different question from whether this caller took the code, so a refusal is logged and the true stands. What the entry left behind still points at is not knowable here - this method never reads the record, so the user code it was handed need not belong to the request it removed - but that entry carries its own expiry either way. ### Remarks This method performs atomic removal of both the device code entry and its associated user code mapping. By accepting the userCode as a parameter, it avoids an additional cache read operation, since the caller already has this information from a previous fetch. Use Case: This method is used in the Device Authorization Grant flow (RFC 8628) when exchanging an authorized device code for tokens. The claim keeps two token requests from both being told they took one device code, however many processes are polling. What it does not reach is a decision landing after the claim: that path re-reads the record and refuses, which leaves a window one store round trip wide rather than none - issues 194 and 435. The Atomicity note below says what the claim itself reaches. Atomicity: Uses [TryRemoveAsync\(this IDistributedCache, string, Nullable<TimeSpan>, CancellationToken\)](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.DistributedCacheExtensions#Abblix.Utils.DistributedCacheExtensions.TryRemoveAsync(thisMicrosoft.Extensions.Caching.Distributed.IDistributedCache,string,System.Nullable_System.TimeSpan_,System.Threading.CancellationToken) 'Abblix\.Utils\.DistributedCacheExtensions\.TryRemoveAsync\(Microsoft\.Extensions\.Caching\.Distributed\.IDistributedCache,System\.String,System\.Nullable\{System\.TimeSpan\},System\.Threading\.CancellationToken\)') which admits at most one caller through its lock-token protocol, and serializes redemptions of one device code in-process, which closes the one way a removal loses its winner to a competitor. What that does NOT give is a winner for every removal - the code can be consumed with nobody told they took it, and that needs neither a second caller nor a second node. The extension's own remarks carry the condition and name the store primitive that closes it. After a successful removal, cleans up the user code mapping. ## DeviceAuthorizationStorage\.UpdateAsync\(string, DeviceAuthorizationRequest, TimeSpan\) Method {#Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationStorage.UpdateAsync(string,Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationRequest,System.TimeSpan)} Updates an existing device authorization request in storage, refreshing its cache entry with the caller\-supplied remaining lifetime\. ```csharp public System.Threading.Tasks.Task UpdateAsync(string deviceCode, Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationRequest request, System.TimeSpan expiresIn); ``` #### Parameters ###### `deviceCode` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationStorage.UpdateAsync(string,Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationRequest,System.TimeSpan).deviceCode} The device code identifier\. ###### `request` [DeviceAuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationRequest 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.DeviceAuthorizationRequest') {#Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationStorage.UpdateAsync(string,Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationRequest,System.TimeSpan).request} The updated device authorization request\. ###### `expiresIn` [System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan') {#Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationStorage.UpdateAsync(string,Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationRequest,System.TimeSpan).expiresIn} The remaining lifetime to apply as the cache TTL\. The caller derives it from the request's fixed expiry \(RFC 8628 section 3\.2\) so that repeated polling cannot extend the code\. Implements [UpdateAsync\(string, DeviceAuthorizationRequest, TimeSpan\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IDeviceAuthorizationStorage#Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IDeviceAuthorizationStorage.UpdateAsync(string,Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationRequest,System.TimeSpan) 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.Interfaces\.IDeviceAuthorizationStorage\.UpdateAsync\(string, Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.DeviceAuthorizationRequest, System\.TimeSpan\)') #### Returns [System\.Threading\.Tasks\.Task](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task 'System\.Threading\.Tasks\.Task') A task that completes when the request is updated\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceCodeGenerator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.DeviceAuthorization](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization') ## DeviceCodeGenerator Class Generates high\-entropy device codes for the Device Authorization Grant \(RFC 8628\)\. The device code is used by clients to poll the token endpoint\. ```csharp public class DeviceCodeGenerator : Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IDeviceCodeGenerator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → DeviceCodeGenerator Implements [IDeviceCodeGenerator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IDeviceCodeGenerator 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.Interfaces\.IDeviceCodeGenerator') ### Constructors ## DeviceCodeGenerator\(IOptions\\) Constructor {#Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceCodeGenerator.DeviceCodeGenerator(Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_)} Generates high\-entropy device codes for the Device Authorization Grant \(RFC 8628\)\. The device code is used by clients to poll the token endpoint\. ```csharp public DeviceCodeGenerator(Microsoft.Extensions.Options.IOptions options); ``` #### Parameters ###### `options` [Microsoft\.Extensions\.Options\.IOptions<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptions-1 'Microsoft\.Extensions\.Options\.IOptions\`1')[OidcOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptions-1 'Microsoft\.Extensions\.Options\.IOptions\`1') {#Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceCodeGenerator.DeviceCodeGenerator(Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_).options} Configuration options containing device code length settings\. ### Methods ## DeviceCodeGenerator\.GenerateDeviceCode\(\) Method {#Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceCodeGenerator.GenerateDeviceCode()} Generates a high\-entropy device code that the client uses to poll the token endpoint\. ```csharp public string GenerateDeviceCode(); ``` Implements [GenerateDeviceCode\(\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IDeviceCodeGenerator#Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IDeviceCodeGenerator.GenerateDeviceCode() 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.Interfaces\.IDeviceCodeGenerator\.GenerateDeviceCode\(\)') #### Returns [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') A cryptographically secure, URL\-safe device code\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.InvalidUserCode.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.DeviceAuthorization](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization') ## InvalidUserCode Class Indicates that the user code was not found or has expired\. ```csharp public record InvalidUserCode : Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeVerificationResult, System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [UserCodeVerificationResult](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeVerificationResult 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.UserCodeVerificationResult') → InvalidUserCode Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[InvalidUserCode](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.InvalidUserCode 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.InvalidUserCode')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeAlreadyUsed.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.DeviceAuthorization](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization') ## UserCodeAlreadyUsed Class Indicates that the user code has already been used \(approved or denied\)\. ```csharp public record UserCodeAlreadyUsed : Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeVerificationResult, System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [UserCodeVerificationResult](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeVerificationResult 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.UserCodeVerificationResult') → UserCodeAlreadyUsed Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[UserCodeAlreadyUsed](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeAlreadyUsed 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.UserCodeAlreadyUsed')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeGenerator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.DeviceAuthorization](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization') ## UserCodeGenerator Class Generates user codes for the Device Authorization Grant \(RFC 8628\)\. The alphabet used for code generation is configurable to support numeric, alphabetic, or alphanumeric codes\. ```csharp public class UserCodeGenerator : Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeGenerator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → UserCodeGenerator Implements [IUserCodeGenerator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeGenerator 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.Interfaces\.IUserCodeGenerator') ### Constructors ## UserCodeGenerator\(IOptions\\) Constructor {#Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeGenerator.UserCodeGenerator(Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_)} Generates user codes for the Device Authorization Grant \(RFC 8628\)\. The alphabet used for code generation is configurable to support numeric, alphabetic, or alphanumeric codes\. ```csharp public UserCodeGenerator(Microsoft.Extensions.Options.IOptions options); ``` #### Parameters ###### `options` [Microsoft\.Extensions\.Options\.IOptions<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptions-1 'Microsoft\.Extensions\.Options\.IOptions\`1')[OidcOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptions-1 'Microsoft\.Extensions\.Options\.IOptions\`1') {#Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeGenerator.UserCodeGenerator(Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_).options} Configuration options containing user code settings\. ### Methods ## UserCodeGenerator\.GenerateUserCode\(\) Method {#Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeGenerator.GenerateUserCode()} Generates a user\-friendly numeric code that the end\-user enters on the verification page\. ```csharp public string GenerateUserCode(); ``` Implements [GenerateUserCode\(\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeGenerator#Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeGenerator.GenerateUserCode() 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.Interfaces\.IUserCodeGenerator\.GenerateUserCode\(\)') #### Returns [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') A numeric verification code \(e\.g\., "1234\-5678"\)\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeNormalizer.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.DeviceAuthorization](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization') ## UserCodeNormalizer Class Canonicalizes user\-entered user codes for the Device Authorization Grant \(RFC 8628\) following the input\-processing guidance in Section 6\.1: punctuation added for readability \(dashes, spaces\) and any other characters outside the configured alphabet are dropped, and case is folded when the alphabet is single\-case so that a user typing the equivalent lowercase \(or uppercase\) form is not rejected\. ```csharp public class UserCodeNormalizer : Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeNormalizer ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → UserCodeNormalizer Implements [IUserCodeNormalizer](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeNormalizer 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.Interfaces\.IUserCodeNormalizer') ### Constructors ## UserCodeNormalizer\(IOptions\\) Constructor {#Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeNormalizer.UserCodeNormalizer(Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_)} Canonicalizes user\-entered user codes for the Device Authorization Grant \(RFC 8628\) following the input\-processing guidance in Section 6\.1: punctuation added for readability \(dashes, spaces\) and any other characters outside the configured alphabet are dropped, and case is folded when the alphabet is single\-case so that a user typing the equivalent lowercase \(or uppercase\) form is not rejected\. ```csharp public UserCodeNormalizer(Microsoft.Extensions.Options.IOptions options); ``` #### Parameters ###### `options` [Microsoft\.Extensions\.Options\.IOptions<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptions-1 'Microsoft\.Extensions\.Options\.IOptions\`1')[OidcOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptions-1 'Microsoft\.Extensions\.Options\.IOptions\`1') {#Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeNormalizer.UserCodeNormalizer(Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_).options} Configuration options carrying the user code alphabet\. ### Methods ## UserCodeNormalizer\.Normalize\(string\) Method {#Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeNormalizer.Normalize(string)} Produces the canonical form of a user code for comparison: characters outside the configured alphabet are removed, and case is folded when the alphabet is single\-case\. ```csharp public string Normalize(string userCode); ``` #### Parameters ###### `userCode` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeNormalizer.Normalize(string).userCode} The raw user code as entered by the end\-user\. Implements [Normalize\(string\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeNormalizer#Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeNormalizer.Normalize(string) 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.Interfaces\.IUserCodeNormalizer\.Normalize\(string\)') #### Returns [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') The canonical user code used for storage lookup and rate limiting\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeRateLimiter.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.DeviceAuthorization](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization') ## UserCodeRateLimiter Class Implements rate limiting for user code verification attempts to prevent brute force attacks\. Uses exponential backoff and per\-IP rate limiting as recommended by RFC 8628 Section 5\.1\. ```csharp public class UserCodeRateLimiter : Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeRateLimiter ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → UserCodeRateLimiter Implements [IUserCodeRateLimiter](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeRateLimiter 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.Interfaces\.IUserCodeRateLimiter') ### Constructors ## UserCodeRateLimiter\(ILogger\, IEntityStorage, IEntityStorageKeyFactory, TimeProvider, IOptions\\) Constructor {#Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeRateLimiter.UserCodeRateLimiter(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeRateLimiter_,Abblix.Oidc.Server.Features.Storages.IEntityStorage,Abblix.Oidc.Server.Features.Storages.IEntityStorageKeyFactory,System.TimeProvider,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_)} Implements rate limiting for user code verification attempts to prevent brute force attacks\. Uses exponential backoff and per\-IP rate limiting as recommended by RFC 8628 Section 5\.1\. ```csharp public UserCodeRateLimiter(Microsoft.Extensions.Logging.ILogger logger, Abblix.Oidc.Server.Features.Storages.IEntityStorage storage, Abblix.Oidc.Server.Features.Storages.IEntityStorageKeyFactory keyFactory, System.TimeProvider timeProvider, Microsoft.Extensions.Options.IOptions options); ``` #### Parameters ###### `logger` [Microsoft\.Extensions\.Logging\.ILogger<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1')[UserCodeRateLimiter](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeRateLimiter 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.UserCodeRateLimiter')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1') {#Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeRateLimiter.UserCodeRateLimiter(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeRateLimiter_,Abblix.Oidc.Server.Features.Storages.IEntityStorage,Abblix.Oidc.Server.Features.Storages.IEntityStorageKeyFactory,System.TimeProvider,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_).logger} Logger for security events\. ###### `storage` [IEntityStorage](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Storages.IEntityStorage 'Abblix\.Oidc\.Server\.Features\.Storages\.IEntityStorage') {#Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeRateLimiter.UserCodeRateLimiter(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeRateLimiter_,Abblix.Oidc.Server.Features.Storages.IEntityStorage,Abblix.Oidc.Server.Features.Storages.IEntityStorageKeyFactory,System.TimeProvider,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_).storage} The storage service for persisting rate limit state\. ###### `keyFactory` [IEntityStorageKeyFactory](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Storages.IEntityStorageKeyFactory 'Abblix\.Oidc\.Server\.Features\.Storages\.IEntityStorageKeyFactory') {#Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeRateLimiter.UserCodeRateLimiter(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeRateLimiter_,Abblix.Oidc.Server.Features.Storages.IEntityStorage,Abblix.Oidc.Server.Features.Storages.IEntityStorageKeyFactory,System.TimeProvider,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_).keyFactory} The factory for generating storage keys\. ###### `timeProvider` [System\.TimeProvider](https://learn.microsoft.com/en-us/dotnet/api/system.timeprovider 'System\.TimeProvider') {#Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeRateLimiter.UserCodeRateLimiter(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeRateLimiter_,Abblix.Oidc.Server.Features.Storages.IEntityStorage,Abblix.Oidc.Server.Features.Storages.IEntityStorageKeyFactory,System.TimeProvider,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_).timeProvider} Provides access to the current time\. ###### `options` [Microsoft\.Extensions\.Options\.IOptions<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptions-1 'Microsoft\.Extensions\.Options\.IOptions\`1')[OidcOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptions-1 'Microsoft\.Extensions\.Options\.IOptions\`1') {#Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeRateLimiter.UserCodeRateLimiter(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeRateLimiter_,Abblix.Oidc.Server.Features.Storages.IEntityStorage,Abblix.Oidc.Server.Features.Storages.IEntityStorageKeyFactory,System.TimeProvider,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_).options} Configuration options containing device authorization settings\. ### Methods ## UserCodeRateLimiter\.CheckAsync\(string, string\) Method {#Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeRateLimiter.CheckAsync(string,string)} Checks if a verification attempt should be allowed for the given user code and client identifier\. Implements exponential backoff and per\-IP rate limiting to prevent brute force attacks\. ```csharp public System.Threading.Tasks.Task> CheckAsync(string userCode, string clientIdentifier); ``` #### Parameters ###### `userCode` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeRateLimiter.CheckAsync(string,string).userCode} The user code being verified\. ###### `clientIdentifier` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeRateLimiter.CheckAsync(string,string).clientIdentifier} The client identifier \(IP address or other identifier\)\. Implements [CheckAsync\(string, string\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeRateLimiter#Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeRateLimiter.CheckAsync(string,string) 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.Interfaces\.IUserCodeRateLimiter\.CheckAsync\(string, string\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A [Result<TSuccess,TFailure>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2') containing: \- Success \(`true`\): The verification attempt is allowed to proceed\. \- Failure \([System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan')\): The attempt is rate limited; the value indicates the duration the client must wait before retrying \(Retry\-After\)\. ## UserCodeRateLimiter\.RecordFailureAsync\(string, string\) Method {#Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeRateLimiter.RecordFailureAsync(string,string)} Records a failed verification attempt for rate limiting purposes\. ```csharp public System.Threading.Tasks.Task RecordFailureAsync(string userCode, string clientIdentifier); ``` #### Parameters ###### `userCode` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeRateLimiter.RecordFailureAsync(string,string).userCode} The user code that failed verification\. ###### `clientIdentifier` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeRateLimiter.RecordFailureAsync(string,string).clientIdentifier} The client identifier \(IP address or other identifier\)\. Implements [RecordFailureAsync\(string, string\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeRateLimiter#Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeRateLimiter.RecordFailureAsync(string,string) 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.Interfaces\.IUserCodeRateLimiter\.RecordFailureAsync\(string, string\)') #### Returns [System\.Threading\.Tasks\.Task](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task 'System\.Threading\.Tasks\.Task') ## UserCodeRateLimiter\.RecordSuccessAsync\(string, string\) Method {#Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeRateLimiter.RecordSuccessAsync(string,string)} Records a successful verification to reset rate limiting counters\. ```csharp public System.Threading.Tasks.Task RecordSuccessAsync(string userCode, string clientIdentifier); ``` #### Parameters ###### `userCode` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeRateLimiter.RecordSuccessAsync(string,string).userCode} The user code that was successfully verified\. ###### `clientIdentifier` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeRateLimiter.RecordSuccessAsync(string,string).clientIdentifier} The client identifier \(IP address or other identifier\)\. Implements [RecordSuccessAsync\(string, string\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeRateLimiter#Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeRateLimiter.RecordSuccessAsync(string,string) 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.Interfaces\.IUserCodeRateLimiter\.RecordSuccessAsync\(string, string\)') #### Returns [System\.Threading\.Tasks\.Task](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task 'System\.Threading\.Tasks\.Task') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeVerificationResult.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.DeviceAuthorization](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization') ## UserCodeVerificationResult Class Represents the result of a user code verification attempt\. This is a discriminated union with three concrete implementations\. ```csharp public abstract record UserCodeVerificationResult : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → UserCodeVerificationResult Derived ↳ [InvalidUserCode](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.InvalidUserCode 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.InvalidUserCode') ↳ [UserCodeAlreadyUsed](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeAlreadyUsed 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.UserCodeAlreadyUsed') ↳ [ValidUserCode](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.ValidUserCode 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.ValidUserCode') Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[UserCodeVerificationResult](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeVerificationResult 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.UserCodeVerificationResult')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeVerificationService.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.DeviceAuthorization](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization') ## UserCodeVerificationService Class Implements the user code verification service for the Device Authorization Grant flow \(RFC 8628\)\. This service handles the verification, approval, and denial of device authorization requests with built\-in brute force protection\. ```csharp public class UserCodeVerificationService : Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeVerificationService ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → UserCodeVerificationService Implements [IUserCodeVerificationService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeVerificationService 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.Interfaces\.IUserCodeVerificationService') ### Constructors ## UserCodeVerificationService\(ILogger\, IDeviceAuthorizationStorage, IUserCodeRateLimiter, IUserCodeNormalizer, IRequestInfoProvider, TimeProvider\) Constructor {#Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeVerificationService.UserCodeVerificationService(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeVerificationService_,Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IDeviceAuthorizationStorage,Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeRateLimiter,Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeNormalizer,Abblix.Oidc.Server.Common.Interfaces.IRequestInfoProvider,System.TimeProvider)} Implements the user code verification service for the Device Authorization Grant flow \(RFC 8628\)\. This service handles the verification, approval, and denial of device authorization requests with built\-in brute force protection\. ```csharp public UserCodeVerificationService(Microsoft.Extensions.Logging.ILogger logger, Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IDeviceAuthorizationStorage storage, Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeRateLimiter rateLimiter, Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeNormalizer normalizer, Abblix.Oidc.Server.Common.Interfaces.IRequestInfoProvider requestInfoProvider, System.TimeProvider timeProvider); ``` #### Parameters ###### `logger` [Microsoft\.Extensions\.Logging\.ILogger<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1')[UserCodeVerificationService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeVerificationService 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.UserCodeVerificationService')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1') {#Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeVerificationService.UserCodeVerificationService(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeVerificationService_,Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IDeviceAuthorizationStorage,Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeRateLimiter,Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeNormalizer,Abblix.Oidc.Server.Common.Interfaces.IRequestInfoProvider,System.TimeProvider).logger} Records what an approval left behind, since the library cannot supply it\. ###### `storage` [IDeviceAuthorizationStorage](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IDeviceAuthorizationStorage 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.Interfaces\.IDeviceAuthorizationStorage') {#Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeVerificationService.UserCodeVerificationService(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeVerificationService_,Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IDeviceAuthorizationStorage,Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeRateLimiter,Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeNormalizer,Abblix.Oidc.Server.Common.Interfaces.IRequestInfoProvider,System.TimeProvider).storage} The storage service for device authorization requests\. ###### `rateLimiter` [IUserCodeRateLimiter](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeRateLimiter 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.Interfaces\.IUserCodeRateLimiter') {#Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeVerificationService.UserCodeVerificationService(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeVerificationService_,Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IDeviceAuthorizationStorage,Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeRateLimiter,Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeNormalizer,Abblix.Oidc.Server.Common.Interfaces.IRequestInfoProvider,System.TimeProvider).rateLimiter} The rate limiter for preventing brute force attacks\. ###### `normalizer` [IUserCodeNormalizer](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeNormalizer 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.Interfaces\.IUserCodeNormalizer') {#Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeVerificationService.UserCodeVerificationService(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeVerificationService_,Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IDeviceAuthorizationStorage,Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeRateLimiter,Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeNormalizer,Abblix.Oidc.Server.Common.Interfaces.IRequestInfoProvider,System.TimeProvider).normalizer} Canonicalizes user\-entered codes before lookup \(RFC 8628 Section 6\.1\)\. ###### `requestInfoProvider` [IRequestInfoProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IRequestInfoProvider 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IRequestInfoProvider') {#Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeVerificationService.UserCodeVerificationService(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeVerificationService_,Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IDeviceAuthorizationStorage,Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeRateLimiter,Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeNormalizer,Abblix.Oidc.Server.Common.Interfaces.IRequestInfoProvider,System.TimeProvider).requestInfoProvider} Supplies the client IP the rate limiter buckets by\. The core reads it through this abstraction rather than the HTTP context so it stays independent of the host, and so a test can drive the limiter without standing up a web host\. ###### `timeProvider` [System\.TimeProvider](https://learn.microsoft.com/en-us/dotnet/api/system.timeprovider 'System\.TimeProvider') {#Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeVerificationService.UserCodeVerificationService(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeVerificationService_,Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IDeviceAuthorizationStorage,Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeRateLimiter,Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeNormalizer,Abblix.Oidc.Server.Common.Interfaces.IRequestInfoProvider,System.TimeProvider).timeProvider} Provides the current time for deriving the request's remaining lifetime\. ### Methods ## UserCodeVerificationService\.ApproveAsync\(string, AuthorizedGrant\) Method {#Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeVerificationService.ApproveAsync(string,Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant)} Approves the device authorization request, linking the user's authorization to the pending device\. ```csharp public System.Threading.Tasks.Task ApproveAsync(string userCode, Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant authorizedGrant); ``` #### Parameters ###### `userCode` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeVerificationService.ApproveAsync(string,Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant).userCode} The user\-entered verification code\. ###### `authorizedGrant` [AuthorizedGrant](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.AuthorizedGrant') {#Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeVerificationService.ApproveAsync(string,Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant).authorizedGrant} The authorized grant containing the user's authentication session and context\. Its `authorization_details` are what the device is granted: the library adds none, and refuses an approval carrying a type the request never asked for\. Its scopes and resources are a starting point rather than the final word \- the token endpoint narrows them against the token request \(RFC 8707 section 2\.2\) and adds the certificate and proof\-key confirmations\. Implements [ApproveAsync\(string, AuthorizedGrant\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeVerificationService#Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeVerificationService.ApproveAsync(string,Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant) 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.Interfaces\.IUserCodeVerificationService\.ApproveAsync\(string, Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.AuthorizedGrant\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') True when this call is the one that recorded the approval\. False otherwise, and otherwise is wider than a bad code: the stored record is re\-read and must still be pending, so a denial or another approval landing first answers false too, as does a request whose lifetime ran out and one whose grant carries a type the request never asked for\. The decision is not applied in any of those cases, and nothing about the record changes\. A true is not a guarantee that nothing landed in between. The re-read and the write are two store calls, and the store exposes no conditional write, so two concurrent approvals can each be told true and the later write wins. That window is one store round trip wide. ### Remarks `authorization_details` are the host's to carry\. The requested entries arrive on [ValidUserCode](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.ValidUserCode 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.ValidUserCode'), and the decision the user made about them belongs on this grant's `AuthorizationContext` \- narrowed, enriched or dropped, as the verification page decided\. The library does not copy them across, because only that page knows what it displayed, and granting a payment nobody was shown is worse than granting none\. Approving with entries on the record and none on the grant is therefore allowed and logged at warning level. RFC 9396 section 7 is satisfied either way, since its MUST is to return what the resource owner GRANTED and nothing granted is nothing to return. What matters here is section 9 of that document: it makes the details reaching the resource server the point of having them, and a token carrying none leaves it nothing to enforce, which is worth seeing in a log rather than discovering at the resource server. The opposite direction is refused rather than logged. A grant carrying a type the device authorization request never asked for gives the device authority nobody requested, so the approval answers `false` and the request stays pending. ## UserCodeVerificationService\.DenyAsync\(string\) Method {#Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeVerificationService.DenyAsync(string)} Denies the device authorization request\. ```csharp public System.Threading.Tasks.Task DenyAsync(string userCode); ``` #### Parameters ###### `userCode` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeVerificationService.DenyAsync(string).userCode} The user\-entered verification code\. Implements [DenyAsync\(string\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeVerificationService#Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeVerificationService.DenyAsync(string) 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.Interfaces\.IUserCodeVerificationService\.DenyAsync\(string\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') True when this call is the one that recorded the denial\. False otherwise, and otherwise is wider than a bad code: the stored record is re\-read and must still be pending, so a decision that landed first answers false, as does a request whose lifetime ran out\. Nothing about the record changes in those cases, and a true carries the same narrowed\-not\-closed window [ApproveAsync\(string, AuthorizedGrant\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeVerificationService#Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeVerificationService.ApproveAsync(string,Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant) 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.Interfaces\.IUserCodeVerificationService\.ApproveAsync\(string, Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.AuthorizedGrant\)') describes\. ## UserCodeVerificationService\.VerifyAsync\(string\) Method {#Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeVerificationService.VerifyAsync(string)} Verifies a user code and returns the associated device authorization request details\. ```csharp public System.Threading.Tasks.Task VerifyAsync(string userCode); ``` #### Parameters ###### `userCode` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeVerificationService.VerifyAsync(string).userCode} The user\-entered verification code\. Implements [VerifyAsync\(string\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeVerificationService#Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeVerificationService.VerifyAsync(string) 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.Interfaces\.IUserCodeVerificationService\.VerifyAsync\(string\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[UserCodeVerificationResult](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeVerificationResult 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.UserCodeVerificationResult')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task that returns the verification result containing request details if valid, or an appropriate error if the code is invalid, expired, or already used\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.ValidUserCode.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.DeviceAuthorization](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization') ## ValidUserCode Class Indicates that the user code was successfully verified and the request is pending authorization\. ```csharp public record ValidUserCode : Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeVerificationResult, System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → [UserCodeVerificationResult](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeVerificationResult 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.UserCodeVerificationResult') → ValidUserCode Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[ValidUserCode](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.ValidUserCode 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.ValidUserCode')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Constructors ## ValidUserCode\(string, string\[\], Uri\[\], JsonArray\) Constructor {#Abblix.Oidc.Server.Features.DeviceAuthorization.ValidUserCode.ValidUserCode(string,string[],System.Uri[],System.Text.Json.Nodes.JsonArray)} Indicates that the user code was successfully verified and the request is pending authorization\. ```csharp public ValidUserCode(string ClientId, string[] Scope, System.Uri[]? Resources, System.Text.Json.Nodes.JsonArray? AuthorizationDetails); ``` #### Parameters ###### `ClientId` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.DeviceAuthorization.ValidUserCode.ValidUserCode(string,string[],System.Uri[],System.Text.Json.Nodes.JsonArray).ClientId} The client identifier that initiated the device authorization request\. ###### `Scope` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Oidc.Server.Features.DeviceAuthorization.ValidUserCode.ValidUserCode(string,string[],System.Uri[],System.Text.Json.Nodes.JsonArray).Scope} The requested scopes for the authorization\. ###### `Resources` [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Oidc.Server.Features.DeviceAuthorization.ValidUserCode.ValidUserCode(string,string[],System.Uri[],System.Text.Json.Nodes.JsonArray).Resources} The requested resources \(RFC 8707\) for the authorization\. ###### `AuthorizationDetails` [System\.Text\.Json\.Nodes\.JsonArray](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonarray 'System\.Text\.Json\.Nodes\.JsonArray') {#Abblix.Oidc.Server.Features.DeviceAuthorization.ValidUserCode.ValidUserCode(string,string[],System.Uri[],System.Text.Json.Nodes.JsonArray).AuthorizationDetails} RFC 9396 §3 Rich Authorization Requests array from the original /device\_authorization request\. The host's user\-verification UI renders these for consent and threads the user's decision onto the AuthorizedGrant's AuthorizationContext\. Nothing else does: approving with a grant that carries none issues a token with no `authorization_details` at all, which RFC 9396 §9 leaves a resource server unable to enforce\. The approval logs that at warning level rather than repairing it, since only this page knows what it showed the user\. ### Properties ## ValidUserCode\.AuthorizationDetails Property {#Abblix.Oidc.Server.Features.DeviceAuthorization.ValidUserCode.AuthorizationDetails} RFC 9396 §3 Rich Authorization Requests array from the original /device\_authorization request\. The host's user\-verification UI renders these for consent and threads the user's decision onto the AuthorizedGrant's AuthorizationContext\. Nothing else does: approving with a grant that carries none issues a token with no `authorization_details` at all, which RFC 9396 §9 leaves a resource server unable to enforce\. The approval logs that at warning level rather than repairing it, since only this page knows what it showed the user\. ```csharp public System.Text.Json.Nodes.JsonArray? AuthorizationDetails { get; init; } ``` #### Property Value [System\.Text\.Json\.Nodes\.JsonArray](https://learn.microsoft.com/en-us/dotnet/api/system.text.json.nodes.jsonarray 'System\.Text\.Json\.Nodes\.JsonArray') ## ValidUserCode\.ClientId Property {#Abblix.Oidc.Server.Features.DeviceAuthorization.ValidUserCode.ClientId} The client identifier that initiated the device authorization request\. ```csharp public string ClientId { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ValidUserCode\.Resources Property {#Abblix.Oidc.Server.Features.DeviceAuthorization.ValidUserCode.Resources} The requested resources \(RFC 8707\) for the authorization\. ```csharp public System.Uri[]? Resources { get; init; } ``` #### Property Value [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') ## ValidUserCode\.Scope Property {#Abblix.Oidc.Server.Features.DeviceAuthorization.ValidUserCode.Scope} The requested scopes for the authorization\. ```csharp public string[] Scope { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ## Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.Interfaces Namespace | Interfaces | | | :--- | :--- | | [IDeviceAuthorizationStorage](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IDeviceAuthorizationStorage 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.Interfaces\.IDeviceAuthorizationStorage') | Defines the contract for a storage system responsible for persisting and retrieving device authorization requests as defined in RFC 8628\. | | [IDeviceCodeGenerator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IDeviceCodeGenerator 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.Interfaces\.IDeviceCodeGenerator') | Defines the contract for generating device codes used in the Device Authorization Grant \(RFC 8628\)\. | | [IUserCodeGenerator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeGenerator 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.Interfaces\.IUserCodeGenerator') | Defines the contract for generating user codes used in the Device Authorization Grant \(RFC 8628\)\. | | [IUserCodeNormalizer](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeNormalizer 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.Interfaces\.IUserCodeNormalizer') | Canonicalizes a user\-entered user code before it is matched against a stored code in the Device Authorization Grant \(RFC 8628\)\. RFC 8628 Section 6\.1 recommends that the server strip readability punctuation the user may have copied \(dashes, spaces\), case\-fold input for single\-case character sets, and drop any characters outside the configured alphabet, so that equivalent user input is not rejected as invalid\. | | [IUserCodeRateLimiter](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeRateLimiter 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.Interfaces\.IUserCodeRateLimiter') | Defines the contract for rate limiting user code verification attempts to prevent brute force attacks\. RFC 8628 Section 5\.1 recommends that the server rate\-limit user code attempts\. The word there is lowercase, so this is a mitigation the server chooses rather than one it inherits \- and the choice is what makes the entropy argument in that section hold\. | | [IUserCodeVerificationService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeVerificationService 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.Interfaces\.IUserCodeVerificationService') | Defines the contract for a service that handles user code verification in the Device Authorization Grant flow \(RFC 8628\)\. | --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IDeviceAuthorizationStorage.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.Interfaces') ## IDeviceAuthorizationStorage Interface Defines the contract for a storage system responsible for persisting and retrieving device authorization requests as defined in RFC 8628\. ```csharp public interface IDeviceAuthorizationStorage ``` Derived ↳ [DeviceAuthorizationStorage](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationStorage 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.DeviceAuthorizationStorage') ### Methods ## IDeviceAuthorizationStorage\.RemoveAsync\(string\) Method {#Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IDeviceAuthorizationStorage.RemoveAsync(string)} Removes a device authorization request from storage using its device code\. ```csharp System.Threading.Tasks.Task RemoveAsync(string deviceCode); ``` #### Parameters ###### `deviceCode` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IDeviceAuthorizationStorage.RemoveAsync(string).deviceCode} The device code identifier\. #### Returns [System\.Threading\.Tasks\.Task](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task 'System\.Threading\.Tasks\.Task') A task that completes when the request is removed\. Tidying the secondary user\-code index is best\-effort and is logged rather than raised: it is not what the caller asked for, and a store deciding otherwise must not become a fault where a grant error belongs\. Removing the request itself is not guarded \- that IS what was asked, so a refusal there raises\. ## IDeviceAuthorizationStorage\.StoreAsync\(string, DeviceAuthorizationRequest, TimeSpan\) Method {#Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IDeviceAuthorizationStorage.StoreAsync(string,Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationRequest,System.TimeSpan)} Stores a device authorization request with the specified device code\. ```csharp System.Threading.Tasks.Task StoreAsync(string deviceCode, Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationRequest request, System.TimeSpan expiresIn); ``` #### Parameters ###### `deviceCode` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IDeviceAuthorizationStorage.StoreAsync(string,Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationRequest,System.TimeSpan).deviceCode} The unique device code identifier\. ###### `request` [DeviceAuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationRequest 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.DeviceAuthorizationRequest') {#Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IDeviceAuthorizationStorage.StoreAsync(string,Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationRequest,System.TimeSpan).request} The device authorization request to store\. ###### `expiresIn` [System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan') {#Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IDeviceAuthorizationStorage.StoreAsync(string,Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationRequest,System.TimeSpan).expiresIn} The duration after which the stored request will expire\. #### Returns [System\.Threading\.Tasks\.Task](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task 'System\.Threading\.Tasks\.Task') A task that completes when the request is stored\. ## IDeviceAuthorizationStorage\.TryGetByDeviceCodeAsync\(string\) Method {#Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IDeviceAuthorizationStorage.TryGetByDeviceCodeAsync(string)} Tries to retrieve a device authorization request by its device code\. This is used by the client when polling the token endpoint\. ```csharp System.Threading.Tasks.Task TryGetByDeviceCodeAsync(string deviceCode); ``` #### Parameters ###### `deviceCode` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IDeviceAuthorizationStorage.TryGetByDeviceCodeAsync(string).deviceCode} The device code identifier\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[DeviceAuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationRequest 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.DeviceAuthorizationRequest')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task that returns the device authorization request if found; otherwise, null\. ## IDeviceAuthorizationStorage\.TryGetByUserCodeAsync\(string\) Method {#Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IDeviceAuthorizationStorage.TryGetByUserCodeAsync(string)} Tries to retrieve a device authorization request by its user code\. This is used during user verification to look up the pending request\. ```csharp System.Threading.Tasks.Task> TryGetByUserCodeAsync(string userCode); ``` #### Parameters ###### `userCode` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IDeviceAuthorizationStorage.TryGetByUserCodeAsync(string).userCode} The user\-friendly verification code\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[<](https://learn.microsoft.com/en-us/dotnet/api/system.valuetuple 'System\.ValueTuple')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[,](https://learn.microsoft.com/en-us/dotnet/api/system.valuetuple 'System\.ValueTuple')[DeviceAuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationRequest 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.DeviceAuthorizationRequest')[>](https://learn.microsoft.com/en-us/dotnet/api/system.valuetuple 'System\.ValueTuple')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task that returns the device code and request if found; otherwise, null\. ## IDeviceAuthorizationStorage\.TryRemoveAsync\(string, string\) Method {#Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IDeviceAuthorizationStorage.TryRemoveAsync(string,string)} Claims a device authorization request by its device code, deciding presence and removing it in one protocol, so that a caller told it removed the request is the only caller that can be told so\. It narrows that window rather than closing it; the returns block below says what a false covers\. ```csharp System.Threading.Tasks.Task TryRemoveAsync(string deviceCode, string userCode); ``` #### Parameters ###### `deviceCode` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IDeviceAuthorizationStorage.TryRemoveAsync(string,string).deviceCode} The device code identifier\. ###### `userCode` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IDeviceAuthorizationStorage.TryRemoveAsync(string,string).userCode} The user code for cleaning up the secondary index mapping\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task that returns true when this caller removed the request AND still held its own claim afterwards\. False otherwise, which is wider than "somebody else got it": it also covers the request not being there and a claim that expired while a store call was in flight \- the second on one caller with nobody to lose to, and its outcome is the request gone with nobody able to be told they took it\. An operator told a second REQUEST was the cause goes looking for one, and the expiry case is exactly the one that never produces a second request\. Removing the secondary user-code index is not part of that answer. It runs after the claim has already decided, so a store that refuses it is logged and the answer stands. The entry left behind expires on its own; what it still resolves to depends on the user code the caller passed, which this method never checks against the record it removed. ## IDeviceAuthorizationStorage\.UpdateAsync\(string, DeviceAuthorizationRequest, TimeSpan\) Method {#Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IDeviceAuthorizationStorage.UpdateAsync(string,Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationRequest,System.TimeSpan)} Updates an existing device authorization request in storage, refreshing its cache entry with the caller\-supplied remaining lifetime\. ```csharp System.Threading.Tasks.Task UpdateAsync(string deviceCode, Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationRequest request, System.TimeSpan expiresIn); ``` #### Parameters ###### `deviceCode` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IDeviceAuthorizationStorage.UpdateAsync(string,Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationRequest,System.TimeSpan).deviceCode} The device code identifier\. ###### `request` [DeviceAuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationRequest 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.DeviceAuthorizationRequest') {#Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IDeviceAuthorizationStorage.UpdateAsync(string,Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationRequest,System.TimeSpan).request} The updated device authorization request\. ###### `expiresIn` [System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan') {#Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IDeviceAuthorizationStorage.UpdateAsync(string,Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationRequest,System.TimeSpan).expiresIn} The remaining lifetime to apply as the cache TTL\. The caller derives it from the request's fixed expiry \(RFC 8628 section 3\.2\) so that repeated polling cannot extend the code\. #### Returns [System\.Threading\.Tasks\.Task](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task 'System\.Threading\.Tasks\.Task') A task that completes when the request is updated\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IDeviceCodeGenerator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.Interfaces') ## IDeviceCodeGenerator Interface Defines the contract for generating device codes used in the Device Authorization Grant \(RFC 8628\)\. ```csharp public interface IDeviceCodeGenerator ``` Derived ↳ [DeviceCodeGenerator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceCodeGenerator 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.DeviceCodeGenerator') ### Methods ## IDeviceCodeGenerator\.GenerateDeviceCode\(\) Method {#Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IDeviceCodeGenerator.GenerateDeviceCode()} Generates a high\-entropy device code that the client uses to poll the token endpoint\. ```csharp string GenerateDeviceCode(); ``` #### Returns [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') A cryptographically secure, URL\-safe device code\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeGenerator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.Interfaces') ## IUserCodeGenerator Interface Defines the contract for generating user codes used in the Device Authorization Grant \(RFC 8628\)\. ```csharp public interface IUserCodeGenerator ``` Derived ↳ [UserCodeGenerator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeGenerator 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.UserCodeGenerator') ### Methods ## IUserCodeGenerator\.GenerateUserCode\(\) Method {#Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeGenerator.GenerateUserCode()} Generates a user\-friendly numeric code that the end\-user enters on the verification page\. ```csharp string GenerateUserCode(); ``` #### Returns [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') A numeric verification code \(e\.g\., "1234\-5678"\)\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeNormalizer.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.Interfaces') ## IUserCodeNormalizer Interface Canonicalizes a user\-entered user code before it is matched against a stored code in the Device Authorization Grant \(RFC 8628\)\. RFC 8628 Section 6\.1 recommends that the server strip readability punctuation the user may have copied \(dashes, spaces\), case\-fold input for single\-case character sets, and drop any characters outside the configured alphabet, so that equivalent user input is not rejected as invalid\. ```csharp public interface IUserCodeNormalizer ``` Derived ↳ [UserCodeNormalizer](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeNormalizer 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.UserCodeNormalizer') ### Methods ## IUserCodeNormalizer\.Normalize\(string\) Method {#Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeNormalizer.Normalize(string)} Produces the canonical form of a user code for comparison: characters outside the configured alphabet are removed, and case is folded when the alphabet is single\-case\. ```csharp string Normalize(string userCode); ``` #### Parameters ###### `userCode` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeNormalizer.Normalize(string).userCode} The raw user code as entered by the end\-user\. #### Returns [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') The canonical user code used for storage lookup and rate limiting\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeRateLimiter.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.Interfaces') ## IUserCodeRateLimiter Interface Defines the contract for rate limiting user code verification attempts to prevent brute force attacks\. RFC 8628 Section 5\.1 recommends that the server rate\-limit user code attempts\. The word there is lowercase, so this is a mitigation the server chooses rather than one it inherits \- and the choice is what makes the entropy argument in that section hold\. ```csharp public interface IUserCodeRateLimiter ``` Derived ↳ [UserCodeRateLimiter](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeRateLimiter 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.UserCodeRateLimiter') ### Methods ## IUserCodeRateLimiter\.CheckAsync\(string, string\) Method {#Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeRateLimiter.CheckAsync(string,string)} Checks if a verification attempt should be allowed for the given user code and client identifier\. Implements exponential backoff and per\-IP rate limiting to prevent brute force attacks\. ```csharp System.Threading.Tasks.Task> CheckAsync(string userCode, string clientIdentifier); ``` #### Parameters ###### `userCode` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeRateLimiter.CheckAsync(string,string).userCode} The user code being verified\. ###### `clientIdentifier` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeRateLimiter.CheckAsync(string,string).clientIdentifier} The client identifier \(IP address or other identifier\)\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A [Result<TSuccess,TFailure>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2') containing: \- Success \(`true`\): The verification attempt is allowed to proceed\. \- Failure \([System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan')\): The attempt is rate limited; the value indicates the duration the client must wait before retrying \(Retry\-After\)\. ## IUserCodeRateLimiter\.RecordFailureAsync\(string, string\) Method {#Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeRateLimiter.RecordFailureAsync(string,string)} Records a failed verification attempt for rate limiting purposes\. ```csharp System.Threading.Tasks.Task RecordFailureAsync(string userCode, string clientIdentifier); ``` #### Parameters ###### `userCode` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeRateLimiter.RecordFailureAsync(string,string).userCode} The user code that failed verification\. ###### `clientIdentifier` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeRateLimiter.RecordFailureAsync(string,string).clientIdentifier} The client identifier \(IP address or other identifier\)\. #### Returns [System\.Threading\.Tasks\.Task](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task 'System\.Threading\.Tasks\.Task') ## IUserCodeRateLimiter\.RecordSuccessAsync\(string, string\) Method {#Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeRateLimiter.RecordSuccessAsync(string,string)} Records a successful verification to reset rate limiting counters\. ```csharp System.Threading.Tasks.Task RecordSuccessAsync(string userCode, string clientIdentifier); ``` #### Parameters ###### `userCode` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeRateLimiter.RecordSuccessAsync(string,string).userCode} The user code that was successfully verified\. ###### `clientIdentifier` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeRateLimiter.RecordSuccessAsync(string,string).clientIdentifier} The client identifier \(IP address or other identifier\)\. #### Returns [System\.Threading\.Tasks\.Task](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task 'System\.Threading\.Tasks\.Task') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeVerificationService.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.Interfaces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.Interfaces') ## IUserCodeVerificationService Interface Defines the contract for a service that handles user code verification in the Device Authorization Grant flow \(RFC 8628\)\. ```csharp public interface IUserCodeVerificationService ``` Derived ↳ [UserCodeVerificationService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeVerificationService 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.UserCodeVerificationService') ### Methods ## IUserCodeVerificationService\.ApproveAsync\(string, AuthorizedGrant\) Method {#Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeVerificationService.ApproveAsync(string,Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant)} Approves the device authorization request, linking the user's authorization to the pending device\. ```csharp System.Threading.Tasks.Task ApproveAsync(string userCode, Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant authorizedGrant); ``` #### Parameters ###### `userCode` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeVerificationService.ApproveAsync(string,Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant).userCode} The user\-entered verification code\. ###### `authorizedGrant` [AuthorizedGrant](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.AuthorizedGrant') {#Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeVerificationService.ApproveAsync(string,Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant).authorizedGrant} The authorized grant containing the user's authentication session and context\. Its `authorization_details` are what the device is granted: the library adds none, and refuses an approval carrying a type the request never asked for\. Its scopes and resources are a starting point rather than the final word \- the token endpoint narrows them against the token request \(RFC 8707 section 2\.2\) and adds the certificate and proof\-key confirmations\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') True when this call is the one that recorded the approval\. False otherwise, and otherwise is wider than a bad code: the stored record is re\-read and must still be pending, so a denial or another approval landing first answers false too, as does a request whose lifetime ran out and one whose grant carries a type the request never asked for\. The decision is not applied in any of those cases, and nothing about the record changes\. A true is not a guarantee that nothing landed in between. The re-read and the write are two store calls, and the store exposes no conditional write, so two concurrent approvals can each be told true and the later write wins. That window is one store round trip wide. ### Remarks `authorization_details` are the host's to carry\. The requested entries arrive on [ValidUserCode](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.ValidUserCode 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.ValidUserCode'), and the decision the user made about them belongs on this grant's `AuthorizationContext` \- narrowed, enriched or dropped, as the verification page decided\. The library does not copy them across, because only that page knows what it displayed, and granting a payment nobody was shown is worse than granting none\. Approving with entries on the record and none on the grant is therefore allowed and logged at warning level. RFC 9396 section 7 is satisfied either way, since its MUST is to return what the resource owner GRANTED and nothing granted is nothing to return. What matters here is section 9 of that document: it makes the details reaching the resource server the point of having them, and a token carrying none leaves it nothing to enforce, which is worth seeing in a log rather than discovering at the resource server. The opposite direction is refused rather than logged. A grant carrying a type the device authorization request never asked for gives the device authority nobody requested, so the approval answers `false` and the request stays pending. ## IUserCodeVerificationService\.DenyAsync\(string\) Method {#Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeVerificationService.DenyAsync(string)} Denies the device authorization request\. ```csharp System.Threading.Tasks.Task DenyAsync(string userCode); ``` #### Parameters ###### `userCode` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeVerificationService.DenyAsync(string).userCode} The user\-entered verification code\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') True when this call is the one that recorded the denial\. False otherwise, and otherwise is wider than a bad code: the stored record is re\-read and must still be pending, so a decision that landed first answers false, as does a request whose lifetime ran out\. Nothing about the record changes in those cases, and a true carries the same narrowed\-not\-closed window [ApproveAsync\(string, AuthorizedGrant\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeVerificationService#Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeVerificationService.ApproveAsync(string,Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant) 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.Interfaces\.IUserCodeVerificationService\.ApproveAsync\(string, Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.AuthorizedGrant\)') describes\. ## IUserCodeVerificationService\.VerifyAsync\(string\) Method {#Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeVerificationService.VerifyAsync(string)} Verifies a user code and returns the associated device authorization request details\. ```csharp System.Threading.Tasks.Task VerifyAsync(string userCode); ``` #### Parameters ###### `userCode` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeVerificationService.VerifyAsync(string).userCode} The user\-entered verification code\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[UserCodeVerificationResult](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeVerificationResult 'Abblix\.Oidc\.Server\.Features\.DeviceAuthorization\.UserCodeVerificationResult')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task that returns the verification result containing request details if valid, or an appropriate error if the code is invalid, expired, or already used\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DPoP.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ## Abblix\.Oidc\.Server\.Features\.DPoP Namespace | Classes | | | :--- | :--- | | [DPoPAlgorithms](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DPoP.DPoPAlgorithms 'Abblix\.Oidc\.Server\.Features\.DPoP\.DPoPAlgorithms') | Single source of truth for the DPoP signing\-algorithm whitelist \(RFC 9449 §4\.2, §7\.1\)\. Both the proof\-validator's enforcement \(it rejects proofs whose `alg` header sits outside this set\) and the resource\-server's `WWW-Authenticate: DPoP algs="..."` challenge advertisement read from here, so adding a new algorithm \(e\.g\. EdDSA when the JWS layer gains support\) propagates everywhere automatically\. | | [DPoPNonceValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DPoP.DPoPNonceValidator 'Abblix\.Oidc\.Server\.Features\.DPoP\.DPoPNonceValidator') | Base class for DPoP\-aware endpoint validators that enforce the RFC 9449 §8 nonce challenge\-response loop\. Encapsulates the proof\-claim check, fresh\-nonce issuance, and [UseDPoPNonceError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.UseDPoPNonceError 'Abblix\.Oidc\.Server\.Common\.UseDPoPNonceError') shaping; concrete validators override [Abblix\.Oidc\.Server\.Features\.DPoP\.DPoPNonceValidator\.LogNonceChallengeIssued](https://learn.microsoft.com/en-us/dotnet/api/abblix.oidc.server.features.dpop.dpopnoncevalidator.lognoncechallengeissued 'Abblix\.Oidc\.Server\.Features\.DPoP\.DPoPNonceValidator\.LogNonceChallengeIssued') to attribute the «challenge issued» event to their own endpoint `EventId`\. | | [Proof](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DPoP.Proof 'Abblix\.Oidc\.Server\.Features\.DPoP\.Proof') | The product of a successfully validated DPoP proof: the parsed JWT \(so callers can read claims the validator does not consume itself, e\.g\. `nonce`\), the public\-only JWK extracted from the proof's `jwk` header, its base64url\-encoded RFC 7638 JWK Thumbprint \(the value that goes into `cnf.jkt` on the issued access token and matches against `dpop_jkt`\), the proof\-unique `jti` for downstream replay protection, and the `iat` the proof claims to have been signed at\. | | [ProofError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DPoP.ProofError 'Abblix\.Oidc\.Server\.Features\.DPoP\.ProofError') | Describes why a DPoP proof was rejected\. [Reason](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DPoP.ProofError#Abblix.Oidc.Server.Features.DPoP.ProofError.Reason 'Abblix\.Oidc\.Server\.Features\.DPoP\.ProofError\.Reason') is a stable token suitable for log filters and metric labels; [Detail](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DPoP.ProofError#Abblix.Oidc.Server.Features.DPoP.ProofError.Detail 'Abblix\.Oidc\.Server\.Features\.DPoP\.ProofError\.Detail') is a human\-readable hint\. | | [ProofErrorReasons](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DPoP.ProofErrorReasons 'Abblix\.Oidc\.Server\.Features\.DPoP\.ProofErrorReasons') | Stable, machine\-friendly reason tokens that [Abblix\.Oidc\.Server\.Features\.DPoP\.ProofValidator](https://learn.microsoft.com/en-us/dotnet/api/abblix.oidc.server.features.dpop.proofvalidator 'Abblix\.Oidc\.Server\.Features\.DPoP\.ProofValidator') assigns to [Reason](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DPoP.ProofError#Abblix.Oidc.Server.Features.DPoP.ProofError.Reason 'Abblix\.Oidc\.Server\.Features\.DPoP\.ProofError\.Reason') for log filters and metric labels\. These are the internal fine\-grained failure categories; the OAuth\-protocol\-level error code surfaced to clients is always `invalid_dpop_proof` \(or `use_dpop_nonce` for the nonce\-required path\) regardless of which of these matched\. | | Interfaces | | | :--- | :--- | | [IProofValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DPoP.IProofValidator 'Abblix\.Oidc\.Server\.Features\.DPoP\.IProofValidator') | Validates a DPoP proof JWT per RFC 9449 §4\.2 / §4\.3 \(structure, signature, claim shape\) but excluding replay\-cache and nonce checks\. Those layered checks land alongside the `jti`\-replay\-cache and DPoP\-Nonce service in a separate slice and build on the [Proof](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DPoP.Proof 'Abblix\.Oidc\.Server\.Features\.DPoP\.Proof') returned by a successful validation here\. | --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DPoP.DPoPAlgorithms.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.DPoP](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DPoP 'Abblix\.Oidc\.Server\.Features\.DPoP') ## DPoPAlgorithms Class Single source of truth for the DPoP signing\-algorithm whitelist \(RFC 9449 §4\.2, §7\.1\)\. Both the proof\-validator's enforcement \(it rejects proofs whose `alg` header sits outside this set\) and the resource\-server's `WWW-Authenticate: DPoP algs="..."` challenge advertisement read from here, so adding a new algorithm \(e\.g\. EdDSA when the JWS layer gains support\) propagates everywhere automatically\. ```csharp public static class DPoPAlgorithms ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → DPoPAlgorithms ### Fields ## DPoPAlgorithms\.Allowed Field {#Abblix.Oidc.Server.Features.DPoP.DPoPAlgorithms.Allowed} JWS algorithms accepted on a DPoP proof\. `none` and HMAC\-based algorithms are intentionally absent \- RFC 9449 §4\.2 forbids them because the embedded `jwk` header carries an asymmetric public key for verification\. ```csharp public static readonly IReadOnlySet Allowed; ``` #### Field Value [System\.Collections\.Generic\.IReadOnlySet<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ireadonlyset-1 'System\.Collections\.Generic\.IReadOnlySet\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ireadonlyset-1 'System\.Collections\.Generic\.IReadOnlySet\`1') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DPoP.DPoPNonceValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.DPoP](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DPoP 'Abblix\.Oidc\.Server\.Features\.DPoP') ## DPoPNonceValidator Class Base class for DPoP\-aware endpoint validators that enforce the RFC 9449 §8 nonce challenge\-response loop\. Encapsulates the proof\-claim check, fresh\-nonce issuance, and [UseDPoPNonceError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.UseDPoPNonceError 'Abblix\.Oidc\.Server\.Common\.UseDPoPNonceError') shaping; concrete validators override [Abblix\.Oidc\.Server\.Features\.DPoP\.DPoPNonceValidator\.LogNonceChallengeIssued](https://learn.microsoft.com/en-us/dotnet/api/abblix.oidc.server.features.dpop.dpopnoncevalidator.lognoncechallengeissued 'Abblix\.Oidc\.Server\.Features\.DPoP\.DPoPNonceValidator\.LogNonceChallengeIssued') to attribute the «challenge issued» event to their own endpoint `EventId`\. ```csharp public abstract class DPoPNonceValidator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → DPoPNonceValidator Derived ↳ [DPoPTokenEndpointValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation.DPoPTokenEndpointValidator 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Validation\.DPoPTokenEndpointValidator') ↳ [DPoPUserInfoValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Validation.DPoPUserInfoValidator 'Abblix\.Oidc\.Server\.Endpoints\.UserInfo\.Validation\.DPoPUserInfoValidator') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DPoP.IProofValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.DPoP](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DPoP 'Abblix\.Oidc\.Server\.Features\.DPoP') ## IProofValidator Interface Validates a DPoP proof JWT per RFC 9449 §4\.2 / §4\.3 \(structure, signature, claim shape\) but excluding replay\-cache and nonce checks\. Those layered checks land alongside the `jti`\-replay\-cache and DPoP\-Nonce service in a separate slice and build on the [Proof](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DPoP.Proof 'Abblix\.Oidc\.Server\.Features\.DPoP\.Proof') returned by a successful validation here\. ```csharp public interface IProofValidator ``` ### Methods ## IProofValidator\.ValidateAsync\(string, string, CancellationToken\) Method {#Abblix.Oidc.Server.Features.DPoP.IProofValidator.ValidateAsync(string,string,System.Threading.CancellationToken)} Validates [proofJwt](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DPoP.IProofValidator#Abblix.Oidc.Server.Features.DPoP.IProofValidator.ValidateAsync(string,string,System.Threading.CancellationToken).proofJwt 'Abblix\.Oidc\.Server\.Features\.DPoP\.IProofValidator\.ValidateAsync\(string, string, System\.Threading\.CancellationToken\)\.proofJwt') as a DPoP proof for the current request\. The HTTP method and URI used for `htm` / `htu` binding checks come from [IRequestInfoProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IRequestInfoProvider 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IRequestInfoProvider') injected into the validator, so callers never need to thread them through\. When [accessToken](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DPoP.IProofValidator#Abblix.Oidc.Server.Features.DPoP.IProofValidator.ValidateAsync(string,string,System.Threading.CancellationToken).accessToken 'Abblix\.Oidc\.Server\.Features\.DPoP\.IProofValidator\.ValidateAsync\(string, string, System\.Threading\.CancellationToken\)\.accessToken') is supplied \(the proof accompanies a bearer\-style access\-token presentation\), the proof's `ath` claim is verified against the access\-token hash per RFC 9449 §4\.2\. ```csharp System.Threading.Tasks.Task> ValidateAsync(string proofJwt, string? accessToken=null, System.Threading.CancellationToken cancellationToken=default(System.Threading.CancellationToken)); ``` #### Parameters ###### `proofJwt` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.DPoP.IProofValidator.ValidateAsync(string,string,System.Threading.CancellationToken).proofJwt} The compact JWS form of the DPoP proof, taken from the `DPoP` request header\. ###### `accessToken` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.DPoP.IProofValidator.ValidateAsync(string,string,System.Threading.CancellationToken).accessToken} The access token presented alongside the proof, when the proof secures a resource\-server request\. `null` at the token endpoint where no access token is yet bound\. ###### `cancellationToken` [System\.Threading\.CancellationToken](https://learn.microsoft.com/en-us/dotnet/api/system.threading.cancellationtoken 'System\.Threading\.CancellationToken') {#Abblix.Oidc.Server.Features.DPoP.IProofValidator.ValidateAsync(string,string,System.Threading.CancellationToken).cancellationToken} Cancellation token for the asynchronous call\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[Proof](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DPoP.Proof 'Abblix\.Oidc\.Server\.Features\.DPoP\.Proof')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[ProofError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DPoP.ProofError 'Abblix\.Oidc\.Server\.Features\.DPoP\.ProofError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A [Result<TSuccess,TFailure>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2'): [Proof](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DPoP.Proof 'Abblix\.Oidc\.Server\.Features\.DPoP\.Proof') when every validation step passes, otherwise [ProofError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DPoP.ProofError 'Abblix\.Oidc\.Server\.Features\.DPoP\.ProofError') describing the failure reason\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DPoP.Proof.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.DPoP](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DPoP 'Abblix\.Oidc\.Server\.Features\.DPoP') ## Proof Class The product of a successfully validated DPoP proof: the parsed JWT \(so callers can read claims the validator does not consume itself, e\.g\. `nonce`\), the public\-only JWK extracted from the proof's `jwk` header, its base64url\-encoded RFC 7638 JWK Thumbprint \(the value that goes into `cnf.jkt` on the issued access token and matches against `dpop_jkt`\), the proof\-unique `jti` for downstream replay protection, and the `iat` the proof claims to have been signed at\. ```csharp public sealed record Proof : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → Proof Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[Proof](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DPoP.Proof 'Abblix\.Oidc\.Server\.Features\.DPoP\.Proof')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Constructors ## Proof\(JsonWebToken, JsonWebKey, string, string, DateTimeOffset\) Constructor {#Abblix.Oidc.Server.Features.DPoP.Proof.Proof(Abblix.Jwt.JsonWebToken,Abblix.Jwt.JsonWebKey,string,string,System.DateTimeOffset)} The product of a successfully validated DPoP proof: the parsed JWT \(so callers can read claims the validator does not consume itself, e\.g\. `nonce`\), the public\-only JWK extracted from the proof's `jwk` header, its base64url\-encoded RFC 7638 JWK Thumbprint \(the value that goes into `cnf.jkt` on the issued access token and matches against `dpop_jkt`\), the proof\-unique `jti` for downstream replay protection, and the `iat` the proof claims to have been signed at\. ```csharp public Proof(Abblix.Jwt.JsonWebToken Token, Abblix.Jwt.JsonWebKey ProofKey, string ProofKeyThumbprint, string JwtId, System.DateTimeOffset IssuedAt); ``` #### Parameters ###### `Token` [JsonWebToken](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebToken 'Abblix\.Jwt\.JsonWebToken') {#Abblix.Oidc.Server.Features.DPoP.Proof.Proof(Abblix.Jwt.JsonWebToken,Abblix.Jwt.JsonWebKey,string,string,System.DateTimeOffset).Token} The parsed proof JWT\. The validator already produced this object internally; carrying it through saves callers a re\-parse when they need claims outside the validator's contract \(notably DPoP\-Nonce checks layered on top\)\. ###### `ProofKey` [JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey') {#Abblix.Oidc.Server.Features.DPoP.Proof.Proof(Abblix.Jwt.JsonWebToken,Abblix.Jwt.JsonWebKey,string,string,System.DateTimeOffset).ProofKey} The public\-only JWK from the proof header\. ###### `ProofKeyThumbprint` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.DPoP.Proof.Proof(Abblix.Jwt.JsonWebToken,Abblix.Jwt.JsonWebKey,string,string,System.DateTimeOffset).ProofKeyThumbprint} RFC 7638 base64url\-encoded JWK Thumbprint of [ProofKey](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DPoP.Proof#Abblix.Oidc.Server.Features.DPoP.Proof.Proof(Abblix.Jwt.JsonWebToken,Abblix.Jwt.JsonWebKey,string,string,System.DateTimeOffset).ProofKey 'Abblix\.Oidc\.Server\.Features\.DPoP\.Proof\.Proof\(Abblix\.Jwt\.JsonWebToken, Abblix\.Jwt\.JsonWebKey, string, string, System\.DateTimeOffset\)\.ProofKey')\. This is the value that goes into `cnf.jkt` on the issued access token \(RFC 9449 §6\.1\) \- the role\-name «proof key thumbprint» reflects the protocol\-level meaning, while the wire\-level cnf\-member retains the RFC's `jkt` spelling\. ###### `JwtId` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.DPoP.Proof.Proof(Abblix.Jwt.JsonWebToken,Abblix.Jwt.JsonWebKey,string,string,System.DateTimeOffset).JwtId} The `jti` claim of the proof\. The validator does not check it against any cache; the layered replay\-cache slice consumes this value\. ###### `IssuedAt` [System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset') {#Abblix.Oidc.Server.Features.DPoP.Proof.Proof(Abblix.Jwt.JsonWebToken,Abblix.Jwt.JsonWebKey,string,string,System.DateTimeOffset).IssuedAt} The `iat` claim of the proof, parsed from the JWT numeric\-date\. ### Properties ## Proof\.IssuedAt Property {#Abblix.Oidc.Server.Features.DPoP.Proof.IssuedAt} The `iat` claim of the proof, parsed from the JWT numeric\-date\. ```csharp public System.DateTimeOffset IssuedAt { get; init; } ``` #### Property Value [System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset') ## Proof\.JwtId Property {#Abblix.Oidc.Server.Features.DPoP.Proof.JwtId} The `jti` claim of the proof\. The validator does not check it against any cache; the layered replay\-cache slice consumes this value\. ```csharp public string JwtId { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## Proof\.ProofKey Property {#Abblix.Oidc.Server.Features.DPoP.Proof.ProofKey} The public\-only JWK from the proof header\. ```csharp public Abblix.Jwt.JsonWebKey ProofKey { get; init; } ``` #### Property Value [JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey') ## Proof\.ProofKeyThumbprint Property {#Abblix.Oidc.Server.Features.DPoP.Proof.ProofKeyThumbprint} RFC 7638 base64url\-encoded JWK Thumbprint of ProofKey\. This is the value that goes into `cnf.jkt` on the issued access token \(RFC 9449 §6\.1\) \- the role\-name «proof key thumbprint» reflects the protocol\-level meaning, while the wire\-level cnf\-member retains the RFC's `jkt` spelling\. ```csharp public string ProofKeyThumbprint { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## Proof\.Token Property {#Abblix.Oidc.Server.Features.DPoP.Proof.Token} The parsed proof JWT\. The validator already produced this object internally; carrying it through saves callers a re\-parse when they need claims outside the validator's contract \(notably DPoP\-Nonce checks layered on top\)\. ```csharp public Abblix.Jwt.JsonWebToken Token { get; init; } ``` #### Property Value [JsonWebToken](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebToken 'Abblix\.Jwt\.JsonWebToken') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DPoP.ProofError.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.DPoP](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DPoP 'Abblix\.Oidc\.Server\.Features\.DPoP') ## ProofError Class Describes why a DPoP proof was rejected\. [Reason](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DPoP.ProofError#Abblix.Oidc.Server.Features.DPoP.ProofError.Reason 'Abblix\.Oidc\.Server\.Features\.DPoP\.ProofError\.Reason') is a stable token suitable for log filters and metric labels; [Detail](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DPoP.ProofError#Abblix.Oidc.Server.Features.DPoP.ProofError.Detail 'Abblix\.Oidc\.Server\.Features\.DPoP\.ProofError\.Detail') is a human\-readable hint\. ```csharp public sealed record ProofError : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ProofError Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[ProofError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DPoP.ProofError 'Abblix\.Oidc\.Server\.Features\.DPoP\.ProofError')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Remarks [Detail](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DPoP.ProofError#Abblix.Oidc.Server.Features.DPoP.ProofError.Detail 'Abblix\.Oidc\.Server\.Features\.DPoP\.ProofError\.Detail') CAN carry what the client put in the token: the JWT core writes several of its descriptions by quoting the value it refused \- an unhandled `crit` name, an unregistered algorithm \- and this type passes those through unchanged\. An earlier version of this summary said the value must not contain such input, which made it read as safe to surface; it was already carrying it\. So the library puts it nowhere: no response, no log, no metric label. What a host reads off the [ProofError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DPoP.ProofError 'Abblix\.Oidc\.Server\.Features\.DPoP\.ProofError') its own call returned is its own to sanitise, and a host that copies it into a response is echoing the client's bytes. ### Constructors ## ProofError\(string, string\) Constructor {#Abblix.Oidc.Server.Features.DPoP.ProofError.ProofError(string,string)} Describes why a DPoP proof was rejected\. [Reason](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DPoP.ProofError#Abblix.Oidc.Server.Features.DPoP.ProofError.Reason 'Abblix\.Oidc\.Server\.Features\.DPoP\.ProofError\.Reason') is a stable token suitable for log filters and metric labels; [Detail](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DPoP.ProofError#Abblix.Oidc.Server.Features.DPoP.ProofError.Detail 'Abblix\.Oidc\.Server\.Features\.DPoP\.ProofError\.Detail') is a human\-readable hint\. ```csharp public ProofError(string Reason, string? Detail=null); ``` #### Parameters ###### `Reason` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.DPoP.ProofError.ProofError(string,string).Reason} A stable, machine\-friendly token \(e\.g\. `invalid_typ`, `signature_invalid`, `htm_mismatch`\)\. ###### `Detail` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.DPoP.ProofError.ProofError(string,string).Detail} Optional human\-readable diagnostic\. ### Remarks [Detail](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DPoP.ProofError#Abblix.Oidc.Server.Features.DPoP.ProofError.Detail 'Abblix\.Oidc\.Server\.Features\.DPoP\.ProofError\.Detail') CAN carry what the client put in the token: the JWT core writes several of its descriptions by quoting the value it refused \- an unhandled `crit` name, an unregistered algorithm \- and this type passes those through unchanged\. An earlier version of this summary said the value must not contain such input, which made it read as safe to surface; it was already carrying it\. So the library puts it nowhere: no response, no log, no metric label. What a host reads off the [ProofError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DPoP.ProofError 'Abblix\.Oidc\.Server\.Features\.DPoP\.ProofError') its own call returned is its own to sanitise, and a host that copies it into a response is echoing the client's bytes. ### Properties ## ProofError\.Detail Property {#Abblix.Oidc.Server.Features.DPoP.ProofError.Detail} Optional human\-readable diagnostic\. ```csharp public string? Detail { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ProofError\.Reason Property {#Abblix.Oidc.Server.Features.DPoP.ProofError.Reason} A stable, machine\-friendly token \(e\.g\. `invalid_typ`, `signature_invalid`, `htm_mismatch`\)\. ```csharp public string Reason { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DPoP.ProofErrorReasons.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.DPoP](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DPoP 'Abblix\.Oidc\.Server\.Features\.DPoP') ## ProofErrorReasons Class Stable, machine\-friendly reason tokens that [Abblix\.Oidc\.Server\.Features\.DPoP\.ProofValidator](https://learn.microsoft.com/en-us/dotnet/api/abblix.oidc.server.features.dpop.proofvalidator 'Abblix\.Oidc\.Server\.Features\.DPoP\.ProofValidator') assigns to [Reason](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DPoP.ProofError#Abblix.Oidc.Server.Features.DPoP.ProofError.Reason 'Abblix\.Oidc\.Server\.Features\.DPoP\.ProofError\.Reason') for log filters and metric labels\. These are the internal fine\-grained failure categories; the OAuth\-protocol\-level error code surfaced to clients is always `invalid_dpop_proof` \(or `use_dpop_nonce` for the nonce\-required path\) regardless of which of these matched\. ```csharp public static class ProofErrorReasons ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ProofErrorReasons ### Fields ## ProofErrorReasons\.AccessTokenHashMismatch Field {#Abblix.Oidc.Server.Features.DPoP.ProofErrorReasons.AccessTokenHashMismatch} Payload `ath` does not match `Base64Url(SHA-256(access_token))`\. ```csharp public const string AccessTokenHashMismatch = "ath_mismatch"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ProofErrorReasons\.AccessTokenHashMissing Field {#Abblix.Oidc.Server.Features.DPoP.ProofErrorReasons.AccessTokenHashMissing} Payload `ath` claim is required \(an access token is presented\) but missing\. ```csharp public const string AccessTokenHashMissing = "ath_missing"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ProofErrorReasons\.HttpMethodMismatch Field {#Abblix.Oidc.Server.Features.DPoP.ProofErrorReasons.HttpMethodMismatch} Payload `htm` does not match the request method\. ```csharp public const string HttpMethodMismatch = "htm_mismatch"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ProofErrorReasons\.HttpUriInvalid Field {#Abblix.Oidc.Server.Features.DPoP.ProofErrorReasons.HttpUriInvalid} Payload `htu` is not a valid absolute URI\. ```csharp public const string HttpUriInvalid = "htu_invalid"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ProofErrorReasons\.HttpUriMismatch Field {#Abblix.Oidc.Server.Features.DPoP.ProofErrorReasons.HttpUriMismatch} Payload `htu` does not match the request URI after RFC 3986 §6\.2 canonicalisation\. ```csharp public const string HttpUriMismatch = "htu_mismatch"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ProofErrorReasons\.HttpUriMissing Field {#Abblix.Oidc.Server.Features.DPoP.ProofErrorReasons.HttpUriMissing} Payload `htu` claim is missing\. ```csharp public const string HttpUriMissing = "htu_missing"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ProofErrorReasons\.InvalidAlgorithm Field {#Abblix.Oidc.Server.Features.DPoP.ProofErrorReasons.InvalidAlgorithm} Header `alg` is missing, not asymmetric, or not in the configured whitelist\. ```csharp public const string InvalidAlgorithm = "invalid_alg"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ProofErrorReasons\.InvalidHeader Field {#Abblix.Oidc.Server.Features.DPoP.ProofErrorReasons.InvalidHeader} A JOSE header parameter is malformed or violates a structural rule\. ```csharp public const string InvalidHeader = "invalid_header"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks Deliberately named for the header rather than for one member of it: this is what the JWT core's `InvalidHeader` becomes, and that category covers an unusable `jwk`, a `crit` that is malformed or names an extension nothing handles, and a header a trust model requires and the token omits\. Reporting all three as `invalid_jwk` told a client its key was bad over a `crit` it had written itself\. WHICH of the three happened is on [Detail](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DPoP.ProofError#Abblix.Oidc.Server.Features.DPoP.ProofError.Detail 'Abblix\.Oidc\.Server\.Features\.DPoP\.ProofError\.Detail') and goes no further - no response, no log, no metric label. That is a decision rather than an omission: two of the core's `crit` descriptions are written by quoting the token, so the value carries what the client put there, and the rest are constants that cannot be told apart from them at this seam. The cost is stated rather than hidden: for all three causes a client is told `invalid_header` and an operator's log line says the same, so nothing the library emits separates an unusable `jwk` from a bad `crit`. A host that wants the difference reads [Detail](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DPoP.ProofError#Abblix.Oidc.Server.Features.DPoP.ProofError.Detail 'Abblix\.Oidc\.Server\.Features\.DPoP\.ProofError\.Detail') off its own call - and sanitises it, because it may be the client's own bytes. ## ProofErrorReasons\.InvalidJwk Field {#Abblix.Oidc.Server.Features.DPoP.ProofErrorReasons.InvalidJwk} Header `jwk` is missing, malformed, or contains private\-key material\. ```csharp public const string InvalidJwk = "invalid_jwk"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks Only where THIS validator establishes it\. A refusal that came from the JWT core arrives under [InvalidHeader](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DPoP.ProofErrorReasons#Abblix.Oidc.Server.Features.DPoP.ProofErrorReasons.InvalidHeader 'Abblix\.Oidc\.Server\.Features\.DPoP\.ProofErrorReasons\.InvalidHeader') instead, because the core reports a bad `jwk`, a bad `crit` and a missing required header under one category and cannot tell a consumer which it met\. ## ProofErrorReasons\.InvalidTokenType Field {#Abblix.Oidc.Server.Features.DPoP.ProofErrorReasons.InvalidTokenType} Header `typ` is not `dpop+jwt`\. ```csharp public const string InvalidTokenType = "invalid_typ"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ProofErrorReasons\.IssuedAtInvalid Field {#Abblix.Oidc.Server.Features.DPoP.ProofErrorReasons.IssuedAtInvalid} Payload `iat` is not a Unix\-time numeric\. ```csharp public const string IssuedAtInvalid = "iat_invalid"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ProofErrorReasons\.IssuedAtMissing Field {#Abblix.Oidc.Server.Features.DPoP.ProofErrorReasons.IssuedAtMissing} Payload `iat` claim is missing\. ```csharp public const string IssuedAtMissing = "iat_missing"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ProofErrorReasons\.IssuedAtOutOfWindow Field {#Abblix.Oidc.Server.Features.DPoP.ProofErrorReasons.IssuedAtOutOfWindow} Payload `iat` falls outside the configured tolerance window around the current time\. ```csharp public const string IssuedAtOutOfWindow = "iat_out_of_window"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ProofErrorReasons\.JwtIdMissing Field {#Abblix.Oidc.Server.Features.DPoP.ProofErrorReasons.JwtIdMissing} Payload `jti` claim is missing\. ```csharp public const string JwtIdMissing = "jti_missing"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ProofErrorReasons\.MalformedJwt Field {#Abblix.Oidc.Server.Features.DPoP.ProofErrorReasons.MalformedJwt} JWS compact form is not three dot\-separated segments, base64url\-decode failed, or the header/payload is not a JSON object\. ```csharp public const string MalformedJwt = "malformed_jwt"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ProofErrorReasons\.ReplayDetected Field {#Abblix.Oidc.Server.Features.DPoP.ProofErrorReasons.ReplayDetected} Payload `jti` has already been used within the acceptance window\. ```csharp public const string ReplayDetected = "replay_detected"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## ProofErrorReasons\.SignatureInvalid Field {#Abblix.Oidc.Server.Features.DPoP.ProofErrorReasons.SignatureInvalid} JWS signature does not verify under the embedded `jwk`\. ```csharp public const string SignatureInvalid = "signature_invalid"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ExternalKeys.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ## Abblix\.Oidc\.Server\.Features\.ExternalKeys Namespace | Classes | | | :--- | :--- | | [ExternalKeysProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ExternalKeys.ExternalKeysProvider 'Abblix\.Oidc\.Server\.Features\.ExternalKeys\.ExternalKeysProvider') | Publishes the public halves of an [IKeyCustodian](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.IKeyCustodian 'Abblix\.Jwt\.ExternalKeys\.IKeyCustodian')'s signing and encryption keys to the OIDC pipeline, one entry per current key version\. It never returns private material: each key is public\-only, which is the signal the crypto seam reads to route the private operation to the custodian by `kid`\. Version\-awareness rides the produce/publish split of [IAuthServiceKeysProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IAuthServiceKeysProvider 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IAuthServiceKeysProvider'): every version is published \(so a client can verify a signature or encrypt a JWE to any of them, and a rotation overlaps\), while the ACTIVE version \- the newest one past the server's [KeyRolloverPropagation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions#Abblix.Oidc.Server.Common.Configuration.OidcOptions.KeyRolloverPropagation 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions\.KeyRolloverPropagation') window \- leads the set, so the produce role signs and encrypts with it\. A freshly rotated version stays announced \(published, trailing\) until it clears the window, so a client that has not refreshed its JWKS cache never sees a token produced with a version it lacks\. One provider serves any custodian, so the Vault and Azure packages carry no key provider of their own\. | --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ExternalKeys.ExternalKeysProvider.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.ExternalKeys](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ExternalKeys 'Abblix\.Oidc\.Server\.Features\.ExternalKeys') ## ExternalKeysProvider Class Publishes the public halves of an [IKeyCustodian](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.IKeyCustodian 'Abblix\.Jwt\.ExternalKeys\.IKeyCustodian')'s signing and encryption keys to the OIDC pipeline, one entry per current key version\. It never returns private material: each key is public\-only, which is the signal the crypto seam reads to route the private operation to the custodian by `kid`\. Version\-awareness rides the produce/publish split of [IAuthServiceKeysProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IAuthServiceKeysProvider 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IAuthServiceKeysProvider'): every version is published \(so a client can verify a signature or encrypt a JWE to any of them, and a rotation overlaps\), while the ACTIVE version \- the newest one past the server's [KeyRolloverPropagation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions#Abblix.Oidc.Server.Common.Configuration.OidcOptions.KeyRolloverPropagation 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions\.KeyRolloverPropagation') window \- leads the set, so the produce role signs and encrypts with it\. A freshly rotated version stays announced \(published, trailing\) until it clears the window, so a client that has not refreshed its JWKS cache never sees a token produced with a version it lacks\. One provider serves any custodian, so the Vault and Azure packages carry no key provider of their own\. ```csharp public sealed class ExternalKeysProvider : Abblix.Oidc.Server.Common.Interfaces.IAuthServiceKeysProvider ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ExternalKeysProvider Implements [IAuthServiceKeysProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IAuthServiceKeysProvider 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IAuthServiceKeysProvider') ### Constructors ## ExternalKeysProvider\(IKeyCustodian, CustodianHeldKeys, IOptions\, TimeProvider\) Constructor {#Abblix.Oidc.Server.Features.ExternalKeys.ExternalKeysProvider.ExternalKeysProvider(Abblix.Jwt.ExternalKeys.IKeyCustodian,Abblix.Jwt.ExternalKeys.CustodianHeldKeys,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,System.TimeProvider)} Publishes the public halves of an [IKeyCustodian](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.IKeyCustodian 'Abblix\.Jwt\.ExternalKeys\.IKeyCustodian')'s signing and encryption keys to the OIDC pipeline, one entry per current key version\. It never returns private material: each key is public\-only, which is the signal the crypto seam reads to route the private operation to the custodian by `kid`\. Version\-awareness rides the produce/publish split of [IAuthServiceKeysProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IAuthServiceKeysProvider 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IAuthServiceKeysProvider'): every version is published \(so a client can verify a signature or encrypt a JWE to any of them, and a rotation overlaps\), while the ACTIVE version \- the newest one past the server's [KeyRolloverPropagation](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions#Abblix.Oidc.Server.Common.Configuration.OidcOptions.KeyRolloverPropagation 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions\.KeyRolloverPropagation') window \- leads the set, so the produce role signs and encrypts with it\. A freshly rotated version stays announced \(published, trailing\) until it clears the window, so a client that has not refreshed its JWKS cache never sees a token produced with a version it lacks\. One provider serves any custodian, so the Vault and Azure packages carry no key provider of their own\. ```csharp public ExternalKeysProvider(Abblix.Jwt.ExternalKeys.IKeyCustodian custodian, Abblix.Jwt.ExternalKeys.CustodianHeldKeys keys, Microsoft.Extensions.Options.IOptions options, System.TimeProvider timeProvider); ``` #### Parameters ###### `custodian` [IKeyCustodian](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.IKeyCustodian 'Abblix\.Jwt\.ExternalKeys\.IKeyCustodian') {#Abblix.Oidc.Server.Features.ExternalKeys.ExternalKeysProvider.ExternalKeysProvider(Abblix.Jwt.ExternalKeys.IKeyCustodian,Abblix.Jwt.ExternalKeys.CustodianHeldKeys,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,System.TimeProvider).custodian} ###### `keys` [CustodianHeldKeys](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.CustodianHeldKeys 'Abblix\.Jwt\.ExternalKeys\.CustodianHeldKeys') {#Abblix.Oidc.Server.Features.ExternalKeys.ExternalKeysProvider.ExternalKeysProvider(Abblix.Jwt.ExternalKeys.IKeyCustodian,Abblix.Jwt.ExternalKeys.CustodianHeldKeys,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,System.TimeProvider).keys} ###### `options` [Microsoft\.Extensions\.Options\.IOptions<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptions-1 'Microsoft\.Extensions\.Options\.IOptions\`1')[OidcOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptions-1 'Microsoft\.Extensions\.Options\.IOptions\`1') {#Abblix.Oidc.Server.Features.ExternalKeys.ExternalKeysProvider.ExternalKeysProvider(Abblix.Jwt.ExternalKeys.IKeyCustodian,Abblix.Jwt.ExternalKeys.CustodianHeldKeys,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,System.TimeProvider).options} ###### `timeProvider` [System\.TimeProvider](https://learn.microsoft.com/en-us/dotnet/api/system.timeprovider 'System\.TimeProvider') {#Abblix.Oidc.Server.Features.ExternalKeys.ExternalKeysProvider.ExternalKeysProvider(Abblix.Jwt.ExternalKeys.IKeyCustodian,Abblix.Jwt.ExternalKeys.CustodianHeldKeys,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,System.TimeProvider).timeProvider} ### Methods ## ExternalKeysProvider\.GetEncryptionKeys\(bool\) Method {#Abblix.Oidc.Server.Features.ExternalKeys.ExternalKeysProvider.GetEncryptionKeys(bool)} Gets the encryption keys used by the service\. The first key per algorithm is the one it encrypts outbound tokens with; the rest are published so inbound JWE can be decrypted and to overlap a rotation\. See the ordering note in the interface remarks\. ```csharp public System.Collections.Generic.IAsyncEnumerable GetEncryptionKeys(bool includePrivateKeys=false); ``` #### Parameters ###### `includePrivateKeys` [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') {#Abblix.Oidc.Server.Features.ExternalKeys.ExternalKeysProvider.GetEncryptionKeys(bool).includePrivateKeys} Whether to include private keys in the result\. Implements [GetEncryptionKeys\(bool\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IAuthServiceKeysProvider#Abblix.Oidc.Server.Common.Interfaces.IAuthServiceKeysProvider.GetEncryptionKeys(bool) 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IAuthServiceKeysProvider\.GetEncryptionKeys\(bool\)') #### Returns [System\.Collections\.Generic\.IAsyncEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.iasyncenumerable-1 'System\.Collections\.Generic\.IAsyncEnumerable\`1')[JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.iasyncenumerable-1 'System\.Collections\.Generic\.IAsyncEnumerable\`1') ## ExternalKeysProvider\.GetSigningKeys\(bool\) Method {#Abblix.Oidc.Server.Features.ExternalKeys.ExternalKeysProvider.GetSigningKeys(bool)} Gets the signing keys used by the service\. The first key per algorithm is the one it signs with; the rest are published for verification and to overlap a rotation\. See the ordering note in the interface remarks\. ```csharp public System.Collections.Generic.IAsyncEnumerable GetSigningKeys(bool includePrivateKeys=false); ``` #### Parameters ###### `includePrivateKeys` [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') {#Abblix.Oidc.Server.Features.ExternalKeys.ExternalKeysProvider.GetSigningKeys(bool).includePrivateKeys} Whether to include private keys in the result\. Implements [GetSigningKeys\(bool\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IAuthServiceKeysProvider#Abblix.Oidc.Server.Common.Interfaces.IAuthServiceKeysProvider.GetSigningKeys(bool) 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IAuthServiceKeysProvider\.GetSigningKeys\(bool\)') #### Returns [System\.Collections\.Generic\.IAsyncEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.iasyncenumerable-1 'System\.Collections\.Generic\.IAsyncEnumerable\`1')[JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.iasyncenumerable-1 'System\.Collections\.Generic\.IAsyncEnumerable\`1') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Hashing.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ## Abblix\.Oidc\.Server\.Features\.Hashing Namespace | Classes | | | :--- | :--- | | [HashService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Hashing.HashService 'Abblix\.Oidc\.Server\.Features\.Hashing\.HashService') | Provides hashing functionality for various types of data, including but not limited to client secrets, in OAuth 2\.0 and OpenID Connect authentication flows\. This class supports SHA\-256 and SHA\-512 hashing algorithms to securely hash data\. | | Interfaces | | | :--- | :--- | | [IHashService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Hashing.IHashService 'Abblix\.Oidc\.Server\.Features\.Hashing\.IHashService') | Offers hashing functionality for data using various Secure Hash Algorithms \(SHA\)\. This service is essential for securely storing and comparing sensitive information like passwords or client secrets without exposing the actual values\. | | Enums | | | :--- | :--- | | [HashAlgorithm](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Hashing.HashAlgorithm 'Abblix\.Oidc\.Server\.Features\.Hashing\.HashAlgorithm') | Specifies the hash algorithms supported for hashing operations\. | --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Hashing.HashAlgorithm.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.Hashing](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Hashing 'Abblix\.Oidc\.Server\.Features\.Hashing') ## HashAlgorithm Enum Specifies the hash algorithms supported for hashing operations\. ```csharp public enum HashAlgorithm ``` ### Fields ###### `Sha256` 0 {#Abblix.Oidc.Server.Features.Hashing.HashAlgorithm.Sha256} Represents the SHA\-256 hash algorithm\. SHA\-256 \(Secure Hash Algorithm 256\-bit\) is a cryptographic hash function that produces a 256\-bit hash value, widely used for data integrity verification\. ###### `Sha512` 1 {#Abblix.Oidc.Server.Features.Hashing.HashAlgorithm.Sha512} Represents the SHA\-512 hash algorithm\. SHA\-512 \(Secure Hash Algorithm 512\-bit\) is a cryptographic hash function that produces a 512\-bit hash value\. It is used in various security applications and protocols, including TLS and SSL, PGP, SSH, and IPsec\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Hashing.HashService.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.Hashing](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Hashing 'Abblix\.Oidc\.Server\.Features\.Hashing') ## HashService Class Provides hashing functionality for various types of data, including but not limited to client secrets, in OAuth 2\.0 and OpenID Connect authentication flows\. This class supports SHA\-256 and SHA\-512 hashing algorithms to securely hash data\. ```csharp public class HashService : Abblix.Oidc.Server.Features.Hashing.IHashService ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → HashService Implements [IHashService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Hashing.IHashService 'Abblix\.Oidc\.Server\.Features\.Hashing\.IHashService') ### Remarks Hashing data, especially secrets, enhances privacy and security by ensuring that only a hashed version of the data is stored\. In the event of a data breach, attackers cannot access the actual data, such as client secrets, thereby reducing the risk of exploitation\. ### Methods ## HashService\.Sha\(HashAlgorithm, string\) Method {#Abblix.Oidc.Server.Features.Hashing.HashService.Sha(Abblix.Oidc.Server.Features.Hashing.HashAlgorithm,string)} Computes a hash for the provided data using the specified hash algorithm\. ```csharp public byte[] Sha(Abblix.Oidc.Server.Features.Hashing.HashAlgorithm algorithm, string data); ``` #### Parameters ###### `algorithm` [HashAlgorithm](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Hashing.HashAlgorithm 'Abblix\.Oidc\.Server\.Features\.Hashing\.HashAlgorithm') {#Abblix.Oidc.Server.Features.Hashing.HashService.Sha(Abblix.Oidc.Server.Features.Hashing.HashAlgorithm,string).algorithm} The hash algorithm to use \(e\.g\., SHA\-256 or SHA\-512\)\. ###### `data` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.Hashing.HashService.Sha(Abblix.Oidc.Server.Features.Hashing.HashAlgorithm,string).data} The data to hash\. Implements [Sha\(HashAlgorithm, string\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Hashing.IHashService#Abblix.Oidc.Server.Features.Hashing.IHashService.Sha(Abblix.Oidc.Server.Features.Hashing.HashAlgorithm,string) 'Abblix\.Oidc\.Server\.Features\.Hashing\.IHashService\.Sha\(Abblix\.Oidc\.Server\.Features\.Hashing\.HashAlgorithm, string\)') #### Returns [System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') A byte array containing the hash of the data\. #### Exceptions [System\.ArgumentOutOfRangeException](https://learn.microsoft.com/en-us/dotnet/api/system.argumentoutofrangeexception 'System\.ArgumentOutOfRangeException') Thrown when the specified hash algorithm is not supported\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Hashing.IHashService.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.Hashing](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Hashing 'Abblix\.Oidc\.Server\.Features\.Hashing') ## IHashService Interface Offers hashing functionality for data using various Secure Hash Algorithms \(SHA\)\. This service is essential for securely storing and comparing sensitive information like passwords or client secrets without exposing the actual values\. ```csharp public interface IHashService ``` Derived ↳ [HashService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Hashing.HashService 'Abblix\.Oidc\.Server\.Features\.Hashing\.HashService') ### Methods ## IHashService\.Sha\(HashAlgorithm, string\) Method {#Abblix.Oidc.Server.Features.Hashing.IHashService.Sha(Abblix.Oidc.Server.Features.Hashing.HashAlgorithm,string)} Generates a hash for the specified data using a chosen SHA algorithm\. This method provides a way to securely hash sensitive data, such as secrets or passwords, ensuring that the original data cannot be easily derived from the hash\. ```csharp byte[] Sha(Abblix.Oidc.Server.Features.Hashing.HashAlgorithm algorithm, string data); ``` #### Parameters ###### `algorithm` [HashAlgorithm](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Hashing.HashAlgorithm 'Abblix\.Oidc\.Server\.Features\.Hashing\.HashAlgorithm') {#Abblix.Oidc.Server.Features.Hashing.IHashService.Sha(Abblix.Oidc.Server.Features.Hashing.HashAlgorithm,string).algorithm} Specifies the SHA algorithm to use for hashing, such as SHA\-256 or SHA\-512\. ###### `data` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.Hashing.IHashService.Sha(Abblix.Oidc.Server.Features.Hashing.HashAlgorithm,string).data} The data to hash\. Typically, this is sensitive information that needs secure handling\. #### Returns [System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') A byte array containing the hash of the input data\. ### Remarks It is crucial to select an appropriate SHA algorithm based on security requirements and performance considerations\. The hash output is ideal for verifying data integrity and authenticating users or clients without storing or transmitting sensitive plain\-text data\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ImplicitFlow.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ## Abblix\.Oidc\.Server\.Features\.ImplicitFlow Namespace | Classes | | | :--- | :--- | | [IdTokenResponseBuilder](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ImplicitFlow.IdTokenResponseBuilder 'Abblix\.Oidc\.Server\.Features\.ImplicitFlow\.IdTokenResponseBuilder') | Builds the `id_token` response\-type component of an authorization endpoint success response \- the OIDC identity\-token contributor of the Implicit / Hybrid Flow\. Generates an ID token via [IIdentityTokenService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.IIdentityTokenService 'Abblix\.Oidc\.Server\.Features\.Tokens\.IIdentityTokenService') and stores it on the running [SuccessfullyAuthenticated](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.SuccessfullyAuthenticated') result\. Registered ONLY when a host calls `EnableImplicitFlow()`; absent by default per OAuth 2\.1 \(draft\) deprecation guidance\. Declares `implicit` in [GrantTypesSupported](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ImplicitFlow.IdTokenResponseBuilder#Abblix.Oidc.Server.Features.ImplicitFlow.IdTokenResponseBuilder.GrantTypesSupported 'Abblix\.Oidc\.Server\.Features\.ImplicitFlow\.IdTokenResponseBuilder\.GrantTypesSupported') so opting in surfaces the implicit grant in discovery and registration\-time gating without extra DI wiring\. | | [ServiceCollectionExtensions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ImplicitFlow.ServiceCollectionExtensions 'Abblix\.Oidc\.Server\.Features\.ImplicitFlow\.ServiceCollectionExtensions') | DI extensions that opt the host into the OAuth 2\.0 / OIDC Implicit and Hybrid Flows\. | | [TokenResponseBuilder](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ImplicitFlow.TokenResponseBuilder 'Abblix\.Oidc\.Server\.Features\.ImplicitFlow\.TokenResponseBuilder') | Builds the `token` response\-type component of an authorization endpoint success response \- the access\-token contributor of the Implicit / Hybrid Flow\. Generates an access token via [IAccessTokenService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.IAccessTokenService 'Abblix\.Oidc\.Server\.Features\.Tokens\.IAccessTokenService') and stores it on the running [SuccessfullyAuthenticated](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.SuccessfullyAuthenticated') result\. Registered ONLY when a host calls `EnableImplicitFlow()`; absent by default per OAuth 2\.1 \(draft\) deprecation guidance\. Declares `implicit` in [GrantTypesSupported](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ImplicitFlow.TokenResponseBuilder#Abblix.Oidc.Server.Features.ImplicitFlow.TokenResponseBuilder.GrantTypesSupported 'Abblix\.Oidc\.Server\.Features\.ImplicitFlow\.TokenResponseBuilder\.GrantTypesSupported') so opting in surfaces the implicit grant in discovery and registration\-time gating without extra DI wiring\. | --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ImplicitFlow.IdTokenResponseBuilder.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.ImplicitFlow](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ImplicitFlow 'Abblix\.Oidc\.Server\.Features\.ImplicitFlow') ## IdTokenResponseBuilder Class Builds the `id_token` response\-type component of an authorization endpoint success response \- the OIDC identity\-token contributor of the Implicit / Hybrid Flow\. Generates an ID token via [IIdentityTokenService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.IIdentityTokenService 'Abblix\.Oidc\.Server\.Features\.Tokens\.IIdentityTokenService') and stores it on the running [SuccessfullyAuthenticated](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.SuccessfullyAuthenticated') result\. Registered ONLY when a host calls `EnableImplicitFlow()`; absent by default per OAuth 2\.1 \(draft\) deprecation guidance\. Declares `implicit` in [GrantTypesSupported](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ImplicitFlow.IdTokenResponseBuilder#Abblix.Oidc.Server.Features.ImplicitFlow.IdTokenResponseBuilder.GrantTypesSupported 'Abblix\.Oidc\.Server\.Features\.ImplicitFlow\.IdTokenResponseBuilder\.GrantTypesSupported') so opting in surfaces the implicit grant in discovery and registration\-time gating without extra DI wiring\. ```csharp public class IdTokenResponseBuilder : Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseBuilder, Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → IdTokenResponseBuilder Implements [IAuthorizationResponseBuilder](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseBuilder 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.IAuthorizationResponseBuilder'), [IGrantTypeInformer](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IGrantTypeInformer') ### Remarks This builder is order\-dependent: it reads [Code](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated.Code 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.SuccessfullyAuthenticated\.Code') and [AccessToken](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated.AccessToken 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.SuccessfullyAuthenticated\.AccessToken') populated by earlier builders to compute the `c_hash` and `at_hash` claims when those response components are present\. The orchestrator iterates response\-type parts in canonical order \(`code` → `token` → `id_token`\) so this dependency holds without explicit sequencing on the builder side\. ### Constructors ## IdTokenResponseBuilder\(IIdentityTokenService\) Constructor {#Abblix.Oidc.Server.Features.ImplicitFlow.IdTokenResponseBuilder.IdTokenResponseBuilder(Abblix.Oidc.Server.Features.Tokens.IIdentityTokenService)} Builds the `id_token` response\-type component of an authorization endpoint success response \- the OIDC identity\-token contributor of the Implicit / Hybrid Flow\. Generates an ID token via [IIdentityTokenService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.IIdentityTokenService 'Abblix\.Oidc\.Server\.Features\.Tokens\.IIdentityTokenService') and stores it on the running [SuccessfullyAuthenticated](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.SuccessfullyAuthenticated') result\. Registered ONLY when a host calls `EnableImplicitFlow()`; absent by default per OAuth 2\.1 \(draft\) deprecation guidance\. Declares `implicit` in [GrantTypesSupported](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ImplicitFlow.IdTokenResponseBuilder#Abblix.Oidc.Server.Features.ImplicitFlow.IdTokenResponseBuilder.GrantTypesSupported 'Abblix\.Oidc\.Server\.Features\.ImplicitFlow\.IdTokenResponseBuilder\.GrantTypesSupported') so opting in surfaces the implicit grant in discovery and registration\-time gating without extra DI wiring\. ```csharp public IdTokenResponseBuilder(Abblix.Oidc.Server.Features.Tokens.IIdentityTokenService identityTokenService); ``` #### Parameters ###### `identityTokenService` [IIdentityTokenService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.IIdentityTokenService 'Abblix\.Oidc\.Server\.Features\.Tokens\.IIdentityTokenService') {#Abblix.Oidc.Server.Features.ImplicitFlow.IdTokenResponseBuilder.IdTokenResponseBuilder(Abblix.Oidc.Server.Features.Tokens.IIdentityTokenService).identityTokenService} ### Remarks This builder is order\-dependent: it reads [Code](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated.Code 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.SuccessfullyAuthenticated\.Code') and [AccessToken](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated.AccessToken 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.SuccessfullyAuthenticated\.AccessToken') populated by earlier builders to compute the `c_hash` and `at_hash` claims when those response components are present\. The orchestrator iterates response\-type parts in canonical order \(`code` → `token` → `id_token`\) so this dependency holds without explicit sequencing on the builder side\. ### Properties ## IdTokenResponseBuilder\.GrantTypesSupported Property {#Abblix.Oidc.Server.Features.ImplicitFlow.IdTokenResponseBuilder.GrantTypesSupported} The grant types supported by this component, as defined in OAuth 2\.0 and OpenID Connect specifications\. ```csharp public System.Collections.Generic.IEnumerable GrantTypesSupported { get; } ``` Implements [GrantTypesSupported](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer#Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer.GrantTypesSupported 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IGrantTypeInformer\.GrantTypesSupported') #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ### Remarks Common grant types include: - "authorization_code" - Authorization Code Grant - "implicit" - Implicit Grant - "refresh_token" - Refresh Token Grant - "client_credentials" - Client Credentials Grant - "password" - Resource Owner Password Credentials Grant ## IdTokenResponseBuilder\.ResponseType Property {#Abblix.Oidc.Server.Features.ImplicitFlow.IdTokenResponseBuilder.ResponseType} The single OAuth 2\.0 / OIDC response\-type value this processor is responsible for, matched case\-sensitively against parts of the request's `response_type`\. ```csharp public string ResponseType { get; } ``` Implements [ResponseType](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseBuilder#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseBuilder.ResponseType 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.IAuthorizationResponseBuilder\.ResponseType') #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Methods ## IdTokenResponseBuilder\.BuildResponseAsync\(ValidAuthorizationRequest, AuthorizedGrant, SuccessfullyAuthenticated\) Method {#Abblix.Oidc.Server.Features.ImplicitFlow.IdTokenResponseBuilder.BuildResponseAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest,Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant,Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated)} Populates the relevant field on [result](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ImplicitFlow.IdTokenResponseBuilder#Abblix.Oidc.Server.Features.ImplicitFlow.IdTokenResponseBuilder.BuildResponseAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest,Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant,Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated).result 'Abblix\.Oidc\.Server\.Features\.ImplicitFlow\.IdTokenResponseBuilder\.BuildResponseAsync\(Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.ValidAuthorizationRequest, Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.AuthorizedGrant, Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.SuccessfullyAuthenticated\)\.result') for this processor's response type\. Implementations mutate [result](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ImplicitFlow.IdTokenResponseBuilder#Abblix.Oidc.Server.Features.ImplicitFlow.IdTokenResponseBuilder.BuildResponseAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest,Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant,Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated).result 'Abblix\.Oidc\.Server\.Features\.ImplicitFlow\.IdTokenResponseBuilder\.BuildResponseAsync\(Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.ValidAuthorizationRequest, Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.AuthorizedGrant, Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.SuccessfullyAuthenticated\)\.result') in place and may read fields populated by processors that ran earlier in the canonical iteration order \(`code` before `token` before `id_token`\)\. ```csharp public System.Threading.Tasks.Task BuildResponseAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest request, Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant authorizedGrant, Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated result); ``` #### Parameters ###### `request` [ValidAuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.ValidAuthorizationRequest') {#Abblix.Oidc.Server.Features.ImplicitFlow.IdTokenResponseBuilder.BuildResponseAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest,Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant,Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated).request} ###### `authorizedGrant` [AuthorizedGrant](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.AuthorizedGrant') {#Abblix.Oidc.Server.Features.ImplicitFlow.IdTokenResponseBuilder.BuildResponseAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest,Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant,Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated).authorizedGrant} ###### `result` [SuccessfullyAuthenticated](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.SuccessfullyAuthenticated') {#Abblix.Oidc.Server.Features.ImplicitFlow.IdTokenResponseBuilder.BuildResponseAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest,Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant,Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated).result} Implements [BuildResponseAsync\(ValidAuthorizationRequest, AuthorizedGrant, SuccessfullyAuthenticated\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseBuilder#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseBuilder.BuildResponseAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest,Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant,Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated) 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.IAuthorizationResponseBuilder\.BuildResponseAsync\(Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.ValidAuthorizationRequest, Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.AuthorizedGrant, Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.SuccessfullyAuthenticated\)') #### Returns [System\.Threading\.Tasks\.Task](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task 'System\.Threading\.Tasks\.Task') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ImplicitFlow.ServiceCollectionExtensions.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.ImplicitFlow](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ImplicitFlow 'Abblix\.Oidc\.Server\.Features\.ImplicitFlow') ## ServiceCollectionExtensions Class DI extensions that opt the host into the OAuth 2\.0 / OIDC Implicit and Hybrid Flows\. ```csharp public static class ServiceCollectionExtensions ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ServiceCollectionExtensions ### Methods ## ServiceCollectionExtensions\.EnableImplicitFlow\(this IServiceCollection\) Method {#Abblix.Oidc.Server.Features.ImplicitFlow.ServiceCollectionExtensions.EnableImplicitFlow(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection)} Enables support for the Implicit and Hybrid Flows by registering the response\-type processors that emit access tokens and ID tokens directly from the authorization endpoint\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection EnableImplicitFlow(this Microsoft.Extensions.DependencyInjection.IServiceCollection services); ``` #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.Oidc.Server.Features.ImplicitFlow.ServiceCollectionExtensions.EnableImplicitFlow(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).services} The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') to register the Implicit / Hybrid response\-type processors in\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') so additional calls can be chained\. ### Remarks OAuth 2\.1 \(draft\) deprecates the Implicit Grant\. By default this library does not register the `token` or `id_token` response\-type processors, so the authorization endpoint rejects requests for those response types with `unsupported_response_type` and the discovery document advertises only `code` in `response_types_supported` and omits `implicit` from `grant_types_supported`\. Hosts that still need Implicit or Hybrid \(legacy SPAs, transition deployments\) make a deliberate decision to opt in via this method, mirroring the `EnablePasswordGrant` precedent for ROPC\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ImplicitFlow.TokenResponseBuilder.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.ImplicitFlow](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ImplicitFlow 'Abblix\.Oidc\.Server\.Features\.ImplicitFlow') ## TokenResponseBuilder Class Builds the `token` response\-type component of an authorization endpoint success response \- the access\-token contributor of the Implicit / Hybrid Flow\. Generates an access token via [IAccessTokenService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.IAccessTokenService 'Abblix\.Oidc\.Server\.Features\.Tokens\.IAccessTokenService') and stores it on the running [SuccessfullyAuthenticated](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.SuccessfullyAuthenticated') result\. Registered ONLY when a host calls `EnableImplicitFlow()`; absent by default per OAuth 2\.1 \(draft\) deprecation guidance\. Declares `implicit` in [GrantTypesSupported](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ImplicitFlow.TokenResponseBuilder#Abblix.Oidc.Server.Features.ImplicitFlow.TokenResponseBuilder.GrantTypesSupported 'Abblix\.Oidc\.Server\.Features\.ImplicitFlow\.TokenResponseBuilder\.GrantTypesSupported') so opting in surfaces the implicit grant in discovery and registration\-time gating without extra DI wiring\. ```csharp public class TokenResponseBuilder : Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseBuilder, Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → TokenResponseBuilder Implements [IAuthorizationResponseBuilder](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseBuilder 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.IAuthorizationResponseBuilder'), [IGrantTypeInformer](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IGrantTypeInformer') ### Constructors ## TokenResponseBuilder\(IAccessTokenService\) Constructor {#Abblix.Oidc.Server.Features.ImplicitFlow.TokenResponseBuilder.TokenResponseBuilder(Abblix.Oidc.Server.Features.Tokens.IAccessTokenService)} Builds the `token` response\-type component of an authorization endpoint success response \- the access\-token contributor of the Implicit / Hybrid Flow\. Generates an access token via [IAccessTokenService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.IAccessTokenService 'Abblix\.Oidc\.Server\.Features\.Tokens\.IAccessTokenService') and stores it on the running [SuccessfullyAuthenticated](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.SuccessfullyAuthenticated') result\. Registered ONLY when a host calls `EnableImplicitFlow()`; absent by default per OAuth 2\.1 \(draft\) deprecation guidance\. Declares `implicit` in [GrantTypesSupported](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ImplicitFlow.TokenResponseBuilder#Abblix.Oidc.Server.Features.ImplicitFlow.TokenResponseBuilder.GrantTypesSupported 'Abblix\.Oidc\.Server\.Features\.ImplicitFlow\.TokenResponseBuilder\.GrantTypesSupported') so opting in surfaces the implicit grant in discovery and registration\-time gating without extra DI wiring\. ```csharp public TokenResponseBuilder(Abblix.Oidc.Server.Features.Tokens.IAccessTokenService accessTokenService); ``` #### Parameters ###### `accessTokenService` [IAccessTokenService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.IAccessTokenService 'Abblix\.Oidc\.Server\.Features\.Tokens\.IAccessTokenService') {#Abblix.Oidc.Server.Features.ImplicitFlow.TokenResponseBuilder.TokenResponseBuilder(Abblix.Oidc.Server.Features.Tokens.IAccessTokenService).accessTokenService} ### Properties ## TokenResponseBuilder\.GrantTypesSupported Property {#Abblix.Oidc.Server.Features.ImplicitFlow.TokenResponseBuilder.GrantTypesSupported} The grant types supported by this component, as defined in OAuth 2\.0 and OpenID Connect specifications\. ```csharp public System.Collections.Generic.IEnumerable GrantTypesSupported { get; } ``` Implements [GrantTypesSupported](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer#Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer.GrantTypesSupported 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IGrantTypeInformer\.GrantTypesSupported') #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ### Remarks Common grant types include: - "authorization_code" - Authorization Code Grant - "implicit" - Implicit Grant - "refresh_token" - Refresh Token Grant - "client_credentials" - Client Credentials Grant - "password" - Resource Owner Password Credentials Grant ## TokenResponseBuilder\.ResponseType Property {#Abblix.Oidc.Server.Features.ImplicitFlow.TokenResponseBuilder.ResponseType} The single OAuth 2\.0 / OIDC response\-type value this processor is responsible for, matched case\-sensitively against parts of the request's `response_type`\. ```csharp public string ResponseType { get; } ``` Implements [ResponseType](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseBuilder#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseBuilder.ResponseType 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.IAuthorizationResponseBuilder\.ResponseType') #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Methods ## TokenResponseBuilder\.BuildResponseAsync\(ValidAuthorizationRequest, AuthorizedGrant, SuccessfullyAuthenticated\) Method {#Abblix.Oidc.Server.Features.ImplicitFlow.TokenResponseBuilder.BuildResponseAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest,Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant,Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated)} Populates the relevant field on [result](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ImplicitFlow.TokenResponseBuilder#Abblix.Oidc.Server.Features.ImplicitFlow.TokenResponseBuilder.BuildResponseAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest,Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant,Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated).result 'Abblix\.Oidc\.Server\.Features\.ImplicitFlow\.TokenResponseBuilder\.BuildResponseAsync\(Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.ValidAuthorizationRequest, Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.AuthorizedGrant, Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.SuccessfullyAuthenticated\)\.result') for this processor's response type\. Implementations mutate [result](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ImplicitFlow.TokenResponseBuilder#Abblix.Oidc.Server.Features.ImplicitFlow.TokenResponseBuilder.BuildResponseAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest,Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant,Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated).result 'Abblix\.Oidc\.Server\.Features\.ImplicitFlow\.TokenResponseBuilder\.BuildResponseAsync\(Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.ValidAuthorizationRequest, Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.AuthorizedGrant, Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.SuccessfullyAuthenticated\)\.result') in place and may read fields populated by processors that ran earlier in the canonical iteration order \(`code` before `token` before `id_token`\)\. ```csharp public System.Threading.Tasks.Task BuildResponseAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest request, Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant authorizedGrant, Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated result); ``` #### Parameters ###### `request` [ValidAuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.ValidAuthorizationRequest') {#Abblix.Oidc.Server.Features.ImplicitFlow.TokenResponseBuilder.BuildResponseAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest,Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant,Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated).request} ###### `authorizedGrant` [AuthorizedGrant](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.AuthorizedGrant') {#Abblix.Oidc.Server.Features.ImplicitFlow.TokenResponseBuilder.BuildResponseAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest,Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant,Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated).authorizedGrant} ###### `result` [SuccessfullyAuthenticated](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.SuccessfullyAuthenticated') {#Abblix.Oidc.Server.Features.ImplicitFlow.TokenResponseBuilder.BuildResponseAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest,Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant,Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated).result} Implements [BuildResponseAsync\(ValidAuthorizationRequest, AuthorizedGrant, SuccessfullyAuthenticated\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseBuilder#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseBuilder.BuildResponseAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest,Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant,Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated) 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.IAuthorizationResponseBuilder\.BuildResponseAsync\(Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.ValidAuthorizationRequest, Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.AuthorizedGrant, Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.SuccessfullyAuthenticated\)') #### Returns [System\.Threading\.Tasks\.Task](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task 'System\.Threading\.Tasks\.Task') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Issuer.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ## Abblix\.Oidc\.Server\.Features\.Issuer Namespace | Interfaces | | | :--- | :--- | | [IIssuerProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Issuer.IIssuerProvider 'Abblix\.Oidc\.Server\.Features\.Issuer\.IIssuerProvider') | Provides a mechanism to retrieve the issuer identifier for the OpenID Connect provider\. The issuer identifier is a fundamental part of the token validation process, as it indicates the origin of the token\. | --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Issuer.IIssuerProvider.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.Issuer](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Issuer 'Abblix\.Oidc\.Server\.Features\.Issuer') ## IIssuerProvider Interface Provides a mechanism to retrieve the issuer identifier for the OpenID Connect provider\. The issuer identifier is a fundamental part of the token validation process, as it indicates the origin of the token\. ```csharp public interface IIssuerProvider ``` ### Methods ## IIssuerProvider\.GetIssuer\(\) Method {#Abblix.Oidc.Server.Features.Issuer.IIssuerProvider.GetIssuer()} Retrieves the issuer identifier that represents the OpenID Connect provider\. This identifier is used in various OpenID Connect responses and tokens to ensure the identity of the issuing server\. ```csharp string GetIssuer(); ``` #### Returns [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') A string representing the issuer identifier\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.JwtBearer.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ## Abblix\.Oidc\.Server\.Features\.JwtBearer Namespace | Classes | | | :--- | :--- | | [DistributedJwtReplayCache](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.JwtBearer.DistributedJwtReplayCache 'Abblix\.Oidc\.Server\.Features\.JwtBearer\.DistributedJwtReplayCache') | Backward\-compat adapter from the legacy two\-step [IJwtReplayCache](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.JwtBearer.IJwtReplayCache 'Abblix\.Oidc\.Server\.Features\.JwtBearer\.IJwtReplayCache') shape onto the canonical single\-call [TryAddAsync\(string, Nullable<DateTimeOffset>\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ReplayPrevention.IJwtReplayCache#Abblix.Oidc.Server.Features.ReplayPrevention.IJwtReplayCache.TryAddAsync(string,System.Nullable_System.DateTimeOffset_) 'Abblix\.Oidc\.Server\.Features\.ReplayPrevention\.IJwtReplayCache\.TryAddAsync\(string, System\.Nullable\\)')\. Delegates via composition rather than inheritance so the deprecated contract stays type\-isolated from the canonical one\. | | [JwtBearerIssuerProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.JwtBearer.JwtBearerIssuerProvider 'Abblix\.Oidc\.Server\.Features\.JwtBearer\.JwtBearerIssuerProvider') | Default implementation of [IJwtBearerIssuerProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.JwtBearer.IJwtBearerIssuerProvider 'Abblix\.Oidc\.Server\.Features\.JwtBearer\.IJwtBearerIssuerProvider') that loads trusted issuers from [JwtBearer](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions#Abblix.Oidc.Server.Common.Configuration.OidcOptions.JwtBearer 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions\.JwtBearer') configuration, fetches JWKS with SSRF protection, and provides JWT replay protection\. | | Interfaces | | | :--- | :--- | | [IJwtBearerIssuerProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.JwtBearer.IJwtBearerIssuerProvider 'Abblix\.Oidc\.Server\.Features\.JwtBearer\.IJwtBearerIssuerProvider') | Provides comprehensive JWT Bearer grant type \(RFC 7523\) functionality including issuer management, key resolution, and replay protection\. | | [IJwtReplayCache](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.JwtBearer.IJwtReplayCache 'Abblix\.Oidc\.Server\.Features\.JwtBearer\.IJwtReplayCache') | Legacy two\-step replay\-cache contract: a separate [IsReplayedAsync\(string\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.JwtBearer.IJwtReplayCache#Abblix.Oidc.Server.Features.JwtBearer.IJwtReplayCache.IsReplayedAsync(string) 'Abblix\.Oidc\.Server\.Features\.JwtBearer\.IJwtReplayCache\.IsReplayedAsync\(string\)') read followed by a [MarkAsUsedAsync\(string, Nullable<DateTimeOffset>\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.JwtBearer.IJwtReplayCache#Abblix.Oidc.Server.Features.JwtBearer.IJwtReplayCache.MarkAsUsedAsync(string,System.Nullable_System.DateTimeOffset_) 'Abblix\.Oidc\.Server\.Features\.JwtBearer\.IJwtReplayCache\.MarkAsUsedAsync\(string, System\.Nullable\\)') write\. The shape leaks a read\-then\-write race window to concurrent presenters of the same jti\. | --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.JwtBearer.DistributedJwtReplayCache.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.JwtBearer](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.JwtBearer 'Abblix\.Oidc\.Server\.Features\.JwtBearer') ## DistributedJwtReplayCache Class Backward\-compat adapter from the legacy two\-step [IJwtReplayCache](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.JwtBearer.IJwtReplayCache 'Abblix\.Oidc\.Server\.Features\.JwtBearer\.IJwtReplayCache') shape onto the canonical single\-call [TryAddAsync\(string, Nullable<DateTimeOffset>\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ReplayPrevention.IJwtReplayCache#Abblix.Oidc.Server.Features.ReplayPrevention.IJwtReplayCache.TryAddAsync(string,System.Nullable_System.DateTimeOffset_) 'Abblix\.Oidc\.Server\.Features\.ReplayPrevention\.IJwtReplayCache\.TryAddAsync\(string, System\.Nullable\\)')\. Delegates via composition rather than inheritance so the deprecated contract stays type\-isolated from the canonical one\. ```csharp public sealed class DistributedJwtReplayCache : Abblix.Oidc.Server.Features.JwtBearer.IJwtReplayCache ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → DistributedJwtReplayCache Implements [IJwtReplayCache](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.JwtBearer.IJwtReplayCache 'Abblix\.Oidc\.Server\.Features\.JwtBearer\.IJwtReplayCache') ### Remarks [IsReplayedAsync\(string\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.JwtBearer.DistributedJwtReplayCache#Abblix.Oidc.Server.Features.JwtBearer.DistributedJwtReplayCache.IsReplayedAsync(string) 'Abblix\.Oidc\.Server\.Features\.JwtBearer\.DistributedJwtReplayCache\.IsReplayedAsync\(string\)') probes the cache in read-only mode (no jti is recorded), and [MarkAsUsedAsync\(string, Nullable<DateTimeOffset>\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.JwtBearer.DistributedJwtReplayCache#Abblix.Oidc.Server.Features.JwtBearer.DistributedJwtReplayCache.MarkAsUsedAsync(string,System.Nullable_System.DateTimeOffset_) 'Abblix\.Oidc\.Server\.Features\.JwtBearer\.DistributedJwtReplayCache\.MarkAsUsedAsync\(string, System\.Nullable\\)') issues the canonical [TryAddAsync\(string, Nullable<DateTimeOffset>\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ReplayPrevention.IJwtReplayCache#Abblix.Oidc.Server.Features.ReplayPrevention.IJwtReplayCache.TryAddAsync(string,System.Nullable_System.DateTimeOffset_) 'Abblix\.Oidc\.Server\.Features\.ReplayPrevention\.IJwtReplayCache\.TryAddAsync\(string, System\.Nullable\\)'). Concurrent presenters of the same jti can therefore both pass the read before either reaches the write - this is the same TOCTOU window the legacy API has always exposed and is the reason new code should consume `TryAddAsync` directly. ### Constructors ## DistributedJwtReplayCache\(IJwtReplayCache\) Constructor {#Abblix.Oidc.Server.Features.JwtBearer.DistributedJwtReplayCache.DistributedJwtReplayCache(Abblix.Oidc.Server.Features.ReplayPrevention.IJwtReplayCache)} Backward\-compat adapter from the legacy two\-step [IJwtReplayCache](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.JwtBearer.IJwtReplayCache 'Abblix\.Oidc\.Server\.Features\.JwtBearer\.IJwtReplayCache') shape onto the canonical single\-call [TryAddAsync\(string, Nullable<DateTimeOffset>\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ReplayPrevention.IJwtReplayCache#Abblix.Oidc.Server.Features.ReplayPrevention.IJwtReplayCache.TryAddAsync(string,System.Nullable_System.DateTimeOffset_) 'Abblix\.Oidc\.Server\.Features\.ReplayPrevention\.IJwtReplayCache\.TryAddAsync\(string, System\.Nullable\\)')\. Delegates via composition rather than inheritance so the deprecated contract stays type\-isolated from the canonical one\. ```csharp public DistributedJwtReplayCache(Abblix.Oidc.Server.Features.ReplayPrevention.IJwtReplayCache canonical); ``` #### Parameters ###### `canonical` [IJwtReplayCache](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ReplayPrevention.IJwtReplayCache 'Abblix\.Oidc\.Server\.Features\.ReplayPrevention\.IJwtReplayCache') {#Abblix.Oidc.Server.Features.JwtBearer.DistributedJwtReplayCache.DistributedJwtReplayCache(Abblix.Oidc.Server.Features.ReplayPrevention.IJwtReplayCache).canonical} ### Remarks [IsReplayedAsync\(string\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.JwtBearer.DistributedJwtReplayCache#Abblix.Oidc.Server.Features.JwtBearer.DistributedJwtReplayCache.IsReplayedAsync(string) 'Abblix\.Oidc\.Server\.Features\.JwtBearer\.DistributedJwtReplayCache\.IsReplayedAsync\(string\)') probes the cache in read-only mode (no jti is recorded), and [MarkAsUsedAsync\(string, Nullable<DateTimeOffset>\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.JwtBearer.DistributedJwtReplayCache#Abblix.Oidc.Server.Features.JwtBearer.DistributedJwtReplayCache.MarkAsUsedAsync(string,System.Nullable_System.DateTimeOffset_) 'Abblix\.Oidc\.Server\.Features\.JwtBearer\.DistributedJwtReplayCache\.MarkAsUsedAsync\(string, System\.Nullable\\)') issues the canonical [TryAddAsync\(string, Nullable<DateTimeOffset>\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ReplayPrevention.IJwtReplayCache#Abblix.Oidc.Server.Features.ReplayPrevention.IJwtReplayCache.TryAddAsync(string,System.Nullable_System.DateTimeOffset_) 'Abblix\.Oidc\.Server\.Features\.ReplayPrevention\.IJwtReplayCache\.TryAddAsync\(string, System\.Nullable\\)'). Concurrent presenters of the same jti can therefore both pass the read before either reaches the write - this is the same TOCTOU window the legacy API has always exposed and is the reason new code should consume `TryAddAsync` directly. ### Methods ## DistributedJwtReplayCache\.IsReplayedAsync\(string\) Method {#Abblix.Oidc.Server.Features.JwtBearer.DistributedJwtReplayCache.IsReplayedAsync(string)} Checks if a JWT with the specified JTI has already been used\. ```csharp public System.Threading.Tasks.Task IsReplayedAsync(string jti); ``` #### Parameters ###### `jti` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.JwtBearer.DistributedJwtReplayCache.IsReplayedAsync(string).jti} The JWT ID \(jti claim\) to check\. Implements [IsReplayedAsync\(string\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.JwtBearer.IJwtReplayCache#Abblix.Oidc.Server.Features.JwtBearer.IJwtReplayCache.IsReplayedAsync(string) 'Abblix\.Oidc\.Server\.Features\.JwtBearer\.IJwtReplayCache\.IsReplayedAsync\(string\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task that completes with true if the JWT has already been used \(replay detected\); false if this is the first time the JWT is being presented\. ## DistributedJwtReplayCache\.MarkAsUsedAsync\(string, Nullable\\) Method {#Abblix.Oidc.Server.Features.JwtBearer.DistributedJwtReplayCache.MarkAsUsedAsync(string,System.Nullable_System.DateTimeOffset_)} Marks a JWT as used by storing its JTI in the cache until the specified expiration time\. ```csharp public System.Threading.Tasks.Task MarkAsUsedAsync(string jti, System.Nullable expiresAt); ``` #### Parameters ###### `jti` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.JwtBearer.DistributedJwtReplayCache.MarkAsUsedAsync(string,System.Nullable_System.DateTimeOffset_).jti} The JWT ID \(jti claim\) to mark as used\. ###### `expiresAt` [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') {#Abblix.Oidc.Server.Features.JwtBearer.DistributedJwtReplayCache.MarkAsUsedAsync(string,System.Nullable_System.DateTimeOffset_).expiresAt} The time at which the JWT expires\. The JTI will be stored until this time plus a small buffer\. If null, a default expiration will be used\. Implements [MarkAsUsedAsync\(string, Nullable<DateTimeOffset>\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.JwtBearer.IJwtReplayCache#Abblix.Oidc.Server.Features.JwtBearer.IJwtReplayCache.MarkAsUsedAsync(string,System.Nullable_System.DateTimeOffset_) 'Abblix\.Oidc\.Server\.Features\.JwtBearer\.IJwtReplayCache\.MarkAsUsedAsync\(string, System\.Nullable\\)') #### Returns [System\.Threading\.Tasks\.Task](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task 'System\.Threading\.Tasks\.Task') A task that completes when the JTI has been stored\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.JwtBearer.IJwtBearerIssuerProvider.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.JwtBearer](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.JwtBearer 'Abblix\.Oidc\.Server\.Features\.JwtBearer') ## IJwtBearerIssuerProvider Interface Provides comprehensive JWT Bearer grant type \(RFC 7523\) functionality including issuer management, key resolution, and replay protection\. ```csharp public interface IJwtBearerIssuerProvider ``` Derived ↳ [JwtBearerIssuerProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.JwtBearer.JwtBearerIssuerProvider 'Abblix\.Oidc\.Server\.Features\.JwtBearer\.JwtBearerIssuerProvider') ### Remarks This interface centralizes JWT Bearer security functionality to: \- Validate that the JWT issuer \(iss claim\) is from a trusted identity provider \- Resolve the signing keys \(JWKS\) for verifying the JWT signature \- Provide replay protection per RFC 7523 Section 3 \- Expose configuration settings \(clock skew, algorithm whitelist, etc\.\) ### Properties ## IJwtBearerIssuerProvider\.Options Property {#Abblix.Oidc.Server.Features.JwtBearer.IJwtBearerIssuerProvider.Options} Gets the JWT Bearer configuration options\. ```csharp Abblix.Oidc.Server.Common.Configuration.JwtBearerOptions Options { get; } ``` #### Property Value [JwtBearerOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.JwtBearerOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.JwtBearerOptions') ### Methods ## IJwtBearerIssuerProvider\.GetSigningKeysAsync\(string\) Method {#Abblix.Oidc.Server.Features.JwtBearer.IJwtBearerIssuerProvider.GetSigningKeysAsync(string)} Resolves the signing keys for a trusted issuer, used to verify JWT assertion signatures\. ```csharp System.Collections.Generic.IAsyncEnumerable GetSigningKeysAsync(string issuer); ``` #### Parameters ###### `issuer` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.JwtBearer.IJwtBearerIssuerProvider.GetSigningKeysAsync(string).issuer} The issuer identifier from the JWT's 'iss' claim\. #### Returns [System\.Collections\.Generic\.IAsyncEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.iasyncenumerable-1 'System\.Collections\.Generic\.IAsyncEnumerable\`1')[JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.iasyncenumerable-1 'System\.Collections\.Generic\.IAsyncEnumerable\`1') An async enumerable of JSON Web Keys that can be used to verify signatures for JWTs issued by this issuer\. Returns empty if the issuer is not trusted or has no configured keys\. ## IJwtBearerIssuerProvider\.GetTrustedIssuerAsync\(string\) Method {#Abblix.Oidc.Server.Features.JwtBearer.IJwtBearerIssuerProvider.GetTrustedIssuerAsync(string)} Gets the full configuration for a trusted issuer\. ```csharp System.Threading.Tasks.Task GetTrustedIssuerAsync(string issuer); ``` #### Parameters ###### `issuer` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.JwtBearer.IJwtBearerIssuerProvider.GetTrustedIssuerAsync(string).issuer} The issuer identifier from the JWT's 'iss' claim\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[TrustedIssuer](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.TrustedIssuer 'Abblix\.Oidc\.Server\.Common\.Configuration\.TrustedIssuer')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task that completes with the trusted issuer configuration if found; null if not trusted\. ## IJwtBearerIssuerProvider\.IsReplayedAsync\(string, Nullable\\) Method {#Abblix.Oidc.Server.Features.JwtBearer.IJwtBearerIssuerProvider.IsReplayedAsync(string,System.Nullable_System.DateTimeOffset_)} Atomically records the JWT's JTI for replay protection and reports whether it had already been recorded\. The entry is kept until the assertion's own expiration, so a JWT cannot be replayed for any part of its validity window\. ```csharp System.Threading.Tasks.Task IsReplayedAsync(string jti, System.Nullable expiresAt); ``` #### Parameters ###### `jti` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.JwtBearer.IJwtBearerIssuerProvider.IsReplayedAsync(string,System.Nullable_System.DateTimeOffset_).jti} The JWT ID \(jti claim\) to reserve\. ###### `expiresAt` [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') {#Abblix.Oidc.Server.Features.JwtBearer.IJwtBearerIssuerProvider.IsReplayedAsync(string,System.Nullable_System.DateTimeOffset_).expiresAt} The assertion's expiration; bounds how long the JTI is remembered\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') True if this JTI was already recorded \(a replay\); false if it was recorded just now\. ## IJwtBearerIssuerProvider\.IsTrustedIssuerAsync\(string\) Method {#Abblix.Oidc.Server.Features.JwtBearer.IJwtBearerIssuerProvider.IsTrustedIssuerAsync(string)} Determines whether the specified issuer is trusted for JWT Bearer assertions\. ```csharp System.Threading.Tasks.Task IsTrustedIssuerAsync(string issuer); ``` #### Parameters ###### `issuer` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.JwtBearer.IJwtBearerIssuerProvider.IsTrustedIssuerAsync(string).issuer} The issuer identifier from the JWT's 'iss' claim\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task that completes with true if the issuer is trusted and can be used for JWT Bearer grants; otherwise, false\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.JwtBearer.IJwtReplayCache.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.JwtBearer](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.JwtBearer 'Abblix\.Oidc\.Server\.Features\.JwtBearer') ## IJwtReplayCache Interface Legacy two\-step replay\-cache contract: a separate [IsReplayedAsync\(string\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.JwtBearer.IJwtReplayCache#Abblix.Oidc.Server.Features.JwtBearer.IJwtReplayCache.IsReplayedAsync(string) 'Abblix\.Oidc\.Server\.Features\.JwtBearer\.IJwtReplayCache\.IsReplayedAsync\(string\)') read followed by a [MarkAsUsedAsync\(string, Nullable<DateTimeOffset>\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.JwtBearer.IJwtReplayCache#Abblix.Oidc.Server.Features.JwtBearer.IJwtReplayCache.MarkAsUsedAsync(string,System.Nullable_System.DateTimeOffset_) 'Abblix\.Oidc\.Server\.Features\.JwtBearer\.IJwtReplayCache\.MarkAsUsedAsync\(string, System\.Nullable\\)') write\. The shape leaks a read\-then\-write race window to concurrent presenters of the same jti\. ```csharp public interface IJwtReplayCache ``` Derived ↳ [DistributedJwtReplayCache](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.JwtBearer.DistributedJwtReplayCache 'Abblix\.Oidc\.Server\.Features\.JwtBearer\.DistributedJwtReplayCache') ### Remarks Replaced by [TryAddAsync\(string, Nullable<DateTimeOffset>\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ReplayPrevention.IJwtReplayCache#Abblix.Oidc.Server.Features.ReplayPrevention.IJwtReplayCache.TryAddAsync(string,System.Nullable_System.DateTimeOffset_) 'Abblix\.Oidc\.Server\.Features\.ReplayPrevention\.IJwtReplayCache\.TryAddAsync\(string, System\.Nullable\\)'), whose single\-call shape lets atomic\-capable backends close the race natively\. This interface remains as a backward\-compat alias so host code that DI\-resolves the legacy type still receives a working instance during the transition window\. ### Methods ## IJwtReplayCache\.IsReplayedAsync\(string\) Method {#Abblix.Oidc.Server.Features.JwtBearer.IJwtReplayCache.IsReplayedAsync(string)} Checks if a JWT with the specified JTI has already been used\. ```csharp System.Threading.Tasks.Task IsReplayedAsync(string jti); ``` #### Parameters ###### `jti` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.JwtBearer.IJwtReplayCache.IsReplayedAsync(string).jti} The JWT ID \(jti claim\) to check\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task that completes with true if the JWT has already been used \(replay detected\); false if this is the first time the JWT is being presented\. ## IJwtReplayCache\.MarkAsUsedAsync\(string, Nullable\\) Method {#Abblix.Oidc.Server.Features.JwtBearer.IJwtReplayCache.MarkAsUsedAsync(string,System.Nullable_System.DateTimeOffset_)} Marks a JWT as used by storing its JTI in the cache until the specified expiration time\. ```csharp System.Threading.Tasks.Task MarkAsUsedAsync(string jti, System.Nullable expiresAt); ``` #### Parameters ###### `jti` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.JwtBearer.IJwtReplayCache.MarkAsUsedAsync(string,System.Nullable_System.DateTimeOffset_).jti} The JWT ID \(jti claim\) to mark as used\. ###### `expiresAt` [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') {#Abblix.Oidc.Server.Features.JwtBearer.IJwtReplayCache.MarkAsUsedAsync(string,System.Nullable_System.DateTimeOffset_).expiresAt} The time at which the JWT expires\. The JTI will be stored until this time plus a small buffer\. If null, a default expiration will be used\. #### Returns [System\.Threading\.Tasks\.Task](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task 'System\.Threading\.Tasks\.Task') A task that completes when the JTI has been stored\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.JwtBearer.JwtBearerIssuerProvider.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.JwtBearer](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.JwtBearer 'Abblix\.Oidc\.Server\.Features\.JwtBearer') ## JwtBearerIssuerProvider Class Default implementation of [IJwtBearerIssuerProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.JwtBearer.IJwtBearerIssuerProvider 'Abblix\.Oidc\.Server\.Features\.JwtBearer\.IJwtBearerIssuerProvider') that loads trusted issuers from [JwtBearer](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions#Abblix.Oidc.Server.Common.Configuration.OidcOptions.JwtBearer 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions\.JwtBearer') configuration, fetches JWKS with SSRF protection, and provides JWT replay protection\. ```csharp public class JwtBearerIssuerProvider : Abblix.Oidc.Server.Features.JwtBearer.IJwtBearerIssuerProvider ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → JwtBearerIssuerProvider Implements [IJwtBearerIssuerProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.JwtBearer.IJwtBearerIssuerProvider 'Abblix\.Oidc\.Server\.Features\.JwtBearer\.IJwtBearerIssuerProvider') ### Constructors ## JwtBearerIssuerProvider\(ILogger\, IOptionsMonitor\, IReplayCache, ISecureHttpFetcher, TimeProvider\) Constructor {#Abblix.Oidc.Server.Features.JwtBearer.JwtBearerIssuerProvider.JwtBearerIssuerProvider(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.JwtBearer.JwtBearerIssuerProvider_,Microsoft.Extensions.Options.IOptionsMonitor_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,Abblix.Jwt.ReplayPrevention.IReplayCache,Abblix.Oidc.Server.Features.SecureHttpFetch.ISecureHttpFetcher,System.TimeProvider)} Default implementation of [IJwtBearerIssuerProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.JwtBearer.IJwtBearerIssuerProvider 'Abblix\.Oidc\.Server\.Features\.JwtBearer\.IJwtBearerIssuerProvider') that loads trusted issuers from [JwtBearer](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions#Abblix.Oidc.Server.Common.Configuration.OidcOptions.JwtBearer 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions\.JwtBearer') configuration, fetches JWKS with SSRF protection, and provides JWT replay protection\. ```csharp public JwtBearerIssuerProvider(Microsoft.Extensions.Logging.ILogger logger, Microsoft.Extensions.Options.IOptionsMonitor oidcOptions, Abblix.Jwt.ReplayPrevention.IReplayCache replayCache, Abblix.Oidc.Server.Features.SecureHttpFetch.ISecureHttpFetcher secureFetcher, System.TimeProvider timeProvider); ``` #### Parameters ###### `logger` [Microsoft\.Extensions\.Logging\.ILogger<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1')[JwtBearerIssuerProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.JwtBearer.JwtBearerIssuerProvider 'Abblix\.Oidc\.Server\.Features\.JwtBearer\.JwtBearerIssuerProvider')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1') {#Abblix.Oidc.Server.Features.JwtBearer.JwtBearerIssuerProvider.JwtBearerIssuerProvider(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.JwtBearer.JwtBearerIssuerProvider_,Microsoft.Extensions.Options.IOptionsMonitor_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,Abblix.Jwt.ReplayPrevention.IReplayCache,Abblix.Oidc.Server.Features.SecureHttpFetch.ISecureHttpFetcher,System.TimeProvider).logger} Logger for recording JWKS fetch operations and errors\. ###### `oidcOptions` [Microsoft\.Extensions\.Options\.IOptionsMonitor<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptionsmonitor-1 'Microsoft\.Extensions\.Options\.IOptionsMonitor\`1')[OidcOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptionsmonitor-1 'Microsoft\.Extensions\.Options\.IOptionsMonitor\`1') {#Abblix.Oidc.Server.Features.JwtBearer.JwtBearerIssuerProvider.JwtBearerIssuerProvider(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.JwtBearer.JwtBearerIssuerProvider_,Microsoft.Extensions.Options.IOptionsMonitor_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,Abblix.Jwt.ReplayPrevention.IReplayCache,Abblix.Oidc.Server.Features.SecureHttpFetch.ISecureHttpFetcher,System.TimeProvider).oidcOptions} OIDC configuration options containing JWT Bearer trusted issuers\. ###### `replayCache` [IReplayCache](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ReplayPrevention.IReplayCache 'Abblix\.Jwt\.ReplayPrevention\.IReplayCache') {#Abblix.Oidc.Server.Features.JwtBearer.JwtBearerIssuerProvider.JwtBearerIssuerProvider(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.JwtBearer.JwtBearerIssuerProvider_,Microsoft.Extensions.Options.IOptionsMonitor_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,Abblix.Jwt.ReplayPrevention.IReplayCache,Abblix.Oidc.Server.Features.SecureHttpFetch.ISecureHttpFetcher,System.TimeProvider).replayCache} Cache for JWT replay protection per RFC 7523 Section 3\. ###### `secureFetcher` [ISecureHttpFetcher](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.SecureHttpFetch.ISecureHttpFetcher 'Abblix\.Oidc\.Server\.Features\.SecureHttpFetch\.ISecureHttpFetcher') {#Abblix.Oidc.Server.Features.JwtBearer.JwtBearerIssuerProvider.JwtBearerIssuerProvider(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.JwtBearer.JwtBearerIssuerProvider_,Microsoft.Extensions.Options.IOptionsMonitor_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,Abblix.Jwt.ReplayPrevention.IReplayCache,Abblix.Oidc.Server.Features.SecureHttpFetch.ISecureHttpFetcher,System.TimeProvider).secureFetcher} HTTP fetcher with SSRF protection and caching\. ###### `timeProvider` [System\.TimeProvider](https://learn.microsoft.com/en-us/dotnet/api/system.timeprovider 'System\.TimeProvider') {#Abblix.Oidc.Server.Features.JwtBearer.JwtBearerIssuerProvider.JwtBearerIssuerProvider(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.JwtBearer.JwtBearerIssuerProvider_,Microsoft.Extensions.Options.IOptionsMonitor_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,Abblix.Jwt.ReplayPrevention.IReplayCache,Abblix.Oidc.Server.Features.SecureHttpFetch.ISecureHttpFetcher,System.TimeProvider).timeProvider} Dates the fallback retention window for an assertion without an expiry\. ### Properties ## JwtBearerIssuerProvider\.Options Property {#Abblix.Oidc.Server.Features.JwtBearer.JwtBearerIssuerProvider.Options} Gets the JWT Bearer configuration options\. ```csharp public Abblix.Oidc.Server.Common.Configuration.JwtBearerOptions Options { get; } ``` Implements [Options](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.JwtBearer.IJwtBearerIssuerProvider#Abblix.Oidc.Server.Features.JwtBearer.IJwtBearerIssuerProvider.Options 'Abblix\.Oidc\.Server\.Features\.JwtBearer\.IJwtBearerIssuerProvider\.Options') #### Property Value [JwtBearerOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.JwtBearerOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.JwtBearerOptions') ### Methods ## JwtBearerIssuerProvider\.GetSigningKeysAsync\(string\) Method {#Abblix.Oidc.Server.Features.JwtBearer.JwtBearerIssuerProvider.GetSigningKeysAsync(string)} Resolves the signing keys for a trusted issuer by fetching the JWKS from the configured JWKS URI with SSRF \(Server\-Side Request Forgery\) protection\. ```csharp public System.Collections.Generic.IAsyncEnumerable GetSigningKeysAsync(string issuer); ``` #### Parameters ###### `issuer` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.JwtBearer.JwtBearerIssuerProvider.GetSigningKeysAsync(string).issuer} The issuer identifier from the JWT's 'iss' claim\. Implements [GetSigningKeysAsync\(string\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.JwtBearer.IJwtBearerIssuerProvider#Abblix.Oidc.Server.Features.JwtBearer.IJwtBearerIssuerProvider.GetSigningKeysAsync(string) 'Abblix\.Oidc\.Server\.Features\.JwtBearer\.IJwtBearerIssuerProvider\.GetSigningKeysAsync\(string\)') #### Returns [System\.Collections\.Generic\.IAsyncEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.iasyncenumerable-1 'System\.Collections\.Generic\.IAsyncEnumerable\`1')[JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.iasyncenumerable-1 'System\.Collections\.Generic\.IAsyncEnumerable\`1') An async enumerable of JSON Web Keys from the issuer's JWKS endpoint\. Returns empty if the issuer is not trusted or if fetching JWKS fails\. ### Remarks This implementation: \- Looks up the issuer in the trusted issuers configuration \- Fetches the JWKS from the configured JwksUri using ISecureHttpFetcher \(SSRF protected\) \- JWKS responses are cached according to [JwksCacheDuration](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.JwtBearerOptions#Abblix.Oidc.Server.Common.Configuration.JwtBearerOptions.JwksCacheDuration 'Abblix\.Oidc\.Server\.Common\.Configuration\.JwtBearerOptions\.JwksCacheDuration') \- Filters keys to return only those suitable for signature verification \- Logs warnings if JWKS fetching fails ## JwtBearerIssuerProvider\.GetTrustedIssuerAsync\(string\) Method {#Abblix.Oidc.Server.Features.JwtBearer.JwtBearerIssuerProvider.GetTrustedIssuerAsync(string)} Gets the full configuration for a trusted issuer\. ```csharp public System.Threading.Tasks.Task GetTrustedIssuerAsync(string issuer); ``` #### Parameters ###### `issuer` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.JwtBearer.JwtBearerIssuerProvider.GetTrustedIssuerAsync(string).issuer} The issuer identifier from the JWT's 'iss' claim\. Implements [GetTrustedIssuerAsync\(string\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.JwtBearer.IJwtBearerIssuerProvider#Abblix.Oidc.Server.Features.JwtBearer.IJwtBearerIssuerProvider.GetTrustedIssuerAsync(string) 'Abblix\.Oidc\.Server\.Features\.JwtBearer\.IJwtBearerIssuerProvider\.GetTrustedIssuerAsync\(string\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[TrustedIssuer](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.TrustedIssuer 'Abblix\.Oidc\.Server\.Common\.Configuration\.TrustedIssuer')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task that completes with the trusted issuer configuration if found; null if not trusted\. ## JwtBearerIssuerProvider\.IsReplayedAsync\(string, Nullable\\) Method {#Abblix.Oidc.Server.Features.JwtBearer.JwtBearerIssuerProvider.IsReplayedAsync(string,System.Nullable_System.DateTimeOffset_)} Atomically records the JWT's JTI for replay protection and reports whether it had already been recorded\. The entry is kept until the assertion's own expiration, so a JWT cannot be replayed for any part of its validity window\. ```csharp public System.Threading.Tasks.Task IsReplayedAsync(string jti, System.Nullable expiresAt); ``` #### Parameters ###### `jti` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.JwtBearer.JwtBearerIssuerProvider.IsReplayedAsync(string,System.Nullable_System.DateTimeOffset_).jti} The JWT ID \(jti claim\) to reserve\. ###### `expiresAt` [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') {#Abblix.Oidc.Server.Features.JwtBearer.JwtBearerIssuerProvider.IsReplayedAsync(string,System.Nullable_System.DateTimeOffset_).expiresAt} The assertion's expiration; bounds how long the JTI is remembered\. Implements [IsReplayedAsync\(string, Nullable<DateTimeOffset>\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.JwtBearer.IJwtBearerIssuerProvider#Abblix.Oidc.Server.Features.JwtBearer.IJwtBearerIssuerProvider.IsReplayedAsync(string,System.Nullable_System.DateTimeOffset_) 'Abblix\.Oidc\.Server\.Features\.JwtBearer\.IJwtBearerIssuerProvider\.IsReplayedAsync\(string, System\.Nullable\\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') True if this JTI was already recorded \(a replay\); false if it was recorded just now\. ## JwtBearerIssuerProvider\.IsTrustedIssuerAsync\(string\) Method {#Abblix.Oidc.Server.Features.JwtBearer.JwtBearerIssuerProvider.IsTrustedIssuerAsync(string)} Determines whether the specified issuer is trusted for JWT Bearer assertions\. Checks against the configured list of trusted issuers in [JwtBearer](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions#Abblix.Oidc.Server.Common.Configuration.OidcOptions.JwtBearer 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions\.JwtBearer')\. ```csharp public System.Threading.Tasks.Task IsTrustedIssuerAsync(string issuer); ``` #### Parameters ###### `issuer` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.JwtBearer.JwtBearerIssuerProvider.IsTrustedIssuerAsync(string).issuer} The issuer identifier from the JWT's 'iss' claim\. Implements [IsTrustedIssuerAsync\(string\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.JwtBearer.IJwtBearerIssuerProvider#Abblix.Oidc.Server.Features.JwtBearer.IJwtBearerIssuerProvider.IsTrustedIssuerAsync(string) 'Abblix\.Oidc\.Server\.Features\.JwtBearer\.IJwtBearerIssuerProvider\.IsTrustedIssuerAsync\(string\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task that completes with true if the issuer is in the trusted issuers list; otherwise, false\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Licensing.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ## Abblix\.Oidc\.Server\.Features\.Licensing Namespace | Classes | | | :--- | :--- | | [AggregationExtensions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Licensing.AggregationExtensions 'Abblix\.Oidc\.Server\.Features\.Licensing\.AggregationExtensions') | Provides extension methods for aggregating values from objects based on specific comparable properties\. | | [License](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Licensing.License 'Abblix\.Oidc\.Server\.Features\.Licensing\.License') | Represents the licensing constraints applied to the application, including limits on the number of clients and issuers, as well as the validity period of the license\. | | [LicenseChecker](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Licensing.LicenseChecker 'Abblix\.Oidc\.Server\.Features\.Licensing\.LicenseChecker') | Manages and enforces licensing constraints on clients and issuers within the application, ensuring compliance with defined licensing terms\. | | [LicenseLoader](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Licensing.LicenseLoader 'Abblix\.Oidc\.Server\.Features\.Licensing\.LicenseLoader') | Handles the loading and validation of application licenses provided as JSON Web Tokens \(JWT\)\. | | [LicenseManager](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Licensing.LicenseManager 'Abblix\.Oidc\.Server\.Features\.Licensing\.LicenseManager') | Manages the application's licenses, ensuring that the current license is appropriately evaluated based on its validity period\. | | [OptionsLicenseJwtProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Licensing.OptionsLicenseJwtProvider 'Abblix\.Oidc\.Server\.Features\.Licensing\.OptionsLicenseJwtProvider') | An [ILicenseJwtProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Licensing.ILicenseJwtProvider 'Abblix\.Oidc\.Server\.Features\.Licensing\.ILicenseJwtProvider') backed by the [LicenseJwt](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions#Abblix.Oidc.Server.Common.Configuration.OidcOptions.LicenseJwt 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions\.LicenseJwt') value resolved through the options pattern\. | | [StaticLicenseJwtProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Licensing.StaticLicenseJwtProvider 'Abblix\.Oidc\.Server\.Features\.Licensing\.StaticLicenseJwtProvider') | An implementation of [ILicenseJwtProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Licensing.ILicenseJwtProvider 'Abblix\.Oidc\.Server\.Features\.Licensing\.ILicenseJwtProvider') that returns a predefined license JWT string\. | | Interfaces | | | :--- | :--- | | [ILicenseJwtProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Licensing.ILicenseJwtProvider 'Abblix\.Oidc\.Server\.Features\.Licensing\.ILicenseJwtProvider') | Defines a provider for accessing the license JSON Web Token \(JWT\) used in OIDC service configuration\. | | Enums | | | :--- | :--- | | [LicenseStatus](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Licensing.LicenseStatus 'Abblix\.Oidc\.Server\.Features\.Licensing\.LicenseStatus') | Specifies the status of a license in relation to its validity period and current date and time\. | --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Licensing.AggregationExtensions.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.Licensing](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Licensing 'Abblix\.Oidc\.Server\.Features\.Licensing') ## AggregationExtensions Class Provides extension methods for aggregating values from objects based on specific comparable properties\. ```csharp public static class AggregationExtensions ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → AggregationExtensions ### Methods ## AggregationExtensions\.Greater\\(this Nullable\, Nullable\\) Method {#Abblix.Oidc.Server.Features.Licensing.AggregationExtensions.Greater_T_(thisSystem.Nullable_T_,System.Nullable_T_)} Determines the greater of two nullable values, treating null as positive infinity\. ```csharp public static System.Nullable Greater(this System.Nullable accumulatorValue, System.Nullable currentValue) where T : struct, System.IComparable; ``` #### Type parameters ###### `T` {#Abblix.Oidc.Server.Features.Licensing.AggregationExtensions.Greater_T_(thisSystem.Nullable_T_,System.Nullable_T_).T} The type of the values being compared, constrained to value types that implement [System\.IComparable](https://learn.microsoft.com/en-us/dotnet/api/system.icomparable 'System\.IComparable')\. #### Parameters ###### `accumulatorValue` [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[T](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Licensing.AggregationExtensions#Abblix.Oidc.Server.Features.Licensing.AggregationExtensions.Greater_T_(thisSystem.Nullable_T_,System.Nullable_T_).T 'Abblix\.Oidc\.Server\.Features\.Licensing\.AggregationExtensions\.Greater\\(this System\.Nullable\, System\.Nullable\\)\.T')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') {#Abblix.Oidc.Server.Features.Licensing.AggregationExtensions.Greater_T_(thisSystem.Nullable_T_,System.Nullable_T_).accumulatorValue} The first nullable value to compare\. ###### `currentValue` [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[T](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Licensing.AggregationExtensions#Abblix.Oidc.Server.Features.Licensing.AggregationExtensions.Greater_T_(thisSystem.Nullable_T_,System.Nullable_T_).T 'Abblix\.Oidc\.Server\.Features\.Licensing\.AggregationExtensions\.Greater\\(this System\.Nullable\, System\.Nullable\\)\.T')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') {#Abblix.Oidc.Server.Features.Licensing.AggregationExtensions.Greater_T_(thisSystem.Nullable_T_,System.Nullable_T_).currentValue} The second nullable value to compare\. #### Returns [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[T](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Licensing.AggregationExtensions#Abblix.Oidc.Server.Features.Licensing.AggregationExtensions.Greater_T_(thisSystem.Nullable_T_,System.Nullable_T_).T 'Abblix\.Oidc\.Server\.Features\.Licensing\.AggregationExtensions\.Greater\\(this System\.Nullable\, System\.Nullable\\)\.T')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') The greater of the two values if at least one is non\-null; otherwise, null\. If both values are non\-null, the method returns null only if the [currentValue](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Licensing.AggregationExtensions#Abblix.Oidc.Server.Features.Licensing.AggregationExtensions.Greater_T_(thisSystem.Nullable_T_,System.Nullable_T_).currentValue 'Abblix\.Oidc\.Server\.Features\.Licensing\.AggregationExtensions\.Greater\\(this System\.Nullable\, System\.Nullable\\)\.currentValue') is null, indicating it is considered as positive infinity\. ### Remarks This method is useful in scenarios where you're aggregating a collection of nullable values and consider the absence of a value \(null\) as the highest possible value, allowing for custom maximum value logic\. ## AggregationExtensions\.Join\\(this HashSet\, HashSet\\) Method {#Abblix.Oidc.Server.Features.Licensing.AggregationExtensions.Join_T_(thisSystem.Collections.Generic.HashSet_T_,System.Collections.Generic.HashSet_T_)} Combines the elements of two hash sets into a single set, including all unique elements from both\. ```csharp public static System.Collections.Generic.HashSet? Join(this System.Collections.Generic.HashSet? accumulator, System.Collections.Generic.HashSet? current); ``` #### Type parameters ###### `T` {#Abblix.Oidc.Server.Features.Licensing.AggregationExtensions.Join_T_(thisSystem.Collections.Generic.HashSet_T_,System.Collections.Generic.HashSet_T_).T} The type of elements in the hash sets\. #### Parameters ###### `accumulator` [System\.Collections\.Generic\.HashSet<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.hashset-1 'System\.Collections\.Generic\.HashSet\`1')[T](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Licensing.AggregationExtensions#Abblix.Oidc.Server.Features.Licensing.AggregationExtensions.Join_T_(thisSystem.Collections.Generic.HashSet_T_,System.Collections.Generic.HashSet_T_).T 'Abblix\.Oidc\.Server\.Features\.Licensing\.AggregationExtensions\.Join\\(this System\.Collections\.Generic\.HashSet\, System\.Collections\.Generic\.HashSet\\)\.T')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.hashset-1 'System\.Collections\.Generic\.HashSet\`1') {#Abblix.Oidc.Server.Features.Licensing.AggregationExtensions.Join_T_(thisSystem.Collections.Generic.HashSet_T_,System.Collections.Generic.HashSet_T_).accumulator} The first hash set\. ###### `current` [System\.Collections\.Generic\.HashSet<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.hashset-1 'System\.Collections\.Generic\.HashSet\`1')[T](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Licensing.AggregationExtensions#Abblix.Oidc.Server.Features.Licensing.AggregationExtensions.Join_T_(thisSystem.Collections.Generic.HashSet_T_,System.Collections.Generic.HashSet_T_).T 'Abblix\.Oidc\.Server\.Features\.Licensing\.AggregationExtensions\.Join\\(this System\.Collections\.Generic\.HashSet\, System\.Collections\.Generic\.HashSet\\)\.T')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.hashset-1 'System\.Collections\.Generic\.HashSet\`1') {#Abblix.Oidc.Server.Features.Licensing.AggregationExtensions.Join_T_(thisSystem.Collections.Generic.HashSet_T_,System.Collections.Generic.HashSet_T_).current} The second hash set to combine with the first\. #### Returns [System\.Collections\.Generic\.HashSet<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.hashset-1 'System\.Collections\.Generic\.HashSet\`1')[T](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Licensing.AggregationExtensions#Abblix.Oidc.Server.Features.Licensing.AggregationExtensions.Join_T_(thisSystem.Collections.Generic.HashSet_T_,System.Collections.Generic.HashSet_T_).T 'Abblix\.Oidc\.Server\.Features\.Licensing\.AggregationExtensions\.Join\\(this System\.Collections\.Generic\.HashSet\, System\.Collections\.Generic\.HashSet\\)\.T')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.hashset-1 'System\.Collections\.Generic\.HashSet\`1') A new hash set containing all unique elements from both input sets\. If both inputs are null, returns null\. ### Remarks This method provides a convenient way to merge two sets of elements, ensuring that the result contains all distinct elements from both sets\. It is particularly useful for combining collections of unique items without duplicating any elements\. ## AggregationExtensions\.Lesser\\(this Nullable\, Nullable\\) Method {#Abblix.Oidc.Server.Features.Licensing.AggregationExtensions.Lesser_T_(thisSystem.Nullable_T_,System.Nullable_T_)} Determines the lesser of two nullable values, treating null as negative infinity\. ```csharp public static System.Nullable Lesser(this System.Nullable currentValue, System.Nullable accumulatorValue) where T : struct, System.IComparable; ``` #### Type parameters ###### `T` {#Abblix.Oidc.Server.Features.Licensing.AggregationExtensions.Lesser_T_(thisSystem.Nullable_T_,System.Nullable_T_).T} The type of the values being compared, constrained to value types that implement [System\.IComparable<>](https://learn.microsoft.com/en-us/dotnet/api/system.icomparable-1 'System\.IComparable\`1')\. #### Parameters ###### `currentValue` [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[T](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Licensing.AggregationExtensions#Abblix.Oidc.Server.Features.Licensing.AggregationExtensions.Lesser_T_(thisSystem.Nullable_T_,System.Nullable_T_).T 'Abblix\.Oidc\.Server\.Features\.Licensing\.AggregationExtensions\.Lesser\\(this System\.Nullable\, System\.Nullable\\)\.T')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') {#Abblix.Oidc.Server.Features.Licensing.AggregationExtensions.Lesser_T_(thisSystem.Nullable_T_,System.Nullable_T_).currentValue} The first nullable value to compare\. ###### `accumulatorValue` [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[T](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Licensing.AggregationExtensions#Abblix.Oidc.Server.Features.Licensing.AggregationExtensions.Lesser_T_(thisSystem.Nullable_T_,System.Nullable_T_).T 'Abblix\.Oidc\.Server\.Features\.Licensing\.AggregationExtensions\.Lesser\\(this System\.Nullable\, System\.Nullable\\)\.T')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') {#Abblix.Oidc.Server.Features.Licensing.AggregationExtensions.Lesser_T_(thisSystem.Nullable_T_,System.Nullable_T_).accumulatorValue} The second nullable value to compare\. #### Returns [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[T](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Licensing.AggregationExtensions#Abblix.Oidc.Server.Features.Licensing.AggregationExtensions.Lesser_T_(thisSystem.Nullable_T_,System.Nullable_T_).T 'Abblix\.Oidc\.Server\.Features\.Licensing\.AggregationExtensions\.Lesser\\(this System\.Nullable\, System\.Nullable\\)\.T')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') The lesser of the two values if at least one is non\-null; otherwise, null\. If both values are non\-null, the method returns null only if the [accumulatorValue](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Licensing.AggregationExtensions#Abblix.Oidc.Server.Features.Licensing.AggregationExtensions.Lesser_T_(thisSystem.Nullable_T_,System.Nullable_T_).accumulatorValue 'Abblix\.Oidc\.Server\.Features\.Licensing\.AggregationExtensions\.Lesser\\(this System\.Nullable\, System\.Nullable\\)\.accumulatorValue') is null, indicating it is considered as negative infinity\. ### Remarks This method supports scenarios requiring aggregation of a series of nullable values where the absence of a value \(null\) is interpreted as the lowest possible value, enabling custom minimum value logic\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Licensing.ILicenseJwtProvider.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.Licensing](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Licensing 'Abblix\.Oidc\.Server\.Features\.Licensing') ## ILicenseJwtProvider Interface Defines a provider for accessing the license JSON Web Token \(JWT\) used in OIDC service configuration\. ```csharp public interface ILicenseJwtProvider ``` Derived ↳ [OptionsLicenseJwtProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Licensing.OptionsLicenseJwtProvider 'Abblix\.Oidc\.Server\.Features\.Licensing\.OptionsLicenseJwtProvider') ↳ [StaticLicenseJwtProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Licensing.StaticLicenseJwtProvider 'Abblix\.Oidc\.Server\.Features\.Licensing\.StaticLicenseJwtProvider') ### Remarks This interface abstracts the mechanism for retrieving the license JWT, which is essential for validating the configuration and operational scope of the OIDC service based on licensing terms\. Implementations of this interface should ensure secure and efficient access to the license JWT, typically stored in service configuration settings\. ### Methods ## ILicenseJwtProvider\.GetLicenseJwtAsync\(\) Method {#Abblix.Oidc.Server.Features.Licensing.ILicenseJwtProvider.GetLicenseJwtAsync()} Asynchronously gets the license JWT string\. ```csharp System.Collections.Generic.IAsyncEnumerable? GetLicenseJwtAsync(); ``` #### Returns [System\.Collections\.Generic\.IAsyncEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.iasyncenumerable-1 'System\.Collections\.Generic\.IAsyncEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.iasyncenumerable-1 'System\.Collections\.Generic\.IAsyncEnumerable\`1') A task representing the asynchronous operation, which upon completion contains the license JWT used for configuration and licensing validation of the OIDC service\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Licensing.License.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.Licensing](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Licensing 'Abblix\.Oidc\.Server\.Features\.Licensing') ## License Class Represents the licensing constraints applied to the application, including limits on the number of clients and issuers, as well as the validity period of the license\. ```csharp public record License : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → License Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[License](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Licensing.License 'Abblix\.Oidc\.Server\.Features\.Licensing\.License')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Remarks This record is central to defining and enforcing operational limits and licensing terms within the application\. It supports not only quantitative restrictions, such as the number of clients and issuers, but also temporal constraints, specifying when the license is valid and providing a grace period beyond the expiration date\. Properties: \- [ClientLimit](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Licensing.License#Abblix.Oidc.Server.Features.Licensing.License.ClientLimit 'Abblix\.Oidc\.Server\.Features\.Licensing\.License\.ClientLimit') and [IssuerLimit](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Licensing.License#Abblix.Oidc.Server.Features.Licensing.License.IssuerLimit 'Abblix\.Oidc\.Server\.Features\.Licensing\.License\.IssuerLimit') impose limits on the number of clients and issuers that can interact with the application, ensuring compliance with the licensing agreement\. \- [ValidIssuers](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Licensing.License#Abblix.Oidc.Server.Features.Licensing.License.ValidIssuers 'Abblix\.Oidc\.Server\.Features\.Licensing\.License\.ValidIssuers') specifies which issuers are recognized as valid sources of tokens or claims, adding an additional layer of security and compliance\. \- [NotBefore](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Licensing.License#Abblix.Oidc.Server.Features.Licensing.License.NotBefore 'Abblix\.Oidc\.Server\.Features\.Licensing\.License\.NotBefore') and [ExpiresAt](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Licensing.License#Abblix.Oidc.Server.Features.Licensing.License.ExpiresAt 'Abblix\.Oidc\.Server\.Features\.Licensing\.License\.ExpiresAt') define the time frame during which the license is considered valid, allowing for precise control over the license's lifecycle\. \- [GracePeriod](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Licensing.License#Abblix.Oidc.Server.Features.Licensing.License.GracePeriod 'Abblix\.Oidc\.Server\.Features\.Licensing\.License\.GracePeriod') offers flexibility by defining a period after [ExpiresAt](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Licensing.License#Abblix.Oidc.Server.Features.Licensing.License.ExpiresAt 'Abblix\.Oidc\.Server\.Features\.Licensing\.License\.ExpiresAt') during which the license constraints are still enforced, but the application may remain operational to account for renewal processes\. Together, these properties enable a robust and flexible approach to licensing, facilitating compliance, security, and operational continuity\. ### Properties ## License\.ClientLimit Property {#Abblix.Oidc.Server.Features.Licensing.License.ClientLimit} The maximum number of clients that are allowed to interact with the application under the current license\. ```csharp public System.Nullable ClientLimit { get; init; } ``` #### Property Value [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.Int32](https://learn.microsoft.com/en-us/dotnet/api/system.int32 'System\.Int32')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') ### Remarks This property specifies a limit on the number of unique client applications that can be registered or authenticated by the application\. It's a crucial aspect of licensing enforcement, ensuring that the application usage does not exceed the terms agreed upon in the licensing contract\. A value of `null` indicates that there is no limit on the number of clients\. When the number of unique clients exceeds this limit, the application should enforce the licensing terms by restricting further client registrations or authentications, aligning with the compliance requirements\. ## License\.ExpiresAt Property {#Abblix.Oidc.Server.Features.Licensing.License.ExpiresAt} The expiration date and time of the license\. ```csharp public System.Nullable ExpiresAt { get; init; } ``` #### Property Value [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') ## License\.GracePeriod Property {#Abblix.Oidc.Server.Features.Licensing.License.GracePeriod} An optional grace period after the expiration date during which the license conditions are still considered valid\. ```csharp public System.Nullable GracePeriod { get; init; } ``` #### Property Value [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') ## License\.IssuerLimit Property {#Abblix.Oidc.Server.Features.Licensing.License.IssuerLimit} The maximum number of issuers that are recognized as valid by the application under the current license\. ```csharp public System.Nullable IssuerLimit { get; init; } ``` #### Property Value [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.Int32](https://learn.microsoft.com/en-us/dotnet/api/system.int32 'System\.Int32')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') ### Remarks This property defines a cap on the number of distinct issuers from which the application will accept tokens or claims\. It plays a vital role in controlling access and ensuring that the application's interactions are within the bounds set by its licensing terms\. A `null` value for this property implies that there's no restriction on the number of issuers\. Exceeding this limit may require the application to implement measures that block tokens or claims issued by additional issuers, thereby maintaining adherence to the licensing agreement\. ## License\.NotBefore Property {#Abblix.Oidc.Server.Features.Licensing.License.NotBefore} The date and time before which the license is not valid\. ```csharp public System.Nullable NotBefore { get; init; } ``` #### Property Value [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') ## License\.ValidIssuers Property {#Abblix.Oidc.Server.Features.Licensing.License.ValidIssuers} An array of strings representing the issuers that are considered valid for this license\. ```csharp public System.Collections.Generic.HashSet? ValidIssuers { get; init; } ``` #### Property Value [System\.Collections\.Generic\.HashSet<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.hashset-1 'System\.Collections\.Generic\.HashSet\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.hashset-1 'System\.Collections\.Generic\.HashSet\`1') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Licensing.LicenseChecker.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.Licensing](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Licensing 'Abblix\.Oidc\.Server\.Features\.Licensing') ## LicenseChecker Class Manages and enforces licensing constraints on clients and issuers within the application, ensuring compliance with defined licensing terms\. ```csharp public static class LicenseChecker ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → LicenseChecker ### Remarks This class dynamically validates the number of clients and issuers against the licensing terms, logging warnings or errors when the application operates beyond these constraints\. It supports real\-time updates to the license, allowing the application to adjust to new licenses dynamically\. ### Methods ## LicenseChecker\.CheckClientLicense\(this ClientInfo\) Method {#Abblix.Oidc.Server.Features.Licensing.LicenseChecker.CheckClientLicense(thisAbblix.Oidc.Server.Features.ClientInformation.ClientInfo)} Applies licensing checks to client information\. ```csharp public static Abblix.Oidc.Server.Features.ClientInformation.ClientInfo? CheckClientLicense(this Abblix.Oidc.Server.Features.ClientInformation.ClientInfo? clientInfo); ``` #### Parameters ###### `clientInfo` [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') {#Abblix.Oidc.Server.Features.Licensing.LicenseChecker.CheckClientLicense(thisAbblix.Oidc.Server.Features.ClientInformation.ClientInfo).clientInfo} The client information to check against licensing constraints\. #### Returns [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') The client information if it complies with the licensing constraints; otherwise, logs an error\. ## LicenseChecker\.CheckIssuer\(string\) Method {#Abblix.Oidc.Server.Features.Licensing.LicenseChecker.CheckIssuer(string)} Applies licensing checks to an issuer value\. ```csharp public static string CheckIssuer(string issuer); ``` #### Parameters ###### `issuer` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.Licensing.LicenseChecker.CheckIssuer(string).issuer} The issuer to check against licensing constraints\. #### Returns [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') The issuer if it complies with the licensing constraints; otherwise, logs an error\. ## LicenseChecker\.WithLicenseCheck\(this Task\\) Method {#Abblix.Oidc.Server.Features.Licensing.LicenseChecker.WithLicenseCheck(thisSystem.Threading.Tasks.Task_Abblix.Oidc.Server.Features.ClientInformation.ClientInfo_)} Asynchronously applies licensing checks to a task that returns client information\. ```csharp public static System.Threading.Tasks.Task WithLicenseCheck(this System.Threading.Tasks.Task clientInfo); ``` #### Parameters ###### `clientInfo` [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') {#Abblix.Oidc.Server.Features.Licensing.LicenseChecker.WithLicenseCheck(thisSystem.Threading.Tasks.Task_Abblix.Oidc.Server.Features.ClientInformation.ClientInfo_).clientInfo} The task returning client information to be checked against licensing constraints\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task that, upon completion, returns the client information if it complies with the licensing constraints; otherwise, logs an error\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Licensing.LicenseLoader.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.Licensing](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Licensing 'Abblix\.Oidc\.Server\.Features\.Licensing') ## LicenseLoader Class Handles the loading and validation of application licenses provided as JSON Web Tokens \(JWT\)\. ```csharp public static class LicenseLoader ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → LicenseLoader ### Remarks This class is responsible for validating the integrity and authenticity of the license JWT against predefined criteria, including issuer validation and signature verification\. Upon successful validation, it extracts and applies license details to configure application features and limits accordingly\. ### Methods ## LicenseLoader\.LoadAsync\(string\) Method {#Abblix.Oidc.Server.Features.Licensing.LicenseLoader.LoadAsync(string)} Asynchronously loads and validates the license JWT, applying the license details upon successful validation\. ```csharp public static System.Threading.Tasks.Task LoadAsync(string licenseJwt); ``` #### Parameters ###### `licenseJwt` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.Licensing.LicenseLoader.LoadAsync(string).licenseJwt} The license JWT string to be loaded and validated\. #### Returns [System\.Threading\.Tasks\.Task](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task 'System\.Threading\.Tasks\.Task') A [System\.Threading\.Tasks\.Task](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task 'System\.Threading\.Tasks\.Task') representing the asynchronous operation\. #### Exceptions [System\.InvalidOperationException](https://learn.microsoft.com/en-us/dotnet/api/system.invalidoperationexception 'System\.InvalidOperationException') Thrown if the JWT type is not valid or if the license cannot be validated\. [UnexpectedTypeException](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Exceptions.UnexpectedTypeException 'Abblix\.Oidc\.Server\.Common\.Exceptions\.UnexpectedTypeException') Thrown if an unexpected validation result type is encountered\. ### Remarks Loading reports nothing, deliberately\. A caller loads licenses one at a time, so every load but the last sees a partial set, and a license in its grace period would be announced before the renewal superseding it had arrived \- once per superseded license, and only in the arrival order that puts the older one first\. What the licenses mean is said on the next consult instead, and once at startup by the hosted service the registration extensions install, which is the moment the set has provably stopped growing\. A host loading licenses through this method after startup therefore gets no record from the load itself\. The consult that follows says everything except that a license still valid is expiring soon, which is the one status a valid cached license never reaches\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Licensing.LicenseManager.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.Licensing](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Licensing 'Abblix\.Oidc\.Server\.Features\.Licensing') ## LicenseManager Class Manages the application's licenses, ensuring that the current license is appropriately evaluated based on its validity period\. ```csharp public class LicenseManager ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → LicenseManager ### Remarks This class supports the addition of multiple licenses and determines the active license by considering their validity periods\. It uses a thread\-safe approach to manage concurrent access to the licenses list, allowing for efficient reads and safe updates\. ### Methods ## LicenseManager\.AddLicense\(License\) Method {#Abblix.Oidc.Server.Features.Licensing.LicenseManager.AddLicense(Abblix.Oidc.Server.Features.Licensing.License)} Adds a new license to the application, placing it in the correct position based on its validity period\. ```csharp public void AddLicense(Abblix.Oidc.Server.Features.Licensing.License license); ``` #### Parameters ###### `license` [License](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Licensing.License 'Abblix\.Oidc\.Server\.Features\.Licensing\.License') {#Abblix.Oidc.Server.Features.Licensing.LicenseManager.AddLicense(Abblix.Oidc.Server.Features.Licensing.License).license} The license to be added\. ### Remarks The method inserts the license into a sorted list, ensuring that licenses are ordered based on their validity periods\. This ordering facilitates the determination of the current active license\. ## LicenseManager\.GetLicenses\(\) Method {#Abblix.Oidc.Server.Features.Licensing.LicenseManager.GetLicenses()} Provides access to the currently managed licenses\. ```csharp public System.Collections.Generic.IEnumerable GetLicenses(); ``` #### Returns [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[License](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Licensing.License 'Abblix\.Oidc\.Server\.Features\.Licensing\.License')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') A sequence of all licenses managed by the LicenseManager\. ## LicenseManager\.TryGetCurrentLicenseLimit\(DateTimeOffset\) Method {#Abblix.Oidc.Server.Features.Licensing.LicenseManager.TryGetCurrentLicenseLimit(System.DateTimeOffset)} Attempts to retrieve the current license from the LicenseManager based on the given moment in time\. ```csharp public Abblix.Oidc.Server.Features.Licensing.License? TryGetCurrentLicenseLimit(System.DateTimeOffset utcNow); ``` #### Parameters ###### `utcNow` [System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset') {#Abblix.Oidc.Server.Features.Licensing.LicenseManager.TryGetCurrentLicenseLimit(System.DateTimeOffset).utcNow} The current UTC time to determine the active license\. #### Returns [License](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Licensing.License 'Abblix\.Oidc\.Server\.Features\.Licensing\.License') The current license if one is active and valid, otherwise null\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Licensing.LicenseStatus.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.Licensing](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Licensing 'Abblix\.Oidc\.Server\.Features\.Licensing') ## LicenseStatus Enum Specifies the status of a license in relation to its validity period and current date and time\. ```csharp public enum LicenseStatus ``` ### Fields ###### `NotActiveYet` 0 {#Abblix.Oidc.Server.Features.Licensing.LicenseStatus.NotActiveYet} Indicates that the license is not active yet according to its defined validity period\. ###### `Active` 1 {#Abblix.Oidc.Server.Features.Licensing.LicenseStatus.Active} Indicates that the license is currently active and within its validity period\. ###### `GracePeriod` 2 {#Abblix.Oidc.Server.Features.Licensing.LicenseStatus.GracePeriod} Indicates that the license has expired but is still within its grace period, during which it may continue to be considered as valid under certain conditions\. ###### `Expired` 3 {#Abblix.Oidc.Server.Features.Licensing.LicenseStatus.Expired} Indicates that the license has expired and is beyond its grace period, if any, and is therefore no longer valid\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Licensing.OptionsLicenseJwtProvider.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.Licensing](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Licensing 'Abblix\.Oidc\.Server\.Features\.Licensing') ## OptionsLicenseJwtProvider Class An [ILicenseJwtProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Licensing.ILicenseJwtProvider 'Abblix\.Oidc\.Server\.Features\.Licensing\.ILicenseJwtProvider') backed by the [LicenseJwt](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions#Abblix.Oidc.Server.Common.Configuration.OidcOptions.LicenseJwt 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions\.LicenseJwt') value resolved through the options pattern\. ```csharp public class OptionsLicenseJwtProvider : Abblix.Oidc.Server.Features.Licensing.ILicenseJwtProvider ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → OptionsLicenseJwtProvider Implements [ILicenseJwtProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Licensing.ILicenseJwtProvider 'Abblix\.Oidc\.Server\.Features\.Licensing\.ILicenseJwtProvider') ### Remarks Returns a single\-element async sequence containing the configured license JWT, or null when no license JWT has been configured\. Used as the default provider when the host configures the license through standard configuration sources \(appsettings, environment variables, etc\.\)\. ### Constructors ## OptionsLicenseJwtProvider\(IOptions\\) Constructor {#Abblix.Oidc.Server.Features.Licensing.OptionsLicenseJwtProvider.OptionsLicenseJwtProvider(Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_)} An [ILicenseJwtProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Licensing.ILicenseJwtProvider 'Abblix\.Oidc\.Server\.Features\.Licensing\.ILicenseJwtProvider') backed by the [LicenseJwt](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions#Abblix.Oidc.Server.Common.Configuration.OidcOptions.LicenseJwt 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions\.LicenseJwt') value resolved through the options pattern\. ```csharp public OptionsLicenseJwtProvider(Microsoft.Extensions.Options.IOptions options); ``` #### Parameters ###### `options` [Microsoft\.Extensions\.Options\.IOptions<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptions-1 'Microsoft\.Extensions\.Options\.IOptions\`1')[OidcOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptions-1 'Microsoft\.Extensions\.Options\.IOptions\`1') {#Abblix.Oidc.Server.Features.Licensing.OptionsLicenseJwtProvider.OptionsLicenseJwtProvider(Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_).options} ### Remarks Returns a single\-element async sequence containing the configured license JWT, or null when no license JWT has been configured\. Used as the default provider when the host configures the license through standard configuration sources \(appsettings, environment variables, etc\.\)\. ### Methods ## OptionsLicenseJwtProvider\.GetLicenseJwtAsync\(\) Method {#Abblix.Oidc.Server.Features.Licensing.OptionsLicenseJwtProvider.GetLicenseJwtAsync()} Asynchronously retrieves the license JWT from the OIDC service configuration\. ```csharp public System.Collections.Generic.IAsyncEnumerable? GetLicenseJwtAsync(); ``` Implements [GetLicenseJwtAsync\(\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Licensing.ILicenseJwtProvider#Abblix.Oidc.Server.Features.Licensing.ILicenseJwtProvider.GetLicenseJwtAsync() 'Abblix\.Oidc\.Server\.Features\.Licensing\.ILicenseJwtProvider\.GetLicenseJwtAsync\(\)') #### Returns [System\.Collections\.Generic\.IAsyncEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.iasyncenumerable-1 'System\.Collections\.Generic\.IAsyncEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.iasyncenumerable-1 'System\.Collections\.Generic\.IAsyncEnumerable\`1') A task representing the asynchronous operation, which upon completion contains the license JWT used for validating the configuration and licensing terms of the OIDC service\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Licensing.StaticLicenseJwtProvider.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.Licensing](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Licensing 'Abblix\.Oidc\.Server\.Features\.Licensing') ## StaticLicenseJwtProvider Class An implementation of [ILicenseJwtProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Licensing.ILicenseJwtProvider 'Abblix\.Oidc\.Server\.Features\.Licensing\.ILicenseJwtProvider') that returns a predefined license JWT string\. ```csharp public class StaticLicenseJwtProvider : Abblix.Oidc.Server.Features.Licensing.ILicenseJwtProvider ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → StaticLicenseJwtProvider Implements [ILicenseJwtProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Licensing.ILicenseJwtProvider 'Abblix\.Oidc\.Server\.Features\.Licensing\.ILicenseJwtProvider') ### Remarks This class is designed for scenarios where the license JWT is statically known at the time of application initialization\. It could be particularly useful in testing environments or situations where the license JWT is obtained from external sources and passed directly to the application without the need for asynchronous retrieval from a configuration store or service\. ### Constructors ## StaticLicenseJwtProvider\(string\) Constructor {#Abblix.Oidc.Server.Features.Licensing.StaticLicenseJwtProvider.StaticLicenseJwtProvider(string)} An implementation of [ILicenseJwtProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Licensing.ILicenseJwtProvider 'Abblix\.Oidc\.Server\.Features\.Licensing\.ILicenseJwtProvider') that returns a predefined license JWT string\. ```csharp public StaticLicenseJwtProvider(string licenseJwt); ``` #### Parameters ###### `licenseJwt` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.Licensing.StaticLicenseJwtProvider.StaticLicenseJwtProvider(string).licenseJwt} ### Remarks This class is designed for scenarios where the license JWT is statically known at the time of application initialization\. It could be particularly useful in testing environments or situations where the license JWT is obtained from external sources and passed directly to the application without the need for asynchronous retrieval from a configuration store or service\. ### Methods ## StaticLicenseJwtProvider\.GetLicenseJwtAsync\(\) Method {#Abblix.Oidc.Server.Features.Licensing.StaticLicenseJwtProvider.GetLicenseJwtAsync()} Asynchronously returns the predefined license JWT string\. ```csharp public System.Collections.Generic.IAsyncEnumerable GetLicenseJwtAsync(); ``` Implements [GetLicenseJwtAsync\(\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Licensing.ILicenseJwtProvider#Abblix.Oidc.Server.Features.Licensing.ILicenseJwtProvider.GetLicenseJwtAsync() 'Abblix\.Oidc\.Server\.Features\.Licensing\.ILicenseJwtProvider\.GetLicenseJwtAsync\(\)') #### Returns [System\.Collections\.Generic\.IAsyncEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.iasyncenumerable-1 'System\.Collections\.Generic\.IAsyncEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.iasyncenumerable-1 'System\.Collections\.Generic\.IAsyncEnumerable\`1') A task that returns the license JWT string\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ## Abblix\.Oidc\.Server\.Features\.LogoutNotification Namespace | Classes | | | :--- | :--- | | [BackChannelLogoutNotifier](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.BackChannelLogoutNotifier 'Abblix\.Oidc\.Server\.Features\.LogoutNotification\.BackChannelLogoutNotifier') | Implements the mechanism for notifying clients about logout events through the back\-channel, leveraging logout tokens to securely communicate the logout state to client applications\. | | [BackChannelLogoutTokenSender](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.BackChannelLogoutTokenSender 'Abblix\.Oidc\.Server\.Features\.LogoutNotification\.BackChannelLogoutTokenSender') | Implements the functionality to send logout tokens to clients via back\-channel communication, adhering to the OpenID Connect back\-channel logout specification\. | | [BackChannelLogoutTransport](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.BackChannelLogoutTransport 'Abblix\.Oidc\.Server\.Features\.LogoutNotification\.BackChannelLogoutTransport') | The HTTP transport back\-channel logout tokens travel on, to the URI a client registered\. | | [CompositeLogoutNotifier](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.CompositeLogoutNotifier 'Abblix\.Oidc\.Server\.Features\.LogoutNotification\.CompositeLogoutNotifier') | Provides a mechanism to aggregate and execute multiple logout notification strategies for an OpenID Connect or OAuth 2\.0 system\. | | [FrontChannelLogoutNotifier](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.FrontChannelLogoutNotifier 'Abblix\.Oidc\.Server\.Features\.LogoutNotification\.FrontChannelLogoutNotifier') | Implements OpenID Connect Front\-Channel Logout 1\.0 notification by collecting per\-client logout URIs \(with `iss` and `sid` appended when the client requires session identifiers\) into the [LogoutContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.LogoutContext 'Abblix\.Oidc\.Server\.Features\.LogoutNotification\.LogoutContext')\. The end\-session endpoint later renders these URIs as iframes so each client receives the logout signal through the user agent\. | | [FrontChannelLogoutResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.FrontChannelLogoutResponse 'Abblix\.Oidc\.Server\.Features\.LogoutNotification\.FrontChannelLogoutResponse') | Represents the response for a front\-channel logout page in OpenID Connect\. Contains complete HTML content with CSP nonce already injected\. | | [FrontChannelLogoutService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.FrontChannelLogoutService 'Abblix\.Oidc\.Server\.Features\.LogoutNotification\.FrontChannelLogoutService') | Implements front\-channel logout HTML generation in accordance with OpenID Connect Front\-Channel Logout 1\.0 specification\. | | [LogoutContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.LogoutContext 'Abblix\.Oidc\.Server\.Features\.LogoutNotification\.LogoutContext') | Represents the context for a logout operation, containing details necessary for processing the logout\. This context includes the session identifier, the subject identifier of the user, the issuer of the authentication token, and a collection of URIs for front\-channel logout notifications\. | | [LogoutTokenEvents](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.LogoutTokenEvents 'Abblix\.Oidc\.Server\.Features\.LogoutNotification\.LogoutTokenEvents') | The security event identifiers this server emits for logout notification\. An event identifier is a wire name every receiver keys on, so it lives as a constant rather than a literal beside its first use\. | | Interfaces | | | :--- | :--- | | [IFrontChannelLogoutService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.IFrontChannelLogoutService 'Abblix\.Oidc\.Server\.Features\.LogoutNotification\.IFrontChannelLogoutService') | Service for generating front\-channel logout HTML responses in accordance with OpenID Connect Front\-Channel Logout 1\.0 specification\. | | [ILogoutNotifier](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.ILogoutNotifier 'Abblix\.Oidc\.Server\.Features\.LogoutNotification\.ILogoutNotifier') | Defines an interface for a service responsible for notifying clients about logout events\. This interface supports both front\-channel and back\-channel logout mechanisms, allowing implementations to handle client notifications through direct user agent redirection or server\-to\-server communication, respectively\. | | [ILogoutTokenSender](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.ILogoutTokenSender 'Abblix\.Oidc\.Server\.Features\.LogoutNotification\.ILogoutTokenSender') | Defines the interface for a service responsible for sending logout tokens to clients via the back\-channel\. | --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.BackChannelLogoutNotifier.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.LogoutNotification](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification 'Abblix\.Oidc\.Server\.Features\.LogoutNotification') ## BackChannelLogoutNotifier Class Implements the mechanism for notifying clients about logout events through the back\-channel, leveraging logout tokens to securely communicate the logout state to client applications\. ```csharp public class BackChannelLogoutNotifier : Abblix.Oidc.Server.Features.LogoutNotification.ILogoutNotifier ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → BackChannelLogoutNotifier Implements [ILogoutNotifier](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.ILogoutNotifier 'Abblix\.Oidc\.Server\.Features\.LogoutNotification\.ILogoutNotifier') ### Constructors ## BackChannelLogoutNotifier\(ILogoutTokenService, ILogoutTokenSender\) Constructor {#Abblix.Oidc.Server.Features.LogoutNotification.BackChannelLogoutNotifier.BackChannelLogoutNotifier(Abblix.Oidc.Server.Features.Tokens.ILogoutTokenService,Abblix.Oidc.Server.Features.LogoutNotification.ILogoutTokenSender)} Implements the mechanism for notifying clients about logout events through the back\-channel, leveraging logout tokens to securely communicate the logout state to client applications\. ```csharp public BackChannelLogoutNotifier(Abblix.Oidc.Server.Features.Tokens.ILogoutTokenService logoutTokenService, Abblix.Oidc.Server.Features.LogoutNotification.ILogoutTokenSender logoutTokenSender); ``` #### Parameters ###### `logoutTokenService` [ILogoutTokenService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.ILogoutTokenService 'Abblix\.Oidc\.Server\.Features\.Tokens\.ILogoutTokenService') {#Abblix.Oidc.Server.Features.LogoutNotification.BackChannelLogoutNotifier.BackChannelLogoutNotifier(Abblix.Oidc.Server.Features.Tokens.ILogoutTokenService,Abblix.Oidc.Server.Features.LogoutNotification.ILogoutTokenSender).logoutTokenService} The service responsible for creating logout tokens that encapsulate the details of the logout event\. ###### `logoutTokenSender` [ILogoutTokenSender](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.ILogoutTokenSender 'Abblix\.Oidc\.Server\.Features\.LogoutNotification\.ILogoutTokenSender') {#Abblix.Oidc.Server.Features.LogoutNotification.BackChannelLogoutNotifier.BackChannelLogoutNotifier(Abblix.Oidc.Server.Features.Tokens.ILogoutTokenService,Abblix.Oidc.Server.Features.LogoutNotification.ILogoutTokenSender).logoutTokenSender} The service responsible for sending the logout tokens to the client applications via back\-channel communication\. ### Properties ## BackChannelLogoutNotifier\.BackChannelLogoutSessionSupported Property {#Abblix.Oidc.Server.Features.LogoutNotification.BackChannelLogoutNotifier.BackChannelLogoutSessionSupported} Indicates whether the logout notifier supports back\-channel logout session management, facilitating the management of user sessions during a back\-channel logout\. ```csharp public bool BackChannelLogoutSessionSupported { get; } ``` Implements [BackChannelLogoutSessionSupported](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.ILogoutNotifier#Abblix.Oidc.Server.Features.LogoutNotification.ILogoutNotifier.BackChannelLogoutSessionSupported 'Abblix\.Oidc\.Server\.Features\.LogoutNotification\.ILogoutNotifier\.BackChannelLogoutSessionSupported') #### Property Value [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') ## BackChannelLogoutNotifier\.BackChannelLogoutSupported Property {#Abblix.Oidc.Server.Features.LogoutNotification.BackChannelLogoutNotifier.BackChannelLogoutSupported} Indicates whether the logout notifier supports back\-channel logout, enabling server\-to\-server communication to notify clients of logout events\. ```csharp public bool BackChannelLogoutSupported { get; } ``` Implements [BackChannelLogoutSupported](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.ILogoutNotifier#Abblix.Oidc.Server.Features.LogoutNotification.ILogoutNotifier.BackChannelLogoutSupported 'Abblix\.Oidc\.Server\.Features\.LogoutNotification\.ILogoutNotifier\.BackChannelLogoutSupported') #### Property Value [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') ## BackChannelLogoutNotifier\.FrontChannelLogoutSessionSupported Property {#Abblix.Oidc.Server.Features.LogoutNotification.BackChannelLogoutNotifier.FrontChannelLogoutSessionSupported} Indicates whether the logout notifier supports front\-channel logout session management, allowing for more precise control over session termination during a front\-channel logout\. ```csharp public bool FrontChannelLogoutSessionSupported { get; } ``` Implements [FrontChannelLogoutSessionSupported](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.ILogoutNotifier#Abblix.Oidc.Server.Features.LogoutNotification.ILogoutNotifier.FrontChannelLogoutSessionSupported 'Abblix\.Oidc\.Server\.Features\.LogoutNotification\.ILogoutNotifier\.FrontChannelLogoutSessionSupported') #### Property Value [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') ## BackChannelLogoutNotifier\.FrontChannelLogoutSupported Property {#Abblix.Oidc.Server.Features.LogoutNotification.BackChannelLogoutNotifier.FrontChannelLogoutSupported} Indicates whether the logout notifier supports front\-channel logout, enabling clients to be notified of logout events via user\-agent redirection\. ```csharp public bool FrontChannelLogoutSupported { get; } ``` Implements [FrontChannelLogoutSupported](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.ILogoutNotifier#Abblix.Oidc.Server.Features.LogoutNotification.ILogoutNotifier.FrontChannelLogoutSupported 'Abblix\.Oidc\.Server\.Features\.LogoutNotification\.ILogoutNotifier\.FrontChannelLogoutSupported') #### Property Value [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') ### Methods ## BackChannelLogoutNotifier\.NotifyClientAsync\(ClientInfo, LogoutContext\) Method {#Abblix.Oidc.Server.Features.LogoutNotification.BackChannelLogoutNotifier.NotifyClientAsync(Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,Abblix.Oidc.Server.Features.LogoutNotification.LogoutContext)} Asynchronously notifies a client of a logout event by creating a logout token and sending it to the client's back\-channel logout endpoint\. This ensures that the client application is informed about the logout event and can take appropriate actions, such as invalidating the user's session\. ```csharp public System.Threading.Tasks.Task NotifyClientAsync(Abblix.Oidc.Server.Features.ClientInformation.ClientInfo clientInfo, Abblix.Oidc.Server.Features.LogoutNotification.LogoutContext logoutContext); ``` #### Parameters ###### `clientInfo` [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') {#Abblix.Oidc.Server.Features.LogoutNotification.BackChannelLogoutNotifier.NotifyClientAsync(Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,Abblix.Oidc.Server.Features.LogoutNotification.LogoutContext).clientInfo} The client information, including the back\-channel logout URI, to which the logout notification should be sent\. ###### `logoutContext` [LogoutContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.LogoutContext 'Abblix\.Oidc\.Server\.Features\.LogoutNotification\.LogoutContext') {#Abblix.Oidc.Server.Features.LogoutNotification.BackChannelLogoutNotifier.NotifyClientAsync(Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,Abblix.Oidc.Server.Features.LogoutNotification.LogoutContext).logoutContext} The context of the logout event, containing details such as the subject identifier and session identifier, which are included in the logout token\. Implements [NotifyClientAsync\(ClientInfo, LogoutContext\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.ILogoutNotifier#Abblix.Oidc.Server.Features.LogoutNotification.ILogoutNotifier.NotifyClientAsync(Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,Abblix.Oidc.Server.Features.LogoutNotification.LogoutContext) 'Abblix\.Oidc\.Server\.Features\.LogoutNotification\.ILogoutNotifier\.NotifyClientAsync\(Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo, Abblix\.Oidc\.Server\.Features\.LogoutNotification\.LogoutContext\)') #### Returns [System\.Threading\.Tasks\.Task](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task 'System\.Threading\.Tasks\.Task') A task that completes when the notification has been successfully sent to the client's back\-channel logout endpoint\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.BackChannelLogoutTokenSender.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.LogoutNotification](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification 'Abblix\.Oidc\.Server\.Features\.LogoutNotification') ## BackChannelLogoutTokenSender Class Implements the functionality to send logout tokens to clients via back\-channel communication, adhering to the OpenID Connect back\-channel logout specification\. ```csharp public class BackChannelLogoutTokenSender : Abblix.Oidc.Server.Features.LogoutNotification.ILogoutTokenSender ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → BackChannelLogoutTokenSender Implements [ILogoutTokenSender](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.ILogoutTokenSender 'Abblix\.Oidc\.Server\.Features\.LogoutNotification\.ILogoutTokenSender') ### Constructors ## BackChannelLogoutTokenSender\(ILogger\, HttpClient\) Constructor {#Abblix.Oidc.Server.Features.LogoutNotification.BackChannelLogoutTokenSender.BackChannelLogoutTokenSender(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.LogoutNotification.BackChannelLogoutTokenSender_,System.Net.Http.HttpClient)} Implements the functionality to send logout tokens to clients via back\-channel communication, adhering to the OpenID Connect back\-channel logout specification\. ```csharp public BackChannelLogoutTokenSender(Microsoft.Extensions.Logging.ILogger logger, System.Net.Http.HttpClient backChannelHttpClient); ``` #### Parameters ###### `logger` [Microsoft\.Extensions\.Logging\.ILogger<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1')[BackChannelLogoutTokenSender](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.BackChannelLogoutTokenSender 'Abblix\.Oidc\.Server\.Features\.LogoutNotification\.BackChannelLogoutTokenSender')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1') {#Abblix.Oidc.Server.Features.LogoutNotification.BackChannelLogoutTokenSender.BackChannelLogoutTokenSender(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.LogoutNotification.BackChannelLogoutTokenSender_,System.Net.Http.HttpClient).logger} The logger to use for logging information about the logout token sending process\. ###### `backChannelHttpClient` [System\.Net\.Http\.HttpClient](https://learn.microsoft.com/en-us/dotnet/api/system.net.http.httpclient 'System\.Net\.Http\.HttpClient') {#Abblix.Oidc.Server.Features.LogoutNotification.BackChannelLogoutTokenSender.BackChannelLogoutTokenSender(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.LogoutNotification.BackChannelLogoutTokenSender_,System.Net.Http.HttpClient).backChannelHttpClient} The HTTP client used for sending the logout tokens to clients over the back channel\. ### Methods ## BackChannelLogoutTokenSender\.SendBackChannelLogoutAsync\(ClientInfo, EncodedJsonWebToken\) Method {#Abblix.Oidc.Server.Features.LogoutNotification.BackChannelLogoutTokenSender.SendBackChannelLogoutAsync(Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,Abblix.Oidc.Server.Features.Tokens.EncodedJsonWebToken)} Asynchronously sends a logout token directly to a client over the back channel\. ```csharp public System.Threading.Tasks.Task SendBackChannelLogoutAsync(Abblix.Oidc.Server.Features.ClientInformation.ClientInfo clientInfo, Abblix.Oidc.Server.Features.Tokens.EncodedJsonWebToken logoutToken); ``` #### Parameters ###### `clientInfo` [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') {#Abblix.Oidc.Server.Features.LogoutNotification.BackChannelLogoutTokenSender.SendBackChannelLogoutAsync(Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,Abblix.Oidc.Server.Features.Tokens.EncodedJsonWebToken).clientInfo} Information about the client to which the logout token is sent\. ###### `logoutToken` [EncodedJsonWebToken](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.EncodedJsonWebToken 'Abblix\.Oidc\.Server\.Features\.Tokens\.EncodedJsonWebToken') {#Abblix.Oidc.Server.Features.LogoutNotification.BackChannelLogoutTokenSender.SendBackChannelLogoutAsync(Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,Abblix.Oidc.Server.Features.Tokens.EncodedJsonWebToken).logoutToken} The logout token to be sent\. Implements [SendBackChannelLogoutAsync\(ClientInfo, EncodedJsonWebToken\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.ILogoutTokenSender#Abblix.Oidc.Server.Features.LogoutNotification.ILogoutTokenSender.SendBackChannelLogoutAsync(Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,Abblix.Oidc.Server.Features.Tokens.EncodedJsonWebToken) 'Abblix\.Oidc\.Server\.Features\.LogoutNotification\.ILogoutTokenSender\.SendBackChannelLogoutAsync\(Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo, Abblix\.Oidc\.Server\.Features\.Tokens\.EncodedJsonWebToken\)') #### Returns [System\.Threading\.Tasks\.Task](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task 'System\.Threading\.Tasks\.Task') A task representing the asynchronous operation of sending the logout token\. ### Remarks This method constructs a back\-channel HTTP POST request containing the logout token and sends it to the client's back\-channel logout URI\. It ensures that the HTTP response indicates successful delivery of the logout token\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.BackChannelLogoutTransport.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.LogoutNotification](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification 'Abblix\.Oidc\.Server\.Features\.LogoutNotification') ## BackChannelLogoutTransport Class The HTTP transport back\-channel logout tokens travel on, to the URI a client registered\. ```csharp public static class BackChannelLogoutTransport ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → BackChannelLogoutTransport ### Fields ## BackChannelLogoutTransport\.HttpClientName Field {#Abblix.Oidc.Server.Features.LogoutNotification.BackChannelLogoutTransport.HttpClientName} The name the transport's client is registered under, published so a host can configure it without copying the string: `services.AddHttpClient(BackChannelLogoutTransport.HttpClientName)` reaches the same client the sender resolves\. ```csharp public const string HttpClientName = "ILogoutTokenSender"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks The value is the contract's name because this is a typed client, and that is the logical name `AddHttpClient` gives it\. Reference the constant rather than spelling that rule out at every call site\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.CompositeLogoutNotifier.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.LogoutNotification](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification 'Abblix\.Oidc\.Server\.Features\.LogoutNotification') ## CompositeLogoutNotifier Class Provides a mechanism to aggregate and execute multiple logout notification strategies for an OpenID Connect or OAuth 2\.0 system\. ```csharp public class CompositeLogoutNotifier : Abblix.Oidc.Server.Features.LogoutNotification.ILogoutNotifier ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → CompositeLogoutNotifier Implements [ILogoutNotifier](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.ILogoutNotifier 'Abblix\.Oidc\.Server\.Features\.LogoutNotification\.ILogoutNotifier') ### Remarks This class allows the system to support various logout mechanisms simultaneously, such as front\-channel and back\-channel logout, by combining multiple [ILogoutNotifier](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.ILogoutNotifier 'Abblix\.Oidc\.Server\.Features\.LogoutNotification\.ILogoutNotifier') implementations\. It ensures that all configured logout notifiers are invoked to notify clients about the logout event, catering to different client capabilities and configurations\. ### Constructors ## CompositeLogoutNotifier\(ILogoutNotifier\[\]\) Constructor {#Abblix.Oidc.Server.Features.LogoutNotification.CompositeLogoutNotifier.CompositeLogoutNotifier(Abblix.Oidc.Server.Features.LogoutNotification.ILogoutNotifier[])} Provides a mechanism to aggregate and execute multiple logout notification strategies for an OpenID Connect or OAuth 2\.0 system\. ```csharp public CompositeLogoutNotifier(Abblix.Oidc.Server.Features.LogoutNotification.ILogoutNotifier[] logoutNotifiers); ``` #### Parameters ###### `logoutNotifiers` [ILogoutNotifier](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.ILogoutNotifier 'Abblix\.Oidc\.Server\.Features\.LogoutNotification\.ILogoutNotifier')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Oidc.Server.Features.LogoutNotification.CompositeLogoutNotifier.CompositeLogoutNotifier(Abblix.Oidc.Server.Features.LogoutNotification.ILogoutNotifier[]).logoutNotifiers} An array of [ILogoutNotifier](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.ILogoutNotifier 'Abblix\.Oidc\.Server\.Features\.LogoutNotification\.ILogoutNotifier') implementations for handling logout notifications\. ### Remarks This class allows the system to support various logout mechanisms simultaneously, such as front\-channel and back\-channel logout, by combining multiple [ILogoutNotifier](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.ILogoutNotifier 'Abblix\.Oidc\.Server\.Features\.LogoutNotification\.ILogoutNotifier') implementations\. It ensures that all configured logout notifiers are invoked to notify clients about the logout event, catering to different client capabilities and configurations\. ### Properties ## CompositeLogoutNotifier\.BackChannelLogoutSessionSupported Property {#Abblix.Oidc.Server.Features.LogoutNotification.CompositeLogoutNotifier.BackChannelLogoutSessionSupported} Indicates whether the logout notifier supports back\-channel logout session management, facilitating the management of user sessions during a back\-channel logout\. ```csharp public bool BackChannelLogoutSessionSupported { get; } ``` Implements [BackChannelLogoutSessionSupported](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.ILogoutNotifier#Abblix.Oidc.Server.Features.LogoutNotification.ILogoutNotifier.BackChannelLogoutSessionSupported 'Abblix\.Oidc\.Server\.Features\.LogoutNotification\.ILogoutNotifier\.BackChannelLogoutSessionSupported') #### Property Value [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') ## CompositeLogoutNotifier\.BackChannelLogoutSupported Property {#Abblix.Oidc.Server.Features.LogoutNotification.CompositeLogoutNotifier.BackChannelLogoutSupported} Indicates whether the logout notifier supports back\-channel logout, enabling server\-to\-server communication to notify clients of logout events\. ```csharp public bool BackChannelLogoutSupported { get; } ``` Implements [BackChannelLogoutSupported](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.ILogoutNotifier#Abblix.Oidc.Server.Features.LogoutNotification.ILogoutNotifier.BackChannelLogoutSupported 'Abblix\.Oidc\.Server\.Features\.LogoutNotification\.ILogoutNotifier\.BackChannelLogoutSupported') #### Property Value [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') ## CompositeLogoutNotifier\.FrontChannelLogoutSessionSupported Property {#Abblix.Oidc.Server.Features.LogoutNotification.CompositeLogoutNotifier.FrontChannelLogoutSessionSupported} Indicates whether the logout notifier supports front\-channel logout session management, allowing for more precise control over session termination during a front\-channel logout\. ```csharp public bool FrontChannelLogoutSessionSupported { get; } ``` Implements [FrontChannelLogoutSessionSupported](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.ILogoutNotifier#Abblix.Oidc.Server.Features.LogoutNotification.ILogoutNotifier.FrontChannelLogoutSessionSupported 'Abblix\.Oidc\.Server\.Features\.LogoutNotification\.ILogoutNotifier\.FrontChannelLogoutSessionSupported') #### Property Value [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') ## CompositeLogoutNotifier\.FrontChannelLogoutSupported Property {#Abblix.Oidc.Server.Features.LogoutNotification.CompositeLogoutNotifier.FrontChannelLogoutSupported} Indicates whether the logout notifier supports front\-channel logout, enabling clients to be notified of logout events via user\-agent redirection\. ```csharp public bool FrontChannelLogoutSupported { get; } ``` Implements [FrontChannelLogoutSupported](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.ILogoutNotifier#Abblix.Oidc.Server.Features.LogoutNotification.ILogoutNotifier.FrontChannelLogoutSupported 'Abblix\.Oidc\.Server\.Features\.LogoutNotification\.ILogoutNotifier\.FrontChannelLogoutSupported') #### Property Value [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') ### Methods ## CompositeLogoutNotifier\.NotifyClientAsync\(ClientInfo, LogoutContext\) Method {#Abblix.Oidc.Server.Features.LogoutNotification.CompositeLogoutNotifier.NotifyClientAsync(Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,Abblix.Oidc.Server.Features.LogoutNotification.LogoutContext)} Asynchronously notifies all configured clients about a logout event by invoking each registered logout notifier\. ```csharp public System.Threading.Tasks.Task NotifyClientAsync(Abblix.Oidc.Server.Features.ClientInformation.ClientInfo clientInfo, Abblix.Oidc.Server.Features.LogoutNotification.LogoutContext logoutContext); ``` #### Parameters ###### `clientInfo` [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') {#Abblix.Oidc.Server.Features.LogoutNotification.CompositeLogoutNotifier.NotifyClientAsync(Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,Abblix.Oidc.Server.Features.LogoutNotification.LogoutContext).clientInfo} The information about the client that is being notified of the logout event\. ###### `logoutContext` [LogoutContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.LogoutContext 'Abblix\.Oidc\.Server\.Features\.LogoutNotification\.LogoutContext') {#Abblix.Oidc.Server.Features.LogoutNotification.CompositeLogoutNotifier.NotifyClientAsync(Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,Abblix.Oidc.Server.Features.LogoutNotification.LogoutContext).logoutContext} Contextual information related to the logout event, including the user and session identifiers\. Implements [NotifyClientAsync\(ClientInfo, LogoutContext\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.ILogoutNotifier#Abblix.Oidc.Server.Features.LogoutNotification.ILogoutNotifier.NotifyClientAsync(Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,Abblix.Oidc.Server.Features.LogoutNotification.LogoutContext) 'Abblix\.Oidc\.Server\.Features\.LogoutNotification\.ILogoutNotifier\.NotifyClientAsync\(Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo, Abblix\.Oidc\.Server\.Features\.LogoutNotification\.LogoutContext\)') #### Returns [System\.Threading\.Tasks\.Task](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task 'System\.Threading\.Tasks\.Task') A task that completes when all clients are notified\. ### Remarks This method ensures that each logout notifier is called, regardless of the individual notifier's outcome\. It allows for a unified approach to logout notifications, accommodating various client requirements and logout mechanisms\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.FrontChannelLogoutNotifier.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.LogoutNotification](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification 'Abblix\.Oidc\.Server\.Features\.LogoutNotification') ## FrontChannelLogoutNotifier Class Implements OpenID Connect Front\-Channel Logout 1\.0 notification by collecting per\-client logout URIs \(with `iss` and `sid` appended when the client requires session identifiers\) into the [LogoutContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.LogoutContext 'Abblix\.Oidc\.Server\.Features\.LogoutNotification\.LogoutContext')\. The end\-session endpoint later renders these URIs as iframes so each client receives the logout signal through the user agent\. ```csharp public class FrontChannelLogoutNotifier : Abblix.Oidc.Server.Features.LogoutNotification.ILogoutNotifier ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → FrontChannelLogoutNotifier Implements [ILogoutNotifier](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.ILogoutNotifier 'Abblix\.Oidc\.Server\.Features\.LogoutNotification\.ILogoutNotifier') ### Properties ## FrontChannelLogoutNotifier\.BackChannelLogoutSessionSupported Property {#Abblix.Oidc.Server.Features.LogoutNotification.FrontChannelLogoutNotifier.BackChannelLogoutSessionSupported} Indicates whether the logout notifier supports back\-channel logout session management, facilitating the management of user sessions during a back\-channel logout\. ```csharp public bool BackChannelLogoutSessionSupported { get; } ``` Implements [BackChannelLogoutSessionSupported](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.ILogoutNotifier#Abblix.Oidc.Server.Features.LogoutNotification.ILogoutNotifier.BackChannelLogoutSessionSupported 'Abblix\.Oidc\.Server\.Features\.LogoutNotification\.ILogoutNotifier\.BackChannelLogoutSessionSupported') #### Property Value [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') ## FrontChannelLogoutNotifier\.BackChannelLogoutSupported Property {#Abblix.Oidc.Server.Features.LogoutNotification.FrontChannelLogoutNotifier.BackChannelLogoutSupported} Indicates whether the logout notifier supports back\-channel logout, enabling server\-to\-server communication to notify clients of logout events\. ```csharp public bool BackChannelLogoutSupported { get; } ``` Implements [BackChannelLogoutSupported](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.ILogoutNotifier#Abblix.Oidc.Server.Features.LogoutNotification.ILogoutNotifier.BackChannelLogoutSupported 'Abblix\.Oidc\.Server\.Features\.LogoutNotification\.ILogoutNotifier\.BackChannelLogoutSupported') #### Property Value [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') ## FrontChannelLogoutNotifier\.FrontChannelLogoutSessionSupported Property {#Abblix.Oidc.Server.Features.LogoutNotification.FrontChannelLogoutNotifier.FrontChannelLogoutSessionSupported} Indicates whether the logout notifier supports front\-channel logout session management, allowing for more precise control over session termination during a front\-channel logout\. ```csharp public bool FrontChannelLogoutSessionSupported { get; } ``` Implements [FrontChannelLogoutSessionSupported](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.ILogoutNotifier#Abblix.Oidc.Server.Features.LogoutNotification.ILogoutNotifier.FrontChannelLogoutSessionSupported 'Abblix\.Oidc\.Server\.Features\.LogoutNotification\.ILogoutNotifier\.FrontChannelLogoutSessionSupported') #### Property Value [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') ## FrontChannelLogoutNotifier\.FrontChannelLogoutSupported Property {#Abblix.Oidc.Server.Features.LogoutNotification.FrontChannelLogoutNotifier.FrontChannelLogoutSupported} Indicates whether the logout notifier supports front\-channel logout, enabling clients to be notified of logout events via user\-agent redirection\. ```csharp public bool FrontChannelLogoutSupported { get; } ``` Implements [FrontChannelLogoutSupported](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.ILogoutNotifier#Abblix.Oidc.Server.Features.LogoutNotification.ILogoutNotifier.FrontChannelLogoutSupported 'Abblix\.Oidc\.Server\.Features\.LogoutNotification\.ILogoutNotifier\.FrontChannelLogoutSupported') #### Property Value [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') ### Methods ## FrontChannelLogoutNotifier\.NotifyClientAsync\(ClientInfo, LogoutContext\) Method {#Abblix.Oidc.Server.Features.LogoutNotification.FrontChannelLogoutNotifier.NotifyClientAsync(Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,Abblix.Oidc.Server.Features.LogoutNotification.LogoutContext)} Builds the client's front\-channel logout URI \(appending `iss` and `sid` when the client's `frontchannel_logout_session_required` is set\) and adds it to [FrontChannelLogoutRequestUris](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.LogoutContext#Abblix.Oidc.Server.Features.LogoutNotification.LogoutContext.FrontChannelLogoutRequestUris 'Abblix\.Oidc\.Server\.Features\.LogoutNotification\.LogoutContext\.FrontChannelLogoutRequestUris') for later iframe rendering\. Throws [System\.InvalidOperationException](https://learn.microsoft.com/en-us/dotnet/api/system.invalidoperationexception 'System\.InvalidOperationException') if the client requires `sid` but the context has no session identifier\. ```csharp public System.Threading.Tasks.Task NotifyClientAsync(Abblix.Oidc.Server.Features.ClientInformation.ClientInfo clientInfo, Abblix.Oidc.Server.Features.LogoutNotification.LogoutContext logoutContext); ``` #### Parameters ###### `clientInfo` [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') {#Abblix.Oidc.Server.Features.LogoutNotification.FrontChannelLogoutNotifier.NotifyClientAsync(Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,Abblix.Oidc.Server.Features.LogoutNotification.LogoutContext).clientInfo} Information about the client that needs to be notified of the logout event\. ###### `logoutContext` [LogoutContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.LogoutContext 'Abblix\.Oidc\.Server\.Features\.LogoutNotification\.LogoutContext') {#Abblix.Oidc.Server.Features.LogoutNotification.FrontChannelLogoutNotifier.NotifyClientAsync(Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,Abblix.Oidc.Server.Features.LogoutNotification.LogoutContext).logoutContext} Contextual information about the logout event, including the session ID and issuer\. Implements [NotifyClientAsync\(ClientInfo, LogoutContext\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.ILogoutNotifier#Abblix.Oidc.Server.Features.LogoutNotification.ILogoutNotifier.NotifyClientAsync(Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,Abblix.Oidc.Server.Features.LogoutNotification.LogoutContext) 'Abblix\.Oidc\.Server\.Features\.LogoutNotification\.ILogoutNotifier\.NotifyClientAsync\(Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo, Abblix\.Oidc\.Server\.Features\.LogoutNotification\.LogoutContext\)') #### Returns [System\.Threading\.Tasks\.Task](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task 'System\.Threading\.Tasks\.Task') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.FrontChannelLogoutResponse.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.LogoutNotification](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification 'Abblix\.Oidc\.Server\.Features\.LogoutNotification') ## FrontChannelLogoutResponse Class Represents the response for a front\-channel logout page in OpenID Connect\. Contains complete HTML content with CSP nonce already injected\. ```csharp public record FrontChannelLogoutResponse : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → FrontChannelLogoutResponse Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[FrontChannelLogoutResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.FrontChannelLogoutResponse 'Abblix\.Oidc\.Server\.Features\.LogoutNotification\.FrontChannelLogoutResponse')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Constructors ## FrontChannelLogoutResponse\(string, string, IReadOnlyList\\) Constructor {#Abblix.Oidc.Server.Features.LogoutNotification.FrontChannelLogoutResponse.FrontChannelLogoutResponse(string,string,System.Collections.Generic.IReadOnlyList_string_)} Represents the response for a front\-channel logout page in OpenID Connect\. Contains complete HTML content with CSP nonce already injected\. ```csharp public FrontChannelLogoutResponse(string HtmlContent, string Nonce, System.Collections.Generic.IReadOnlyList FrameSources); ``` #### Parameters ###### `HtmlContent` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.LogoutNotification.FrontChannelLogoutResponse.FrontChannelLogoutResponse(string,string,System.Collections.Generic.IReadOnlyList_string_).HtmlContent} The complete HTML content ready to be rendered\. ###### `Nonce` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.LogoutNotification.FrontChannelLogoutResponse.FrontChannelLogoutResponse(string,string,System.Collections.Generic.IReadOnlyList_string_).Nonce} The CSP nonce value used in the HTML for script\-src and style\-src directives\. ###### `FrameSources` [System\.Collections\.Generic\.IReadOnlyList<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ireadonlylist-1 'System\.Collections\.Generic\.IReadOnlyList\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ireadonlylist-1 'System\.Collections\.Generic\.IReadOnlyList\`1') {#Abblix.Oidc.Server.Features.LogoutNotification.FrontChannelLogoutResponse.FrontChannelLogoutResponse(string,string,System.Collections.Generic.IReadOnlyList_string_).FrameSources} Unique origins for CSP frame\-src directive\. ### Properties ## FrontChannelLogoutResponse\.FrameSources Property {#Abblix.Oidc.Server.Features.LogoutNotification.FrontChannelLogoutResponse.FrameSources} Unique origins for CSP frame\-src directive\. ```csharp public System.Collections.Generic.IReadOnlyList FrameSources { get; init; } ``` #### Property Value [System\.Collections\.Generic\.IReadOnlyList<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ireadonlylist-1 'System\.Collections\.Generic\.IReadOnlyList\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ireadonlylist-1 'System\.Collections\.Generic\.IReadOnlyList\`1') ## FrontChannelLogoutResponse\.HtmlContent Property {#Abblix.Oidc.Server.Features.LogoutNotification.FrontChannelLogoutResponse.HtmlContent} The complete HTML content ready to be rendered\. ```csharp public string HtmlContent { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## FrontChannelLogoutResponse\.Nonce Property {#Abblix.Oidc.Server.Features.LogoutNotification.FrontChannelLogoutResponse.Nonce} The CSP nonce value used in the HTML for script\-src and style\-src directives\. ```csharp public string Nonce { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.FrontChannelLogoutService.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.LogoutNotification](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification 'Abblix\.Oidc\.Server\.Features\.LogoutNotification') ## FrontChannelLogoutService Class Implements front\-channel logout HTML generation in accordance with OpenID Connect Front\-Channel Logout 1\.0 specification\. ```csharp public class FrontChannelLogoutService : Abblix.Oidc.Server.Features.LogoutNotification.IFrontChannelLogoutService ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → FrontChannelLogoutService Implements [IFrontChannelLogoutService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.IFrontChannelLogoutService 'Abblix\.Oidc\.Server\.Features\.LogoutNotification\.IFrontChannelLogoutService') ### Methods ## FrontChannelLogoutService\.GetFrontChannelLogoutResponse\(Uri, IList\\) Method {#Abblix.Oidc.Server.Features.LogoutNotification.FrontChannelLogoutService.GetFrontChannelLogoutResponse(System.Uri,System.Collections.Generic.IList_System.Uri_)} Generates the HTML response for a front\-channel logout page\. The response contains iframes for each logout URI and an optional redirect script\. ```csharp public Abblix.Oidc.Server.Features.LogoutNotification.FrontChannelLogoutResponse GetFrontChannelLogoutResponse(System.Uri? postLogoutRedirectUri, System.Collections.Generic.IList frontChannelLogoutUris); ``` #### Parameters ###### `postLogoutRedirectUri` [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri') {#Abblix.Oidc.Server.Features.LogoutNotification.FrontChannelLogoutService.GetFrontChannelLogoutResponse(System.Uri,System.Collections.Generic.IList_System.Uri_).postLogoutRedirectUri} The URI to redirect to after all iframes have loaded, or null for no redirect\. ###### `frontChannelLogoutUris` [System\.Collections\.Generic\.IList<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ilist-1 'System\.Collections\.Generic\.IList\`1')[System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ilist-1 'System\.Collections\.Generic\.IList\`1') {#Abblix.Oidc.Server.Features.LogoutNotification.FrontChannelLogoutService.GetFrontChannelLogoutResponse(System.Uri,System.Collections.Generic.IList_System.Uri_).frontChannelLogoutUris} The list of client logout URIs to embed as iframes\. Implements [GetFrontChannelLogoutResponse\(Uri, IList<Uri>\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.IFrontChannelLogoutService#Abblix.Oidc.Server.Features.LogoutNotification.IFrontChannelLogoutService.GetFrontChannelLogoutResponse(System.Uri,System.Collections.Generic.IList_System.Uri_) 'Abblix\.Oidc\.Server\.Features\.LogoutNotification\.IFrontChannelLogoutService\.GetFrontChannelLogoutResponse\(System\.Uri, System\.Collections\.Generic\.IList\\)') #### Returns [FrontChannelLogoutResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.FrontChannelLogoutResponse 'Abblix\.Oidc\.Server\.Features\.LogoutNotification\.FrontChannelLogoutResponse') A response containing complete HTML with CSP nonce already injected\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.IFrontChannelLogoutService.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.LogoutNotification](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification 'Abblix\.Oidc\.Server\.Features\.LogoutNotification') ## IFrontChannelLogoutService Interface Service for generating front\-channel logout HTML responses in accordance with OpenID Connect Front\-Channel Logout 1\.0 specification\. ```csharp public interface IFrontChannelLogoutService ``` Derived ↳ [FrontChannelLogoutService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.FrontChannelLogoutService 'Abblix\.Oidc\.Server\.Features\.LogoutNotification\.FrontChannelLogoutService') ### Methods ## IFrontChannelLogoutService\.GetFrontChannelLogoutResponse\(Uri, IList\\) Method {#Abblix.Oidc.Server.Features.LogoutNotification.IFrontChannelLogoutService.GetFrontChannelLogoutResponse(System.Uri,System.Collections.Generic.IList_System.Uri_)} Generates the HTML response for a front\-channel logout page\. The response contains iframes for each logout URI and an optional redirect script\. ```csharp Abblix.Oidc.Server.Features.LogoutNotification.FrontChannelLogoutResponse GetFrontChannelLogoutResponse(System.Uri? postLogoutRedirectUri, System.Collections.Generic.IList frontChannelLogoutUris); ``` #### Parameters ###### `postLogoutRedirectUri` [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri') {#Abblix.Oidc.Server.Features.LogoutNotification.IFrontChannelLogoutService.GetFrontChannelLogoutResponse(System.Uri,System.Collections.Generic.IList_System.Uri_).postLogoutRedirectUri} The URI to redirect to after all iframes have loaded, or null for no redirect\. ###### `frontChannelLogoutUris` [System\.Collections\.Generic\.IList<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ilist-1 'System\.Collections\.Generic\.IList\`1')[System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ilist-1 'System\.Collections\.Generic\.IList\`1') {#Abblix.Oidc.Server.Features.LogoutNotification.IFrontChannelLogoutService.GetFrontChannelLogoutResponse(System.Uri,System.Collections.Generic.IList_System.Uri_).frontChannelLogoutUris} The list of client logout URIs to embed as iframes\. #### Returns [FrontChannelLogoutResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.FrontChannelLogoutResponse 'Abblix\.Oidc\.Server\.Features\.LogoutNotification\.FrontChannelLogoutResponse') A response containing complete HTML with CSP nonce already injected\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.ILogoutNotifier.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.LogoutNotification](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification 'Abblix\.Oidc\.Server\.Features\.LogoutNotification') ## ILogoutNotifier Interface Defines an interface for a service responsible for notifying clients about logout events\. This interface supports both front\-channel and back\-channel logout mechanisms, allowing implementations to handle client notifications through direct user agent redirection or server\-to\-server communication, respectively\. ```csharp public interface ILogoutNotifier ``` Derived ↳ [BackChannelLogoutNotifier](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.BackChannelLogoutNotifier 'Abblix\.Oidc\.Server\.Features\.LogoutNotification\.BackChannelLogoutNotifier') ↳ [CompositeLogoutNotifier](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.CompositeLogoutNotifier 'Abblix\.Oidc\.Server\.Features\.LogoutNotification\.CompositeLogoutNotifier') ↳ [FrontChannelLogoutNotifier](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.FrontChannelLogoutNotifier 'Abblix\.Oidc\.Server\.Features\.LogoutNotification\.FrontChannelLogoutNotifier') ### Properties ## ILogoutNotifier\.BackChannelLogoutSessionSupported Property {#Abblix.Oidc.Server.Features.LogoutNotification.ILogoutNotifier.BackChannelLogoutSessionSupported} Indicates whether the logout notifier supports back\-channel logout session management, facilitating the management of user sessions during a back\-channel logout\. ```csharp bool BackChannelLogoutSessionSupported { get; } ``` #### Property Value [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') ## ILogoutNotifier\.BackChannelLogoutSupported Property {#Abblix.Oidc.Server.Features.LogoutNotification.ILogoutNotifier.BackChannelLogoutSupported} Indicates whether the logout notifier supports back\-channel logout, enabling server\-to\-server communication to notify clients of logout events\. ```csharp bool BackChannelLogoutSupported { get; } ``` #### Property Value [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') ## ILogoutNotifier\.FrontChannelLogoutSessionSupported Property {#Abblix.Oidc.Server.Features.LogoutNotification.ILogoutNotifier.FrontChannelLogoutSessionSupported} Indicates whether the logout notifier supports front\-channel logout session management, allowing for more precise control over session termination during a front\-channel logout\. ```csharp bool FrontChannelLogoutSessionSupported { get; } ``` #### Property Value [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') ## ILogoutNotifier\.FrontChannelLogoutSupported Property {#Abblix.Oidc.Server.Features.LogoutNotification.ILogoutNotifier.FrontChannelLogoutSupported} Indicates whether the logout notifier supports front\-channel logout, enabling clients to be notified of logout events via user\-agent redirection\. ```csharp bool FrontChannelLogoutSupported { get; } ``` #### Property Value [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') ### Methods ## ILogoutNotifier\.NotifyClientAsync\(ClientInfo, LogoutContext\) Method {#Abblix.Oidc.Server.Features.LogoutNotification.ILogoutNotifier.NotifyClientAsync(Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,Abblix.Oidc.Server.Features.LogoutNotification.LogoutContext)} Asynchronously notifies a client about a logout event, providing the client with information necessary to process the logout on its end\. ```csharp System.Threading.Tasks.Task NotifyClientAsync(Abblix.Oidc.Server.Features.ClientInformation.ClientInfo clientInfo, Abblix.Oidc.Server.Features.LogoutNotification.LogoutContext logoutContext); ``` #### Parameters ###### `clientInfo` [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') {#Abblix.Oidc.Server.Features.LogoutNotification.ILogoutNotifier.NotifyClientAsync(Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,Abblix.Oidc.Server.Features.LogoutNotification.LogoutContext).clientInfo} The information about the client that needs to be notified\. This includes details such as the client ID and the logout endpoint URI\. ###### `logoutContext` [LogoutContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.LogoutContext 'Abblix\.Oidc\.Server\.Features\.LogoutNotification\.LogoutContext') {#Abblix.Oidc.Server.Features.LogoutNotification.ILogoutNotifier.NotifyClientAsync(Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,Abblix.Oidc.Server.Features.LogoutNotification.LogoutContext).logoutContext} The context of the logout event, including any relevant information such as the session ID and the subject ID of the user\. This context is essential for clients to understand the scope and reason for the logout, enabling them to perform appropriate actions, such as clearing session data or redirecting the user\. #### Returns [System\.Threading\.Tasks\.Task](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task 'System\.Threading\.Tasks\.Task') A [System\.Threading\.Tasks\.Task](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task 'System\.Threading\.Tasks\.Task') representing the asynchronous operation of notifying the client\. The task completes when the notification has been successfully sent to the client or an attempt has been made to notify the client\. ### Remarks Implementations of this interface should handle any exceptions that occur during the notification process and ensure that all clients are notified as configured, regardless of the mechanism used \(front\-channel or back\-channel\)\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.ILogoutTokenSender.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.LogoutNotification](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification 'Abblix\.Oidc\.Server\.Features\.LogoutNotification') ## ILogoutTokenSender Interface Defines the interface for a service responsible for sending logout tokens to clients via the back\-channel\. ```csharp public interface ILogoutTokenSender ``` Derived ↳ [BackChannelLogoutTokenSender](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.BackChannelLogoutTokenSender 'Abblix\.Oidc\.Server\.Features\.LogoutNotification\.BackChannelLogoutTokenSender') ### Methods ## ILogoutTokenSender\.SendBackChannelLogoutAsync\(ClientInfo, EncodedJsonWebToken\) Method {#Abblix.Oidc.Server.Features.LogoutNotification.ILogoutTokenSender.SendBackChannelLogoutAsync(Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,Abblix.Oidc.Server.Features.Tokens.EncodedJsonWebToken)} Asynchronously sends a logout token to a client using back\-channel communication\. ```csharp System.Threading.Tasks.Task SendBackChannelLogoutAsync(Abblix.Oidc.Server.Features.ClientInformation.ClientInfo clientInfo, Abblix.Oidc.Server.Features.Tokens.EncodedJsonWebToken logoutToken); ``` #### Parameters ###### `clientInfo` [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') {#Abblix.Oidc.Server.Features.LogoutNotification.ILogoutTokenSender.SendBackChannelLogoutAsync(Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,Abblix.Oidc.Server.Features.Tokens.EncodedJsonWebToken).clientInfo} The information about the client to which the logout token will be sent\. This includes the client's identifier and any relevant endpoints for back\-channel communication\. ###### `logoutToken` [EncodedJsonWebToken](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.EncodedJsonWebToken 'Abblix\.Oidc\.Server\.Features\.Tokens\.EncodedJsonWebToken') {#Abblix.Oidc.Server.Features.LogoutNotification.ILogoutTokenSender.SendBackChannelLogoutAsync(Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,Abblix.Oidc.Server.Features.Tokens.EncodedJsonWebToken).logoutToken} The logout token that encapsulates the logout information\. This token is typically a JSON Web Token \(JWT\) that contains claims relevant to the logout event, such as the subject identifier and the session identifier\. #### Returns [System\.Threading\.Tasks\.Task](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task 'System\.Threading\.Tasks\.Task') A [System\.Threading\.Tasks\.Task](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task 'System\.Threading\.Tasks\.Task') representing the asynchronous operation of sending the logout token\. The task completes when the logout token has been successfully sent to the client's back\-channel endpoint, or an attempt has been made to send the token\. ### Remarks Implementations of this interface are responsible for securely transmitting the logout token to the client's back\-channel endpoint specified in the [clientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.ILogoutTokenSender#Abblix.Oidc.Server.Features.LogoutNotification.ILogoutTokenSender.SendBackChannelLogoutAsync(Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,Abblix.Oidc.Server.Features.Tokens.EncodedJsonWebToken).clientInfo 'Abblix\.Oidc\.Server\.Features\.LogoutNotification\.ILogoutTokenSender\.SendBackChannelLogoutAsync\(Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo, Abblix\.Oidc\.Server\.Features\.Tokens\.EncodedJsonWebToken\)\.clientInfo')\. This process usually involves making an HTTP POST request to the client's back\-channel logout URI with the logout token included in the request body\. It's important for implementations to handle any errors or exceptions that may occur during the transmission process and ensure proper logging and error handling mechanisms are in place\. This ensures that logout events are reliably communicated to clients, even in scenarios where direct user\-agent\-based communication \(front\-channel logout\) is not feasible\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.LogoutContext.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.LogoutNotification](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification 'Abblix\.Oidc\.Server\.Features\.LogoutNotification') ## LogoutContext Class Represents the context for a logout operation, containing details necessary for processing the logout\. This context includes the session identifier, the subject identifier of the user, the issuer of the authentication token, and a collection of URIs for front\-channel logout notifications\. ```csharp public record LogoutContext : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → LogoutContext Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[LogoutContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.LogoutContext 'Abblix\.Oidc\.Server\.Features\.LogoutNotification\.LogoutContext')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Constructors ## LogoutContext\(string, string, string\) Constructor {#Abblix.Oidc.Server.Features.LogoutNotification.LogoutContext.LogoutContext(string,string,string)} Represents the context for a logout operation, containing details necessary for processing the logout\. This context includes the session identifier, the subject identifier of the user, the issuer of the authentication token, and a collection of URIs for front\-channel logout notifications\. ```csharp public LogoutContext(string SessionId, string SubjectId, string Issuer); ``` #### Parameters ###### `SessionId` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.LogoutNotification.LogoutContext.LogoutContext(string,string,string).SessionId} ###### `SubjectId` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.LogoutNotification.LogoutContext.LogoutContext(string,string,string).SubjectId} ###### `Issuer` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.LogoutNotification.LogoutContext.LogoutContext(string,string,string).Issuer} ### Properties ## LogoutContext\.FrontChannelLogoutRequestUris Property {#Abblix.Oidc.Server.Features.LogoutNotification.LogoutContext.FrontChannelLogoutRequestUris} A list of URIs for sending front\-channel logout requests\. These URIs are intended for notifying relevant parties of the logout event through the front\-channel, enabling the propagation of logout notifications to clients or services that need to respond to the logout event\. ```csharp public System.Collections.Generic.IList FrontChannelLogoutRequestUris { get; init; } ``` #### Property Value [System\.Collections\.Generic\.IList<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ilist-1 'System\.Collections\.Generic\.IList\`1')[System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ilist-1 'System\.Collections\.Generic\.IList\`1') ## LogoutContext\.Issuer Property {#Abblix.Oidc.Server.Features.LogoutNotification.LogoutContext.Issuer} The issuer of the logout event\. This is typically represented by the URL of the authentication server that issued the original authentication token, allowing the identification of the authority responsible for the user's authentication\. ```csharp public string Issuer { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## LogoutContext\.SessionId Property {#Abblix.Oidc.Server.Features.LogoutNotification.LogoutContext.SessionId} The session ID associated with the logout event\. This identifier is typically used to identify and terminate the specific session that the logout request pertains to\. ```csharp public string SessionId { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## LogoutContext\.SubjectId Property {#Abblix.Oidc.Server.Features.LogoutNotification.LogoutContext.SubjectId} The subject ID of the user initiating the logout\. This identifier usually corresponds to the unique identifier of the user within the identity system, facilitating the identification of the user across different services or components\. ```csharp public string SubjectId { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.LogoutTokenEvents.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.LogoutNotification](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification 'Abblix\.Oidc\.Server\.Features\.LogoutNotification') ## LogoutTokenEvents Class The security event identifiers this server emits for logout notification\. An event identifier is a wire name every receiver keys on, so it lives as a constant rather than a literal beside its first use\. ```csharp public static class LogoutTokenEvents ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → LogoutTokenEvents ### Fields ## LogoutTokenEvents\.BackChannelLogout Field {#Abblix.Oidc.Server.Features.LogoutNotification.LogoutTokenEvents.BackChannelLogout} The Back\-Channel Logout event statement's identifier, fixed by OpenID Connect Back\-Channel Logout 1\.0 Section 2\.4: the member under the "events" claim whose presence is what makes a token a logout order\. Its value is always the empty JSON object, as the specification requires\. ```csharp public const string BackChannelLogout = "http://schemas.openid.net/event/backchannel-logout"; ``` #### Field Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Nonces.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ## Abblix\.Oidc\.Server\.Features\.Nonces Namespace | Classes | | | :--- | :--- | | [NonceOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Nonces.NonceOptions 'Abblix\.Oidc\.Server\.Features\.Nonces\.NonceOptions') | Base configuration class for the generic stateless\-nonce service\. Each feature that needs server\-issued, time\-bounded opaque tokens \(DPoP\-Nonce per RFC 9449 §8 / §9 is the current consumer; future candidates include state\-parameter validation and challenge\-response patterns\) defines its own subclass \- see [DPoPNonceOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.DPoPNonceOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.DPoPNonceOptions') \- and adds its own slot under [OidcOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions')\. This base governs only the primitive's own concerns: issuance window and secret\-rotation cadence\. Feature\-specific policy \(e\.g\. which DPoP endpoints require a nonce\) lives on the corresponding subclass\. | | [RollingHmacNonceService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Nonces.RollingHmacNonceService 'Abblix\.Oidc\.Server\.Features\.Nonces\.RollingHmacNonceService') | HMAC\-SHA256 backed implementation of [INonceService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Nonces.INonceService 'Abblix\.Oidc\.Server\.Features\.Nonces\.INonceService')\. Issues stateless nonces of the form `Base64Url(timestamp_8B || HMAC-SHA256(secret, timestamp_8B)[..16])` where `secret` is rotated on a configurable cadence and shared across server instances via [Microsoft\.Extensions\.Caching\.Distributed\.IDistributedCache](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.caching.distributed.idistributedcache 'Microsoft\.Extensions\.Caching\.Distributed\.IDistributedCache'), keyed by time bucket\. | | Interfaces | | | :--- | :--- | | [INonceService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Nonces.INonceService 'Abblix\.Oidc\.Server\.Features\.Nonces\.INonceService') | Issues and validates server\-issued opaque, time\-bounded nonces\. The current consumer is DPoP\-Nonce per RFC 9449 §8 / §9 \- the server returns a nonce via the `DPoP-Nonce` response header and the client echoes it back in the `nonce` claim of a subsequent DPoP proof to prove freshness \- but the primitive is intentionally generic: any future feature needing challenge\-response freshness checks can resolve the same service\. | | Enums | | | :--- | :--- | | [NonceValidationFailure](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Nonces.NonceValidationFailure 'Abblix\.Oidc\.Server\.Features\.Nonces\.NonceValidationFailure') | Reasons a server\-issued nonce can fail validation\. The categories are for log filters and metrics \- at the protocol layer DPoP\-Nonce flows surface every failure as the same RFC 9449 §8 `use_dpop_nonce` error with a freshly issued nonce in the response header, regardless of the underlying reason\. | --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Nonces.INonceService.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.Nonces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Nonces 'Abblix\.Oidc\.Server\.Features\.Nonces') ## INonceService Interface Issues and validates server\-issued opaque, time\-bounded nonces\. The current consumer is DPoP\-Nonce per RFC 9449 §8 / §9 \- the server returns a nonce via the `DPoP-Nonce` response header and the client echoes it back in the `nonce` claim of a subsequent DPoP proof to prove freshness \- but the primitive is intentionally generic: any future feature needing challenge\-response freshness checks can resolve the same service\. ```csharp public interface INonceService ``` Derived ↳ [RollingHmacNonceService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Nonces.RollingHmacNonceService 'Abblix\.Oidc\.Server\.Features\.Nonces\.RollingHmacNonceService') ### Remarks The default implementation is stateless modulo a short\-lived rotating HMAC secret stored in `IDistributedCache`\. No per\-nonce state is kept, so [ValidateAsync\(string, CancellationToken\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Nonces.INonceService#Abblix.Oidc.Server.Features.Nonces.INonceService.ValidateAsync(string,System.Threading.CancellationToken) 'Abblix\.Oidc\.Server\.Features\.Nonces\.INonceService\.ValidateAsync\(string, System\.Threading\.CancellationToken\)') does not enforce single\-use; replay protection at the proof level is handled separately by the `jti` replay cache\. ### Methods ## INonceService\.IssueAsync\(CancellationToken\) Method {#Abblix.Oidc.Server.Features.Nonces.INonceService.IssueAsync(System.Threading.CancellationToken)} Mints a fresh nonce string suitable for the `DPoP-Nonce` response header\. The returned value is opaque to callers \- clients must echo it verbatim\. ```csharp System.Threading.Tasks.Task IssueAsync(System.Threading.CancellationToken cancellationToken=default(System.Threading.CancellationToken)); ``` #### Parameters ###### `cancellationToken` [System\.Threading\.CancellationToken](https://learn.microsoft.com/en-us/dotnet/api/system.threading.cancellationtoken 'System\.Threading\.CancellationToken') {#Abblix.Oidc.Server.Features.Nonces.INonceService.IssueAsync(System.Threading.CancellationToken).cancellationToken} #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') ## INonceService\.ValidateAsync\(string, CancellationToken\) Method {#Abblix.Oidc.Server.Features.Nonces.INonceService.ValidateAsync(string,System.Threading.CancellationToken)} Verifies that [nonce](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Nonces.INonceService#Abblix.Oidc.Server.Features.Nonces.INonceService.ValidateAsync(string,System.Threading.CancellationToken).nonce 'Abblix\.Oidc\.Server\.Features\.Nonces\.INonceService\.ValidateAsync\(string, System\.Threading\.CancellationToken\)\.nonce') was issued by this deployment and is still within the acceptance window\. ```csharp System.Threading.Tasks.Task> ValidateAsync(string nonce, System.Threading.CancellationToken cancellationToken=default(System.Threading.CancellationToken)); ``` #### Parameters ###### `nonce` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.Nonces.INonceService.ValidateAsync(string,System.Threading.CancellationToken).nonce} The nonce string echoed by the client in its DPoP proof `nonce` claim\. ###### `cancellationToken` [System\.Threading\.CancellationToken](https://learn.microsoft.com/en-us/dotnet/api/system.threading.cancellationtoken 'System\.Threading\.CancellationToken') {#Abblix.Oidc.Server.Features.Nonces.INonceService.ValidateAsync(string,System.Threading.CancellationToken).cancellationToken} Cancellation token\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[NonceValidationFailure](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Nonces.NonceValidationFailure 'Abblix\.Oidc\.Server\.Features\.Nonces\.NonceValidationFailure')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') `null` when the nonce is acceptable, otherwise a [NonceValidationFailure](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Nonces.NonceValidationFailure 'Abblix\.Oidc\.Server\.Features\.Nonces\.NonceValidationFailure') describing why it is not\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Nonces.NonceOptions.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.Nonces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Nonces 'Abblix\.Oidc\.Server\.Features\.Nonces') ## NonceOptions Class Base configuration class for the generic stateless\-nonce service\. Each feature that needs server\-issued, time\-bounded opaque tokens \(DPoP\-Nonce per RFC 9449 §8 / §9 is the current consumer; future candidates include state\-parameter validation and challenge\-response patterns\) defines its own subclass \- see [DPoPNonceOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.DPoPNonceOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.DPoPNonceOptions') \- and adds its own slot under [OidcOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions')\. This base governs only the primitive's own concerns: issuance window and secret\-rotation cadence\. Feature\-specific policy \(e\.g\. which DPoP endpoints require a nonce\) lives on the corresponding subclass\. ```csharp public class NonceOptions ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → NonceOptions Derived ↳ [DPoPNonceOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.DPoPNonceOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.DPoPNonceOptions') ### Remarks The nonce service is stateless: nonces themselves are not stored\. Only a short\-lived rotating HMAC secret lives in `IDistributedCache`, keyed by time bucket so multiple server instances can validate each other's nonces without coordination\. Per RFC 9449 §11\.3 a nonce mismatch is recoverable \- the client receives a fresh nonce and retries \- so the brief window during secret rotation where two instances disagree on the current secret degrades to a single client\-side retry, not a hard failure\. ### Properties ## NonceOptions\.AcceptanceWindow Property {#Abblix.Oidc.Server.Features.Nonces.NonceOptions.AcceptanceWindow} Maximum age of a server\-issued nonce that the validator will still accept, measured against the timestamp embedded in the nonce\. Defaults to 5 minutes \- long enough to survive normal client clock skew and a retry round\-trip, short enough that a leaked nonce stops being useful quickly\. ```csharp public System.TimeSpan AcceptanceWindow { get; set; } ``` #### Property Value [System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan') ## NonceOptions\.RotationInterval Property {#Abblix.Oidc.Server.Features.Nonces.NonceOptions.RotationInterval} How often the HMAC secret used to sign nonces is rotated\. Each rotation boundary becomes a new cache bucket; [AcceptanceWindow](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Nonces.NonceOptions#Abblix.Oidc.Server.Features.Nonces.NonceOptions.AcceptanceWindow 'Abblix\.Oidc\.Server\.Features\.Nonces\.NonceOptions\.AcceptanceWindow') MUST be larger than this so an in\-flight nonce signed under the previous bucket's secret is still verifiable\. Defaults to 2 minutes\. ```csharp public System.TimeSpan RotationInterval { get; set; } ``` #### Property Value [System\.TimeSpan](https://learn.microsoft.com/en-us/dotnet/api/system.timespan 'System\.TimeSpan') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Nonces.NonceValidationFailure.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.Nonces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Nonces 'Abblix\.Oidc\.Server\.Features\.Nonces') ## NonceValidationFailure Enum Reasons a server\-issued nonce can fail validation\. The categories are for log filters and metrics \- at the protocol layer DPoP\-Nonce flows surface every failure as the same RFC 9449 §8 `use_dpop_nonce` error with a freshly issued nonce in the response header, regardless of the underlying reason\. ```csharp public enum NonceValidationFailure ``` ### Fields ###### `Malformed` 0 {#Abblix.Oidc.Server.Features.Nonces.NonceValidationFailure.Malformed} The nonce string could not be Base64Url\-decoded or has the wrong byte length to be one of ours\. Often a sign of a client mis\-handling the `DPoP-Nonce` header \(truncation, extra whitespace\) or of an attacker probing the endpoint\. ###### `OutOfWindow` 1 {#Abblix.Oidc.Server.Features.Nonces.NonceValidationFailure.OutOfWindow} The nonce decoded cleanly but its embedded timestamp is outside the configured acceptance window \- either older than `AcceptanceWindow` or too far in the future relative to server clock\. Routine for clients that cached a nonce too long\. ###### `BadSignature` 2 {#Abblix.Oidc.Server.Features.Nonces.NonceValidationFailure.BadSignature} The HMAC tag does not match what the server would compute for the embedded timestamp under any in\-rotation secret\. Indicates either tampering, a nonce minted by a different deployment, or a brief rotation race window where the issuing instance's secret has not yet propagated through `IDistributedCache`\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Nonces.RollingHmacNonceService.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.Nonces](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Nonces 'Abblix\.Oidc\.Server\.Features\.Nonces') ## RollingHmacNonceService Class HMAC\-SHA256 backed implementation of [INonceService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Nonces.INonceService 'Abblix\.Oidc\.Server\.Features\.Nonces\.INonceService')\. Issues stateless nonces of the form `Base64Url(timestamp_8B || HMAC-SHA256(secret, timestamp_8B)[..16])` where `secret` is rotated on a configurable cadence and shared across server instances via [Microsoft\.Extensions\.Caching\.Distributed\.IDistributedCache](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.caching.distributed.idistributedcache 'Microsoft\.Extensions\.Caching\.Distributed\.IDistributedCache'), keyed by time bucket\. ```csharp public class RollingHmacNonceService : Abblix.Oidc.Server.Features.Nonces.INonceService ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → RollingHmacNonceService Implements [INonceService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Nonces.INonceService 'Abblix\.Oidc\.Server\.Features\.Nonces\.INonceService') ### Remarks The bucketed\-secret design avoids any explicit lock or coordination on the rotation boundary: every instance derives the same bucket index from the nonce's embedded timestamp, looks up that bucket's secret in the distributed cache, and either finds it or creates one with last\-write\-wins semantics\. Per RFC 9449 §11\.3 a brief mismatch during the rotation race surfaces to the DPoP client as a single retry with a fresh `DPoP-Nonce` header, which is the protocol's intended recovery path; other consumers of this service get the analogous one\-retry behaviour through their own challenge\-response loop\. ### Constructors ## RollingHmacNonceService\(ILogger\, IDistributedCache, IOptionsMonitor\, TimeProvider\) Constructor {#Abblix.Oidc.Server.Features.Nonces.RollingHmacNonceService.RollingHmacNonceService(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.Nonces.RollingHmacNonceService_,Microsoft.Extensions.Caching.Distributed.IDistributedCache,Microsoft.Extensions.Options.IOptionsMonitor_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,System.TimeProvider)} HMAC\-SHA256 backed implementation of [INonceService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Nonces.INonceService 'Abblix\.Oidc\.Server\.Features\.Nonces\.INonceService')\. Issues stateless nonces of the form `Base64Url(timestamp_8B || HMAC-SHA256(secret, timestamp_8B)[..16])` where `secret` is rotated on a configurable cadence and shared across server instances via [Microsoft\.Extensions\.Caching\.Distributed\.IDistributedCache](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.caching.distributed.idistributedcache 'Microsoft\.Extensions\.Caching\.Distributed\.IDistributedCache'), keyed by time bucket\. ```csharp public RollingHmacNonceService(Microsoft.Extensions.Logging.ILogger logger, Microsoft.Extensions.Caching.Distributed.IDistributedCache cache, Microsoft.Extensions.Options.IOptionsMonitor options, System.TimeProvider timeProvider); ``` #### Parameters ###### `logger` [Microsoft\.Extensions\.Logging\.ILogger<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1')[RollingHmacNonceService](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Nonces.RollingHmacNonceService 'Abblix\.Oidc\.Server\.Features\.Nonces\.RollingHmacNonceService')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1') {#Abblix.Oidc.Server.Features.Nonces.RollingHmacNonceService.RollingHmacNonceService(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.Nonces.RollingHmacNonceService_,Microsoft.Extensions.Caching.Distributed.IDistributedCache,Microsoft.Extensions.Options.IOptionsMonitor_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,System.TimeProvider).logger} ###### `cache` [Microsoft\.Extensions\.Caching\.Distributed\.IDistributedCache](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.caching.distributed.idistributedcache 'Microsoft\.Extensions\.Caching\.Distributed\.IDistributedCache') {#Abblix.Oidc.Server.Features.Nonces.RollingHmacNonceService.RollingHmacNonceService(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.Nonces.RollingHmacNonceService_,Microsoft.Extensions.Caching.Distributed.IDistributedCache,Microsoft.Extensions.Options.IOptionsMonitor_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,System.TimeProvider).cache} ###### `options` [Microsoft\.Extensions\.Options\.IOptionsMonitor<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptionsmonitor-1 'Microsoft\.Extensions\.Options\.IOptionsMonitor\`1')[OidcOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptionsmonitor-1 'Microsoft\.Extensions\.Options\.IOptionsMonitor\`1') {#Abblix.Oidc.Server.Features.Nonces.RollingHmacNonceService.RollingHmacNonceService(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.Nonces.RollingHmacNonceService_,Microsoft.Extensions.Caching.Distributed.IDistributedCache,Microsoft.Extensions.Options.IOptionsMonitor_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,System.TimeProvider).options} ###### `timeProvider` [System\.TimeProvider](https://learn.microsoft.com/en-us/dotnet/api/system.timeprovider 'System\.TimeProvider') {#Abblix.Oidc.Server.Features.Nonces.RollingHmacNonceService.RollingHmacNonceService(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.Nonces.RollingHmacNonceService_,Microsoft.Extensions.Caching.Distributed.IDistributedCache,Microsoft.Extensions.Options.IOptionsMonitor_Abblix.Oidc.Server.Common.Configuration.OidcOptions_,System.TimeProvider).timeProvider} ### Remarks The bucketed\-secret design avoids any explicit lock or coordination on the rotation boundary: every instance derives the same bucket index from the nonce's embedded timestamp, looks up that bucket's secret in the distributed cache, and either finds it or creates one with last\-write\-wins semantics\. Per RFC 9449 §11\.3 a brief mismatch during the rotation race surfaces to the DPoP client as a single retry with a fresh `DPoP-Nonce` header, which is the protocol's intended recovery path; other consumers of this service get the analogous one\-retry behaviour through their own challenge\-response loop\. ### Methods ## RollingHmacNonceService\.IssueAsync\(CancellationToken\) Method {#Abblix.Oidc.Server.Features.Nonces.RollingHmacNonceService.IssueAsync(System.Threading.CancellationToken)} Mints a fresh nonce string suitable for the `DPoP-Nonce` response header\. The returned value is opaque to callers \- clients must echo it verbatim\. ```csharp public System.Threading.Tasks.Task IssueAsync(System.Threading.CancellationToken cancellationToken=default(System.Threading.CancellationToken)); ``` #### Parameters ###### `cancellationToken` [System\.Threading\.CancellationToken](https://learn.microsoft.com/en-us/dotnet/api/system.threading.cancellationtoken 'System\.Threading\.CancellationToken') {#Abblix.Oidc.Server.Features.Nonces.RollingHmacNonceService.IssueAsync(System.Threading.CancellationToken).cancellationToken} Implements [IssueAsync\(CancellationToken\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Nonces.INonceService#Abblix.Oidc.Server.Features.Nonces.INonceService.IssueAsync(System.Threading.CancellationToken) 'Abblix\.Oidc\.Server\.Features\.Nonces\.INonceService\.IssueAsync\(System\.Threading\.CancellationToken\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') ## RollingHmacNonceService\.ValidateAsync\(string, CancellationToken\) Method {#Abblix.Oidc.Server.Features.Nonces.RollingHmacNonceService.ValidateAsync(string,System.Threading.CancellationToken)} Verifies that [nonce](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Nonces.RollingHmacNonceService#Abblix.Oidc.Server.Features.Nonces.RollingHmacNonceService.ValidateAsync(string,System.Threading.CancellationToken).nonce 'Abblix\.Oidc\.Server\.Features\.Nonces\.RollingHmacNonceService\.ValidateAsync\(string, System\.Threading\.CancellationToken\)\.nonce') was issued by this deployment and is still within the acceptance window\. ```csharp public System.Threading.Tasks.Task> ValidateAsync(string nonce, System.Threading.CancellationToken cancellationToken=default(System.Threading.CancellationToken)); ``` #### Parameters ###### `nonce` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.Nonces.RollingHmacNonceService.ValidateAsync(string,System.Threading.CancellationToken).nonce} The nonce string echoed by the client in its DPoP proof `nonce` claim\. ###### `cancellationToken` [System\.Threading\.CancellationToken](https://learn.microsoft.com/en-us/dotnet/api/system.threading.cancellationtoken 'System\.Threading\.CancellationToken') {#Abblix.Oidc.Server.Features.Nonces.RollingHmacNonceService.ValidateAsync(string,System.Threading.CancellationToken).cancellationToken} Cancellation token\. Implements [ValidateAsync\(string, CancellationToken\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Nonces.INonceService#Abblix.Oidc.Server.Features.Nonces.INonceService.ValidateAsync(string,System.Threading.CancellationToken) 'Abblix\.Oidc\.Server\.Features\.Nonces\.INonceService\.ValidateAsync\(string, System\.Threading\.CancellationToken\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[NonceValidationFailure](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Nonces.NonceValidationFailure 'Abblix\.Oidc\.Server\.Features\.Nonces\.NonceValidationFailure')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') `null` when the nonce is acceptable, otherwise a [NonceValidationFailure](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Nonces.NonceValidationFailure 'Abblix\.Oidc\.Server\.Features\.Nonces\.NonceValidationFailure') describing why it is not\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.NoneFlow.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ## Abblix\.Oidc\.Server\.Features\.NoneFlow Namespace | Classes | | | :--- | :--- | | [NoneResponseBuilder](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.NoneFlow.NoneResponseBuilder 'Abblix\.Oidc\.Server\.Features\.NoneFlow\.NoneResponseBuilder') | Builds the `none` response\-type component of an authorization endpoint success response \(OAuth 2\.0 Multiple Response Type Encoding Practices §4\)\. The none response type authorizes the request without returning any credentials, so this builder contributes nothing to the running [SuccessfullyAuthenticated](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.SuccessfullyAuthenticated') result \- the authorization endpoint returns only `state` and, when advertised, `iss` \(RFC 9207\)\. Registered by opt\-in through `EnableNoneFlow()`\. Unlike the other response types it declares no grant type, because it issues no code or token to be exchanged later\. | | [ServiceCollectionExtensions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.NoneFlow.ServiceCollectionExtensions 'Abblix\.Oidc\.Server\.Features\.NoneFlow\.ServiceCollectionExtensions') | DI extensions that opt the host into the OAuth 2\.0 `none` response type\. | --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.NoneFlow.NoneResponseBuilder.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.NoneFlow](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.NoneFlow 'Abblix\.Oidc\.Server\.Features\.NoneFlow') ## NoneResponseBuilder Class Builds the `none` response\-type component of an authorization endpoint success response \(OAuth 2\.0 Multiple Response Type Encoding Practices §4\)\. The none response type authorizes the request without returning any credentials, so this builder contributes nothing to the running [SuccessfullyAuthenticated](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.SuccessfullyAuthenticated') result \- the authorization endpoint returns only `state` and, when advertised, `iss` \(RFC 9207\)\. Registered by opt\-in through `EnableNoneFlow()`\. Unlike the other response types it declares no grant type, because it issues no code or token to be exchanged later\. ```csharp public class NoneResponseBuilder : Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseBuilder, Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → NoneResponseBuilder Implements [IAuthorizationResponseBuilder](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseBuilder 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.IAuthorizationResponseBuilder'), [IGrantTypeInformer](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IGrantTypeInformer') ### Properties ## NoneResponseBuilder\.GrantTypesSupported Property {#Abblix.Oidc.Server.Features.NoneFlow.NoneResponseBuilder.GrantTypesSupported} The grant types supported by this component, as defined in OAuth 2\.0 and OpenID Connect specifications\. ```csharp public System.Collections.Generic.IEnumerable GrantTypesSupported { get; } ``` Implements [GrantTypesSupported](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer#Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer.GrantTypesSupported 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IGrantTypeInformer\.GrantTypesSupported') #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ### Remarks Common grant types include: - "authorization_code" - Authorization Code Grant - "implicit" - Implicit Grant - "refresh_token" - Refresh Token Grant - "client_credentials" - Client Credentials Grant - "password" - Resource Owner Password Credentials Grant ## NoneResponseBuilder\.ResponseType Property {#Abblix.Oidc.Server.Features.NoneFlow.NoneResponseBuilder.ResponseType} The single OAuth 2\.0 / OIDC response\-type value this processor is responsible for, matched case\-sensitively against parts of the request's `response_type`\. ```csharp public string ResponseType { get; } ``` Implements [ResponseType](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseBuilder#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseBuilder.ResponseType 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.IAuthorizationResponseBuilder\.ResponseType') #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Methods ## NoneResponseBuilder\.BuildResponseAsync\(ValidAuthorizationRequest, AuthorizedGrant, SuccessfullyAuthenticated\) Method {#Abblix.Oidc.Server.Features.NoneFlow.NoneResponseBuilder.BuildResponseAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest,Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant,Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated)} Populates the relevant field on [result](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.NoneFlow.NoneResponseBuilder#Abblix.Oidc.Server.Features.NoneFlow.NoneResponseBuilder.BuildResponseAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest,Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant,Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated).result 'Abblix\.Oidc\.Server\.Features\.NoneFlow\.NoneResponseBuilder\.BuildResponseAsync\(Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.ValidAuthorizationRequest, Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.AuthorizedGrant, Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.SuccessfullyAuthenticated\)\.result') for this processor's response type\. Implementations mutate [result](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.NoneFlow.NoneResponseBuilder#Abblix.Oidc.Server.Features.NoneFlow.NoneResponseBuilder.BuildResponseAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest,Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant,Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated).result 'Abblix\.Oidc\.Server\.Features\.NoneFlow\.NoneResponseBuilder\.BuildResponseAsync\(Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.ValidAuthorizationRequest, Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.AuthorizedGrant, Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.SuccessfullyAuthenticated\)\.result') in place and may read fields populated by processors that ran earlier in the canonical iteration order \(`code` before `token` before `id_token`\)\. ```csharp public System.Threading.Tasks.Task BuildResponseAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest request, Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant authorizedGrant, Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated result); ``` #### Parameters ###### `request` [ValidAuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.ValidAuthorizationRequest') {#Abblix.Oidc.Server.Features.NoneFlow.NoneResponseBuilder.BuildResponseAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest,Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant,Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated).request} ###### `authorizedGrant` [AuthorizedGrant](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.AuthorizedGrant') {#Abblix.Oidc.Server.Features.NoneFlow.NoneResponseBuilder.BuildResponseAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest,Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant,Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated).authorizedGrant} ###### `result` [SuccessfullyAuthenticated](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.SuccessfullyAuthenticated') {#Abblix.Oidc.Server.Features.NoneFlow.NoneResponseBuilder.BuildResponseAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest,Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant,Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated).result} Implements [BuildResponseAsync\(ValidAuthorizationRequest, AuthorizedGrant, SuccessfullyAuthenticated\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseBuilder#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseBuilder.BuildResponseAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest,Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant,Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated) 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.IAuthorizationResponseBuilder\.BuildResponseAsync\(Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.ValidAuthorizationRequest, Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.AuthorizedGrant, Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.SuccessfullyAuthenticated\)') #### Returns [System\.Threading\.Tasks\.Task](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task 'System\.Threading\.Tasks\.Task') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.NoneFlow.ServiceCollectionExtensions.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.NoneFlow](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.NoneFlow 'Abblix\.Oidc\.Server\.Features\.NoneFlow') ## ServiceCollectionExtensions Class DI extensions that opt the host into the OAuth 2\.0 `none` response type\. ```csharp public static class ServiceCollectionExtensions ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ServiceCollectionExtensions ### Methods ## ServiceCollectionExtensions\.EnableNoneFlow\(this IServiceCollection\) Method {#Abblix.Oidc.Server.Features.NoneFlow.ServiceCollectionExtensions.EnableNoneFlow(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection)} Enables the `none` response type \(OAuth 2\.0 Multiple Response Type Encoding Practices §4\), which authorizes a request without returning any code or token \- the authorization endpoint responds with only `state` and, when advertised, `iss` \(RFC 9207\)\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection EnableNoneFlow(this Microsoft.Extensions.DependencyInjection.IServiceCollection services); ``` #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.Oidc.Server.Features.NoneFlow.ServiceCollectionExtensions.EnableNoneFlow(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).services} The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') to register the processor in\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') The [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') so additional calls can be chained\. ### Remarks By default this library does not register the `none` response\-type processor, so the authorization endpoint rejects `response_type=none` with `unsupported_response_type` and the discovery document omits `none` from `response_types_supported`\. Hosts that need it \- for example, to pre\-authorize a grant the client redeems later by other means \- opt in via this method, mirroring the `EnableImplicitFlow` precedent for non\-core response types\. A client must additionally list `none` among its allowed response types to use it\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.PairwiseIdentifiers.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ## Abblix\.Oidc\.Server\.Features\.PairwiseIdentifiers Namespace | Classes | | | :--- | :--- | | [PairwiseSubjectSettings](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.PairwiseIdentifiers.PairwiseSubjectSettings 'Abblix\.Oidc\.Server\.Features\.PairwiseIdentifiers\.PairwiseSubjectSettings') | Configuration for pairwise subject identifier generation\. The salt is a server\-side secret that keys the reversible pairwise seal, so that even with knowledge of the user's real subject and the sector, an attacker cannot derive or open the pairwise identifier\. | | [PairwiseSubjectSettingsValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.PairwiseIdentifiers.PairwiseSubjectSettingsValidator 'Abblix\.Oidc\.Server\.Features\.PairwiseIdentifiers\.PairwiseSubjectSettingsValidator') | Fails loudly at startup when the configured seal key cannot key the pairwise seal, instead of letting the first pairwise token request answer 500\. | | [SubjectTypeConverter](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.PairwiseIdentifiers.SubjectTypeConverter 'Abblix\.Oidc\.Server\.Features\.PairwiseIdentifiers\.SubjectTypeConverter') | Implements the OIDC Core Section 8 subject types\. A public client's subject passes through unchanged\. A pairwise client's subject is sealed into a per\-sector pseudonym that is stable \(the same user and sector always map to the same value\), opaque and unlinkable to outsiders, yet reversible by this server \- so the real subject rides inside the pseudonym itself and no separate protected claim is needed\. The seal is a deterministic \(SIV\-style\) authenticated encryption keyed by the pairwise salt and bound to the sector as associated data, so different sectors seal the same user to unlinkable values and a pseudonym cannot be opened under the wrong sector\. | | [SubjectTypeConverterExtensions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.PairwiseIdentifiers.SubjectTypeConverterExtensions 'Abblix\.Oidc\.Server\.Features\.PairwiseIdentifiers\.SubjectTypeConverterExtensions') | Comparing a session against the end users a client named\. | | Interfaces | | | :--- | :--- | | [ISubjectTypeConverter](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter 'Abblix\.Oidc\.Server\.Features\.PairwiseIdentifiers\.ISubjectTypeConverter') | Defines the interface for a service that converts user subject identifiers according to the client's specified subject type\. This conversion ensures that the subject identifier presented to the client is in the format that the client expects, based on its configuration\. | --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.PairwiseIdentifiers](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.PairwiseIdentifiers 'Abblix\.Oidc\.Server\.Features\.PairwiseIdentifiers') ## ISubjectTypeConverter Interface Defines the interface for a service that converts user subject identifiers according to the client's specified subject type\. This conversion ensures that the subject identifier presented to the client is in the format that the client expects, based on its configuration\. ```csharp public interface ISubjectTypeConverter ``` Derived ↳ [SubjectTypeConverter](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.PairwiseIdentifiers.SubjectTypeConverter 'Abblix\.Oidc\.Server\.Features\.PairwiseIdentifiers\.SubjectTypeConverter') ### Remarks The implementation of this interface should support various subject types, such as "public" or "pairwise", and provide appropriate conversions based on the OpenID Connect specifications\. ### Properties ## ISubjectTypeConverter\.SubjectTypesSupported Property {#Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter.SubjectTypesSupported} Lists the subject types that this converter supports\. This typically includes "public" and "pairwise" among others, depending on the OpenID Connect implementation specifics\. ```csharp System.Collections.Generic.IEnumerable SubjectTypesSupported { get; } ``` #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ### Methods ## ISubjectTypeConverter\.Convert\(string, ClientInfo\) Method {#Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter.Convert(string,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo)} Converts the real subject identifier into the client\-facing one based on the client's subject type: a pairwise client gets a reversible, per\-sector pseudonym; a public client gets the subject unchanged\. ```csharp string Convert(string subject, Abblix.Oidc.Server.Features.ClientInformation.ClientInfo clientInfo); ``` #### Parameters ###### `subject` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter.Convert(string,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo).subject} The original subject identifier of the end\-user\. ###### `clientInfo` [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') {#Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter.Convert(string,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo).clientInfo} Information about the client for which the subject identifier is being transformed\. #### Returns [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') The transformed subject identifier suitable for the client's subject type\. ## ISubjectTypeConverter\.ConvertBack\(string, ClientInfo\) Method {#Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter.ConvertBack(string,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo)} Recovers the real subject identifier from the client\-facing one produced by [Convert\(string, ClientInfo\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter#Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter.Convert(string,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo) 'Abblix\.Oidc\.Server\.Features\.PairwiseIdentifiers\.ISubjectTypeConverter\.Convert\(string, Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo\)'): a pairwise client's pseudonym is opened back to the real subject; a public client's subject is returned unchanged\. The [clientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter#Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter.ConvertBack(string,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo).clientInfo 'Abblix\.Oidc\.Server\.Features\.PairwiseIdentifiers\.ISubjectTypeConverter\.ConvertBack\(string, Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo\)\.clientInfo') must be the client the subject was sealed for, as its sector binds the pseudonym\. ```csharp string? ConvertBack(string subject, Abblix.Oidc.Server.Features.ClientInformation.ClientInfo clientInfo); ``` #### Parameters ###### `subject` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter.ConvertBack(string,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo).subject} The client\-facing subject identifier \(pairwise pseudonym or real subject\)\. ###### `clientInfo` [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') {#Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter.ConvertBack(string,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo).clientInfo} The client the subject was issued for\. #### Returns [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') The real subject identifier, or `null` when a pairwise pseudonym cannot be opened \(malformed, sealed for a different sector, or produced under a different pairwise salt\) so the caller can reject the token at the protocol level\. #### Exceptions [System\.InvalidOperationException](https://learn.microsoft.com/en-us/dotnet/api/system.invalidoperationexception 'System\.InvalidOperationException') Thrown only when pairwise identifiers are not configured but a pairwise client is asked to recover, which is a server misconfiguration rather than a bad token\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.PairwiseIdentifiers.PairwiseSubjectSettings.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.PairwiseIdentifiers](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.PairwiseIdentifiers 'Abblix\.Oidc\.Server\.Features\.PairwiseIdentifiers') ## PairwiseSubjectSettings Class Configuration for pairwise subject identifier generation\. The salt is a server\-side secret that keys the reversible pairwise seal, so that even with knowledge of the user's real subject and the sector, an attacker cannot derive or open the pairwise identifier\. ```csharp public record PairwiseSubjectSettings : System.IEquatable ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → PairwiseSubjectSettings Implements [System\.IEquatable<](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[PairwiseSubjectSettings](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.PairwiseIdentifiers.PairwiseSubjectSettings 'Abblix\.Oidc\.Server\.Features\.PairwiseIdentifiers\.PairwiseSubjectSettings')[>](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1') ### Properties ## PairwiseSubjectSettings\.HashAlgorithm Property {#Abblix.Oidc.Server.Features.PairwiseIdentifiers.PairwiseSubjectSettings.HashAlgorithm} The hash algorithm used for the HKDF key derivation that keys the pairwise seal\. Defaults to SHA\-256\. Supported algorithms: SHA256, SHA384, SHA512, SHA1\. ```csharp public System.Security.Cryptography.HashAlgorithmName HashAlgorithm { get; init; } ``` #### Property Value [System\.Security\.Cryptography\.HashAlgorithmName](https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.hashalgorithmname 'System\.Security\.Cryptography\.HashAlgorithmName') ## PairwiseSubjectSettings\.Salt Property {#Abblix.Oidc.Server.Features.PairwiseIdentifiers.PairwiseSubjectSettings.Salt} A base64\-encoded cryptographic key that keys the deterministic authenticated\-encryption seal producing pairwise identifiers\. This value MUST be kept secret, generated once, and never changed \(changing it would invalidate all existing pairwise identifiers \- none could be opened back\)\. Minimum length: 32 bytes \(256 bits\) before encoding\. ```csharp public string Salt { get; init; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') #### Exceptions [System\.ArgumentException](https://learn.microsoft.com/en-us/dotnet/api/system.argumentexception 'System\.ArgumentException') The salt is missing, is not valid base64, or decodes to fewer than 32 bytes\. ### Remarks Judged by whoever wires it rather than on assignment: settings the host bound are judged when the host starts, by [PairwiseSubjectSettingsValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.PairwiseIdentifiers.PairwiseSubjectSettingsValidator 'Abblix\.Oidc\.Server\.Features\.PairwiseIdentifiers\.PairwiseSubjectSettingsValidator'), and an instance handed to `AddPairwiseSubjectIdentifiers` is judged there\. Refusing in the accessor would sound stricter and be worse \- the configuration binder assigns properties by reflection, so the refusal would reach the host wrapped in a `TargetInvocationException` naming reflection instead of the setting, and it would fire before any validator could say which rule failed\. ### Methods ## PairwiseSubjectSettings\.SaltRefusal\(string\) Method {#Abblix.Oidc.Server.Features.PairwiseIdentifiers.PairwiseSubjectSettings.SaltRefusal(string)} Why this salt cannot key the seal, or null when it can\. ```csharp public static string? SaltRefusal(string? salt); ``` #### Parameters ###### `salt` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.PairwiseIdentifiers.PairwiseSubjectSettings.SaltRefusal(string).salt} The base64 value a deployment configured\. #### Returns [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ### Remarks Returned rather than thrown, so one rule serves both callers: whoever HOLDS the value throws on it, and whoever REPORTS on it \- a startup options validator \- hands the same sentence to the host\. Two shapes of one rule cannot disagree; two rules would\. ## PairwiseSubjectSettings\.ValidateSalt\(string\) Method {#Abblix.Oidc.Server.Features.PairwiseIdentifiers.PairwiseSubjectSettings.ValidateSalt(string)} Refuses a salt that cannot key the seal\. ```csharp public static void ValidateSalt(string? salt); ``` #### Parameters ###### `salt` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.PairwiseIdentifiers.PairwiseSubjectSettings.ValidateSalt(string).salt} The base64 value a deployment configured\. #### Exceptions [System\.ArgumentException](https://learn.microsoft.com/en-us/dotnet/api/system.argumentexception 'System\.ArgumentException') It is missing, is not valid base64, or decodes to fewer than 32 bytes\. ### Remarks Reachable because the property cannot be the only judge\. The configuration binder constructs the object and then sets only the properties whose keys are present, so an absent key never enters the accessor \- `required` is a compiler rule and the binder does not enforce it\. A caller holding an instance it did not write asks here instead\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.PairwiseIdentifiers.PairwiseSubjectSettingsValidator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.PairwiseIdentifiers](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.PairwiseIdentifiers 'Abblix\.Oidc\.Server\.Features\.PairwiseIdentifiers') ## PairwiseSubjectSettingsValidator Class Fails loudly at startup when the configured seal key cannot key the pairwise seal, instead of letting the first pairwise token request answer 500\. ```csharp public sealed class PairwiseSubjectSettingsValidator : Microsoft.Extensions.Options.IValidateOptions ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → PairwiseSubjectSettingsValidator Implements [Microsoft\.Extensions\.Options\.IValidateOptions<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ivalidateoptions-1 'Microsoft\.Extensions\.Options\.IValidateOptions\`1')[PairwiseSubjectSettings](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.PairwiseIdentifiers.PairwiseSubjectSettings 'Abblix\.Oidc\.Server\.Features\.PairwiseIdentifiers\.PairwiseSubjectSettings')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ivalidateoptions-1 'Microsoft\.Extensions\.Options\.IValidateOptions\`1') ### Remarks The salt is the sole key material of the seal, and the two ways it goes wrong are both quiet. An absent key leaves the settings carrying null: `required` is a rule of the compiler, and the configuration binder assigns only the properties whose keys are present, so nothing is raised and nothing is set. A present but unusable key - not base64, or too short - is refused where it is assigned, but only for an instance somebody wrote in code. Downstream, neither is loud either: [SubjectTypeConverter](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.PairwiseIdentifiers.SubjectTypeConverter 'Abblix\.Oidc\.Server\.Features\.PairwiseIdentifiers\.SubjectTypeConverter') treats settings it cannot use as pairwise not being configured, while discovery goes on advertising `pairwise` as a supported subject type. So a client registered for it is accepted and fails at the token endpoint. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.PairwiseIdentifiers.SubjectTypeConverter.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.PairwiseIdentifiers](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.PairwiseIdentifiers 'Abblix\.Oidc\.Server\.Features\.PairwiseIdentifiers') ## SubjectTypeConverter Class Implements the OIDC Core Section 8 subject types\. A public client's subject passes through unchanged\. A pairwise client's subject is sealed into a per\-sector pseudonym that is stable \(the same user and sector always map to the same value\), opaque and unlinkable to outsiders, yet reversible by this server \- so the real subject rides inside the pseudonym itself and no separate protected claim is needed\. The seal is a deterministic \(SIV\-style\) authenticated encryption keyed by the pairwise salt and bound to the sector as associated data, so different sectors seal the same user to unlinkable values and a pseudonym cannot be opened under the wrong sector\. ```csharp public class SubjectTypeConverter : Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → SubjectTypeConverter Implements [ISubjectTypeConverter](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter 'Abblix\.Oidc\.Server\.Features\.PairwiseIdentifiers\.ISubjectTypeConverter') ### Constructors ## SubjectTypeConverter\(PairwiseSubjectSettings\) Constructor {#Abblix.Oidc.Server.Features.PairwiseIdentifiers.SubjectTypeConverter.SubjectTypeConverter(Abblix.Oidc.Server.Features.PairwiseIdentifiers.PairwiseSubjectSettings)} Creates the converter\. When [settings](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.PairwiseIdentifiers.SubjectTypeConverter#Abblix.Oidc.Server.Features.PairwiseIdentifiers.SubjectTypeConverter.SubjectTypeConverter(Abblix.Oidc.Server.Features.PairwiseIdentifiers.PairwiseSubjectSettings).settings 'Abblix\.Oidc\.Server\.Features\.PairwiseIdentifiers\.SubjectTypeConverter\.SubjectTypeConverter\(Abblix\.Oidc\.Server\.Features\.PairwiseIdentifiers\.PairwiseSubjectSettings\)\.settings') is present, its salt keys the reversible pairwise seal and its hash selects the pseudorandom function; when absent, only public subjects are supported and a pairwise request fails loud\. ```csharp public SubjectTypeConverter(Abblix.Oidc.Server.Features.PairwiseIdentifiers.PairwiseSubjectSettings? settings=null); ``` #### Parameters ###### `settings` [PairwiseSubjectSettings](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.PairwiseIdentifiers.PairwiseSubjectSettings 'Abblix\.Oidc\.Server\.Features\.PairwiseIdentifiers\.PairwiseSubjectSettings') {#Abblix.Oidc.Server.Features.PairwiseIdentifiers.SubjectTypeConverter.SubjectTypeConverter(Abblix.Oidc.Server.Features.PairwiseIdentifiers.PairwiseSubjectSettings).settings} The pairwise salt and hash, or null when pairwise identifiers are not configured\. ### Properties ## SubjectTypeConverter\.SubjectTypesSupported Property {#Abblix.Oidc.Server.Features.PairwiseIdentifiers.SubjectTypeConverter.SubjectTypesSupported} The two OIDC Core Section 8 subject types this converter implements: `public` \(passes the local subject through unchanged\) and `pairwise` \(a reversible, per\-sector sealed identifier\)\. ```csharp public System.Collections.Generic.IEnumerable SubjectTypesSupported { get; } ``` Implements [SubjectTypesSupported](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter#Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter.SubjectTypesSupported 'Abblix\.Oidc\.Server\.Features\.PairwiseIdentifiers\.ISubjectTypeConverter\.SubjectTypesSupported') #### Property Value [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') ### Methods ## SubjectTypeConverter\.Convert\(string, ClientInfo\) Method {#Abblix.Oidc.Server.Features.PairwiseIdentifiers.SubjectTypeConverter.Convert(string,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo)} Converts the real subject into the client\-facing subject: for a pairwise client, the reversible per\-sector pseudonym; for a public client, the subject unchanged\. ```csharp public string Convert(string subject, Abblix.Oidc.Server.Features.ClientInformation.ClientInfo clientInfo); ``` #### Parameters ###### `subject` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.PairwiseIdentifiers.SubjectTypeConverter.Convert(string,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo).subject} ###### `clientInfo` [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') {#Abblix.Oidc.Server.Features.PairwiseIdentifiers.SubjectTypeConverter.Convert(string,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo).clientInfo} Implements [Convert\(string, ClientInfo\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter#Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter.Convert(string,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo) 'Abblix\.Oidc\.Server\.Features\.PairwiseIdentifiers\.ISubjectTypeConverter\.Convert\(string, Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo\)') #### Returns [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') ## SubjectTypeConverter\.ConvertBack\(string, ClientInfo\) Method {#Abblix.Oidc.Server.Features.PairwiseIdentifiers.SubjectTypeConverter.ConvertBack(string,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo)} Recovers the real subject from the client\-facing subject: for a pairwise client, opens the per\-sector pseudonym; for a public client, returns the subject unchanged\. Returns `null` when a pairwise pseudonym cannot be opened, so the caller can surface a protocol\-level rejection instead of faulting\. ```csharp public string? ConvertBack(string subject, Abblix.Oidc.Server.Features.ClientInformation.ClientInfo clientInfo); ``` #### Parameters ###### `subject` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.PairwiseIdentifiers.SubjectTypeConverter.ConvertBack(string,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo).subject} ###### `clientInfo` [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') {#Abblix.Oidc.Server.Features.PairwiseIdentifiers.SubjectTypeConverter.ConvertBack(string,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo).clientInfo} Implements [ConvertBack\(string, ClientInfo\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter#Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter.ConvertBack(string,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo) 'Abblix\.Oidc\.Server\.Features\.PairwiseIdentifiers\.ISubjectTypeConverter\.ConvertBack\(string, Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo\)') #### Returns [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.PairwiseIdentifiers.SubjectTypeConverterExtensions.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.PairwiseIdentifiers](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.PairwiseIdentifiers 'Abblix\.Oidc\.Server\.Features\.PairwiseIdentifiers') ## SubjectTypeConverterExtensions Class Comparing a session against the end users a client named\. ```csharp public static class SubjectTypeConverterExtensions ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → SubjectTypeConverterExtensions ### Methods ## SubjectTypeConverterExtensions\.Names\(this ISubjectTypeConverter, AuthSession, IReadOnlyCollection\, ClientInfo\) Method {#Abblix.Oidc.Server.Features.PairwiseIdentifiers.SubjectTypeConverterExtensions.Names(thisAbblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter,Abblix.Oidc.Server.Features.UserAuthentication.AuthSession,System.Collections.Generic.IReadOnlyCollection_string_,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo)} Whether this session belongs to one of the end users named, as the client spells them\. ```csharp public static bool Names(this Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter converter, Abblix.Oidc.Server.Features.UserAuthentication.AuthSession session, System.Collections.Generic.IReadOnlyCollection subjects, Abblix.Oidc.Server.Features.ClientInformation.ClientInfo clientInfo); ``` #### Parameters ###### `converter` [ISubjectTypeConverter](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter 'Abblix\.Oidc\.Server\.Features\.PairwiseIdentifiers\.ISubjectTypeConverter') {#Abblix.Oidc.Server.Features.PairwiseIdentifiers.SubjectTypeConverterExtensions.Names(thisAbblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter,Abblix.Oidc.Server.Features.UserAuthentication.AuthSession,System.Collections.Generic.IReadOnlyCollection_string_,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo).converter} Seals the session's subject the way this client sees it\. ###### `session` [AuthSession](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.UserAuthentication.AuthSession 'Abblix\.Oidc\.Server\.Features\.UserAuthentication\.AuthSession') {#Abblix.Oidc.Server.Features.PairwiseIdentifiers.SubjectTypeConverterExtensions.Names(thisAbblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter,Abblix.Oidc.Server.Features.UserAuthentication.AuthSession,System.Collections.Generic.IReadOnlyCollection_string_,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo).session} The session to judge\. ###### `subjects` [System\.Collections\.Generic\.IReadOnlyCollection<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ireadonlycollection-1 'System\.Collections\.Generic\.IReadOnlyCollection\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ireadonlycollection-1 'System\.Collections\.Generic\.IReadOnlyCollection\`1') {#Abblix.Oidc.Server.Features.PairwiseIdentifiers.SubjectTypeConverterExtensions.Names(thisAbblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter,Abblix.Oidc.Server.Features.UserAuthentication.AuthSession,System.Collections.Generic.IReadOnlyCollection_string_,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo).subjects} The end users the request will accept\. Empty accepts nobody\. ###### `clientInfo` [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') {#Abblix.Oidc.Server.Features.PairwiseIdentifiers.SubjectTypeConverterExtensions.Names(thisAbblix.Oidc.Server.Features.PairwiseIdentifiers.ISubjectTypeConverter,Abblix.Oidc.Server.Features.UserAuthentication.AuthSession,System.Collections.Generic.IReadOnlyCollection_string_,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo).clientInfo} The client whose spelling of a subject is in force\. #### Returns [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') ### Remarks OpenID Connect Core 1\.0 Section 3\.1\.2\.2 requires this wherever a request names an end user: the server "MUST NOT reply with an ID Token or Access Token for a different user, even if they have an active session"\. Every endpoint accepting such a name needs the same comparison, and one that wrote its own would have to rediscover both properties below\. The session is converted forward rather than the name opened, because only the forward direction answers for a client whose sector moved since the name was minted: opening would fail, while sealing produces the pseudonym that client would receive today and compares it against what was sent. Neither direction is total. Sealing needs pairwise settings the deployment may not have configured, and a client registered as pairwise without them makes the converter throw. That is a configuration fault rather than an answer about this end user, so it is reported as no match: the caller refuses this session instead of faulting every request that merely named somebody. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.PushedAuthorization.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ## Abblix\.Oidc\.Server\.Features\.PushedAuthorization Namespace | Classes | | | :--- | :--- | | [PushedAuthorizationRequestProcessorDecorator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.PushedAuthorization.PushedAuthorizationRequestProcessorDecorator 'Abblix\.Oidc\.Server\.Features\.PushedAuthorization\.PushedAuthorizationRequestProcessorDecorator') | Enforces single\-use of a pushed authorization `request_uri` \(RFC 9126 §7\.3\) by decorating the authorization request processor\. Once processing yields a terminal success \- an authorization code or token has been minted \- the `request_uri` is removed from storage so it cannot be replayed within its remaining time\-to\-live\. Interactive continuations \(login, consent, account selection\) leave it in place so the user agent can re\-enter the authorization endpoint with the same `request_uri`\. | --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.PushedAuthorization.PushedAuthorizationRequestProcessorDecorator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.PushedAuthorization](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.PushedAuthorization 'Abblix\.Oidc\.Server\.Features\.PushedAuthorization') ## PushedAuthorizationRequestProcessorDecorator Class Enforces single\-use of a pushed authorization `request_uri` \(RFC 9126 §7\.3\) by decorating the authorization request processor\. Once processing yields a terminal success \- an authorization code or token has been minted \- the `request_uri` is removed from storage so it cannot be replayed within its remaining time\-to\-live\. Interactive continuations \(login, consent, account selection\) leave it in place so the user agent can re\-enter the authorization endpoint with the same `request_uri`\. ```csharp public class PushedAuthorizationRequestProcessorDecorator : Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationRequestProcessor ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → PushedAuthorizationRequestProcessorDecorator Implements [IAuthorizationRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.IAuthorizationRequestProcessor') ### Constructors ## PushedAuthorizationRequestProcessorDecorator\(IAuthorizationRequestProcessor, IAuthorizationRequestStorage\) Constructor {#Abblix.Oidc.Server.Features.PushedAuthorization.PushedAuthorizationRequestProcessorDecorator.PushedAuthorizationRequestProcessorDecorator(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationRequestProcessor,Abblix.Oidc.Server.Features.Storages.IAuthorizationRequestStorage)} Enforces single\-use of a pushed authorization `request_uri` \(RFC 9126 §7\.3\) by decorating the authorization request processor\. Once processing yields a terminal success \- an authorization code or token has been minted \- the `request_uri` is removed from storage so it cannot be replayed within its remaining time\-to\-live\. Interactive continuations \(login, consent, account selection\) leave it in place so the user agent can re\-enter the authorization endpoint with the same `request_uri`\. ```csharp public PushedAuthorizationRequestProcessorDecorator(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationRequestProcessor inner, Abblix.Oidc.Server.Features.Storages.IAuthorizationRequestStorage authorizationRequestStorage); ``` #### Parameters ###### `inner` [IAuthorizationRequestProcessor](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationRequestProcessor 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.IAuthorizationRequestProcessor') {#Abblix.Oidc.Server.Features.PushedAuthorization.PushedAuthorizationRequestProcessorDecorator.PushedAuthorizationRequestProcessorDecorator(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationRequestProcessor,Abblix.Oidc.Server.Features.Storages.IAuthorizationRequestStorage).inner} The authorization request processor being decorated\. ###### `authorizationRequestStorage` [IAuthorizationRequestStorage](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Storages.IAuthorizationRequestStorage 'Abblix\.Oidc\.Server\.Features\.Storages\.IAuthorizationRequestStorage') {#Abblix.Oidc.Server.Features.PushedAuthorization.PushedAuthorizationRequestProcessorDecorator.PushedAuthorizationRequestProcessorDecorator(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationRequestProcessor,Abblix.Oidc.Server.Features.Storages.IAuthorizationRequestStorage).authorizationRequestStorage} The storage backing pushed authorization requests, from which the consumed `request_uri` is removed on a terminal success\. ### Methods ## PushedAuthorizationRequestProcessorDecorator\.ProcessAsync\(ValidAuthorizationRequest\) Method {#Abblix.Oidc.Server.Features.PushedAuthorization.PushedAuthorizationRequestProcessorDecorator.ProcessAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest)} Delegates to the wrapped processor and, when the outcome is a successful authentication originating from a pushed request, consumes the originating `request_uri` to enforce single use\. ```csharp public System.Threading.Tasks.Task ProcessAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest request); ``` #### Parameters ###### `request` [ValidAuthorizationRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.ValidAuthorizationRequest') {#Abblix.Oidc.Server.Features.PushedAuthorization.PushedAuthorizationRequestProcessorDecorator.ProcessAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest).request} The validated authorization request to process\. Implements [ProcessAsync\(ValidAuthorizationRequest\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationRequestProcessor#Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationRequestProcessor.ProcessAsync(Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest) 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.IAuthorizationRequestProcessor\.ProcessAsync\(Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.ValidAuthorizationRequest\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[AuthorizationResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationResponse 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationResponse')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') The inner processor's [AuthorizationResponse](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationResponse 'Abblix\.Oidc\.Server\.Endpoints\.Authorization\.Interfaces\.AuthorizationResponse'), unchanged\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ## Abblix\.Oidc\.Server\.Features\.RandomGenerators Namespace | Classes | | | :--- | :--- | | [AuthorizationCodeGenerator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.AuthorizationCodeGenerator 'Abblix\.Oidc\.Server\.Features\.RandomGenerators\.AuthorizationCodeGenerator') | Generates secure authorization codes for OAuth 2\.0 authorization code flows\. This implementation relies on cryptographic randomness to generate codes that are difficult to predict, enhancing the security of the authorization process\. | | [AuthorizationRequestUriGenerator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.AuthorizationRequestUriGenerator 'Abblix\.Oidc\.Server\.Features\.RandomGenerators\.AuthorizationRequestUriGenerator') | Default [IAuthorizationRequestUriGenerator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.IAuthorizationRequestUriGenerator 'Abblix\.Oidc\.Server\.Features\.RandomGenerators\.IAuthorizationRequestUriGenerator') implementation\. Appends a URL\-safe Base64 encoded block of cryptographically secure random bytes \(length governed by [RequestUriLength](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions#Abblix.Oidc.Server.Common.Configuration.OidcOptions.RequestUriLength 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions\.RequestUriLength')\) to [Prefix](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.RequestUrn#Abblix.Oidc.Server.Common.Constants.RequestUrn.Prefix 'Abblix\.Oidc\.Server\.Common\.Constants\.RequestUrn\.Prefix'), producing the `urn:`\-style `request_uri` values used by Pushed Authorization Requests \(RFC 9126\)\. | | [ClientIdGenerator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.ClientIdGenerator 'Abblix\.Oidc\.Server\.Features\.RandomGenerators\.ClientIdGenerator') | Implements the [IClientIdGenerator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.IClientIdGenerator 'Abblix\.Oidc\.Server\.Features\.RandomGenerators\.IClientIdGenerator') interface to generate client IDs for OpenID Connect \(OIDC\) clients\. The generated client IDs are based on cryptographically secure random bytes and are encoded in Base32 format, providing a URL\-safe, human\-readable identifier\. The length and format of the generated client IDs can be configured through OIDC options\. | | [ClientSecretGenerator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.ClientSecretGenerator 'Abblix\.Oidc\.Server\.Features\.RandomGenerators\.ClientSecretGenerator') | Provides a mechanism for securely generating client secret strings used in OAuth 2\.0 and OpenID Connect authentication flows\. This implementation uses a cryptographic random number generator to produce a high\-entropy secret string, which is crucial for maintaining the security and integrity of client authentication\. The generated secret is encoded in a URL\-safe Base32 format and trimmed to the specified length\. | | [GrantIdGenerator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.GrantIdGenerator 'Abblix\.Oidc\.Server\.Features\.RandomGenerators\.GrantIdGenerator') | Default [IGrantIdGenerator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.IGrantIdGenerator 'Abblix\.Oidc\.Server\.Features\.RandomGenerators\.IGrantIdGenerator') implementation\. Draws random bytes from a cryptographically secure source \([System\.Security\.Cryptography\.RandomNumberGenerator](https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.randomnumbergenerator 'System\.Security\.Cryptography\.RandomNumberGenerator') via `CryptoRandom`\) using the byte count configured in [GrantIdLength](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions#Abblix.Oidc.Server.Common.Configuration.OidcOptions.GrantIdLength 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions\.GrantIdLength'), then URL\-safe Base64 encodes the result so the resulting `grant_id` value can travel safely through HTTP transports\. | | [SessionIdGenerator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.SessionIdGenerator 'Abblix\.Oidc\.Server\.Features\.RandomGenerators\.SessionIdGenerator') | Implements the [ISessionIdGenerator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.ISessionIdGenerator 'Abblix\.Oidc\.Server\.Features\.RandomGenerators\.ISessionIdGenerator') interface to generate unique session identifiers\. The session IDs are generated using a cryptographically strong random number generator and are encoded to be safely included in HTTP URLs, avoiding characters that might cause issues in URLs\. | | [TokenIdGenerator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.TokenIdGenerator 'Abblix\.Oidc\.Server\.Features\.RandomGenerators\.TokenIdGenerator') | Default [ITokenIdGenerator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.ITokenIdGenerator 'Abblix\.Oidc\.Server\.Features\.RandomGenerators\.ITokenIdGenerator') implementation\. Draws random bytes from a cryptographically secure source \([System\.Security\.Cryptography\.RandomNumberGenerator](https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.randomnumbergenerator 'System\.Security\.Cryptography\.RandomNumberGenerator') via `CryptoRandom`\) using the byte count configured in [TokenIdLength](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions#Abblix.Oidc.Server.Common.Configuration.OidcOptions.TokenIdLength 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions\.TokenIdLength'), then URL\-safe Base64 encodes the result so the resulting `jti` value can travel safely through HTTP transports\. | | Interfaces | | | :--- | :--- | | [IAuthorizationCodeGenerator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.IAuthorizationCodeGenerator 'Abblix\.Oidc\.Server\.Features\.RandomGenerators\.IAuthorizationCodeGenerator') | Defines a contract for generating unique authorization codes for use in OAuth 2\.0 authorization code flows\. Implementations of this interface should ensure that the generated codes are cryptographically secure and suitable for one\-time use in authenticating and authorizing access\. | | [IAuthorizationRequestUriGenerator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.IAuthorizationRequestUriGenerator 'Abblix\.Oidc\.Server\.Features\.RandomGenerators\.IAuthorizationRequestUriGenerator') | Produces unique, unguessable request URIs used to reference stored authorization request objects, such as those handled by Pushed Authorization Requests \(RFC 9126\) via the `request_uri` parameter\. Implementations must derive the URI from a high\-entropy, cryptographically secure random value to prevent an attacker from guessing or enumerating active authorization requests\. | | [IClientIdGenerator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.IClientIdGenerator 'Abblix\.Oidc\.Server\.Features\.RandomGenerators\.IClientIdGenerator') | Defines an interface for generating client IDs for OpenID Connect \(OIDC\) clients\. This interface abstracts the mechanism for creating unique client identifiers used in the registration of OIDC clients\. Implementations of this interface can provide different strategies for generating client IDs, such as UUIDs, random strings, or based on specific patterns\. | | [IClientSecretGenerator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.IClientSecretGenerator 'Abblix\.Oidc\.Server\.Features\.RandomGenerators\.IClientSecretGenerator') | Defines an interface responsible for generating secure client secrets for OpenID Connect \(OIDC\) clients\. Client secrets are used as credentials for client authentication to the OIDC provider or authorization server\. | | [IGrantIdGenerator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.IGrantIdGenerator 'Abblix\.Oidc\.Server\.Features\.RandomGenerators\.IGrantIdGenerator') | Produces unique identifiers for refresh\-token grants, used as the `grant_id` claim that binds every refresh token derived from one authorization grant into a single lineage \(a "token family" in RFC 9700 terms\)\. Rotation and family revocation \(RFC 9700 §4\.14\.2\) rely on this identifier, so implementations must generate values with sufficient entropy to make collisions and guessing impractical\. | | [ISessionIdGenerator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.ISessionIdGenerator 'Abblix\.Oidc\.Server\.Features\.RandomGenerators\.ISessionIdGenerator') | Defines the interface for generating new session identifiers, which are crucial for tracking user sessions in web applications, especially in scenarios involving authentication and authorization processes\. | | [ITokenIdGenerator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.ITokenIdGenerator 'Abblix\.Oidc\.Server\.Features\.RandomGenerators\.ITokenIdGenerator') | Produces unique identifiers for JSON Web Tokens, used as the `jti` claim defined in RFC 7519 §4\.1\.7\. A unique `jti` per token is required to support replay detection and one\-time token semantics, so implementations must generate values with sufficient entropy to make collisions and guessing impractical\. | --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.AuthorizationCodeGenerator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.RandomGenerators](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators 'Abblix\.Oidc\.Server\.Features\.RandomGenerators') ## AuthorizationCodeGenerator Class Generates secure authorization codes for OAuth 2\.0 authorization code flows\. This implementation relies on cryptographic randomness to generate codes that are difficult to predict, enhancing the security of the authorization process\. ```csharp public class AuthorizationCodeGenerator : Abblix.Oidc.Server.Features.RandomGenerators.IAuthorizationCodeGenerator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → AuthorizationCodeGenerator Implements [IAuthorizationCodeGenerator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.IAuthorizationCodeGenerator 'Abblix\.Oidc\.Server\.Features\.RandomGenerators\.IAuthorizationCodeGenerator') ### Constructors ## AuthorizationCodeGenerator\(IOptions\\) Constructor {#Abblix.Oidc.Server.Features.RandomGenerators.AuthorizationCodeGenerator.AuthorizationCodeGenerator(Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_)} Generates secure authorization codes for OAuth 2\.0 authorization code flows\. This implementation relies on cryptographic randomness to generate codes that are difficult to predict, enhancing the security of the authorization process\. ```csharp public AuthorizationCodeGenerator(Microsoft.Extensions.Options.IOptions options); ``` #### Parameters ###### `options` [Microsoft\.Extensions\.Options\.IOptions<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptions-1 'Microsoft\.Extensions\.Options\.IOptions\`1')[OidcOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptions-1 'Microsoft\.Extensions\.Options\.IOptions\`1') {#Abblix.Oidc.Server.Features.RandomGenerators.AuthorizationCodeGenerator.AuthorizationCodeGenerator(Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_).options} ### Methods ## AuthorizationCodeGenerator\.GenerateAuthorizationCode\(\) Method {#Abblix.Oidc.Server.Features.RandomGenerators.AuthorizationCodeGenerator.GenerateAuthorizationCode()} Generates a unique authorization code using secure cryptographic methods\. The code is URL\-safe encoded to ensure it can be transmitted safely in URLs\. ```csharp public string GenerateAuthorizationCode(); ``` Implements [GenerateAuthorizationCode\(\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.IAuthorizationCodeGenerator#Abblix.Oidc.Server.Features.RandomGenerators.IAuthorizationCodeGenerator.GenerateAuthorizationCode() 'Abblix\.Oidc\.Server\.Features\.RandomGenerators\.IAuthorizationCodeGenerator\.GenerateAuthorizationCode\(\)') #### Returns [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') A URL\-safe, secure, and randomly generated authorization code\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.AuthorizationRequestUriGenerator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.RandomGenerators](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators 'Abblix\.Oidc\.Server\.Features\.RandomGenerators') ## AuthorizationRequestUriGenerator Class Default [IAuthorizationRequestUriGenerator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.IAuthorizationRequestUriGenerator 'Abblix\.Oidc\.Server\.Features\.RandomGenerators\.IAuthorizationRequestUriGenerator') implementation\. Appends a URL\-safe Base64 encoded block of cryptographically secure random bytes \(length governed by [RequestUriLength](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions#Abblix.Oidc.Server.Common.Configuration.OidcOptions.RequestUriLength 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions\.RequestUriLength')\) to [Prefix](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.RequestUrn#Abblix.Oidc.Server.Common.Constants.RequestUrn.Prefix 'Abblix\.Oidc\.Server\.Common\.Constants\.RequestUrn\.Prefix'), producing the `urn:`\-style `request_uri` values used by Pushed Authorization Requests \(RFC 9126\)\. ```csharp public class AuthorizationRequestUriGenerator : Abblix.Oidc.Server.Features.RandomGenerators.IAuthorizationRequestUriGenerator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → AuthorizationRequestUriGenerator Implements [IAuthorizationRequestUriGenerator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.IAuthorizationRequestUriGenerator 'Abblix\.Oidc\.Server\.Features\.RandomGenerators\.IAuthorizationRequestUriGenerator') ### Constructors ## AuthorizationRequestUriGenerator\(IOptions\\) Constructor {#Abblix.Oidc.Server.Features.RandomGenerators.AuthorizationRequestUriGenerator.AuthorizationRequestUriGenerator(Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_)} Default [IAuthorizationRequestUriGenerator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.IAuthorizationRequestUriGenerator 'Abblix\.Oidc\.Server\.Features\.RandomGenerators\.IAuthorizationRequestUriGenerator') implementation\. Appends a URL\-safe Base64 encoded block of cryptographically secure random bytes \(length governed by [RequestUriLength](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions#Abblix.Oidc.Server.Common.Configuration.OidcOptions.RequestUriLength 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions\.RequestUriLength')\) to [Prefix](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.RequestUrn#Abblix.Oidc.Server.Common.Constants.RequestUrn.Prefix 'Abblix\.Oidc\.Server\.Common\.Constants\.RequestUrn\.Prefix'), producing the `urn:`\-style `request_uri` values used by Pushed Authorization Requests \(RFC 9126\)\. ```csharp public AuthorizationRequestUriGenerator(Microsoft.Extensions.Options.IOptions options); ``` #### Parameters ###### `options` [Microsoft\.Extensions\.Options\.IOptions<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptions-1 'Microsoft\.Extensions\.Options\.IOptions\`1')[OidcOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptions-1 'Microsoft\.Extensions\.Options\.IOptions\`1') {#Abblix.Oidc.Server.Features.RandomGenerators.AuthorizationRequestUriGenerator.AuthorizationRequestUriGenerator(Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_).options} ### Methods ## AuthorizationRequestUriGenerator\.GenerateRequestUri\(\) Method {#Abblix.Oidc.Server.Features.RandomGenerators.AuthorizationRequestUriGenerator.GenerateRequestUri()} Generates a unique request URI by appending a securely generated random string to a predefined URN prefix\. ```csharp public System.Uri GenerateRequestUri(); ``` Implements [GenerateRequestUri\(\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.IAuthorizationRequestUriGenerator#Abblix.Oidc.Server.Features.RandomGenerators.IAuthorizationRequestUriGenerator.GenerateRequestUri() 'Abblix\.Oidc\.Server\.Features\.RandomGenerators\.IAuthorizationRequestUriGenerator\.GenerateRequestUri\(\)') #### Returns [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri') A new unique URI for an authorization request\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.ClientIdGenerator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.RandomGenerators](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators 'Abblix\.Oidc\.Server\.Features\.RandomGenerators') ## ClientIdGenerator Class Implements the [IClientIdGenerator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.IClientIdGenerator 'Abblix\.Oidc\.Server\.Features\.RandomGenerators\.IClientIdGenerator') interface to generate client IDs for OpenID Connect \(OIDC\) clients\. The generated client IDs are based on cryptographically secure random bytes and are encoded in Base32 format, providing a URL\-safe, human\-readable identifier\. The length and format of the generated client IDs can be configured through OIDC options\. ```csharp public class ClientIdGenerator : Abblix.Oidc.Server.Features.RandomGenerators.IClientIdGenerator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ClientIdGenerator Implements [IClientIdGenerator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.IClientIdGenerator 'Abblix\.Oidc\.Server\.Features\.RandomGenerators\.IClientIdGenerator') ### Constructors ## ClientIdGenerator\(IOptions\\) Constructor {#Abblix.Oidc.Server.Features.RandomGenerators.ClientIdGenerator.ClientIdGenerator(Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_)} Implements the [IClientIdGenerator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.IClientIdGenerator 'Abblix\.Oidc\.Server\.Features\.RandomGenerators\.IClientIdGenerator') interface to generate client IDs for OpenID Connect \(OIDC\) clients\. The generated client IDs are based on cryptographically secure random bytes and are encoded in Base32 format, providing a URL\-safe, human\-readable identifier\. The length and format of the generated client IDs can be configured through OIDC options\. ```csharp public ClientIdGenerator(Microsoft.Extensions.Options.IOptions options); ``` #### Parameters ###### `options` [Microsoft\.Extensions\.Options\.IOptions<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptions-1 'Microsoft\.Extensions\.Options\.IOptions\`1')[OidcOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptions-1 'Microsoft\.Extensions\.Options\.IOptions\`1') {#Abblix.Oidc.Server.Features.RandomGenerators.ClientIdGenerator.ClientIdGenerator(Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_).options} ### Methods ## ClientIdGenerator\.GenerateClientId\(\) Method {#Abblix.Oidc.Server.Features.RandomGenerators.ClientIdGenerator.GenerateClientId()} Generates a new client ID for an OIDC client\. The method produces a random, URL\-safe, and human\-readable identifier using Base32 encoding, based on the length specified in the OIDC options\. This ensures that the generated client IDs are suitable for use in various contexts, including web URLs and user interfaces\. ```csharp public string GenerateClientId(); ``` Implements [GenerateClientId\(\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.IClientIdGenerator#Abblix.Oidc.Server.Features.RandomGenerators.IClientIdGenerator.GenerateClientId() 'Abblix\.Oidc\.Server\.Features\.RandomGenerators\.IClientIdGenerator\.GenerateClientId\(\)') #### Returns [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') A new, randomly generated client ID string that conforms to the specifications defined in the OIDC options\. The client ID is encoded in Base32 format to ensure URL safety and readability\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.ClientSecretGenerator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.RandomGenerators](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators 'Abblix\.Oidc\.Server\.Features\.RandomGenerators') ## ClientSecretGenerator Class Provides a mechanism for securely generating client secret strings used in OAuth 2\.0 and OpenID Connect authentication flows\. This implementation uses a cryptographic random number generator to produce a high\-entropy secret string, which is crucial for maintaining the security and integrity of client authentication\. The generated secret is encoded in a URL\-safe Base32 format and trimmed to the specified length\. ```csharp public class ClientSecretGenerator : Abblix.Oidc.Server.Features.RandomGenerators.IClientSecretGenerator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ClientSecretGenerator Implements [IClientSecretGenerator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.IClientSecretGenerator 'Abblix\.Oidc\.Server\.Features\.RandomGenerators\.IClientSecretGenerator') ### Methods ## ClientSecretGenerator\.GenerateClientSecret\(int\) Method {#Abblix.Oidc.Server.Features.RandomGenerators.ClientSecretGenerator.GenerateClientSecret(int)} Generates a client secret string with the specified length\. ```csharp public string GenerateClientSecret(int length); ``` #### Parameters ###### `length` [System\.Int32](https://learn.microsoft.com/en-us/dotnet/api/system.int32 'System\.Int32') {#Abblix.Oidc.Server.Features.RandomGenerators.ClientSecretGenerator.GenerateClientSecret(int).length} The length of the client secret to generate\. The actual length of the generated secret might be slightly longer to ensure proper encoding and then trimmed to the desired length\. Implements [GenerateClientSecret\(int\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.IClientSecretGenerator#Abblix.Oidc.Server.Features.RandomGenerators.IClientSecretGenerator.GenerateClientSecret(int) 'Abblix\.Oidc\.Server\.Features\.RandomGenerators\.IClientSecretGenerator\.GenerateClientSecret\(int\)') #### Returns [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') A client secret string of the specified length\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.GrantIdGenerator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.RandomGenerators](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators 'Abblix\.Oidc\.Server\.Features\.RandomGenerators') ## GrantIdGenerator Class Default [IGrantIdGenerator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.IGrantIdGenerator 'Abblix\.Oidc\.Server\.Features\.RandomGenerators\.IGrantIdGenerator') implementation\. Draws random bytes from a cryptographically secure source \([System\.Security\.Cryptography\.RandomNumberGenerator](https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.randomnumbergenerator 'System\.Security\.Cryptography\.RandomNumberGenerator') via `CryptoRandom`\) using the byte count configured in [GrantIdLength](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions#Abblix.Oidc.Server.Common.Configuration.OidcOptions.GrantIdLength 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions\.GrantIdLength'), then URL\-safe Base64 encodes the result so the resulting `grant_id` value can travel safely through HTTP transports\. ```csharp public class GrantIdGenerator : Abblix.Oidc.Server.Features.RandomGenerators.IGrantIdGenerator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → GrantIdGenerator Implements [IGrantIdGenerator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.IGrantIdGenerator 'Abblix\.Oidc\.Server\.Features\.RandomGenerators\.IGrantIdGenerator') ### Constructors ## GrantIdGenerator\(IOptions\\) Constructor {#Abblix.Oidc.Server.Features.RandomGenerators.GrantIdGenerator.GrantIdGenerator(Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_)} Default [IGrantIdGenerator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.IGrantIdGenerator 'Abblix\.Oidc\.Server\.Features\.RandomGenerators\.IGrantIdGenerator') implementation\. Draws random bytes from a cryptographically secure source \([System\.Security\.Cryptography\.RandomNumberGenerator](https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.randomnumbergenerator 'System\.Security\.Cryptography\.RandomNumberGenerator') via `CryptoRandom`\) using the byte count configured in [GrantIdLength](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions#Abblix.Oidc.Server.Common.Configuration.OidcOptions.GrantIdLength 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions\.GrantIdLength'), then URL\-safe Base64 encodes the result so the resulting `grant_id` value can travel safely through HTTP transports\. ```csharp public GrantIdGenerator(Microsoft.Extensions.Options.IOptions options); ``` #### Parameters ###### `options` [Microsoft\.Extensions\.Options\.IOptions<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptions-1 'Microsoft\.Extensions\.Options\.IOptions\`1')[OidcOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptions-1 'Microsoft\.Extensions\.Options\.IOptions\`1') {#Abblix.Oidc.Server.Features.RandomGenerators.GrantIdGenerator.GrantIdGenerator(Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_).options} ### Methods ## GrantIdGenerator\.GenerateGrantId\(\) Method {#Abblix.Oidc.Server.Features.RandomGenerators.GrantIdGenerator.GenerateGrantId()} Produces a new `grant_id` value from cryptographically secure random bytes, sized per [GrantIdLength](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions#Abblix.Oidc.Server.Common.Configuration.OidcOptions.GrantIdLength 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions\.GrantIdLength') and URL\-safe Base64 encoded\. ```csharp public string GenerateGrantId(); ``` Implements [GenerateGrantId\(\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.IGrantIdGenerator#Abblix.Oidc.Server.Features.RandomGenerators.IGrantIdGenerator.GenerateGrantId() 'Abblix\.Oidc\.Server\.Features\.RandomGenerators\.IGrantIdGenerator\.GenerateGrantId\(\)') #### Returns [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') A URL\-safe, randomly generated unique identifier for a refresh\-token grant lineage\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.IAuthorizationCodeGenerator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.RandomGenerators](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators 'Abblix\.Oidc\.Server\.Features\.RandomGenerators') ## IAuthorizationCodeGenerator Interface Defines a contract for generating unique authorization codes for use in OAuth 2\.0 authorization code flows\. Implementations of this interface should ensure that the generated codes are cryptographically secure and suitable for one\-time use in authenticating and authorizing access\. ```csharp public interface IAuthorizationCodeGenerator ``` Derived ↳ [AuthorizationCodeGenerator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.AuthorizationCodeGenerator 'Abblix\.Oidc\.Server\.Features\.RandomGenerators\.AuthorizationCodeGenerator') ### Methods ## IAuthorizationCodeGenerator\.GenerateAuthorizationCode\(\) Method {#Abblix.Oidc.Server.Features.RandomGenerators.IAuthorizationCodeGenerator.GenerateAuthorizationCode()} Generates a unique, cryptographically secure authorization code\. ```csharp string GenerateAuthorizationCode(); ``` #### Returns [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') A string representing a unique authorization code\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.IAuthorizationRequestUriGenerator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.RandomGenerators](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators 'Abblix\.Oidc\.Server\.Features\.RandomGenerators') ## IAuthorizationRequestUriGenerator Interface Produces unique, unguessable request URIs used to reference stored authorization request objects, such as those handled by Pushed Authorization Requests \(RFC 9126\) via the `request_uri` parameter\. Implementations must derive the URI from a high\-entropy, cryptographically secure random value to prevent an attacker from guessing or enumerating active authorization requests\. ```csharp public interface IAuthorizationRequestUriGenerator ``` Derived ↳ [AuthorizationRequestUriGenerator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.AuthorizationRequestUriGenerator 'Abblix\.Oidc\.Server\.Features\.RandomGenerators\.AuthorizationRequestUriGenerator') ### Methods ## IAuthorizationRequestUriGenerator\.GenerateRequestUri\(\) Method {#Abblix.Oidc.Server.Features.RandomGenerators.IAuthorizationRequestUriGenerator.GenerateRequestUri()} Generates a unique, unpredictable URI suitable for use as the `request_uri` reference for a previously stored authorization request\. ```csharp System.Uri GenerateRequestUri(); ``` #### Returns [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri') A unique URI that serves as the identifier for a specific authorization request\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.IClientIdGenerator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.RandomGenerators](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators 'Abblix\.Oidc\.Server\.Features\.RandomGenerators') ## IClientIdGenerator Interface Defines an interface for generating client IDs for OpenID Connect \(OIDC\) clients\. This interface abstracts the mechanism for creating unique client identifiers used in the registration of OIDC clients\. Implementations of this interface can provide different strategies for generating client IDs, such as UUIDs, random strings, or based on specific patterns\. ```csharp public interface IClientIdGenerator ``` Derived ↳ [ClientIdGenerator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.ClientIdGenerator 'Abblix\.Oidc\.Server\.Features\.RandomGenerators\.ClientIdGenerator') ### Methods ## IClientIdGenerator\.GenerateClientId\(\) Method {#Abblix.Oidc.Server.Features.RandomGenerators.IClientIdGenerator.GenerateClientId()} Generates a new, unique client ID\. This client ID is intended for use in identifying an OIDC client within an authorization server or OIDC provider\. The format and uniqueness constraints of the client ID can vary depending on the implementation\. ```csharp string GenerateClientId(); ``` #### Returns [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') A string representing the generated client ID, which should be unique across all clients within the authorization server's context\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.IClientSecretGenerator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.RandomGenerators](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators 'Abblix\.Oidc\.Server\.Features\.RandomGenerators') ## IClientSecretGenerator Interface Defines an interface responsible for generating secure client secrets for OpenID Connect \(OIDC\) clients\. Client secrets are used as credentials for client authentication to the OIDC provider or authorization server\. ```csharp public interface IClientSecretGenerator ``` Derived ↳ [ClientSecretGenerator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.ClientSecretGenerator 'Abblix\.Oidc\.Server\.Features\.RandomGenerators\.ClientSecretGenerator') ### Methods ## IClientSecretGenerator\.GenerateClientSecret\(int\) Method {#Abblix.Oidc.Server.Features.RandomGenerators.IClientSecretGenerator.GenerateClientSecret(int)} Generates a new, secure client secret string of the specified length\. The generated secret is intended for use by confidential clients in OAuth 2\.0 and OpenID Connect authentication flows\. It is crucial that the generated secret is of sufficient length and randomness to ensure the security of client authentication processes\. ```csharp string GenerateClientSecret(int length); ``` #### Parameters ###### `length` [System\.Int32](https://learn.microsoft.com/en-us/dotnet/api/system.int32 'System\.Int32') {#Abblix.Oidc.Server.Features.RandomGenerators.IClientSecretGenerator.GenerateClientSecret(int).length} The desired length of the client secret\. It is recommended that secrets be of sufficient length \(e\.g\., at least 32 characters\) to ensure adequate security against brute\-force or guessing attacks\. #### Returns [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') A securely generated client secret string of the specified length\. The secret should consist of a cryptographically strong, random sequence of characters that can include a mix of letters, digits, and special characters\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.IGrantIdGenerator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.RandomGenerators](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators 'Abblix\.Oidc\.Server\.Features\.RandomGenerators') ## IGrantIdGenerator Interface Produces unique identifiers for refresh\-token grants, used as the `grant_id` claim that binds every refresh token derived from one authorization grant into a single lineage \(a "token family" in RFC 9700 terms\)\. Rotation and family revocation \(RFC 9700 §4\.14\.2\) rely on this identifier, so implementations must generate values with sufficient entropy to make collisions and guessing impractical\. ```csharp public interface IGrantIdGenerator ``` Derived ↳ [GrantIdGenerator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.GrantIdGenerator 'Abblix\.Oidc\.Server\.Features\.RandomGenerators\.GrantIdGenerator') ### Methods ## IGrantIdGenerator\.GenerateGrantId\(\) Method {#Abblix.Oidc.Server.Features.RandomGenerators.IGrantIdGenerator.GenerateGrantId()} Generates a new unique identifier suitable for the `grant_id` claim of a refresh token\. ```csharp string GenerateGrantId(); ``` #### Returns [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') A unique identifier for a refresh\-token grant lineage\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.ISessionIdGenerator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.RandomGenerators](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators 'Abblix\.Oidc\.Server\.Features\.RandomGenerators') ## ISessionIdGenerator Interface Defines the interface for generating new session identifiers, which are crucial for tracking user sessions in web applications, especially in scenarios involving authentication and authorization processes\. ```csharp public interface ISessionIdGenerator ``` Derived ↳ [SessionIdGenerator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.SessionIdGenerator 'Abblix\.Oidc\.Server\.Features\.RandomGenerators\.SessionIdGenerator') ### Methods ## ISessionIdGenerator\.GenerateSessionId\(\) Method {#Abblix.Oidc.Server.Features.RandomGenerators.ISessionIdGenerator.GenerateSessionId()} Generates a new, unique session identifier\. This method is responsible for producing session IDs that are sufficiently random and unique to securely identify individual user sessions\. The generated IDs are used in session management mechanisms to differentiate between user sessions, thereby ensuring that user data and interactions are isolated and protected across different sessions\. ```csharp string GenerateSessionId(); ``` #### Returns [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') A new, unique session identifier as a string\. The format and characteristics of the session ID \(e\.g\., length, characters used\) should be designed to enhance security and minimize the risk of session hijacking or collision\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.ITokenIdGenerator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.RandomGenerators](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators 'Abblix\.Oidc\.Server\.Features\.RandomGenerators') ## ITokenIdGenerator Interface Produces unique identifiers for JSON Web Tokens, used as the `jti` claim defined in RFC 7519 §4\.1\.7\. A unique `jti` per token is required to support replay detection and one\-time token semantics, so implementations must generate values with sufficient entropy to make collisions and guessing impractical\. ```csharp public interface ITokenIdGenerator ``` Derived ↳ [TokenIdGenerator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.TokenIdGenerator 'Abblix\.Oidc\.Server\.Features\.RandomGenerators\.TokenIdGenerator') ### Methods ## ITokenIdGenerator\.GenerateTokenId\(\) Method {#Abblix.Oidc.Server.Features.RandomGenerators.ITokenIdGenerator.GenerateTokenId()} Generates a new unique identifier suitable for the `jti` claim of a JWT\. ```csharp string GenerateTokenId(); ``` #### Returns [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') A unique identifier suitable for use as a JWT ID\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.SessionIdGenerator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.RandomGenerators](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators 'Abblix\.Oidc\.Server\.Features\.RandomGenerators') ## SessionIdGenerator Class Implements the [ISessionIdGenerator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.ISessionIdGenerator 'Abblix\.Oidc\.Server\.Features\.RandomGenerators\.ISessionIdGenerator') interface to generate unique session identifiers\. The session IDs are generated using a cryptographically strong random number generator and are encoded to be safely included in HTTP URLs, avoiding characters that might cause issues in URLs\. ```csharp public class SessionIdGenerator : Abblix.Oidc.Server.Features.RandomGenerators.ISessionIdGenerator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → SessionIdGenerator Implements [ISessionIdGenerator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.ISessionIdGenerator 'Abblix\.Oidc\.Server\.Features\.RandomGenerators\.ISessionIdGenerator') ### Constructors ## SessionIdGenerator\(IOptions\\) Constructor {#Abblix.Oidc.Server.Features.RandomGenerators.SessionIdGenerator.SessionIdGenerator(Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_)} Implements the [ISessionIdGenerator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.ISessionIdGenerator 'Abblix\.Oidc\.Server\.Features\.RandomGenerators\.ISessionIdGenerator') interface to generate unique session identifiers\. The session IDs are generated using a cryptographically strong random number generator and are encoded to be safely included in HTTP URLs, avoiding characters that might cause issues in URLs\. ```csharp public SessionIdGenerator(Microsoft.Extensions.Options.IOptions options); ``` #### Parameters ###### `options` [Microsoft\.Extensions\.Options\.IOptions<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptions-1 'Microsoft\.Extensions\.Options\.IOptions\`1')[OidcOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptions-1 'Microsoft\.Extensions\.Options\.IOptions\`1') {#Abblix.Oidc.Server.Features.RandomGenerators.SessionIdGenerator.SessionIdGenerator(Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_).options} ### Methods ## SessionIdGenerator\.GenerateSessionId\(\) Method {#Abblix.Oidc.Server.Features.RandomGenerators.SessionIdGenerator.GenerateSessionId()} Generates a new session identifier\. The method employs a cryptographically strong random number generator to produce a sequence of bytes, which are then URL\-encoded to ensure they can be safely used within HTTP URLs\. This approach ensures that the session identifiers are highly unlikely to collide and are secure for use in web applications\. ```csharp public string GenerateSessionId(); ``` Implements [GenerateSessionId\(\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.ISessionIdGenerator#Abblix.Oidc.Server.Features.RandomGenerators.ISessionIdGenerator.GenerateSessionId() 'Abblix\.Oidc\.Server\.Features\.RandomGenerators\.ISessionIdGenerator\.GenerateSessionId\(\)') #### Returns [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') A string representing a URL\-safe, cryptographically strong random session identifier\. The identifier is encoded in a way that makes it suitable for use in HTTP URLs, cookies, or any other URL\-based contexts\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.TokenIdGenerator.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.RandomGenerators](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators 'Abblix\.Oidc\.Server\.Features\.RandomGenerators') ## TokenIdGenerator Class Default [ITokenIdGenerator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.ITokenIdGenerator 'Abblix\.Oidc\.Server\.Features\.RandomGenerators\.ITokenIdGenerator') implementation\. Draws random bytes from a cryptographically secure source \([System\.Security\.Cryptography\.RandomNumberGenerator](https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.randomnumbergenerator 'System\.Security\.Cryptography\.RandomNumberGenerator') via `CryptoRandom`\) using the byte count configured in [TokenIdLength](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions#Abblix.Oidc.Server.Common.Configuration.OidcOptions.TokenIdLength 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions\.TokenIdLength'), then URL\-safe Base64 encodes the result so the resulting `jti` value can travel safely through HTTP transports\. ```csharp public class TokenIdGenerator : Abblix.Oidc.Server.Features.RandomGenerators.ITokenIdGenerator ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → TokenIdGenerator Implements [ITokenIdGenerator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.ITokenIdGenerator 'Abblix\.Oidc\.Server\.Features\.RandomGenerators\.ITokenIdGenerator') ### Constructors ## TokenIdGenerator\(IOptions\\) Constructor {#Abblix.Oidc.Server.Features.RandomGenerators.TokenIdGenerator.TokenIdGenerator(Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_)} Default [ITokenIdGenerator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.ITokenIdGenerator 'Abblix\.Oidc\.Server\.Features\.RandomGenerators\.ITokenIdGenerator') implementation\. Draws random bytes from a cryptographically secure source \([System\.Security\.Cryptography\.RandomNumberGenerator](https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.randomnumbergenerator 'System\.Security\.Cryptography\.RandomNumberGenerator') via `CryptoRandom`\) using the byte count configured in [TokenIdLength](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions#Abblix.Oidc.Server.Common.Configuration.OidcOptions.TokenIdLength 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions\.TokenIdLength'), then URL\-safe Base64 encodes the result so the resulting `jti` value can travel safely through HTTP transports\. ```csharp public TokenIdGenerator(Microsoft.Extensions.Options.IOptions options); ``` #### Parameters ###### `options` [Microsoft\.Extensions\.Options\.IOptions<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptions-1 'Microsoft\.Extensions\.Options\.IOptions\`1')[OidcOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptions-1 'Microsoft\.Extensions\.Options\.IOptions\`1') {#Abblix.Oidc.Server.Features.RandomGenerators.TokenIdGenerator.TokenIdGenerator(Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_).options} ### Methods ## TokenIdGenerator\.GenerateTokenId\(\) Method {#Abblix.Oidc.Server.Features.RandomGenerators.TokenIdGenerator.GenerateTokenId()} Produces a new `jti` value from cryptographically secure random bytes, sized per [TokenIdLength](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions#Abblix.Oidc.Server.Common.Configuration.OidcOptions.TokenIdLength 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions\.TokenIdLength') and URL\-safe Base64 encoded\. ```csharp public string GenerateTokenId(); ``` Implements [GenerateTokenId\(\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.ITokenIdGenerator#Abblix.Oidc.Server.Features.RandomGenerators.ITokenIdGenerator.GenerateTokenId() 'Abblix\.Oidc\.Server\.Features\.RandomGenerators\.ITokenIdGenerator\.GenerateTokenId\(\)') #### Returns [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') A URL\-safe, randomly generated unique identifier for a JWT\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ReplayPrevention.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ## Abblix\.Oidc\.Server\.Features\.ReplayPrevention Namespace | Classes | | | :--- | :--- | | [DistributedJwtReplayCache](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ReplayPrevention.DistributedJwtReplayCache 'Abblix\.Oidc\.Server\.Features\.ReplayPrevention\.DistributedJwtReplayCache') | The deprecated contract's default implementation, kept so a host that resolves [IJwtReplayCache](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ReplayPrevention.IJwtReplayCache 'Abblix\.Oidc\.Server\.Features\.ReplayPrevention\.IJwtReplayCache') still receives a working object\. It stores nothing of its own: every reservation goes to the same [IReplayCache](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ReplayPrevention.IReplayCache 'Abblix\.Jwt\.ReplayPrevention\.IReplayCache') the server's own consumers use, so the deprecated and current spellings share one set of entries and cannot disagree about whether an identifier has been seen\. | | [ServiceCollectionExtensions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ReplayPrevention.ServiceCollectionExtensions 'Abblix\.Oidc\.Server\.Features\.ReplayPrevention\.ServiceCollectionExtensions') | Wires replay protection, which several unrelated features need and none of them owns: JWT\-bearer assertions \(RFC 7523 Section 3\), client assertions, and DPoP proofs \(RFC 9449 Section 11\.1\) all reserve identifiers in the same place\. | | Interfaces | | | :--- | :--- | | [IJwtReplayCache](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ReplayPrevention.IJwtReplayCache 'Abblix\.Oidc\.Server\.Features\.ReplayPrevention\.IJwtReplayCache') | Tracks JWT IDs \(jti claims\) presented to the server, so a JWT\-bearing flow can detect replay attempts\. Both RFC 7523 §3 \(JWT\-bearer\-grant assertion replay\) and RFC 9449 §11\.1 \(DPoP proof replay\) want this primitive; it is intentionally namespace\-neutral so a single distributed\-cache instance serves every consumer\. | --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ReplayPrevention.DistributedJwtReplayCache.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.ReplayPrevention](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ReplayPrevention 'Abblix\.Oidc\.Server\.Features\.ReplayPrevention') ## DistributedJwtReplayCache Class The deprecated contract's default implementation, kept so a host that resolves [IJwtReplayCache](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ReplayPrevention.IJwtReplayCache 'Abblix\.Oidc\.Server\.Features\.ReplayPrevention\.IJwtReplayCache') still receives a working object\. It stores nothing of its own: every reservation goes to the same [IReplayCache](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ReplayPrevention.IReplayCache 'Abblix\.Jwt\.ReplayPrevention\.IReplayCache') the server's own consumers use, so the deprecated and current spellings share one set of entries and cannot disagree about whether an identifier has been seen\. ```csharp public class DistributedJwtReplayCache : Abblix.Oidc.Server.Features.ReplayPrevention.IJwtReplayCache ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → DistributedJwtReplayCache Implements [IJwtReplayCache](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ReplayPrevention.IJwtReplayCache 'Abblix\.Oidc\.Server\.Features\.ReplayPrevention\.IJwtReplayCache') ### Remarks The only behaviour left here is the one the current contract deliberately dropped: an absent expiry\. The moved contract requires its caller to say when an identifier stops being worth remembering, because a cache that guesses either outlives or forgets the window its caller actually validates against\. This shim keeps guessing on its callers' behalf, with the hour the deprecated contract names\. ### Constructors ## DistributedJwtReplayCache\(IReplayCache, TimeProvider\) Constructor {#Abblix.Oidc.Server.Features.ReplayPrevention.DistributedJwtReplayCache.DistributedJwtReplayCache(Abblix.Jwt.ReplayPrevention.IReplayCache,System.TimeProvider)} The deprecated contract's default implementation, kept so a host that resolves [IJwtReplayCache](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ReplayPrevention.IJwtReplayCache 'Abblix\.Oidc\.Server\.Features\.ReplayPrevention\.IJwtReplayCache') still receives a working object\. It stores nothing of its own: every reservation goes to the same [IReplayCache](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ReplayPrevention.IReplayCache 'Abblix\.Jwt\.ReplayPrevention\.IReplayCache') the server's own consumers use, so the deprecated and current spellings share one set of entries and cannot disagree about whether an identifier has been seen\. ```csharp public DistributedJwtReplayCache(Abblix.Jwt.ReplayPrevention.IReplayCache replayCache, System.TimeProvider timeProvider); ``` #### Parameters ###### `replayCache` [IReplayCache](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ReplayPrevention.IReplayCache 'Abblix\.Jwt\.ReplayPrevention\.IReplayCache') {#Abblix.Oidc.Server.Features.ReplayPrevention.DistributedJwtReplayCache.DistributedJwtReplayCache(Abblix.Jwt.ReplayPrevention.IReplayCache,System.TimeProvider).replayCache} Where the reservation lands\. ###### `timeProvider` [System\.TimeProvider](https://learn.microsoft.com/en-us/dotnet/api/system.timeprovider 'System\.TimeProvider') {#Abblix.Oidc.Server.Features.ReplayPrevention.DistributedJwtReplayCache.DistributedJwtReplayCache(Abblix.Jwt.ReplayPrevention.IReplayCache,System.TimeProvider).timeProvider} Turns an absent expiry into an absolute moment\. ### Remarks The only behaviour left here is the one the current contract deliberately dropped: an absent expiry\. The moved contract requires its caller to say when an identifier stops being worth remembering, because a cache that guesses either outlives or forgets the window its caller actually validates against\. This shim keeps guessing on its callers' behalf, with the hour the deprecated contract names\. ### Methods ## DistributedJwtReplayCache\.TryAddAsync\(string, Nullable\\) Method {#Abblix.Oidc.Server.Features.ReplayPrevention.DistributedJwtReplayCache.TryAddAsync(string,System.Nullable_System.DateTimeOffset_)} Records a fresh jti, returning `true` only on the first call for that value\. The single\-call shape is atomic\-by\-contract: implementations are expected to use the backend's compare\-and\-set primitive so concurrent presenters of the same jti cannot both observe a miss and both succeed\. ```csharp public System.Threading.Tasks.Task TryAddAsync(string jti, System.Nullable expiresAt); ``` #### Parameters ###### `jti` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.ReplayPrevention.DistributedJwtReplayCache.TryAddAsync(string,System.Nullable_System.DateTimeOffset_).jti} The JWT ID \(jti claim\) to record\. ###### `expiresAt` [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') {#Abblix.Oidc.Server.Features.ReplayPrevention.DistributedJwtReplayCache.TryAddAsync(string,System.Nullable_System.DateTimeOffset_).expiresAt} Latest moment a same\-jti replay could still pass the iat\-window check; the cache entry only needs to persist that long\. `null` defers to the implementation's default TTL\. Implements [TryAddAsync\(string, Nullable<DateTimeOffset>\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ReplayPrevention.IJwtReplayCache#Abblix.Oidc.Server.Features.ReplayPrevention.IJwtReplayCache.TryAddAsync(string,System.Nullable_System.DateTimeOffset_) 'Abblix\.Oidc\.Server\.Features\.ReplayPrevention\.IJwtReplayCache\.TryAddAsync\(string, System\.Nullable\\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') `true` if the jti was newly recorded \(proof is fresh\); `false` if it was already present \(replay detected\)\. ### Remarks Atomic-capable backends close the race natively: Redis `SET ... NX EX` (via `StackExchange.Redis`), SQL `INSERT ... ON CONFLICT DO NOTHING`, Memcached `add`, in-memory `ConcurrentDictionary.TryAdd`. The default implementation [DistributedJwtReplayCache](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ReplayPrevention.DistributedJwtReplayCache 'Abblix\.Oidc\.Server\.Features\.ReplayPrevention\.DistributedJwtReplayCache') uses [Microsoft\.Extensions\.Caching\.Distributed\.IDistributedCache](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.caching.distributed.idistributedcache 'Microsoft\.Extensions\.Caching\.Distributed\.IDistributedCache'), which exposes only Get + Set and no compare-and-set primitive. It therefore provides only a probabilistic guarantee: two concurrent presenters of the same jti can both observe a miss before either writes. The race window is bounded by the cache round-trip and RFC 9449 §11.1 accepts probabilistic replay defence - but hosts that need strict atomicity should override the registration with a backend-aware implementation that bypasses [Microsoft\.Extensions\.Caching\.Distributed\.IDistributedCache](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.caching.distributed.idistributedcache 'Microsoft\.Extensions\.Caching\.Distributed\.IDistributedCache') and talks to the chosen backend's atomic primitive directly. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ReplayPrevention.IJwtReplayCache.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.ReplayPrevention](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ReplayPrevention 'Abblix\.Oidc\.Server\.Features\.ReplayPrevention') ## IJwtReplayCache Interface Tracks JWT IDs \(jti claims\) presented to the server, so a JWT\-bearing flow can detect replay attempts\. Both RFC 7523 §3 \(JWT\-bearer\-grant assertion replay\) and RFC 9449 §11\.1 \(DPoP proof replay\) want this primitive; it is intentionally namespace\-neutral so a single distributed\-cache instance serves every consumer\. ```csharp public interface IJwtReplayCache ``` Derived ↳ [DistributedJwtReplayCache](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ReplayPrevention.DistributedJwtReplayCache 'Abblix\.Oidc\.Server\.Features\.ReplayPrevention\.DistributedJwtReplayCache') ### Remarks The primitive now lives in Abblix\.JWT as [IReplayCache](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ReplayPrevention.IReplayCache 'Abblix\.Jwt\.ReplayPrevention\.IReplayCache'), one layer below this package, because Security Event Token receivers need the same reserve\-and\-check and cannot reference the OpenID Connect server to get it\. This contract remains registered and working for host code that names it, and its default implementation stores through the moved one, so both spellings share a single set of entries\. ### Methods ## IJwtReplayCache\.TryAddAsync\(string, Nullable\\) Method {#Abblix.Oidc.Server.Features.ReplayPrevention.IJwtReplayCache.TryAddAsync(string,System.Nullable_System.DateTimeOffset_)} Records a fresh jti, returning `true` only on the first call for that value\. The single\-call shape is atomic\-by\-contract: implementations are expected to use the backend's compare\-and\-set primitive so concurrent presenters of the same jti cannot both observe a miss and both succeed\. ```csharp System.Threading.Tasks.Task TryAddAsync(string jti, System.Nullable expiresAt); ``` #### Parameters ###### `jti` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.ReplayPrevention.IJwtReplayCache.TryAddAsync(string,System.Nullable_System.DateTimeOffset_).jti} The JWT ID \(jti claim\) to record\. ###### `expiresAt` [System\.Nullable<](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[System\.DateTimeOffset](https://learn.microsoft.com/en-us/dotnet/api/system.datetimeoffset 'System\.DateTimeOffset')[>](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1') {#Abblix.Oidc.Server.Features.ReplayPrevention.IJwtReplayCache.TryAddAsync(string,System.Nullable_System.DateTimeOffset_).expiresAt} Latest moment a same\-jti replay could still pass the iat\-window check; the cache entry only needs to persist that long\. `null` defers to the implementation's default TTL\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') `true` if the jti was newly recorded \(proof is fresh\); `false` if it was already present \(replay detected\)\. ### Remarks Atomic-capable backends close the race natively: Redis `SET ... NX EX` (via `StackExchange.Redis`), SQL `INSERT ... ON CONFLICT DO NOTHING`, Memcached `add`, in-memory `ConcurrentDictionary.TryAdd`. The default implementation [DistributedJwtReplayCache](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ReplayPrevention.DistributedJwtReplayCache 'Abblix\.Oidc\.Server\.Features\.ReplayPrevention\.DistributedJwtReplayCache') uses [Microsoft\.Extensions\.Caching\.Distributed\.IDistributedCache](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.caching.distributed.idistributedcache 'Microsoft\.Extensions\.Caching\.Distributed\.IDistributedCache'), which exposes only Get + Set and no compare-and-set primitive. It therefore provides only a probabilistic guarantee: two concurrent presenters of the same jti can both observe a miss before either writes. The race window is bounded by the cache round-trip and RFC 9449 §11.1 accepts probabilistic replay defence - but hosts that need strict atomicity should override the registration with a backend-aware implementation that bypasses [Microsoft\.Extensions\.Caching\.Distributed\.IDistributedCache](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.caching.distributed.idistributedcache 'Microsoft\.Extensions\.Caching\.Distributed\.IDistributedCache') and talks to the chosen backend's atomic primitive directly. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ReplayPrevention.ServiceCollectionExtensions.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.ReplayPrevention](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ReplayPrevention 'Abblix\.Oidc\.Server\.Features\.ReplayPrevention') ## ServiceCollectionExtensions Class Wires replay protection, which several unrelated features need and none of them owns: JWT\-bearer assertions \(RFC 7523 Section 3\), client assertions, and DPoP proofs \(RFC 9449 Section 11\.1\) all reserve identifiers in the same place\. ```csharp public static class ServiceCollectionExtensions ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ServiceCollectionExtensions ### Methods ## ServiceCollectionExtensions\.AddReplayPrevention\(this IServiceCollection\) Method {#Abblix.Oidc.Server.Features.ReplayPrevention.ServiceCollectionExtensions.AddReplayPrevention(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection)} Registers the replay cache and the deprecated contract that still resolves to it\. ```csharp public static Microsoft.Extensions.DependencyInjection.IServiceCollection AddReplayPrevention(this Microsoft.Extensions.DependencyInjection.IServiceCollection services); ``` #### Parameters ###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.Oidc.Server.Features.ReplayPrevention.ServiceCollectionExtensions.AddReplayPrevention(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection).services} The service collection\. #### Returns [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') ### Remarks Idempotent and TryAdd throughout, because three unrelated feature registrations call it and a host may have decided any part of it beforehand\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RequestObject.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ## Abblix\.Oidc\.Server\.Features\.RequestObject Namespace | Classes | | | :--- | :--- | | [RequestObjectFetcher](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RequestObject.RequestObjectFetcher 'Abblix\.Oidc\.Server\.Features\.RequestObject\.RequestObjectFetcher') | Provides functionality to validate and process JWT request objects, binding their payloads to a request model\. This class is typically used in OpenID Connect flows where request parameters are passed as JWTs\. | | Interfaces | | | :--- | :--- | | [IRequestObjectFetcher](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RequestObject.IRequestObjectFetcher 'Abblix\.Oidc\.Server\.Features\.RequestObject\.IRequestObjectFetcher') | Defines the interface for fetching and processing JWT request objects, validating their content and binding their payloads to a request model\. This is typically used in OpenID Connect flows where request parameters are passed as JWTs\. | --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RequestObject.IRequestObjectFetcher.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.RequestObject](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RequestObject 'Abblix\.Oidc\.Server\.Features\.RequestObject') ## IRequestObjectFetcher Interface Defines the interface for fetching and processing JWT request objects, validating their content and binding their payloads to a request model\. This is typically used in OpenID Connect flows where request parameters are passed as JWTs\. ```csharp public interface IRequestObjectFetcher ``` Derived ↳ [RequestObjectFetcher](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RequestObject.RequestObjectFetcher 'Abblix\.Oidc\.Server\.Features\.RequestObject\.RequestObjectFetcher') ### Methods ## IRequestObjectFetcher\.FetchAsync\\(T, string, Func\\) Method {#Abblix.Oidc.Server.Features.RequestObject.IRequestObjectFetcher.FetchAsync_T_(T,string,System.Func_Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,string_)} Fetches and processes the request object by validating its JWT and binding the payload to the request model\. ```csharp System.Threading.Tasks.Task> FetchAsync(T request, string? requestObject, System.Func? requiredSigningAlgorithm=null) where T : class; ``` #### Type parameters ###### `T` {#Abblix.Oidc.Server.Features.RequestObject.IRequestObjectFetcher.FetchAsync_T_(T,string,System.Func_Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,string_).T} The type of the request model\. #### Parameters ###### `request` [T](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RequestObject.IRequestObjectFetcher#Abblix.Oidc.Server.Features.RequestObject.IRequestObjectFetcher.FetchAsync_T_(T,string,System.Func_Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,string_).T 'Abblix\.Oidc\.Server\.Features\.RequestObject\.IRequestObjectFetcher\.FetchAsync\\(T, string, System\.Func\\)\.T') {#Abblix.Oidc.Server.Features.RequestObject.IRequestObjectFetcher.FetchAsync_T_(T,string,System.Func_Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,string_).request} The initial request model to bind the JWT payload to\. ###### `requestObject` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.RequestObject.IRequestObjectFetcher.FetchAsync_T_(T,string,System.Func_Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,string_).requestObject} The JWT contained within the request, if any\. ###### `requiredSigningAlgorithm` [System\.Func<](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2')[ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo')[,](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2') {#Abblix.Oidc.Server.Features.RequestObject.IRequestObjectFetcher.FetchAsync_T_(T,string,System.Func_Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,string_).requiredSigningAlgorithm} Optional selector returning the algorithm the resolved client registered for this kind of request object \(e\.g\. `request_object_signing_alg` for authorization requests or `backchannel_authentication_request_signing_alg` for CIBA\)\. When it returns a non\-empty value, a request object whose `alg` differs is rejected\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[T](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RequestObject.IRequestObjectFetcher#Abblix.Oidc.Server.Features.RequestObject.IRequestObjectFetcher.FetchAsync_T_(T,string,System.Func_Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,string_).T 'Abblix\.Oidc\.Server\.Features\.RequestObject\.IRequestObjectFetcher\.FetchAsync\\(T, string, System\.Func\\)\.T')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task representing the asynchronous operation\. The task result contains a [Result<TSuccess,TFailure>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2') object, which either represents a successfully processed request or an error indicating issues with the JWT validation\. ### Remarks This method is responsible for decoding and validating the JWT contained in the request\. If the JWT is valid, the payload is bound to the request model\. If the JWT is invalid or not present, an appropriate error result is returned\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RequestObject.RequestObjectFetcher.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.RequestObject](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RequestObject 'Abblix\.Oidc\.Server\.Features\.RequestObject') ## RequestObjectFetcher Class Provides functionality to validate and process JWT request objects, binding their payloads to a request model\. This class is typically used in OpenID Connect flows where request parameters are passed as JWTs\. ```csharp public class RequestObjectFetcher : Abblix.Oidc.Server.Features.RequestObject.IRequestObjectFetcher ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → RequestObjectFetcher Implements [IRequestObjectFetcher](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RequestObject.IRequestObjectFetcher 'Abblix\.Oidc\.Server\.Features\.RequestObject\.IRequestObjectFetcher') ### Constructors ## RequestObjectFetcher\(ILogger\, IJsonObjectBinder, IServiceProvider, IOptionsSnapshot\\) Constructor {#Abblix.Oidc.Server.Features.RequestObject.RequestObjectFetcher.RequestObjectFetcher(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.RequestObject.RequestObjectFetcher_,Abblix.Oidc.Server.Common.Interfaces.IJsonObjectBinder,System.IServiceProvider,Microsoft.Extensions.Options.IOptionsSnapshot_Abblix.Oidc.Server.Common.Configuration.OidcOptions_)} Provides functionality to validate and process JWT request objects, binding their payloads to a request model\. This class is typically used in OpenID Connect flows where request parameters are passed as JWTs\. ```csharp public RequestObjectFetcher(Microsoft.Extensions.Logging.ILogger logger, Abblix.Oidc.Server.Common.Interfaces.IJsonObjectBinder jsonObjectBinder, System.IServiceProvider serviceProvider, Microsoft.Extensions.Options.IOptionsSnapshot options); ``` #### Parameters ###### `logger` [Microsoft\.Extensions\.Logging\.ILogger<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1')[RequestObjectFetcher](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RequestObject.RequestObjectFetcher 'Abblix\.Oidc\.Server\.Features\.RequestObject\.RequestObjectFetcher')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1') {#Abblix.Oidc.Server.Features.RequestObject.RequestObjectFetcher.RequestObjectFetcher(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.RequestObject.RequestObjectFetcher_,Abblix.Oidc.Server.Common.Interfaces.IJsonObjectBinder,System.IServiceProvider,Microsoft.Extensions.Options.IOptionsSnapshot_Abblix.Oidc.Server.Common.Configuration.OidcOptions_).logger} The logger for recording debug information and warnings\. ###### `jsonObjectBinder` [IJsonObjectBinder](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IJsonObjectBinder 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IJsonObjectBinder') {#Abblix.Oidc.Server.Features.RequestObject.RequestObjectFetcher.RequestObjectFetcher(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.RequestObject.RequestObjectFetcher_,Abblix.Oidc.Server.Common.Interfaces.IJsonObjectBinder,System.IServiceProvider,Microsoft.Extensions.Options.IOptionsSnapshot_Abblix.Oidc.Server.Common.Configuration.OidcOptions_).jsonObjectBinder} The binder for converting JSON payloads into request objects\. ###### `serviceProvider` [System\.IServiceProvider](https://learn.microsoft.com/en-us/dotnet/api/system.iserviceprovider 'System\.IServiceProvider') {#Abblix.Oidc.Server.Features.RequestObject.RequestObjectFetcher.RequestObjectFetcher(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.RequestObject.RequestObjectFetcher_,Abblix.Oidc.Server.Common.Interfaces.IJsonObjectBinder,System.IServiceProvider,Microsoft.Extensions.Options.IOptionsSnapshot_Abblix.Oidc.Server.Common.Configuration.OidcOptions_).serviceProvider} The service provider used for resolving dependencies at runtime\. ###### `options` [Microsoft\.Extensions\.Options\.IOptionsSnapshot<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptionssnapshot-1 'Microsoft\.Extensions\.Options\.IOptionsSnapshot\`1')[OidcOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptionssnapshot-1 'Microsoft\.Extensions\.Options\.IOptionsSnapshot\`1') {#Abblix.Oidc.Server.Features.RequestObject.RequestObjectFetcher.RequestObjectFetcher(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.RequestObject.RequestObjectFetcher_,Abblix.Oidc.Server.Common.Interfaces.IJsonObjectBinder,System.IServiceProvider,Microsoft.Extensions.Options.IOptionsSnapshot_Abblix.Oidc.Server.Common.Configuration.OidcOptions_).options} Options that define how request object validation is handled, including whether request objects must be signed\. ### Methods ## RequestObjectFetcher\.FetchAsync\\(T, string, Func\\) Method {#Abblix.Oidc.Server.Features.RequestObject.RequestObjectFetcher.FetchAsync_T_(T,string,System.Func_Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,string_)} Fetches and processes the request object by validating its JWT and binding the payload to the request model\. ```csharp public System.Threading.Tasks.Task> FetchAsync(T request, string? requestObject, System.Func? requiredSigningAlgorithm=null) where T : class; ``` #### Type parameters ###### `T` {#Abblix.Oidc.Server.Features.RequestObject.RequestObjectFetcher.FetchAsync_T_(T,string,System.Func_Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,string_).T} The type of the request model\. #### Parameters ###### `request` [T](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RequestObject.RequestObjectFetcher#Abblix.Oidc.Server.Features.RequestObject.RequestObjectFetcher.FetchAsync_T_(T,string,System.Func_Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,string_).T 'Abblix\.Oidc\.Server\.Features\.RequestObject\.RequestObjectFetcher\.FetchAsync\\(T, string, System\.Func\\)\.T') {#Abblix.Oidc.Server.Features.RequestObject.RequestObjectFetcher.FetchAsync_T_(T,string,System.Func_Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,string_).request} The initial request model to bind the JWT payload to\. ###### `requestObject` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.RequestObject.RequestObjectFetcher.FetchAsync_T_(T,string,System.Func_Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,string_).requestObject} The JWT contained within the request, if any\. ###### `requiredSigningAlgorithm` [System\.Func<](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2')[ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo')[,](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2') {#Abblix.Oidc.Server.Features.RequestObject.RequestObjectFetcher.FetchAsync_T_(T,string,System.Func_Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,string_).requiredSigningAlgorithm} An optional selector returning the signing algorithm the request object must use for a given client, or `null` to impose no per\-client requirement\. Implements [FetchAsync<T>\(T, string, Func<ClientInfo,string>\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RequestObject.IRequestObjectFetcher#Abblix.Oidc.Server.Features.RequestObject.IRequestObjectFetcher.FetchAsync_T_(T,string,System.Func_Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,string_) 'Abblix\.Oidc\.Server\.Features\.RequestObject\.IRequestObjectFetcher\.FetchAsync\\(T, string, System\.Func\\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result<](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[T](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RequestObject.RequestObjectFetcher#Abblix.Oidc.Server.Features.RequestObject.RequestObjectFetcher.FetchAsync_T_(T,string,System.Func_Abblix.Oidc.Server.Features.ClientInformation.ClientInfo,string_).T 'Abblix\.Oidc\.Server\.Features\.RequestObject\.RequestObjectFetcher\.FetchAsync\\(T, string, System\.Func\\)\.T')[,](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') A task representing the asynchronous operation\. The task result contains an [Result<TSuccess,TFailure>](https://www.abblix.com/en/docs/api/abblix-utils/Abblix.Utils.Result_TSuccess_TFailure_ 'Abblix\.Utils\.Result\`2') which either represents a successfully processed request or an error indicating issues with the JWT validation\. ### Remarks This method is used to decode and validate the JWT contained in the request\. If the JWT is valid, the payload is bound to the request model\. If the JWT is invalid, an error is returned and logged\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ResourceIndicators.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ## Abblix\.Oidc\.Server\.Features\.ResourceIndicators Namespace | Classes | | | :--- | :--- | | [AudienceKeyResolver](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ResourceIndicators.AudienceKeyResolver 'Abblix\.Oidc\.Server\.Features\.ResourceIndicators\.AudienceKeyResolver') | Answers from the resource registry, taking the first published key per resource\. | | [ResourceKeysProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ResourceIndicators.ResourceKeysProvider 'Abblix\.Oidc\.Server\.Features\.ResourceIndicators\.ResourceKeysProvider') | Resolves a protected resource's encryption keys from its registration, inline or at its JWKS URI\. | | [ResourceManager](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ResourceIndicators.ResourceManager 'Abblix\.Oidc\.Server\.Features\.ResourceIndicators\.ResourceManager') | In\-memory [IResourceManager](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ResourceIndicators.IResourceManager 'Abblix\.Oidc\.Server\.Features\.ResourceIndicators\.IResourceManager') backed by [Resources](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions#Abblix.Oidc.Server.Common.Configuration.OidcOptions.Resources 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions\.Resources')\. Indexes the configured [ResourceDefinition](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ResourceDefinition 'Abblix\.Oidc\.Server\.Common\.Constants\.ResourceDefinition') entries by their absolute URI for O\(1\) lookup during RFC 8707 resource indicator validation\. | | [ResourceManagerExtensions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ResourceIndicators.ResourceManagerExtensions 'Abblix\.Oidc\.Server\.Features\.ResourceIndicators\.ResourceManagerExtensions') | Provides extension methods for resource validation, leveraging a resource manager to ensure the validity and permissibility of requested resources\. | | Interfaces | | | :--- | :--- | | [IAudienceKeyResolver](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ResourceIndicators.IAudienceKeyResolver 'Abblix\.Oidc\.Server\.Features\.ResourceIndicators\.IAudienceKeyResolver') | Finds the one encryption key a token's audience published, if any\. | | [IResourceKeysProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ResourceIndicators.IResourceKeysProvider 'Abblix\.Oidc\.Server\.Features\.ResourceIndicators\.IResourceKeysProvider') | Supplies the encryption keys a protected resource publishes, so an access token minted for it can be encrypted to the party that reads it rather than to this server\. | | [IResourceManager](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ResourceIndicators.IResourceManager 'Abblix\.Oidc\.Server\.Features\.ResourceIndicators\.IResourceManager') | Looks up [ResourceDefinition](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ResourceDefinition 'Abblix\.Oidc\.Server\.Common\.Constants\.ResourceDefinition') entries registered for the authorization server, supporting validation of the `resource` parameter defined by RFC 8707 \(Resource Indicators for OAuth 2\.0\) at the authorization, token, and PAR endpoints\. | --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ResourceIndicators.AudienceKeyResolver.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.ResourceIndicators](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ResourceIndicators 'Abblix\.Oidc\.Server\.Features\.ResourceIndicators') ## AudienceKeyResolver Class Answers from the resource registry, taking the first published key per resource\. ```csharp public class AudienceKeyResolver : Abblix.Oidc.Server.Features.ResourceIndicators.IAudienceKeyResolver ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → AudienceKeyResolver Implements [IAudienceKeyResolver](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ResourceIndicators.IAudienceKeyResolver 'Abblix\.Oidc\.Server\.Features\.ResourceIndicators\.IAudienceKeyResolver') ### Constructors ## AudienceKeyResolver\(IResourceManager, IResourceKeysProvider\) Constructor {#Abblix.Oidc.Server.Features.ResourceIndicators.AudienceKeyResolver.AudienceKeyResolver(Abblix.Oidc.Server.Features.ResourceIndicators.IResourceManager,Abblix.Oidc.Server.Features.ResourceIndicators.IResourceKeysProvider)} Answers from the resource registry, taking the first published key per resource\. ```csharp public AudienceKeyResolver(Abblix.Oidc.Server.Features.ResourceIndicators.IResourceManager resourceManager, Abblix.Oidc.Server.Features.ResourceIndicators.IResourceKeysProvider resourceKeysProvider); ``` #### Parameters ###### `resourceManager` [IResourceManager](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ResourceIndicators.IResourceManager 'Abblix\.Oidc\.Server\.Features\.ResourceIndicators\.IResourceManager') {#Abblix.Oidc.Server.Features.ResourceIndicators.AudienceKeyResolver.AudienceKeyResolver(Abblix.Oidc.Server.Features.ResourceIndicators.IResourceManager,Abblix.Oidc.Server.Features.ResourceIndicators.IResourceKeysProvider).resourceManager} Resolves a requested resource URI to its registered definition\. ###### `resourceKeysProvider` [IResourceKeysProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ResourceIndicators.IResourceKeysProvider 'Abblix\.Oidc\.Server\.Features\.ResourceIndicators\.IResourceKeysProvider') {#Abblix.Oidc.Server.Features.ResourceIndicators.AudienceKeyResolver.AudienceKeyResolver(Abblix.Oidc.Server.Features.ResourceIndicators.IResourceManager,Abblix.Oidc.Server.Features.ResourceIndicators.IResourceKeysProvider).resourceKeysProvider} Supplies that resource's published encryption keys\. ### Methods ## AudienceKeyResolver\.FindEncryptionKeyAsync\(IReadOnlyCollection\\) Method {#Abblix.Oidc.Server.Features.ResourceIndicators.AudienceKeyResolver.FindEncryptionKeyAsync(System.Collections.Generic.IReadOnlyCollection_System.Uri_)} The encryption key published by the audience named in [resources](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ResourceIndicators.AudienceKeyResolver#Abblix.Oidc.Server.Features.ResourceIndicators.AudienceKeyResolver.FindEncryptionKeyAsync(System.Collections.Generic.IReadOnlyCollection_System.Uri_).resources 'Abblix\.Oidc\.Server\.Features\.ResourceIndicators\.AudienceKeyResolver\.FindEncryptionKeyAsync\(System\.Collections\.Generic\.IReadOnlyCollection\\)\.resources'), or `null` when none of them publishes one\. ```csharp public System.Threading.Tasks.Task FindEncryptionKeyAsync(System.Collections.Generic.IReadOnlyCollection resources); ``` #### Parameters ###### `resources` [System\.Collections\.Generic\.IReadOnlyCollection<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ireadonlycollection-1 'System\.Collections\.Generic\.IReadOnlyCollection\`1')[System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ireadonlycollection-1 'System\.Collections\.Generic\.IReadOnlyCollection\`1') {#Abblix.Oidc.Server.Features.ResourceIndicators.AudienceKeyResolver.FindEncryptionKeyAsync(System.Collections.Generic.IReadOnlyCollection_System.Uri_).resources} The resources the token is minted for\. Implements [FindEncryptionKeyAsync\(IReadOnlyCollection<Uri>\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ResourceIndicators.IAudienceKeyResolver#Abblix.Oidc.Server.Features.ResourceIndicators.IAudienceKeyResolver.FindEncryptionKeyAsync(System.Collections.Generic.IReadOnlyCollection_System.Uri_) 'Abblix\.Oidc\.Server\.Features\.ResourceIndicators\.IAudienceKeyResolver\.FindEncryptionKeyAsync\(System\.Collections\.Generic\.IReadOnlyCollection\\)') #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') #### Exceptions [System\.InvalidOperationException](https://learn.microsoft.com/en-us/dotnet/api/system.invalidoperationexception 'System\.InvalidOperationException') Several of the named resources each publish an encryption key\. ### Remarks A resource that publishes no key contributes nothing, which is how it says a signed JWS is what it expects\. Several resources each publishing a key have no correct answer: compact JWE serialization carries one recipient, so encrypting to one of them would silently leave the token unreadable to the rest \- refuse instead of choosing\. Unknown resources never reach here, having been rejected as `invalid_target` during request validation \(RFC 8707 Section 2\)\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ResourceIndicators.IAudienceKeyResolver.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.ResourceIndicators](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ResourceIndicators 'Abblix\.Oidc\.Server\.Features\.ResourceIndicators') ## IAudienceKeyResolver Interface Finds the one encryption key a token's audience published, if any\. ```csharp public interface IAudienceKeyResolver ``` Derived ↳ [AudienceKeyResolver](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ResourceIndicators.AudienceKeyResolver 'Abblix\.Oidc\.Server\.Features\.ResourceIndicators\.AudienceKeyResolver') ### Remarks Owns the question rather than leaving its two halves \- resolving a resource to its definition and reading that definition's keys \- to every consumer that asks it\. A token service needs the answer, not the mechanics\. ### Methods ## IAudienceKeyResolver\.FindEncryptionKeyAsync\(IReadOnlyCollection\\) Method {#Abblix.Oidc.Server.Features.ResourceIndicators.IAudienceKeyResolver.FindEncryptionKeyAsync(System.Collections.Generic.IReadOnlyCollection_System.Uri_)} The encryption key published by the audience named in [resources](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ResourceIndicators.IAudienceKeyResolver#Abblix.Oidc.Server.Features.ResourceIndicators.IAudienceKeyResolver.FindEncryptionKeyAsync(System.Collections.Generic.IReadOnlyCollection_System.Uri_).resources 'Abblix\.Oidc\.Server\.Features\.ResourceIndicators\.IAudienceKeyResolver\.FindEncryptionKeyAsync\(System\.Collections\.Generic\.IReadOnlyCollection\\)\.resources'), or `null` when none of them publishes one\. ```csharp System.Threading.Tasks.Task FindEncryptionKeyAsync(System.Collections.Generic.IReadOnlyCollection resources); ``` #### Parameters ###### `resources` [System\.Collections\.Generic\.IReadOnlyCollection<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ireadonlycollection-1 'System\.Collections\.Generic\.IReadOnlyCollection\`1')[System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ireadonlycollection-1 'System\.Collections\.Generic\.IReadOnlyCollection\`1') {#Abblix.Oidc.Server.Features.ResourceIndicators.IAudienceKeyResolver.FindEncryptionKeyAsync(System.Collections.Generic.IReadOnlyCollection_System.Uri_).resources} The resources the token is minted for\. #### Returns [System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1') #### Exceptions [System\.InvalidOperationException](https://learn.microsoft.com/en-us/dotnet/api/system.invalidoperationexception 'System\.InvalidOperationException') Several of the named resources each publish an encryption key\. ### Remarks A resource that publishes no key contributes nothing, which is how it says a signed JWS is what it expects\. Several resources each publishing a key have no correct answer: compact JWE serialization carries one recipient, so encrypting to one of them would silently leave the token unreadable to the rest \- refuse instead of choosing\. Unknown resources never reach here, having been rejected as `invalid_target` during request validation \(RFC 8707 Section 2\)\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ResourceIndicators.IResourceKeysProvider.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.ResourceIndicators](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ResourceIndicators 'Abblix\.Oidc\.Server\.Features\.ResourceIndicators') ## IResourceKeysProvider Interface Supplies the encryption keys a protected resource publishes, so an access token minted for it can be encrypted to the party that reads it rather than to this server\. ```csharp public interface IResourceKeysProvider ``` Derived ↳ [ResourceKeysProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ResourceIndicators.ResourceKeysProvider 'Abblix\.Oidc\.Server\.Features\.ResourceIndicators\.ResourceKeysProvider') ### Remarks The service\-side counterpart of [IClientKeysProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.IClientKeysProvider 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.IClientKeysProvider'): same two forms \(inline in the registration, or fetched from a JWKS URI\), same SSRF\-protected and cached path\. Only the owner differs, and with it who can decrypt the result\. ### Methods ## IResourceKeysProvider\.GetEncryptionKeys\(ResourceDefinition\) Method {#Abblix.Oidc.Server.Features.ResourceIndicators.IResourceKeysProvider.GetEncryptionKeys(Abblix.Oidc.Server.Common.Constants.ResourceDefinition)} Retrieves the encryption keys published by the given resource\. ```csharp System.Collections.Generic.IAsyncEnumerable GetEncryptionKeys(Abblix.Oidc.Server.Common.Constants.ResourceDefinition definition); ``` #### Parameters ###### `definition` [ResourceDefinition](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ResourceDefinition 'Abblix\.Oidc\.Server\.Common\.Constants\.ResourceDefinition') {#Abblix.Oidc.Server.Features.ResourceIndicators.IResourceKeysProvider.GetEncryptionKeys(Abblix.Oidc.Server.Common.Constants.ResourceDefinition).definition} The registered definition of the resource\. #### Returns [System\.Collections\.Generic\.IAsyncEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.iasyncenumerable-1 'System\.Collections\.Generic\.IAsyncEnumerable\`1')[JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.iasyncenumerable-1 'System\.Collections\.Generic\.IAsyncEnumerable\`1') The resource's encryption keys, empty when it publishes none, which is how a resource says it accepts a signed JWS\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ResourceIndicators.IResourceManager.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.ResourceIndicators](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ResourceIndicators 'Abblix\.Oidc\.Server\.Features\.ResourceIndicators') ## IResourceManager Interface Looks up [ResourceDefinition](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ResourceDefinition 'Abblix\.Oidc\.Server\.Common\.Constants\.ResourceDefinition') entries registered for the authorization server, supporting validation of the `resource` parameter defined by RFC 8707 \(Resource Indicators for OAuth 2\.0\) at the authorization, token, and PAR endpoints\. ```csharp public interface IResourceManager ``` Derived ↳ [ResourceManager](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ResourceIndicators.ResourceManager 'Abblix\.Oidc\.Server\.Features\.ResourceIndicators\.ResourceManager') ### Remarks Acts as the registry that decides whether a requested resource URI corresponds to an audience the server is willing to mint tokens for, and which scopes that resource accepts\. ### Methods ## IResourceManager\.TryGet\(Uri, ResourceDefinition\) Method {#Abblix.Oidc.Server.Features.ResourceIndicators.IResourceManager.TryGet(System.Uri,Abblix.Oidc.Server.Common.Constants.ResourceDefinition)} Attempts to retrieve the resource definition associated with the specified URI\. ```csharp bool TryGet(System.Uri resource, out Abblix.Oidc.Server.Common.Constants.ResourceDefinition definition); ``` #### Parameters ###### `resource` [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri') {#Abblix.Oidc.Server.Features.ResourceIndicators.IResourceManager.TryGet(System.Uri,Abblix.Oidc.Server.Common.Constants.ResourceDefinition).resource} The URI identifying the resource for which the definition is requested\. ###### `definition` [ResourceDefinition](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ResourceDefinition 'Abblix\.Oidc\.Server\.Common\.Constants\.ResourceDefinition') {#Abblix.Oidc.Server.Features.ResourceIndicators.IResourceManager.TryGet(System.Uri,Abblix.Oidc.Server.Common.Constants.ResourceDefinition).definition} When this method returns, contains the resource definition associated with the specified URI, if the resource is found; otherwise, null\. This parameter is passed uninitialized\. #### Returns [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') `true` if the resource definition is found; otherwise, `false`\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ResourceIndicators.ResourceKeysProvider.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.ResourceIndicators](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ResourceIndicators 'Abblix\.Oidc\.Server\.Features\.ResourceIndicators') ## ResourceKeysProvider Class Resolves a protected resource's encryption keys from its registration, inline or at its JWKS URI\. ```csharp public class ResourceKeysProvider : Abblix.Oidc.Server.Features.ResourceIndicators.IResourceKeysProvider ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ResourceKeysProvider Implements [IResourceKeysProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ResourceIndicators.IResourceKeysProvider 'Abblix\.Oidc\.Server\.Features\.ResourceIndicators\.IResourceKeysProvider') ### Constructors ## ResourceKeysProvider\(ILogger\, IServiceProvider\) Constructor {#Abblix.Oidc.Server.Features.ResourceIndicators.ResourceKeysProvider.ResourceKeysProvider(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.ResourceIndicators.ResourceKeysProvider_,System.IServiceProvider)} Resolves a protected resource's encryption keys from its registration, inline or at its JWKS URI\. ```csharp public ResourceKeysProvider(Microsoft.Extensions.Logging.ILogger logger, System.IServiceProvider serviceProvider); ``` #### Parameters ###### `logger` [Microsoft\.Extensions\.Logging\.ILogger<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1')[ResourceKeysProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ResourceIndicators.ResourceKeysProvider 'Abblix\.Oidc\.Server\.Features\.ResourceIndicators\.ResourceKeysProvider')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1') {#Abblix.Oidc.Server.Features.ResourceIndicators.ResourceKeysProvider.ResourceKeysProvider(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.ResourceIndicators.ResourceKeysProvider_,System.IServiceProvider).logger} Logger for capturing fetch operations and errors\. ###### `serviceProvider` [System\.IServiceProvider](https://learn.microsoft.com/en-us/dotnet/api/system.iserviceprovider 'System\.IServiceProvider') {#Abblix.Oidc.Server.Features.ResourceIndicators.ResourceKeysProvider.ResourceKeysProvider(Microsoft.Extensions.Logging.ILogger_Abblix.Oidc.Server.Features.ResourceIndicators.ResourceKeysProvider_,System.IServiceProvider).serviceProvider} Used to resolve the scoped [ISecureHttpFetcher](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.SecureHttpFetch.ISecureHttpFetcher 'Abblix\.Oidc\.Server\.Features\.SecureHttpFetch\.ISecureHttpFetcher') per fetch\. ### Methods ## ResourceKeysProvider\.GetEncryptionKeys\(ResourceDefinition\) Method {#Abblix.Oidc.Server.Features.ResourceIndicators.ResourceKeysProvider.GetEncryptionKeys(Abblix.Oidc.Server.Common.Constants.ResourceDefinition)} Retrieves the encryption keys published by the given resource\. ```csharp public System.Collections.Generic.IAsyncEnumerable GetEncryptionKeys(Abblix.Oidc.Server.Common.Constants.ResourceDefinition definition); ``` #### Parameters ###### `definition` [ResourceDefinition](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ResourceDefinition 'Abblix\.Oidc\.Server\.Common\.Constants\.ResourceDefinition') {#Abblix.Oidc.Server.Features.ResourceIndicators.ResourceKeysProvider.GetEncryptionKeys(Abblix.Oidc.Server.Common.Constants.ResourceDefinition).definition} The registered definition of the resource\. Implements [GetEncryptionKeys\(ResourceDefinition\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ResourceIndicators.IResourceKeysProvider#Abblix.Oidc.Server.Features.ResourceIndicators.IResourceKeysProvider.GetEncryptionKeys(Abblix.Oidc.Server.Common.Constants.ResourceDefinition) 'Abblix\.Oidc\.Server\.Features\.ResourceIndicators\.IResourceKeysProvider\.GetEncryptionKeys\(Abblix\.Oidc\.Server\.Common\.Constants\.ResourceDefinition\)') #### Returns [System\.Collections\.Generic\.IAsyncEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.iasyncenumerable-1 'System\.Collections\.Generic\.IAsyncEnumerable\`1')[JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.iasyncenumerable-1 'System\.Collections\.Generic\.IAsyncEnumerable\`1') The resource's encryption keys, empty when it publishes none, which is how a resource says it accepts a signed JWS\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ResourceIndicators.ResourceManager.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.ResourceIndicators](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ResourceIndicators 'Abblix\.Oidc\.Server\.Features\.ResourceIndicators') ## ResourceManager Class In\-memory [IResourceManager](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ResourceIndicators.IResourceManager 'Abblix\.Oidc\.Server\.Features\.ResourceIndicators\.IResourceManager') backed by [Resources](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions#Abblix.Oidc.Server.Common.Configuration.OidcOptions.Resources 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions\.Resources')\. Indexes the configured [ResourceDefinition](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ResourceDefinition 'Abblix\.Oidc\.Server\.Common\.Constants\.ResourceDefinition') entries by their absolute URI for O\(1\) lookup during RFC 8707 resource indicator validation\. ```csharp public class ResourceManager : Abblix.Oidc.Server.Features.ResourceIndicators.IResourceManager ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ResourceManager Implements [IResourceManager](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ResourceIndicators.IResourceManager 'Abblix\.Oidc\.Server\.Features\.ResourceIndicators\.IResourceManager') ### Remarks The dictionary is built once at construction time from the snapshot of options; subsequent changes to the options instance are not reflected\. ### Constructors ## ResourceManager\(IOptions\\) Constructor {#Abblix.Oidc.Server.Features.ResourceIndicators.ResourceManager.ResourceManager(Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_)} In\-memory [IResourceManager](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ResourceIndicators.IResourceManager 'Abblix\.Oidc\.Server\.Features\.ResourceIndicators\.IResourceManager') backed by [Resources](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions#Abblix.Oidc.Server.Common.Configuration.OidcOptions.Resources 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions\.Resources')\. Indexes the configured [ResourceDefinition](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ResourceDefinition 'Abblix\.Oidc\.Server\.Common\.Constants\.ResourceDefinition') entries by their absolute URI for O\(1\) lookup during RFC 8707 resource indicator validation\. ```csharp public ResourceManager(Microsoft.Extensions.Options.IOptions options); ``` #### Parameters ###### `options` [Microsoft\.Extensions\.Options\.IOptions<](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptions-1 'Microsoft\.Extensions\.Options\.IOptions\`1')[OidcOptions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions 'Abblix\.Oidc\.Server\.Common\.Configuration\.OidcOptions')[>](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptions-1 'Microsoft\.Extensions\.Options\.IOptions\`1') {#Abblix.Oidc.Server.Features.ResourceIndicators.ResourceManager.ResourceManager(Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_).options} The OIDC options containing resource definitions to be registered\. ### Remarks The dictionary is built once at construction time from the snapshot of options; subsequent changes to the options instance are not reflected\. ### Methods ## ResourceManager\.TryGet\(Uri, ResourceDefinition\) Method {#Abblix.Oidc.Server.Features.ResourceIndicators.ResourceManager.TryGet(System.Uri,Abblix.Oidc.Server.Common.Constants.ResourceDefinition)} Attempts to retrieve the resource definition associated with the specified URI\. ```csharp public bool TryGet(System.Uri resource, out Abblix.Oidc.Server.Common.Constants.ResourceDefinition definition); ``` #### Parameters ###### `resource` [System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri') {#Abblix.Oidc.Server.Features.ResourceIndicators.ResourceManager.TryGet(System.Uri,Abblix.Oidc.Server.Common.Constants.ResourceDefinition).resource} The URI identifying the resource for which the definition is requested\. ###### `definition` [ResourceDefinition](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ResourceDefinition 'Abblix\.Oidc\.Server\.Common\.Constants\.ResourceDefinition') {#Abblix.Oidc.Server.Features.ResourceIndicators.ResourceManager.TryGet(System.Uri,Abblix.Oidc.Server.Common.Constants.ResourceDefinition).definition} When this method returns, contains the resource definition associated with the specified URI, if the resource is found; otherwise, null\. This parameter is passed uninitialized\. Implements [TryGet\(Uri, ResourceDefinition\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ResourceIndicators.IResourceManager#Abblix.Oidc.Server.Features.ResourceIndicators.IResourceManager.TryGet(System.Uri,Abblix.Oidc.Server.Common.Constants.ResourceDefinition) 'Abblix\.Oidc\.Server\.Features\.ResourceIndicators\.IResourceManager\.TryGet\(System\.Uri, Abblix\.Oidc\.Server\.Common\.Constants\.ResourceDefinition\)') #### Returns [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') `true` if the resource definition is found; otherwise, `false`\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ResourceIndicators.ResourceManagerExtensions.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.ResourceIndicators](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ResourceIndicators 'Abblix\.Oidc\.Server\.Features\.ResourceIndicators') ## ResourceManagerExtensions Class Provides extension methods for resource validation, leveraging a resource manager to ensure the validity and permissibility of requested resources\. ```csharp public static class ResourceManagerExtensions ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ResourceManagerExtensions ### Methods ## ResourceManagerExtensions\.Validate\(this IResourceManager, IEnumerable\, IEnumerable\, ResourceDefinition\[\], string\) Method {#Abblix.Oidc.Server.Features.ResourceIndicators.ResourceManagerExtensions.Validate(thisAbblix.Oidc.Server.Features.ResourceIndicators.IResourceManager,System.Collections.Generic.IEnumerable_System.Uri_,System.Collections.Generic.IEnumerable_string_,Abblix.Oidc.Server.Common.Constants.ResourceDefinition[],string)} Validates requested resources against registered resource definitions to confirm their validity and authorization\. This method ensures that resources and the requested scopes within those resources are registered and allowed\. ```csharp public static bool Validate(this Abblix.Oidc.Server.Features.ResourceIndicators.IResourceManager resourceManager, System.Collections.Generic.IEnumerable resources, System.Collections.Generic.IEnumerable scopes, out Abblix.Oidc.Server.Common.Constants.ResourceDefinition[] resourceDefinitions, out string errorDescription); ``` #### Parameters ###### `resourceManager` [IResourceManager](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ResourceIndicators.IResourceManager 'Abblix\.Oidc\.Server\.Features\.ResourceIndicators\.IResourceManager') {#Abblix.Oidc.Server.Features.ResourceIndicators.ResourceManagerExtensions.Validate(thisAbblix.Oidc.Server.Features.ResourceIndicators.IResourceManager,System.Collections.Generic.IEnumerable_System.Uri_,System.Collections.Generic.IEnumerable_string_,Abblix.Oidc.Server.Common.Constants.ResourceDefinition[],string).resourceManager} The resource manager that maintains the definitions of resources\. ###### `resources` [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.Uri](https://learn.microsoft.com/en-us/dotnet/api/system.uri 'System\.Uri')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') {#Abblix.Oidc.Server.Features.ResourceIndicators.ResourceManagerExtensions.Validate(thisAbblix.Oidc.Server.Features.ResourceIndicators.IResourceManager,System.Collections.Generic.IEnumerable_System.Uri_,System.Collections.Generic.IEnumerable_string_,Abblix.Oidc.Server.Common.Constants.ResourceDefinition[],string).resources} A collection of URIs representing the resources being requested\. ###### `scopes` [System\.Collections\.Generic\.IEnumerable<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1') {#Abblix.Oidc.Server.Features.ResourceIndicators.ResourceManagerExtensions.Validate(thisAbblix.Oidc.Server.Features.ResourceIndicators.IResourceManager,System.Collections.Generic.IEnumerable_System.Uri_,System.Collections.Generic.IEnumerable_string_,Abblix.Oidc.Server.Common.Constants.ResourceDefinition[],string).scopes} A collection of scope identifiers associated with the request\. ###### `resourceDefinitions` [ResourceDefinition](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ResourceDefinition 'Abblix\.Oidc\.Server\.Common\.Constants\.ResourceDefinition')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Oidc.Server.Features.ResourceIndicators.ResourceManagerExtensions.Validate(thisAbblix.Oidc.Server.Features.ResourceIndicators.IResourceManager,System.Collections.Generic.IEnumerable_System.Uri_,System.Collections.Generic.IEnumerable_string_,Abblix.Oidc.Server.Common.Constants.ResourceDefinition[],string).resourceDefinitions} Outputs an array of [ResourceDefinition](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ResourceDefinition 'Abblix\.Oidc\.Server\.Common\.Constants\.ResourceDefinition') objects if the validation is successful, otherwise null\. ###### `errorDescription` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.ResourceIndicators.ResourceManagerExtensions.Validate(thisAbblix.Oidc.Server.Features.ResourceIndicators.IResourceManager,System.Collections.Generic.IEnumerable_System.Uri_,System.Collections.Generic.IEnumerable_string_,Abblix.Oidc.Server.Common.Constants.ResourceDefinition[],string).errorDescription} Outputs a string describing the reason for validation failure, otherwise null if the validation is successful\. #### Returns [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') True if all requested resources and their corresponding scopes are valid and permissible, false otherwise\. --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ResponseObject.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ## Abblix\.Oidc\.Server\.Features\.ResponseObject Namespace | Classes | | | :--- | :--- | | [ResponseJwtBuilder](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ResponseObject.ResponseJwtBuilder 'Abblix\.Oidc\.Server\.Features\.ResponseObject\.ResponseJwtBuilder') | Default [IResponseJwtBuilder](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ResponseObject.IResponseJwtBuilder 'Abblix\.Oidc\.Server\.Features\.ResponseObject\.IResponseJwtBuilder'): resolves the client, builds the JARM \([JWT Secured Authorization Response Mode](https://openid.net/specs/oauth-v2-jarm-final.html 'https://openid.net/specs/oauth-v2-jarm-final.html')\) response JWT and hands it to [IClientJwtFormatter](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.Formatters.IClientJwtFormatter 'Abblix\.Oidc\.Server\.Features\.Tokens\.Formatters\.IClientJwtFormatter') for signing and \- when the client registered an encryption algorithm \- encryption to the client's public key \(a Nested JWT per JARM §2\.2\)\. | | [ResponseModeExtensions](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ResponseObject.ResponseModeExtensions 'Abblix\.Oidc\.Server\.Features\.ResponseObject\.ResponseModeExtensions') | Helpers over the `response_mode` value for JARM \([JWT Secured Authorization Response Mode](https://openid.net/specs/oauth-v2-jarm-final.html 'https://openid.net/specs/oauth-v2-jarm-final.html')\)\. | | Interfaces | | | :--- | :--- | | [IResponseJwtBuilder](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ResponseObject.IResponseJwtBuilder 'Abblix\.Oidc\.Server\.Features\.ResponseObject\.IResponseJwtBuilder') | Encodes authorization endpoint response parameters into a JWT secured for a specific client, as defined by JWT Secured Authorization Response Mode for OAuth 2\.0 \(JARM\), [JARM](https://openid.net/specs/oauth-v2-jarm-final.html 'https://openid.net/specs/oauth-v2-jarm-final.html')\. This is the framework\-agnostic core of JARM: it builds, signs and optionally encrypts the response JWT\. The JARM response mode is mapped to its plaintext delivery counterpart separately via [ToDeliveryMode\(this string, bool\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ResponseObject.ResponseModeExtensions#Abblix.Oidc.Server.Features.ResponseObject.ResponseModeExtensions.ToDeliveryMode(thisstring,bool) 'Abblix\.Oidc\.Server\.Features\.ResponseObject\.ResponseModeExtensions\.ToDeliveryMode\(this string, bool\)')\. Hosts \(MVC, Minimal API, \.\.\.\) supply the response parameters and emit the resulting `response` parameter through their own transport layer\. | --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ResponseObject.IResponseJwtBuilder.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.ResponseObject](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ResponseObject 'Abblix\.Oidc\.Server\.Features\.ResponseObject') ## IResponseJwtBuilder Interface Encodes authorization endpoint response parameters into a JWT secured for a specific client, as defined by JWT Secured Authorization Response Mode for OAuth 2\.0 \(JARM\), [JARM](https://openid.net/specs/oauth-v2-jarm-final.html 'https://openid.net/specs/oauth-v2-jarm-final.html')\. This is the framework\-agnostic core of JARM: it builds, signs and optionally encrypts the response JWT\. The JARM response mode is mapped to its plaintext delivery counterpart separately via [ToDeliveryMode\(this string, bool\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ResponseObject.ResponseModeExtensions#Abblix.Oidc.Server.Features.ResponseObject.ResponseModeExtensions.ToDeliveryMode(thisstring,bool) 'Abblix\.Oidc\.Server\.Features\.ResponseObject\.ResponseModeExtensions\.ToDeliveryMode\(this string, bool\)')\. Hosts \(MVC, Minimal API, \.\.\.\) supply the response parameters and emit the resulting `response` parameter through their own transport layer\. ```csharp public interface IResponseJwtBuilder ``` Derived ↳ [ResponseJwtBuilder](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ResponseObject.ResponseJwtBuilder 'Abblix\.Oidc\.Server\.Features\.ResponseObject\.ResponseJwtBuilder') --- Source: https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ResponseObject.ResponseJwtBuilder.md #### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index') ### [Abblix\.Oidc\.Server\.Features\.ResponseObject](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ResponseObject 'Abblix\.Oidc\.Server\.Features\.ResponseObject') ## ResponseJwtBuilder Class Default [IResponseJwtBuilder](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ResponseObject.IResponseJwtBuilder 'Abblix\.Oidc\.Server\.Features\.ResponseObject\.IResponseJwtBuilder'): resolves the client, builds the JARM \([JWT Secured Authorization Response Mode](https://openid.net/specs/oauth-v2-jarm-final.html 'https://openid.net/specs/oauth-v2-jarm-final.html')\) response JWT and hands it to [IClientJwtFormatter](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.Formatters.IClientJwtFormatter 'Abblix\.Oidc\.Server\.Features\.Tokens\.Formatters\.IClientJwtFormatter') for signing and \- when the client registered an encryption algorithm \- encryption to the client's public key \(a Nested JWT per JARM §2\.2\)\. ```csharp public class ResponseJwtBuilder : Abblix.Oidc.Server.Features.ResponseObject.IResponseJwtBuilder ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ResponseJwtBuilder Implements [IResponseJwtBuilder](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ResponseObject.IResponseJwtBuilder 'Abblix\.Oidc\.Server\.Features\.ResponseObject\.IResponseJwtBuilder') ### Constructors ## ResponseJwtBuilder\(IClientInfoProvider, IClientJwtFormatter, IIssuerProvider, TimeProvider, IOptions\\) Constructor {#Abblix.Oidc.Server.Features.ResponseObject.ResponseJwtBuilder.ResponseJwtBuilder(Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider,Abblix.Oidc.Server.Features.Tokens.Formatters.IClientJwtFormatter,Abblix.Oidc.Server.Features.Issuer.IIssuerProvider,System.TimeProvider,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_)} Default [IResponseJwtBuilder](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ResponseObject.IResponseJwtBuilder 'Abblix\.Oidc\.Server\.Features\.ResponseObject\.IResponseJwtBuilder'): resolves the client, builds the JARM \([JWT Secured Authorization Response Mode](https://openid.net/specs/oauth-v2-jarm-final.html 'https://openid.net/specs/oauth-v2-jarm-final.html')\) response JWT and hands it to [IClientJwtFormatter](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.Formatters.IClientJwtFormatter 'Abblix\.Oidc\.Server\.Features\.Tokens\.Formatters\.IClientJwtFormatter') for signing and \- when the client registered an encryption algorithm \- encryption to the client's public key \(a Nested JWT per JARM §2\.2\)\. ```csharp public ResponseJwtBuilder(Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider clientInfoProvider, Abblix.Oidc.Server.Features.Tokens.Formatters.IClientJwtFormatter clientJwtFormatter, Abblix.Oidc.Server.Features.Issuer.IIssuerProvider issuerProvider, System.TimeProvider timeProvider, Microsoft.Extensions.Options.IOptions options); ``` #### Parameters ###### `clientInfoProvider` [IClientInfoProvider](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.IClientInfoProvider') {#Abblix.Oidc.Server.Features.ResponseObject.ResponseJwtBuilder.ResponseJwtBuilder(Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider,Abblix.Oidc.Server.Features.Tokens.Formatters.IClientJwtFormatter,Abblix.Oidc.Server.Features.Issuer.IIssuerProvider,System.TimeProvider,Microsoft.Extensions.Options.IOptions_Abblix.Oidc.Server.Common.Configuration.OidcOptions_).clientInfoProvider} Resolves the client the response is intended for\. ###### `clientJwtFormatter` [IClientJwtFormatter](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.Formatters.IClientJwtFormatter 'Abblix\.Oidc\.Server\.Features\.Tokens\.Formatters\.IClientJwtFormatter') {#Abblix.Oidc.Server.Features.ResponseObject.ResponseJwtBuilder.ResponseJwtBuilder(Abblix.Oidc.Server.Featur