# Abblix

> Abblix builds identity infrastructure for .NET: Abblix OIDC Server, an OpenID Foundation
> certified OpenID Connect / OAuth 2.0 server library you deploy inside your own perimeter,
> and Abblix Account, a free cloud authentication service. Both are used in production by
> Abblix itself. The company is an Astana Hub resident.

## Products

- [Abblix OIDC Server](https://www.abblix.com/en/oidc-server): certified OpenID Connect and OAuth 2.0 server
  library for ASP.NET Core, distributed as a NuGet package with source on GitHub.
- [Abblix Account](https://www.abblix.com/en/account): free cloud authentication service - passkeys, MFA,
  external identity providers, session management.

## Licensing and price

- [Pricing](https://www.abblix.com/en/oidc-server/pricing): three tiers - Community (free), Pro, Enterprise.
  Priced by company size, never per user or per client application.
- [License terms in plain language](https://www.abblix.com/en/oidc-server/license): who may use it free of
  charge, when a paid license is required, what is not allowed.
- [Verify a license file](https://www.abblix.com/en/oidc-server/verify): checks expiry and details of an
  issued license, in the browser.

## Technical

- [Implemented standards](https://www.abblix.com/en/oidc-server/standards): every RFC and OpenID specification
  the server implements, with links to the source documents.
- [Documentation](https://www.abblix.com/en/docs/introduction-to-abblix-oidc-server): installation,
  configuration, guides and architecture - full articles listed below.
- [Source code](https://github.com/Abblix/Oidc.Server#readme): GitHub repository and README.

## Documentation

Every article is also served as raw markdown at its URL + ".md":

- [A Durable Client Store in About a Hundred Lines](https://www.abblix.com/en/docs/durable-client-store.md): How to back Abblix OIDC Server's client registry with your own persistent database: the two seams to implement, the registration pattern that keeps config-file clients working, and a complete worked example on PostgreSQL.
- [A Source Generator Replaced Over a Thousand Lines of Hand-Written Code](https://www.abblix.com/en/docs/source-generated-binding-models.md): How migrating Abblix OIDC Server's MVC binding models to a Roslyn source generator removed a duplicated model layer, the hand-written mapping between the two, and the ongoing effort of keeping them consistent.
- [Abblix OIDC Server Configuration Guide](https://www.abblix.com/en/docs/configuration-and-setup.md): Complete configuration guide for Abblix OIDC Server - install NuGet packages, apply license, and set up your .NET authentication project step-by-step.
- [Abblix OIDC Server Product Roadmap](https://www.abblix.com/en/docs/product-roadmap.md): Future features and planned improvements for Abblix OIDC Server, including FAPI 2.0 Security Profile certification, automatic signing-key management, Entity Framework Core and ASP.NET Identity stores, end-to-end observability, server-side sessions and reference tokens, and OpenID Federation 1.0.
- [Abblix OIDC Server Release Notes](https://www.abblix.com/en/docs/releases.md): Latest releases and updates for Abblix OIDC Server. View changelog, new features, and bug fixes on GitHub.
- [Abblix OIDC Server Technical Requirements](https://www.abblix.com/en/docs/technical-requirements.md): System requirements for Abblix OIDC Server: .NET 6 through 10 across product versions, supported web servers (Nginx, Apache, IIS), and hardware notes.
- [Abblix OIDC Server Version Support Lifecycle](https://www.abblix.com/en/docs/version-support-lifecycle.md): Support lifecycle and end-of-life dates for Abblix OIDC Server versions. Version 1.* supported .NET 6-9 and reached end of support in July 2026, Version 2.* supports .NET 8-10 until November 2028, and the planned Version 3.* targets .NET 11-12 until November 2030.
- [Abblix OIDC Server: An Alternative to IdentityServer4 and Duende IdentityServer](https://www.abblix.com/en/docs/duende-identityserver-alternative.md): Weighing a move off IdentityServer4 or Duende IdentityServer? Abblix OIDC Server is a certified, self-hosted .NET OpenID Connect library where every protocol feature ships in every tier, the free one included. Here is what the switch involves.
- [Abblix.Jwt API Reference](https://www.abblix.com/en/docs/api/abblix-jwt.md): Abblix.Jwt API Reference - Abblix OIDC Server API Reference.
- [Abblix.Jwt Namespace](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.md): Abblix.Jwt Namespace - Abblix OIDC Server API Reference.
- [Abblix.Jwt.Encryption Namespace](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Encryption.md): Abblix.Jwt.Encryption Namespace - Abblix OIDC Server API Reference.
- [Abblix.Jwt.Signing Namespace](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Signing.md): Abblix.Jwt.Signing Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server API Reference](https://www.abblix.com/en/docs/api/abblix-oidc-server.md): Abblix.Oidc.Server API Reference - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.md): Abblix.Oidc.Server Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Common Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.md): Abblix.Oidc.Server.Common Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Common.Configuration Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.md): Abblix.Oidc.Server.Common.Configuration Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Common.Constants Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.md): Abblix.Oidc.Server.Common.Constants Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Common.Exceptions Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Exceptions.md): Abblix.Oidc.Server.Common.Exceptions Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Common.Implementation Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Implementation.md): Abblix.Oidc.Server.Common.Implementation Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Common.Interfaces Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.md): Abblix.Oidc.Server.Common.Interfaces Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Common.Validation Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Validation.md): Abblix.Oidc.Server.Common.Validation Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.DeclarativeBinding Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.DeclarativeBinding.md): Abblix.Oidc.Server.DeclarativeBinding Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Endpoints Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.md): Abblix.Oidc.Server.Endpoints Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Endpoints.Authorization Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.md): Abblix.Oidc.Server.Endpoints.Authorization Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Endpoints.Authorization.Interfaces Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.md): Abblix.Oidc.Server.Endpoints.Authorization.Interfaces Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.md): Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Endpoints.Authorization.Validation Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.md): Abblix.Oidc.Server.Endpoints.Authorization.Validation Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Endpoints.BackChannelAuthentication Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.md): Abblix.Oidc.Server.Endpoints.BackChannelAuthentication Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.md): Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.RequestFetching Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.RequestFetching.md): Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.RequestFetching Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.md): Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Endpoints.CheckSession.Interfaces Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.CheckSession.Interfaces.md): Abblix.Oidc.Server.Endpoints.CheckSession.Interfaces Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Endpoints.Configuration Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.md): Abblix.Oidc.Server.Endpoints.Configuration Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Endpoints.Configuration.Interfaces Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.md): Abblix.Oidc.Server.Endpoints.Configuration.Interfaces Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Endpoints.DeviceAuthorization Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.md): Abblix.Oidc.Server.Endpoints.DeviceAuthorization Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Interfaces Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Interfaces.md): Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Interfaces Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.md): Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Endpoints.DynamicClientManagement Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.md): Abblix.Oidc.Server.Endpoints.DynamicClientManagement Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.md): Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.md): Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Endpoints.EndSession Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.md): Abblix.Oidc.Server.Endpoints.EndSession Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Endpoints.EndSession.Interfaces Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Interfaces.md): Abblix.Oidc.Server.Endpoints.EndSession.Interfaces Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Endpoints.EndSession.Validation Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Validation.md): Abblix.Oidc.Server.Endpoints.EndSession.Validation Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Endpoints.Introspection Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection.md): Abblix.Oidc.Server.Endpoints.Introspection Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Endpoints.Introspection.Interfaces Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.md): Abblix.Oidc.Server.Endpoints.Introspection.Interfaces Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Endpoints.PushedAuthorization Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.PushedAuthorization.md): Abblix.Oidc.Server.Endpoints.PushedAuthorization Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Endpoints.PushedAuthorization.Interfaces Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.PushedAuthorization.Interfaces.md): Abblix.Oidc.Server.Endpoints.PushedAuthorization.Interfaces Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Endpoints.Revocation Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Revocation.md): Abblix.Oidc.Server.Endpoints.Revocation Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Endpoints.Revocation.Interfaces Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.md): Abblix.Oidc.Server.Endpoints.Revocation.Interfaces Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Endpoints.Token Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.md): Abblix.Oidc.Server.Endpoints.Token Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Endpoints.Token.Grants Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.md): Abblix.Oidc.Server.Endpoints.Token.Grants Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Endpoints.Token.Interfaces Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.md): Abblix.Oidc.Server.Endpoints.Token.Interfaces Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Endpoints.Token.Validation Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation.md): Abblix.Oidc.Server.Endpoints.Token.Validation Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Endpoints.UserInfo Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.md): Abblix.Oidc.Server.Endpoints.UserInfo Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.md): Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Endpoints.UserInfo.Validation Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Validation.md): Abblix.Oidc.Server.Endpoints.UserInfo.Validation Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Features Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.md): Abblix.Oidc.Server.Features Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Features.BackChannelAuthentication Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.md): Abblix.Oidc.Server.Features.BackChannelAuthentication Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.md): Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Features.BackChannelAuthentication.GrantProcessors Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.GrantProcessors.md): Abblix.Oidc.Server.Features.BackChannelAuthentication.GrantProcessors Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.md): Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Features.ClientAuthentication Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.md): Abblix.Oidc.Server.Features.ClientAuthentication Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Features.ClientInformation Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.md): Abblix.Oidc.Server.Features.ClientInformation Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Features.Consents Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Consents.md): Abblix.Oidc.Server.Features.Consents Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Features.DeviceAuthorization Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.md): Abblix.Oidc.Server.Features.DeviceAuthorization Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.md): Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Features.DPoP Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DPoP.md): algs='...' challenge advertisement read from here, so adding a new algorithm (e.g. EdDSA when the JWS layer gains support) propagates everywhere…
- [Abblix.Oidc.Server.Features.Hashing Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Hashing.md): Abblix.Oidc.Server.Features.Hashing Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Features.ImplicitFlow Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ImplicitFlow.md): Abblix.Oidc.Server.Features.ImplicitFlow Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Features.Issuer Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Issuer.md): Abblix.Oidc.Server.Features.Issuer Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Features.JwtBearer Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.JwtBearer.md): Abblix.Oidc.Server.Features.JwtBearer Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Features.Licensing Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Licensing.md): Abblix.Oidc.Server.Features.Licensing Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Features.LogoutNotification Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.md): Abblix.Oidc.Server.Features.LogoutNotification Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Features.Nonces Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Nonces.md): Abblix.Oidc.Server.Features.Nonces Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Features.NoneFlow Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.NoneFlow.md): Abblix.Oidc.Server.Features.NoneFlow Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Features.PushedAuthorization Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.PushedAuthorization.md): Abblix.Oidc.Server.Features.PushedAuthorization Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Features.RandomGenerators Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.md): Abblix.Oidc.Server.Features.RandomGenerators Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Features.ReplayPrevention Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ReplayPrevention.md): Abblix.Oidc.Server.Features.ReplayPrevention Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Features.RequestObject Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RequestObject.md): Abblix.Oidc.Server.Features.RequestObject Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Features.ResourceIndicators Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ResourceIndicators.md): Abblix.Oidc.Server.Features.ResourceIndicators Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Features.ResponseObject Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ResponseObject.md): Abblix.Oidc.Server.Features.ResponseObject Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Features.ReusePrevention Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ReusePrevention.md): Abblix.Oidc.Server.Features.ReusePrevention Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Features.RichAuthorizationRequests Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RichAuthorizationRequests.md): Abblix.Oidc.Server.Features.RichAuthorizationRequests Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Features.ScopeManagement Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ScopeManagement.md): Abblix.Oidc.Server.Features.ScopeManagement Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Features.SecureHttpFetch Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.SecureHttpFetch.md): Abblix.Oidc.Server.Features.SecureHttpFetch Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Features.SessionManagement Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.SessionManagement.md): Abblix.Oidc.Server.Features.SessionManagement Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Features.Storages Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Storages.md): Abblix.Oidc.Server.Features.Storages Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Features.Storages.Proto Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Storages.Proto.md): Abblix.Oidc.Server.Features.Storages.Proto Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Features.TokenExchange Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.TokenExchange.md): Abblix.Oidc.Server.Features.TokenExchange Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Features.Tokens Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.md): Abblix.Oidc.Server.Features.Tokens Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Features.Tokens.Formatters Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.Formatters.md): Abblix.Oidc.Server.Features.Tokens.Formatters Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Features.Tokens.Revocation Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.Revocation.md): Abblix.Oidc.Server.Features.Tokens.Revocation Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Features.Tokens.Validation Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.Validation.md): Abblix.Oidc.Server.Features.Tokens.Validation Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Features.UriValidation Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.UriValidation.md): Abblix.Oidc.Server.Features.UriValidation Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Features.UserAuthentication Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.UserAuthentication.md): Abblix.Oidc.Server.Features.UserAuthentication Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Features.UserInfo Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.UserInfo.md): Abblix.Oidc.Server.Features.UserInfo Namespace - Abblix OIDC Server API Reference.
- [Abblix.Oidc.Server.Model Namespace](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.md): Abblix.Oidc.Server.Model Namespace - Abblix OIDC Server API Reference.
- [AbsoluteUriAttribute Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.DeclarativeBinding.AbsoluteUriAttribute.md): Marks a System.Uri-typed property, field, or parameter as having to be an absolute URI. Relative URIs and values that do not parse as absolute are treated as invalid by validators that honor this attribute; null values are not flagged here, leave ...
- [AccountSelectionRequired Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AccountSelectionRequired.md): Outcome signalling that more than one active end-user session matches the request and the host UI must let the user pick one before authorization can continue. Maps to OpenID Connect Core 1.0 §3.1.2.6 `account_selection_required` when `prompt=none...
- [AcrMetadataProvider Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.AcrMetadataProvider.md): Default implementation of IAcrMetadataProvider that reads ACR values from OidcOptions configuration.
- [Address Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.Address.md): Represents a physical address, providing various components typically used in postal addresses.
- [Advanced DI in .NET: Dependency Overrides, Decorators, Composites and Editable Pipelines](https://www.abblix.com/en/docs/advanced-dependency-injection.md): Advanced dependency injection in .NET: aliases, Dependency.Override, decorators, composites, and a live cursor that edits a composed pipeline after the fact, all at registration time, with no third-party container.
- [AggregationExtensions Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Licensing.AggregationExtensions.md): Provides extension methods for aggregating values from objects based on specific comparable properties.
- [AllowedValuesAttribute Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.DeclarativeBinding.AllowedValuesAttribute.md): Restricts a string-valued (or string-array-valued) property, field, or parameter to a fixed set of allowed values. Typically used to constrain protocol parameters such as `response_type`, `grant_type`, or `code_challenge_method` to the values defi...
- [ApplicationTypes Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ApplicationTypes.md): Defines constants for different types of applications in OAuth 2.0 and OpenID Connect contexts.
- [AuthenticationCompletionHandler Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.AuthenticationCompletionHandler.md): Abstract base class for CIBA authentication completion handlers. Provides common functionality for validation, status management, and delivery orchestration. Derived classes implement specific token delivery modes (poll, ping, push) per CIBA speci...
- [AuthenticationCompletionRouter Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.AuthenticationCompletionRouter.md): Routes CIBA authentication completion to the appropriate mode-specific handler (PollModeCompletionHandler, PingModeCompletionHandler, or PushModeCompletionHandler) based on the client's configured backchannel_token_delivery_mode.
- [AuthenticationMethodReferences Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.AuthenticationMethodReferences.md): Contains IANA-registered Authentication Method Reference (AMR) values as per RFC 8176.
- [AuthenticationRequestIdGenerator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationRequestIdGenerator.md): Generates a unique authentication request ID using a cryptographically secure random number generator. This ID is encoded for safe use in URLs and is typically used in backchannel authentication flows.
- [AuthorizationCodeBuilder Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationCodeBuilder.md): Builds the `code` response-type component of an authorization endpoint success response — the Authorization Code Flow contributor. Generates an authorization code via IAuthorizationCodeService and stores it on the running SuccessfullyAuthenticated...
- [AuthorizationCodeGenerator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.AuthorizationCodeGenerator.md): Generates secure authorization codes for OAuth 2.0 authorization code flows. This implementation relies on cryptographic randomness to generate codes that are difficult to predict, enhancing the security of the authorization process.
- [AuthorizationCodeGrantHandler Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.AuthorizationCodeGrantHandler.md): IAuthorizationGrantHandler for `grant_type=authorization_code` (RFC 6749 §4.1.3). Resolves the code to its stored AuthorizedGrant, asserts that the redeeming client is the same one the code was issued to, and, when a `code_challenge` was bound at ...
- [AuthorizationCodeReusePreventingDecorator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.AuthorizationCodeReusePreventingDecorator.md): Enhances token processing by revoking tokens associated with previously used authorization codes, preventing authorization code reuse in compliance with OAuth 2.0 security best practices.
- [AuthorizationCodeService Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Storages.AuthorizationCodeService.md): Provides services for managing the lifecycle of OAuth 2.0 authorization codes. This service generates, stores, validates, and deletes authorization codes as part of the authorization code grant flow.
- [AuthorizationContext Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.AuthorizationContext.md): Represents the context of an authorization process, encapsulating the key parameters required for processing authorization requests.
- [AuthorizationContext Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Storages.Proto.AuthorizationContext.md): Represents the context of an authorization process
- [AuthorizationContextExtensions Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.AuthorizationContextExtensions.md): Provides extension methods for working with AuthorizationContext objects, facilitating the conversion between authorization contexts and JWT claims.
- [AuthorizationContextReflection Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Storages.Proto.AuthorizationContextReflection.md): Holder for reflection information generated from Features/Storages/Proto/AuthorizationContext.proto
- [AuthorizationContextValidatorComposite Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationContextValidatorComposite.md): Represents a composite validator for authorization contexts. This class implements IAuthorizationContextValidator and aggregates multiple validation steps into a single validation process.
- [AuthorizationDetail Class](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.AuthorizationDetail.md): One entry in the OAuth 2.0 Rich Authorization Requests `authorization_details` array (RFC 9396 §2), wrapped over a System.Text.Json.Nodes.JsonNode which is the source of truth for the entry's content. The wrapper exposes the RFC 9396 §2.2 common-d...
- [AuthorizationDetailDescriptor Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RichAuthorizationRequests.AuthorizationDetailDescriptor.md): Host-renderable description of a single RFC 9396 `authorization_details` entry, produced by BuildConsentDescriptorAsync(AuthorizationDetail, ClientInfo, CancellationToken) 'Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetail...
- [AuthorizationDetailsRequestValidator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationDetailsRequestValidator.md): Thin endpoint-side adapter that delegates the RFC 9396 `authorization_details` validation to ApplyAsync(JsonArray, ClientInfo, CancellationToken) 'Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy.ApplyAsync(System....
- [AuthorizationDetailsTypesValidator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.AuthorizationDetailsTypesValidator.md): Rejects client registration when the requested `authorization_details_types` per-client allowlist (RFC 9396 §5.1) names any `type` value the server does not understand, returning `invalid_client_metadata` per OIDC DCR §3.2. Without this gate the r...
- [AuthorizationEndpointMetadata Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationEndpointMetadata.md): Holds metadata for the authorization endpoint, detailing the capabilities and supported standards.
- [AuthorizationEndpointMetadataFactory Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationEndpointMetadataFactory.md): Builds the AuthorizationEndpointMetadata advertised in discovery from the registered set of IAuthorizationResponseBuilder: each builder declares the response-type it owns, and the supported response-type combinations are the canonical OAuth/OIDC c...
- [AuthorizationError Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationError.md): Represents an error response for an authorization request, detailing the nature of the error.
- [AuthorizationGrantValidator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation.AuthorizationGrantValidator.md): Validates the authorization grant in the context of a token request, ensuring that the request is authorized and that the associated redirect URI matches the one used during the initial authorization request
- [AuthorizationHandler Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationHandler.md): Handles authorization requests by fetching, validating, processing and encoding the response.
- [AuthorizationHeaderAttribute Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.DeclarativeBinding.AuthorizationHeaderAttribute.md): Declares that the value is the parsed HTTP `Authorization` request header — the scheme and credentials used by transport-level client authentication such as `Basic` (RFC 7617) or `Bearer` (RFC 6750). Purely semantic: it names the transport source ...
- [AuthorizationMetadataProvider Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.AuthorizationMetadataProvider.md): Provides authorization-endpoint metadata for discovery, computed directly from the registered response builders. Deliberately does not depend on IAuthorizationHandler: resolving the handler just to read metadata would also construct its request-ti...
- [AuthorizationRequest Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Storages.Proto.AuthorizationRequest.md): Represents an authorization request for OpenID Connect or OAuth 2.0
- [AuthorizationRequest Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.AuthorizationRequest.md): The set of parameters carried by an OAuth 2.0 / OpenID Connect authorization request to the `authorization_endpoint` as defined in RFC 6749 §4.1.1 and OpenID Connect Core 1.0 §3.1.2.1. Parameters are bound from query string, form body, or a Reques...
- [AuthorizationRequest.Parameters Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.AuthorizationRequest.Parameters.md): Wire-level parameter names accepted at the authorization endpoint per RFC 6749 §4.1.1, OpenID Connect Core 1.0 §3.1.2.1, RFC 7636 (PKCE), RFC 8707 (resource indicators), and RFC 9449 §10 (DPoP).
- [AuthorizationRequestProcessor Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationRequestProcessor.md): Processes authorization requests by coordinating with various services like authentication, consent, and token issuance. This class handles the logic of determining the appropriate response to an authorization request based on the request's parame...
- [AuthorizationRequestProcessorDecorator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.SessionManagement.AuthorizationRequestProcessorDecorator.md): Enhances an existing authorization request processor with session management capabilities, specifically tailored for OpenID Connect (OIDC) scenarios. This decorator introduces session state handling into the authorization response, enabling client...
- [AuthorizationRequestReflection Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Storages.Proto.AuthorizationRequestReflection.md): Holder for reflection information generated from Features/Storages/Proto/AuthorizationRequest.proto
- [AuthorizationRequestStorage Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Storages.AuthorizationRequestStorage.md): Provides storage and retrieval services for OAuth 2.0 authorization requests using a distributed cache. This class is designed to handle the storage of AuthorizationRequest objects and facilitate their retrieval using unique request URIs, supporti...
- [AuthorizationRequestUriGenerator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.AuthorizationRequestUriGenerator.md): Default IAuthorizationRequestUriGenerator implementation. Appends a URL-safe Base64 encoded block of cryptographically secure random bytes (length governed by RequestUriLength) to Prefix, producing the `urn:`-style `request_uri` values used by Pus...
- [AuthorizationRequestValidationError Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationRequestValidationError.md): Represents a specific type of validation result for an authorization request that has been deemed invalid. This record details the nature of the validation failure through an error code and description, providing insights into why the request did ...
- [AuthorizationRequestValidator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationRequestValidator.md): Implements the Chain of Responsibility design pattern for processing authorization requests. This class delegates the validation of authorization requests to an IAuthorizationContextValidator, allowing a sequence of validators to handle the reques...
- [AuthorizationResponse Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationResponse.md): Represents the response to an authorization request. This abstract record serves as a base for specific authorization response implementations. It should be inherited by classes that define the detailed structure and behavior of different types of...
- [AuthorizationResponse Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.AuthorizationResponse.md): The authorization response delivered to the client's redirect URI (via query, fragment or form_post), carrying either the success parameters (code/tokens) or the error, or — under JARM — the single packed `response` JWT. This is the framework-neut...
- [AuthorizationResponse.Parameters Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.AuthorizationResponse.Parameters.md): Wire-level parameter names returned to the client by the authorization endpoint (via query, fragment, form_post, or — under JARM — as claims inside the single `response` JWT). Shared by the core response encoder and the MVC serialization DTO so th...
- [AuthorizationResponseEncoder Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.AuthorizationResponseEncoder.md): Default IAuthorizationResponseEncoder. Applies the `iss` (RFC 9207) and implicit/hybrid `scope` gating, and — for a JARM (`*.jwt`) response mode — packs the response parameters into a signed/encrypted `response` JWT and resolves the delivery mode....
- [AuthorizationValidationContext Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.AuthorizationValidationContext.md): Encapsulates the context necessary for validating an authorization request, including client details, response modes, and the OAuth 2.0 flow type.
- [AuthorizationValueReuseDetector Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ReusePrevention.AuthorizationValueReuseDetector.md): Default IAuthorizationValueReuseDetector implementation backed by IEntityStorage. It records a SHA-256 hash of each value under a per-client, per-kind key with a time-to-live equal to the configured detection window, so a raw code_challenge or non...
- [AuthorizedGrant Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant.md): The (authentication-session, authorization-context) pair from which the token endpoint mints access, refresh and ID tokens. Produced by an IAuthorizationGrantHandler and carried through token issuance.
- [AuthorizedGrant Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Storages.Proto.AuthorizedGrant.md): Represents the successful result of an authorized grant operation
- [AuthorizedGrantReflection Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Storages.Proto.AuthorizedGrantReflection.md): Holder for reflection information generated from Features/Storages/Proto/AuthorizedGrant.proto
- [AuthServiceJwtFormatter Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.Formatters.AuthServiceJwtFormatter.md): Provides functionality to format and sign JSON Web Tokens (JWTs) specifically for use within the authentication service. This class processes tokens issued by the authentication service itself, including access tokens, refresh tokens and Registrat...
- [AuthServiceJwtValidator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.Validation.AuthServiceJwtValidator.md): Validates JSON Web Tokens (JWTs) issued by the authentication service, ensuring they are authentic and compliant with the expected issuer, audience, and cryptographic signatures.
- [AuthSession Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Storages.Proto.AuthSession.md): Represents an authentication session for a logged-in user
- [AuthSession Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.UserAuthentication.AuthSession.md): Represents a model of an authentication session for a logged-in user, capturing essential details about the user's authentication state and interactions within the system.
- [AuthSessionExtensions Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.UserAuthentication.AuthSessionExtensions.md): Provides extension methods for AuthSession, facilitating the conversion between authentication session information and JWT claims.
- [AuthSessionReflection Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Storages.Proto.AuthSessionReflection.md): Holder for reflection information generated from Features/Storages/Proto/AuthSession.proto
- [BackChannelAuthenticationForbidden Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.BackChannelAuthenticationForbidden.md): Represents a forbidden response for a backchannel authentication request. This response typically indicates that the client is authenticated but does not have permission to perform the requested operation.
- [BackChannelAuthenticationGrantHandler Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.BackChannelAuthenticationGrantHandler.md): Handles the authorization process for backchannel authentication requests under the Client-Initiated Backchannel Authentication (CIBA) grant type. This handler validates the token request based on the backchannel authentication flow, ensuring that...
- [BackChannelAuthenticationHandler Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.BackChannelAuthenticationHandler.md): Default IBackChannelAuthenticationHandler implementation that drives the CIBA endpoint pipeline as fetch (request object resolution) -> validation -> processing, short-circuiting on the first error so that subsequent stages never see invalid input.
- [BackChannelAuthenticationOptions Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.BackChannelAuthenticationOptions.md): Provides configuration options for the backchannel authentication process.
- [BackChannelAuthenticationRequest Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationRequest.md): Represents a backchannel authentication request as part of the Client-Initiated Backchannel Authentication (CIBA) protocol. This request facilitates the authentication of users without requiring immediate interaction with their devices, allowing f...
- [BackChannelAuthenticationRequest Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Storages.Proto.BackChannelAuthenticationRequest.md): Represents a backchannel authentication request (CIBA protocol)
- [BackChannelAuthenticationRequest Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.BackChannelAuthenticationRequest.md): Parameters of a Client-Initiated Backchannel Authentication (CIBA) request as defined in OpenID Connect Client-Initiated Backchannel Authentication Flow Core 1.0 §7. The client posts these to the `backchannel_authentication_endpoint` to ask the OP...
- [BackChannelAuthenticationRequest.Parameters Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.BackChannelAuthenticationRequest.Parameters.md): Wire-level parameter names accepted at the CIBA backchannel authentication endpoint (OpenID Connect CIBA Core 1.0 §7).
- [BackChannelAuthenticationRequestProcessor Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.BackChannelAuthenticationRequestProcessor.md): Handles the processing of backchannel authentication requests in an OAuth 2.0/OpenID Connect context. This class is responsible for managing the lifecycle of a backchannel authentication request, from initiating the user's authentication on their ...
- [BackChannelAuthenticationRequestReflection Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Storages.Proto.BackChannelAuthenticationRequestReflection.md): Holder for reflection information generated from Features/Storages/Proto/BackChannelAuthenticationRequest.proto
- [BackChannelAuthenticationRequestValidator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.BackChannelAuthenticationRequestValidator.md): Validates backchannel authentication requests by delegating the context validation to a context validator. This class is responsible for ensuring that the request meets all necessary criteria for successful authentication within the backchannel au...
- [BackChannelAuthenticationStatus Enum](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelAuthenticationStatus.md): Represents the various states of a backchannel authentication request. This enumeration defines the possible statuses that an authentication request can have, facilitating the management of the authentication process in Client-Initiated Backchanne...
- [BackChannelAuthenticationStatus Enum](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Storages.Proto.BackChannelAuthenticationStatus.md): Status of a backchannel authentication request
- [BackChannelAuthenticationSuccess Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.BackChannelAuthenticationSuccess.md): Represents a successful backchannel authentication response (CIBA Core §7.3). This record indicates that the backchannel authentication request has been accepted and end-user authentication is now pending; the issued `auth_req_id` identifies the p...
- [BackChannelAuthenticationSuccess.Parameters Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.BackChannelAuthenticationSuccess.Parameters.md): Contains constants representing the parameter names used in the backchannel authentication response. These are included in the JSON response to the client to ensure the correct values are returned.
- [BackChannelAuthenticationUnauthorized Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.BackChannelAuthenticationUnauthorized.md): Represents an unauthorized response for a backchannel authentication request. This response typically indicates that the request failed due to invalid client credentials or other authorization-related issues.
- [BackChannelAuthenticationValidationContext Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidationContext.md): Represents the context for validating a backchannel authentication request. This context encapsulates the details of the authentication request, allowing validators to perform the necessary checks and validations according to the backchannel authe...
- [BackChannelAuthenticationValidator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.BackChannelAuthenticationValidator.md): Validates CIBA-related metadata (OpenID Connect Client-Initiated Backchannel Authentication 1.0 §4): the consistency between `backchannel_token_delivery_mode` and `backchannel_client_notification_endpoint`, and that `backchannel_authentication_req...
- [BackChannelAuthenticationValidatorComposite Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthenticationValidatorComposite.md): Represents a composite validator for backchannel authentication contexts, aggregating multiple validation steps into a single validation process. This class implements IBackChannelAuthenticationContextValidator and allows for the combination of mu...
- [BackChannelAuthorizationDetailsValidator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.BackChannelAuthorizationDetailsValidator.md): Thin endpoint-side adapter that delegates the RFC 9396 §3 CIBA `authorization_details` validation to ApplyAsync(JsonArray, ClientInfo, CancellationToken) 'Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy.ApplyAsync...
- [BackChannelLogoutNotifier Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.BackChannelLogoutNotifier.md): Implements the mechanism for notifying clients about logout events through the back-channel, leveraging logout tokens to securely communicate the logout state to client applications.
- [BackChannelLogoutOptions Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.BackChannelLogoutOptions.md): Back-channel logout settings for a single client, as defined by the OpenID Connect Back-Channel Logout 1.0 specification. The OP delivers a signed logout token directly (server-to-server) to the configured endpoint when an end-session occurs, bypa...
- [BackChannelLogoutTokenSender Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.BackChannelLogoutTokenSender.md): Implements the functionality to send logout tokens to clients via back-channel communication, adhering to the OpenID Connect back-channel logout specification.
- [BackChannelLogoutUriValidator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.BackChannelLogoutUriValidator.md): Validates the OIDC Back-Channel Logout 1.0 `backchannel_logout_uri`: when supplied it must be an absolute URI that the server is permitted to fetch under the active SSRF policy (SecureHttpFetchOptions). Because the OP itself POSTs the logout token...
- [BackChannelPingNotificationRequest Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.BackChannelPingNotificationRequest.md): Represents the notification payload sent to the client in ping mode.
- [BackChannelPingNotificationRequest.Parameters Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.BackChannelPingNotificationRequest.Parameters.md): Wire-level parameter names for the CIBA ping-mode notification payload (OpenID Connect CIBA Core 1.0 §10.2).
- [BackChannelPushNotificationRequest Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.BackChannelPushNotificationRequest.md): Represents the token delivery payload sent to the client in push mode.
- [BackChannelPushNotificationRequest.Parameters Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.BackChannelPushNotificationRequest.Parameters.md): Wire-level parameter names for the CIBA push-mode token delivery payload (OpenID Connect CIBA Core 1.0 §10.3.1).
- [BackChannelRequestStorage Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.BackChannelRequestStorage.md): Implements the storage of backchannel authentication requests, allowing for persistence and retrieval of authentication request data in the context of Client-Initiated Backchannel Authentication (CIBA).
- [BackchannelTokenDeliveryModes Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.BackchannelTokenDeliveryModes.md): Defines the available delivery modes for backchannel token delivery in Client-Initiated Backchannel Authentication (CIBA). These modes specify how the authentication server communicates the result of the backchannel authentication process to the c...
- [BackChannelTokenPushRequest Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.BackChannelTokenPushRequest.md): Represents the token payload sent to the client in CIBA push mode. Per CIBA specification, this payload is delivered to the client's registered notification endpoint.
- [BackChannelTokenPushRequest.Parameters Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.BackChannelTokenPushRequest.Parameters.md): Wire-level parameter names for the CIBA push-mode token delivery payload (OpenID Connect CIBA Core 1.0 §10.3.1).
- [CachingSecureHttpFetcherDecorator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.SecureHttpFetch.CachingSecureHttpFetcherDecorator.md): A decorator for ISecureHttpFetcher that adds caching capabilities. Caches successful responses for the configured duration to reduce network calls and improve performance.
- [CheckSessionCookieOptions Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.CheckSessionCookieOptions.md): Defines options for the session check cookie used in monitoring changes in session status.
- [CheckSessionResponse Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.CheckSession.Interfaces.CheckSessionResponse.md): Represents the response to a check session request in OpenID Connect Session Management. This record contains the necessary information to ascertain the current state of a user session.
- [Choosing a Backend for Operational State](https://www.abblix.com/en/docs/choosing-a-cache-backend.md): Abblix OIDC Server keeps all short-lived protocol state in whatever IDistributedCache you register: this guide maps what lives there, which flows break without a shared cache, why token status marks make persistence a security requirement, and how latency shapes the choice.
- [ClaimEntry Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Storages.Proto.ClaimEntry.md): Dictionary entry mapping claim name to its details. Represents key-value pairs for structured claim requests.
- [ClaimExtensions Class](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ClaimExtensions.md): Provides extension methods for handling claims, particularly for converting between JWT claims and security claims.
- [ClaimsExtensions Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.ClaimsExtensions.md): Helpers for working with System.Security.Claims.ClaimsPrincipal and System.Security.Claims.Claim sequences: classify claims as registered/public/private (per IANA), filter or replace them by type, and look up values by claim name in a case-insensi...
- [ClientAssertionTypes Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ClientAssertionTypes.md): Provides constants for client assertion types used in OAuth 2.0.
- [ClientAuthenticationMethods Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ClientAuthenticationMethods.md): This class defines various client authentication methods used in OAuth 2.0.
- [ClientCertificateAttribute Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.DeclarativeBinding.ClientCertificateAttribute.md): Declares that the value is the client X.509 certificate presented at the transport layer — via mutual TLS (RFC 8705) or forwarded by a trusted reverse proxy. Purely semantic: it names the transport source and leaves the extraction mechanism to the...
- [ClientCredentialFactory Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.ClientCredentialFactory.md): Coordinates credential generation by composing ID generation, secret generation, hashing, and expiration calculation. Uses SHA-512 for strong cryptographic hashing while maintaining configurable secret length and expiration policies.
- [ClientCredentials Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ClientCredentials.md): Encapsulates both transmission and storage formats of client credentials. Maintains plain-text secret for immediate transmission in registration response, while also providing SHA-512 hash for secure persistence.
- [ClientCredentialsGrantHandler Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.ClientCredentialsGrantHandler.md): Handles the authorization process for the client credentials grant type within the OAuth 2.0 framework. This grant type is designed for machine-to-machine (M2M) authentication where the client itself is the resource owner. There is no end-user inv...
- [ClientDeliveredResponse Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ClientDeliveredResponse.md): Base for the authorization responses that are delivered to the client's `redirect_uri` (SuccessfullyAuthenticated and AuthorizationError), as opposed to the interaction responses (LoginRequired, ConsentRequired, …) that redirect to the authorizati...
- [ClientIdGenerator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.ClientIdGenerator.md): Implements the IClientIdGenerator interface to generate client IDs for OpenID Connect (OIDC) clients. The generated client IDs are based on cryptographically secure random bytes and are encoded in Base32 format, providing a URL-safe, human-readabl...
- [ClientIdOptions Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.ClientIdOptions.md): Represents options for generating client IDs.
- [ClientIdValidator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientIdValidator.md): Cross-checks the supplied `client_id` against the operation type: for Update (RFC 7592 §2.2) the client must already exist, for Register (RFC 7591 §3) it must not. A missing `client_id` is treated as new-registration with server-assigned id.
- [ClientInfo Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo.md): Contains information about a client in an OAuth2/OpenID Connect context.
- [ClientJwksConfigurationExtensions Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.ClientJwksConfigurationExtensions.md): Configuration-time extensions that populate Jwks from raw configuration sections by binding into JsonWebKeySetSettings (a flat DTO that Microsoft.Extensions.Configuration can handle natively) and mapping to the polymorphic JsonWebKey hierarchy.
- [ClientJwtEncryption Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.Formatters.ClientJwtEncryption.md): The encryption policy a caller hands to ClientJwtFormatter when formatting a client-addressed JWT. It makes explicit which registered client metadata governs encryption, so the formatter no longer has to infer it from the token type. Each client-J...
- [ClientJwtFormatter Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.Formatters.ClientJwtFormatter.md): Provides functionality to format JSON Web Tokens (JWTs) issued to clients by the authentication service. This class handles the signing of JWTs and, if configured, their encryption, based on the needs of each client.
- [ClientJwtValidator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.Validation.ClientJwtValidator.md): Validates JWTs issued by clients to the authentication service, supporting scenarios such as private JWT client authentication and the validation of request objects. This class plays a crucial role in ensuring that tokens received from clients are...
- [ClientKeysProvider Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientKeysProvider.md): Facilitates the retrieval of JSON Web Keys (JWKs) for cryptographic operations, including encryption and signing. This provider supports fetching keys from a client's JSON Web Key Set (JWKS) URL or directly from the client configuration.
- [ClientRegistrationContextValidatorComposite Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientRegistrationContextValidatorComposite.md): Composite that runs the configured chain of IClientRegistrationContextValidator steps in order and short-circuits on the first failure, mirroring RFC 7591 §3.2.2 which requires the server to reject a registration on the first invalid metadata field.
- [ClientRegistrationRequest Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRegistrationRequest.md): Represents metadata for an OAuth2 client based on the OpenID Connect discovery specification.
- [ClientRegistrationRequest.Parameters Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRegistrationRequest.Parameters.md): Wire-level parameter names for the dynamic client registration request (RFC 7591 and OpenID Connect Dynamic Client Registration 1.0). Each constant is the JSON member name expected on the registration payload sent to the registration endpoint.
- [ClientRegistrationResponse Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRegistrationResponse.md): The response returned from the client registration endpoint per RFC 7591 §3.2.1 and OIDC Dynamic Client Registration §3.2, echoing the registered metadata together with server-issued credentials and the URL of the client configuration endpoint (RF...
- [ClientRegistrationSuccessResponse Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ClientRegistrationSuccessResponse.md): Represents a successful response for a client registration in the context of OpenID Connect. Per RFC 7591 §3.2.1, the authorization server returns all registered metadata about the client (including server-assigned defaults for omitted fields) so ...
- [ClientRegistrationValidationContext Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ClientRegistrationValidationContext.md): Mutable state shared by the validation pipeline. Carries the original ClientRegistrationRequest alongside derived values that earlier steps compute and later steps (or the processor) consume.
- [ClientRequest Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRequest.md): Carries the OAuth 2.0 client authentication material common to back-channel endpoints (token, introspection, revocation): credentials passed in the request body per RFC 6749 §2.3.1, JWT-based client assertions per RFC 7521/7523, and the mTLS clien...
- [ClientRequest.Parameters Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ClientRequest.Parameters.md): Wire-level parameter names for OAuth 2.0 client authentication material common to back-channel endpoints (RFC 6749 §2.3.1, RFC 7521/7523 client assertions, OIDC Core §9).
- [ClientRequestValidator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.ClientRequestValidator.md): Default IClientRequestValidator for the RFC 7592 client configuration endpoint. First verifies the registration access token is bound to the requested `client_id`, then loads the corresponding ClientInfo from storage and rejects the request when n...
- [ClientSecret Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientSecret.md): Encapsulates the details of a client secret used in OAuth2 and OpenID Connect authentication flows.
- [ClientSecretAuthenticator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.ClientSecretAuthenticator.md): Serves as a base class for client authentication, utilizing client ID and secret. It validates clients against a known list of clients, ensuring that the client secret provided during the authentication process matches the stored secret for the cl...
- [ClientSecretBasicAuthenticator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.ClientSecretBasicAuthenticator.md): Implements an authentication of a client request by HTTP 'Authorization' header using the 'Basic' scheme. This authentication method follows the standards outlined in RFC 7617.
- [ClientSecretGenerator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.ClientSecretGenerator.md): Provides a mechanism for securely generating client secret strings used in OAuth 2.0 and OpenID Connect authentication flows. This implementation uses a cryptographic random number generator to produce a high-entropy secret string, which is crucia...
- [ClientSecretJwtAuthenticator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.ClientSecretJwtAuthenticator.md): Authenticates client requests using the client_secret_jwt authentication method. This method is used in scenarios where the client signs a JWT with its secret as a means of authentication.
- [ClientSecretOptions Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.ClientSecretOptions.md): Configuration options for generating client secrets in OAuth2/OpenID Connect authentication.
- [ClientSecretPostAuthenticator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.ClientSecretPostAuthenticator.md): Implements an authentication of a client request by extracting client credentials (client_id and client_secret) from the request body. This approach is typically used in OAuth 2.0 client credential flows where the client submits its credentials as...
- [ClientSecurityProfile Enum](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ClientSecurityProfile.md): A named bundle of security controls a client is held to. Selecting a profile forces the whole bundle on the client at once and prevents an individual toggle from silently weakening it, which is what makes a client conformant with one setting inste...
- [ClientType Enum](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ClientType.md): Enumeration representing the type of OAuth 2.0 client.
- [ClientValidator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.ClientValidator.md): Validates the client specified in the authorization request. This class checks whether the client is registered and authorized to perform the request, as part of the authorization validation process. It plays a crucial role in ensuring that only v...
- [ClientValidator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.ClientValidator.md): Validates the client in a backchannel authentication request, ensuring the client is registered and authorized to perform the request as part of the authentication validation process.
- [ClientValidator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.ClientValidator.md): Validates the client in a device authorization request.
- [ClientValidator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Validation.ClientValidator.md): Resolves the client referenced by the request (either via `client_id` directly or via `id_token_hint`'s audience) into a ClientInfo stored on the context for later steps such as post-logout redirect URI validation. A request with no client identif...
- [ClientValidator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation.ClientValidator.md): Validates the client information in the context of a token request, ensuring that the client is properly authenticated.
- [CodeChallengeMethods Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.CodeChallengeMethods.md): Static class representing the methods for PKCE (Proof Key for Code Exchange) code challenges.
- [CompositeAuthorizationGrantHandler Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.CompositeAuthorizationGrantHandler.md): A composite handler that coordinates multiple authorization grant handlers for processing OAuth 2.0 token requests. This class allows for flexible and extensible handling of various grant types by delegating specific grant processing tasks to indi...
- [CompositeBinarySerializer Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Storages.CompositeBinarySerializer.md): A composite serializer that tries Protocol Buffers first, then falls back to JSON for unsupported types.
- [CompositeLogoutNotifier Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.CompositeLogoutNotifier.md): Provides a mechanism to aggregate and execute multiple logout notification strategies for an OpenID Connect or OAuth 2.0 system.
- [CompositeRequestFetcher Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.CompositeRequestFetcher.md): A composite fetcher that combines multiple IAuthorizationRequestFetcher instances. It iterates through each fetcher to process an authorization request, allowing for a flexible and extensible mechanism to fetch and validate authorization requests ...
- [CompositeRequestFetcher Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.RequestFetching.CompositeRequestFetcher.md): Chains multiple IBackChannelAuthenticationRequestFetcher instances, feeding each one's output into the next so that distinct sources or formats (for example, the signed Request Object) can progressively enrich the request. Returns the first failur...
- [CompositeUriValidator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.UriValidation.CompositeUriValidator.md): Aggregates several IUriValidator instances under OR semantics: a URI is accepted as soon as any of the wrapped validators accepts it. Used to back a client whose configuration registers multiple equally-valid URIs (for example, several registered ...
- [ConfigurationHandler Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.ConfigurationHandler.md): Handles OpenID Connect discovery configuration requests by building metadata response. Returns framework-agnostic discovery metadata without endpoint URLs.
- [ConfigurationResponse Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.ConfigurationResponse.md): Framework-agnostic OpenID Connect discovery metadata response. Contains provider capabilities, supported features, and cryptographic algorithms, but excludes endpoint URLs which are framework-specific.
- [ConfigurationResponse Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ConfigurationResponse.md): The OpenID Provider discovery document returned by the `/.well-known/openid-configuration` endpoint, as defined by OpenID Connect Discovery 1.0 §3 and OAuth 2.0 Authorization Server Metadata (RFC 8414). Its content lists the provider's endpoints, ...
- [ConfigurationResponse.Parameters Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ConfigurationResponse.Parameters.md): Nested class containing string constants for JSON property names used in the configuration response. These names map directly to the fields returned by the OpenID Connect discovery document, ensuring proper serialization and deserialization of con...
- [ConfirmationValidator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Validation.ConfirmationValidator.md): Enforces the end-user confirmation step described in OpenID Connect RP-Initiated Logout 1.0 §2: when the request omits `id_token_hint` the OP cannot trust that the user really initiated the logout, so a UI confirmation must precede the call. This ...
- [ConsentConstraintEnforcer Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.ConsentConstraintEnforcer.md): Default IConsentConstraintEnforcer. Asserts `granted ⊆ requested` for scopes, resources (including their nested scopes) and RFC 9396 `authorization_details`, throwing when the consent provider returned anything outside the request.
- [ConsentDefinition Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Consents.ConsentDefinition.md): Defines the details of user consents required for specific scopes and resources. This record is used to manage and validate user consent for accessing specific scopes, resources, and RFC 9396 Rich Authorization Requests entries, ensuring that cons...
- [ConsentRequired Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ConsentRequired.md): Outcome signalling that the user is authenticated but has not yet granted every scope or resource the client is asking for, so the host must show its consent UI for the deltas in RequiredUserConsents. Maps to OpenID Connect Core 1.0 §3.1.2.6 `cons...
- [Cookie Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Cookie.md): Represents an HTTP cookie along with its options.
- [CookieOptions Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.CookieOptions.md): Represents options for an HTTP cookie, including properties for HTTP-only, essential, secure, path, domain, SameSite attribute, expiration, and maximum age.
- [CredentialsValidator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.CredentialsValidator.md): Validates that client authentication methods are consistent with the credentials provided during registration. Ensures clients using JWT-based or TLS authentication have the required credentials (JWKS for JWT methods, TLS metadata for TLS methods)...
- [CriticalHeaderContext Class](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.CriticalHeaderContext.md): Per-call context passed to HandleAsync(CriticalHeaderContext, CancellationToken) 'Abblix.Jwt.ICriticalHeaderHandler.HandleAsync(Abblix.Jwt.CriticalHeaderContext, System.Threading.CancellationToken)'). Reference type with init-only properties so ad...
- [CultureListAttribute Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.DeclarativeBinding.CultureListAttribute.md): Declares that the value travels on the wire as a space-separated list of BCP 47 language tags while the model exposes it as an array of cultures — e.g. the OIDC `ui_locales` and `claims_locales` parameters. Purely semantic: it names the wire forma...
- [DeviceAuthorizationDetailsValidator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.DeviceAuthorizationDetailsValidator.md): Thin endpoint-side adapter that delegates the RFC 9396 §3 device-flow `authorization_details` validation to ApplyAsync(JsonArray, ClientInfo, CancellationToken) 'Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy.App...
- [DeviceAuthorizationHandler Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.DeviceAuthorizationHandler.md): Handles device authorization requests as defined in RFC 8628. Coordinates validation and processing of requests to generate device_code and user_code.
- [DeviceAuthorizationOptions Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.DeviceAuthorizationOptions.md): Provides configuration options for the Device Authorization Grant (RFC 8628).
- [DeviceAuthorizationOptionsValidator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.DeviceAuthorizationOptionsValidator.md): Fails loudly the first time OidcOptions is resolved when the device authorization endpoint is enabled but its settings are absent, instead of letting the contradiction surface as an unhandled HTTP 500 on the first request. The endpoint is off in t...
- [DeviceAuthorizationRequest Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationRequest.md): Represents a stored device authorization request as defined in RFC 8628. This record is used to persist the state of a device authorization flow between the initial request and when the user completes authentication.
- [DeviceAuthorizationRequest Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Storages.Proto.DeviceAuthorizationRequest.md): Represents a device authorization request (RFC 8628)
- [DeviceAuthorizationRequest Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.DeviceAuthorizationRequest.md): Represents a device authorization request as defined in RFC 8628. This request is initiated by a device with limited input capabilities to obtain a device code and user code for user authentication on a separate device.
- [DeviceAuthorizationRequest.Parameters Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.DeviceAuthorizationRequest.Parameters.md): Contains constants representing the parameter names used in the device authorization request.
- [DeviceAuthorizationRequestProcessor Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.DeviceAuthorizationRequestProcessor.md): Processes validated device authorization requests, generating codes and storing the request.
- [DeviceAuthorizationRequestReflection Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Storages.Proto.DeviceAuthorizationRequestReflection.md): Holder for reflection information generated from Features/Storages/Proto/DeviceAuthorizationRequest.proto
- [DeviceAuthorizationRequestValidator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.DeviceAuthorizationRequestValidator.md): Validates device authorization requests by delegating to a context validator.
- [DeviceAuthorizationResponse Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.DeviceAuthorizationResponse.md): Represents a successful device authorization response as defined in RFC 8628. This response contains the device code the client uses to poll the token endpoint and the user code the device displays to the user for entry on a separate device.
- [DeviceAuthorizationResponse.Parameters Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.DeviceAuthorizationResponse.Parameters.md): Contains constants representing the parameter names used in the device authorization response.
- [DeviceAuthorizationStatus Enum](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationStatus.md): Represents the various states of a device authorization request as defined in RFC 8628. This enumeration defines the possible statuses that a device authorization request can have, facilitating the management of the device authorization flow.
- [DeviceAuthorizationStatus Enum](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Storages.Proto.DeviceAuthorizationStatus.md): Status of a device authorization request
- [DeviceAuthorizationStorage Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceAuthorizationStorage.md): Implements storage for device authorization requests as defined in RFC 8628. Stores requests by device_code (for client polling) with a secondary index by user_code (for user verification). Uses atomic distributed cache operations to prevent race ...
- [DeviceAuthorizationValidationContext Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.DeviceAuthorizationValidationContext.md): Represents the context for validating a device authorization request.
- [DeviceAuthorizationValidatorComposite Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.DeviceAuthorizationValidatorComposite.md): Composes multiple device authorization context validators into a single validator. Executes validators in sequence until one returns an error or all pass.
- [DeviceCodeGenerator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.DeviceCodeGenerator.md): Generates high-entropy device codes for the Device Authorization Grant (RFC 8628). The device code is used by clients to poll the token endpoint.
- [DeviceCodeGrantHandler Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.DeviceCodeGrantHandler.md): Handles the Device Code grant type as defined in RFC 8628. This handler validates token requests for the device authorization flow, checking the device code status and returning tokens when authorized.
- [DiscoveryOptions Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.DiscoveryOptions.md): Defines discovery endpoint options.
- [DisplayModes Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.DisplayModes.md): The class representing the display modes for the authentication and consent UI.
- [DistributedCacheStorage Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Storages.DistributedCacheStorage.md): Provides a general-purpose distributed caching mechanism with serialization support, enabling the storage and retrieval of serialized objects.
- [DistributedJwtReplayCache Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.JwtBearer.DistributedJwtReplayCache.md): Backward-compat adapter from the legacy two-step IJwtReplayCache shape onto the canonical single-call TryAddAsync(string, Nullable<DateTimeOffset>) 'Abblix.Oidc.Server.Features.ReplayPrevention.IJwtReplayCache.TryAddAsync(string, System.Null...
- [DistributedJwtReplayCache Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ReplayPrevention.DistributedJwtReplayCache.md): Distributed cache implementation of IJwtReplayCache for JWT replay protection. Uses Microsoft.Extensions.Caching.Distributed.IDistributedCache to store JTIs, enabling multi-instance deployments.
- [DPoPAlgorithms Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DPoP.DPoPAlgorithms.md): Single source of truth for the DPoP signing-algorithm whitelist (RFC 9449 §4.2, §7.1). Both the proof-validator's enforcement (it rejects proofs whose `alg` header sits outside this set) and the resource-server's `WWW-Authenticate: DPoP algs="..."...
- [DPoPNonceOptions Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.DPoPNonceOptions.md): DPoP-specific extension of NonceOptions per RFC 9449 §8. Inherits the generic primitive's `AcceptanceWindow` and `RotationInterval` so DPoP can override them independently of any other nonce-service consumer, and adds the per-endpoint policy that ...
- [DPoPNonceValidator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DPoP.DPoPNonceValidator.md): Base class for DPoP-aware endpoint validators that enforce the RFC 9449 §8 nonce challenge-response loop. Encapsulates the proof-claim check, fresh-nonce issuance, and UseDPoPNonceError shaping; concrete validators override Abblix.Oidc.Server.Feat...
- [DPoPOptions Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.DPoPOptions.md): Configuration options for OAuth 2.0 DPoP (RFC 9449), covering the proof validator's `iat` tolerance and DPoP-specific nonce policy. The nonce sub-section inherits from the generic NonceOptions so DPoP can configure stricter values independently of...
- [DPoPTokenEndpointValidator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation.DPoPTokenEndpointValidator.md): Token-endpoint enforcement of RFC 9449 DPoP: validates the proof JWT carried on the inbound `DPoP` header against the request's method+URI, runs the layered nonce-policy if the deployment requires it, and stashes the proof's JWK thumbprint on the ...
- [DPoPUserInfoValidator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Validation.DPoPUserInfoValidator.md): Resource-server-side enforcement of RFC 9449 DPoP at the UserInfo endpoint. Mirrors the shape of DPoPTokenEndpointValidator so the branching logic stays symmetric across endpoints; differences are limited to the trigger (`cnf.jkt` on the inbound a...
- [Dynamic Routing in ASP.NET Core with Abblix OIDC](https://www.abblix.com/en/docs/tokenized-routing-dotnet.md): Learn tokenized routing and runtime route resolution for cloud-native apps. Configure environment-specific routes for Docker, Kubernetes, and CI/CD pipelines.
- [DynamicClientOperation Enum](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.DynamicClientOperation.md): Defines the type of dynamic client management operation being performed.
- [ElementsRequiredAttribute Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.DeclarativeBinding.ElementsRequiredAttribute.md): Applied to an array, collection, or otherwise enumerable property, field, or parameter to declare that the collection itself must be non-null and contain at least one element, and that no element inside it may be null. Useful for protocol metadata...
- [EllipticCurveJsonWebKey Class](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.EllipticCurveJsonWebKey.md): Represents an Elliptic Curve JSON Web Key (JWK) containing EC-specific cryptographic parameters. Supports both public and private EC keys per RFC 7518 Section 6.2.
- [EllipticCurveOids Class](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.EllipticCurveOids.md): ASN.1 object identifiers (OIDs) for NIST-recommended elliptic curves used in ECDSA cryptography.
- [EllipticCurveTypes Class](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.EllipticCurveTypes.md): Elliptic curve identifiers for the JWK "crv" parameter, as defined in RFC 7518 Section 6.2.1.1.
- [EncodedJsonWebToken Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.EncodedJsonWebToken.md): Represents an encoded JSON Web Token (JWT) along with its decoded model representation.
- [EncryptedData Class](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Encryption.EncryptedData.md): Represents the result of JWE content encryption operation. Contains the components required for JWE Compact Serialization per RFC 7516.
- [EncryptedResponseAlgorithmsValidator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.EncryptedResponseAlgorithmsValidator.md): Validates the JWE algorithms a client requests for the JWTs this server encrypts or decrypts: `id_token_encrypted_response_alg`/`enc` and `userinfo_encrypted_response_alg`/`enc` (OIDC Core), `request_object_encryption_alg`/`enc` (RFC 9101) and `au...
- [EncryptionAlgorithms Class](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.EncryptionAlgorithms.md): JWE algorithm identifiers ("alg" and "enc" header values) defined in RFC 7516 (JWE) and RFC 7518 Sections 4 (key management) and 5 (content encryption). Constants on this class are recognized by the library; some are listed but not yet supported b...
- [EncryptionAlgorithms.ContentEncryption Class](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.EncryptionAlgorithms.ContentEncryption.md): Content encryption algorithms ("enc" parameter in the JWE header). These encrypt the JWE payload using the Content Encryption Key produced by the key management algorithm.
- [EncryptionAlgorithms.KeyManagement Class](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.EncryptionAlgorithms.KeyManagement.md): Key management algorithms ("alg" parameter in the JWE header). These wrap or derive the Content Encryption Key (CEK) that is then used by a content encryption algorithm.
- [EndSessionContextValidatorComposite Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Validation.EndSessionContextValidatorComposite.md): Represents a composite validator for end-session requests.
- [EndSessionHandler Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.EndSessionHandler.md): Default IEndSessionHandler implementation. Delegates validation to IEndSessionRequestValidator, then forwards a successful ValidEndSessionRequest to IEndSessionRequestProcessor; validation failures short-circuit and are returned as-is.
- [EndSessionRequest Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.EndSessionRequest.md): Parameters of an RP-initiated logout request to the OpenID Provider's `end_session_endpoint`, as defined in OpenID Connect RP-Initiated Logout 1.0.
- [EndSessionRequest.Parameters Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.EndSessionRequest.Parameters.md): Wire-level parameter names accepted at the OP's `end_session_endpoint` (OpenID Connect RP-Initiated Logout 1.0).
- [EndSessionRequestProcessor Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.EndSessionRequestProcessor.md): Implements the logic for processing end-session requests.
- [EndSessionRequestValidator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.EndSessionRequestValidator.md): Implements the logic for validating end-session requests.
- [EndSessionSuccess Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Interfaces.EndSessionSuccess.md): Result of a successful RP-initiated logout (OpenID Connect RP-Initiated Logout 1.0 §3). Carries the post-logout redirect target (with `state` already appended when present) and the set of front-channel logout URIs the user agent must visit so each...
- [EndSessionValidationContext Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Validation.EndSessionValidationContext.md): Represents the context for validating an end-session request.
- [EntityStorageKeyFactory Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Storages.EntityStorageKeyFactory.md): Centralized factory for generating entity storage keys with consistent formatting. Provides standardized key generation for all OIDC storage entities.
- [ErrorCodes Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ErrorCodes.md): Represents OAuth 2.0 and OpenID Connect error codes.
- [ErrorFactory Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Validation.ErrorFactory.md): Builds OidcError instances for the request-binding layer shared by every endpoint and both transport adapters. The counterpart of the per-area error factories (authorization validation, token grants, dynamic client registration, ...): those cover ...
- [ErrorFactory Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.ErrorFactory.md): Provides a factory for creating standardized authorization request error responses. This factory simplifies the creation of error responses for various types of validation failures during authorization request processing.
- [ErrorFactory Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ErrorFactory.md): Builds OidcError instances using the error codes RFC 7591 §3.2.2 reserves for dynamic client registration: `invalid_redirect_uri`, `invalid_client_metadata`, `invalid_software_statement`, and `unapproved_software_statement`.
- [ErrorFactory Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.ErrorFactory.md): Builds OidcError instances using the error codes RFC 6749 §5.2 defines for the token endpoint. Mirrors the sibling per-area factories (authorization validation, dynamic client registration, secure HTTP fetch): each area exposes only the error code...
- [ErrorFactory Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.SecureHttpFetch.ErrorFactory.md): A static factory class for creating OIDC error instances related to secure HTTP fetching operations.
- [ErrorResponse Struct](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ErrorResponse.md): Represents a standardized error response, commonly used in web APIs and OAuth2/OpenID Connect protocols.
- [Evolution of OIDC Flows: From Implicit to PKCE and BFF](https://www.abblix.com/en/docs/openid-connect-flows-explained-simply-from-implicit-flows-to-authorization-code-flows-with-pkce-and-bff.md): Detailed analysis of OpenID Connect authentication flows - Implicit Flow, Authorization Code with PKCE, and BFF pattern. Learn vulnerabilities and security best practices.
- [ExactMatchUriValidator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.UriValidation.ExactMatchUriValidator.md): Implements the simple-string-comparison matching rule for redirect URIs (RFC 6749 §3.1.2.2): the candidate URI must equal a single registered absolute URI. Optionally strips the query and fragment from the candidate before comparison to accommodat...
- [Extension Points Map: Which Interface Owns Which Behavior](https://www.abblix.com/en/docs/extension-points-map.md): A map of Abblix OIDC Server's public extension points: which interface to replace or decorate for each customization goal (clients, tokens, keys, sessions, storage, flows) with shipped defaults and the registration rules that make an override stick.
- [FlowTypes Enum](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.FlowTypes.md): Represents OAuth 2.0 flow types.
- [FlowTypeValidator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.FlowTypeValidator.md): Validates the OAuth 2.0 flow type specified in the authorization request. This class determines if the requested flow type is supported and matches the expected patterns for authorization requests, as part of the validation process.
- [FrontChannelLogoutNotifier Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.FrontChannelLogoutNotifier.md): Implements OpenID Connect Front-Channel Logout 1.0 notification by collecting per-client logout URIs (with `iss` and `sid` appended when the client requires session identifiers) into the LogoutContext. The end-session endpoint later renders these ...
- [FrontChannelLogoutOptions Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.FrontChannelLogoutOptions.md): Front-channel logout settings for a single client, as defined by the OpenID Connect Front-Channel Logout 1.0 specification. Tells the authorization server which URL to load in a hidden iframe during end-session processing and whether the iframe UR...
- [FrontChannelLogoutResponse Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.FrontChannelLogoutResponse.md): Represents the response for a front-channel logout page in OpenID Connect. Contains complete HTML content with CSP nonce already injected.
- [FrontChannelLogoutService Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.FrontChannelLogoutService.md): Implements front-channel logout HTML generation in accordance with OpenID Connect Front-Channel Logout 1.0 specification.
- [Getting Started with Abblix OIDC Server](https://www.abblix.com/en/docs/getting-started-guide.md): Step-by-step guide to building an OpenID Connect Provider with ASP.NET MVC and Abblix OIDC Server. Learn setup, configuration, and testing.
- [GrantIdGenerator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.GrantIdGenerator.md): Default IGrantIdGenerator implementation. Draws random bytes from a cryptographically secure source (System.Security.Cryptography.RandomNumberGenerator via `CryptoRandom`) using the byte count configured in GrantIdLength, then URL-safe Base64 enco...
- [GrantTypes Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.GrantTypes.md): Represents OAuth 2.0 grant types.
- [GrantTypeValidator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.GrantTypeValidator.md): Enforces the consistency rule from OIDC DCR 1.0 §2 between `response_types` and `grant_types`: a client requesting `code` must register the `authorization_code` grant, and one requesting `token` or `id_token` must register the `implicit` grant.
- [HashAlgorithm Enum](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Hashing.HashAlgorithm.md): Specifies the hash algorithms supported for hashing operations.
- [HashService Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Hashing.HashService.md): Provides hashing functionality for various types of data, including but not limited to client secrets, in OAuth 2.0 and OpenID Connect authentication flows. This class supports SHA-256 and SHA-512 hashing algorithms to securely hash data.
- [Hexagonal Architecture of Abblix OIDC Server](https://www.abblix.com/en/docs/understanding-the-architecture.md): Learn about Abblix OIDC Server's hexagonal architecture - core components, ports, adapters, and integration capabilities for scalable authentication services.
- [HttpNotificationDeliveryService Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.HttpNotificationDeliveryService.md): HTTP-based implementation of backchannel notification service for CIBA ping and push modes. Sends HTTP POST notifications to client endpoints with authentication request status updates or token delivery.
- [HttpRequestHeaders Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.HttpRequestHeaders.md): This class defines HTTP header names commonly used in HTTP requests.
- [HttpRequestMessageExtensions Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.HttpRequestMessageExtensions.md): Extension methods for System.Net.Http.HttpRequestMessage.
- [IAccessTokenService Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.IAccessTokenService.md): Issues OAuth 2.0 access tokens as signed JWTs (RFC 9068 access-token format) and reverses the mapping by reconstructing the originating AuthSession and AuthorizationContext from the token's claims.
- [IAcrMetadataProvider Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IAcrMetadataProvider.md): Provides metadata about supported ACR (Authentication Context Class Reference) values for OpenID Connect discovery document.
- [IanaClaimTypes Class](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.IanaClaimTypes.md): Provides constants for various JWT and OpenID Connect claim types. Includes both registered claim types and public claim types as defined in various standards. This classification helps in ensuring interoperability across different systems and ser...
- [IanaClaimTypes.ConfirmationMethods Class](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.IanaClaimTypes.ConfirmationMethods.md): Member names of the `cnf` confirmation-method JSON object (RFC 7800 §3.1 / IANA "JWT Confirmation Methods" registry). Each member encodes a different proof-of-possession binding scheme; multiple members can coexist when a deployment uses several s...
- [IAuthenticationCompletionHandler Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IAuthenticationCompletionHandler.md): Handles CIBA authentication completion by routing to the appropriate delivery mode handler (poll, ping, or push) based on the client's configured backchannel_token_delivery_mode.
- [IAuthenticationRequestIdGenerator Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IAuthenticationRequestIdGenerator.md): Defines the contract for generating unique authentication request identifiers in the context of a backchannel or other authentication flows. This identifier is used to track and reference individual authentication requests.
- [IAuthorizationCodeGenerator Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.IAuthorizationCodeGenerator.md): Defines a contract for generating unique authorization codes for use in OAuth 2.0 authorization code flows. Implementations of this interface should ensure that the generated codes are cryptographically secure and suitable for one-time use in auth...
- [IAuthorizationCodeService Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Storages.IAuthorizationCodeService.md): Provides a contract for managing OAuth 2.0 authorization codes, facilitating the authorization code flow. This interface enables the generation of unique authorization codes for authenticated sessions, the validation of these codes for user author...
- [IAuthorizationContextValidator Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.IAuthorizationContextValidator.md): Defines the contract for a validator in an authorization context. Implementations of this interface should provide logic for validating authorization requests.
- [IAuthorizationDetailsMetadataProvider Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsMetadataProvider.md): Discovery metadata contributor for the RFC 9396 Rich Authorization Requests feature. Sources the set of `authorization_details` types the server supports, projected from the same keyed-DI registry that request-time dispatch uses — single source of...
- [IAuthorizationDetailsPolicy Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailsPolicy.md): Single request-time entry point for the RFC 9396 authorization_details policy: per-client allowlist (§5.1) plus per-type composite dispatch (§5). Endpoint-side adapters delegate here so /authorize, /par, CIBA and device-flow share one policy source.
- [IAuthorizationDetailValidator Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RichAuthorizationRequests.IAuthorizationDetailValidator.md): Validates a single RFC 9396 authorization_details entry whose `type` value matches the implementation. Hosts register one implementation per supported `type` via AddAuthorizationDetailValidator<TValidator>(this IServiceCollection, string) 'A...
- [IAuthorizationGrantHandler Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler.md): Strategy contract for resolving the `grant_type`-specific portion of an OAuth 2.0 token request (RFC 6749 §4) into an AuthorizedGrant: an authentication session plus the AuthorizationContext (subject, scope, resources, claims) that the issued toke...
- [IAuthorizationHandler Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationHandler.md): Defines a contract for handling authorization requests, ensuring they are processed according to OAuth 2.0 and OpenID Connect protocol specifications.
- [IAuthorizationMetadataProvider Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IAuthorizationMetadataProvider.md): Provides authorization-related metadata for OpenID Connect discovery.
- [IAuthorizationRequestFetcher Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.IAuthorizationRequestFetcher.md): Defines an interface for fetching the details of an authorization request, potentially including resolving and validating a request object.
- [IAuthorizationRequestProcessor Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationRequestProcessor.md): Defines the interface for processing authorization requests according to OpenID Connect and OAuth 2.0 specifications. It handles the end-user's authentication, authorization decision, and the issuance of authorization codes and tokens.
- [IAuthorizationRequestStorage Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Storages.IAuthorizationRequestStorage.md): Provides mechanisms for securely storing and retrieving OAuth 2.0 authorization requests. This interface abstracts the storage layer, allowing for implementation-specific details such as database, cache or filesystem storage.
- [IAuthorizationRequestUriGenerator Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.IAuthorizationRequestUriGenerator.md): Produces unique, unguessable request URIs used to reference stored authorization request objects, such as those handled by Pushed Authorization Requests (RFC 9126) via the `request_uri` parameter. Implementations must derive the URI from a high-en...
- [IAuthorizationRequestValidator Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationRequestValidator.md): Defines the interface for validating authorization requests in accordance with OpenID Connect Core 1.0 specifications. It assesses if a request complies with the required parameters and constraints for authentication and authorization processes.
- [IAuthorizationResponseBuilder Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseBuilder.md): Contributes one response-type component to the authorization endpoint's success response. Each implementation owns a single value of the OAuth 2.0 / OIDC `response_type` parameter (for example `code`, `token`, or `id_token`) and populates the corr...
- [IAuthorizationResponseEncoder Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.IAuthorizationResponseEncoder.md): Applies the protocol-level encoding of an authorization response in the framework-agnostic core: the `iss` (RFC 9207) and implicit/hybrid `scope` gating, and — when the client requested a JARM (`*.jwt`) response mode — packing all response paramet...
- [IAuthorizationValueReuseDetector Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ReusePrevention.IAuthorizationValueReuseDetector.md): Detects reuse of an authorization request's transaction-binding values — the PKCE `code_challenge` (RFC 7636) and the OpenID Connect `nonce`. Both must be transaction-specific; a client that keeps sending a constant value defeats the protection th...
- [IAuthServiceJwtFormatter Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.Formatters.IAuthServiceJwtFormatter.md): Serializes a JsonWebToken minted by the authorization server itself (access tokens, refresh tokens, Registration Access Tokens) into a compact JWS form (RFC 7515) using the server's signing keys, optionally wrapping the result in a JWE (RFC 7516) ...
- [IAuthServiceJwtValidator Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.Validation.IAuthServiceJwtValidator.md): Validates JWTs minted by this authorization server itself (its own access tokens, refresh tokens and Registration Access Tokens), checking signature against the server's signing keys, issuer equality, and audience membership against the configured...
- [IAuthServiceKeysProvider Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IAuthServiceKeysProvider.md): Provides the keys of the OpenID Connect service to encrypt and sign JWT tokens issued by it.
- [IAuthSessionService Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.UserAuthentication.IAuthSessionService.md): Manages user authentication, providing mechanisms to sign in, sign out, and maintain user sessions. This interface plays a pivotal role in the security and session management of an application, ensuring that users are authenticated and their sessi...
- [IBackChannelAuthenticationContextValidator Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.IBackChannelAuthenticationContextValidator.md): Defines a contract for validating the context of a backchannel authentication request. Implementations of this interface are responsible for ensuring that the backchannel authentication request meets all necessary validation criteria based on the ...
- [IBackChannelAuthenticationHandler Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.IBackChannelAuthenticationHandler.md): Endpoint contract for the OpenID Connect CIBA (Client-Initiated Backchannel Authentication) flow, orchestrating fetch, validation and processing of an incoming backchannel authentication request to produce the response defined in CIBA Core 1.0 §7.
- [IBackChannelAuthenticationRequestFetcher Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.RequestFetching.IBackChannelAuthenticationRequestFetcher.md): Resolves a CIBA request by enriching the raw incoming model with parameters obtained from out-of-band sources, most notably a signed JWT Request Object. The validation pipeline runs against the resolved request, not the raw one.
- [IBackChannelAuthenticationRequestProcessor Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.IBackChannelAuthenticationRequestProcessor.md): Defines the contract for processing validated backchannel authentication requests, transforming them into a response that includes necessary information for the client to complete the authentication flow.
- [IBackChannelAuthenticationRequestValidator Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.IBackChannelAuthenticationRequestValidator.md): Defines the contract for validating client-initiated backchannel authentication requests, ensuring that the requests conform to the necessary security and protocol standards.
- [IBackChannelGrantProcessor Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelGrantProcessor.md): Defines mode-specific processing logic for handling authenticated CIBA requests at the token endpoint. Different delivery modes (poll, ping, push) have different requirements for token retrieval.
- [IBackChannelLongPollingService Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelLongPollingService.md): Provides signaling infrastructure for CIBA poll mode long-polling, allowing token endpoint requests to wait for authentication completion rather than immediately returning authorization_pending.
- [IBackChannelNotificationRequest Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelNotificationRequest.md): Common shape of the JSON body the authorization server posts to the client's `client_notification_endpoint` in CIBA ping and push modes. The `auth_req_id` is always present; push payloads add the issued tokens.
- [IBackChannelRequestStorage Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IBackChannelRequestStorage.md): Defines the contract for a storage system responsible for persisting and retrieving backchannel authentication requests in the context of Client-Initiated Backchannel Authentication (CIBA).
- [IBinarySerializer Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IBinarySerializer.md): Defines the contract for a binary serializer that supports serialization and deserialization of objects to and from binary format.
- [ICheckSessionHandler Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.CheckSession.Interfaces.ICheckSessionHandler.md): Represents an interface for creating a response to build the content of an OpenID Connect check-session frame (OP frame). This interface defines a method for asynchronously processing the check session request and generating a response.
- [IClientAuthenticator Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.IClientAuthenticator.md): Defines the interface for client authentication, supporting various authentication methods during OAuth flows.
- [IClientCredentialFactory Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IClientCredentialFactory.md): Encapsulates client credential generation to maintain single responsibility and reduce constructor complexity. Separates credential-specific concerns (ID generation, secret generation, hashing, expiration) from the broader client registration proc...
- [IClientIdGenerator Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.IClientIdGenerator.md): Defines an interface for generating client IDs for OpenID Connect (OIDC) clients. This interface abstracts the mechanism for creating unique client identifiers used in the registration of OIDC clients. Implementations of this interface can provide...
- [IClientInfoManager Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.IClientInfoManager.md): Defines operations for managing the lifecycle and information of OAuth 2.0 clients in a storage system.
- [IClientInfoProvider Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.IClientInfoProvider.md): Provides access to OAuth 2.0 client information, enabling the retrieval of client details by client ID.
- [IClientJwtFormatter Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.Formatters.IClientJwtFormatter.md): Serializes a JWT addressed to a specific client (ID Token, Logout Token, etc.) into compact form: signed as a JWS (RFC 7515) with the server's signing key chosen by the JWT's header algorithm, then optionally wrapped in a JWE (RFC 7516) encrypted ...
- [IClientJwtValidator Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.Validation.IClientJwtValidator.md): Defines a contract for validating JSON Web Tokens (JWTs) issued by clients, specifically for client authentication.
- [IClientKeysProvider Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.IClientKeysProvider.md): Provides access to cryptographic keys for OpenID Connect clients, supporting token encryption and signature validation.
- [IClientRegistrationContextValidator Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.IClientRegistrationContextValidator.md): One step in the client-registration validation pipeline (RFC 7591 §2 / OIDC DCR 1.0). Implementations check a specific aspect of the supplied metadata (redirect URIs, grant types, signing algorithms, sector identifier, software statement, etc.) an...
- [IClientRequestValidator Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IClientRequestValidator.md): Validates a request against the client configuration endpoint (RFC 7592 §2-§4). Confirms that the bearer registration access token authorizes the operation on the referenced `client_id` and that the client still exists.
- [IClientSecretGenerator Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.IClientSecretGenerator.md): Defines an interface responsible for generating secure client secrets for OpenID Connect (OIDC) clients. Client secrets are used as credentials for client authentication to the OIDC provider or authorization server.
- [IConfigurationHandler Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IConfigurationHandler.md): Builds the discovery document served at `/.well-known/openid-configuration` per OpenID Connect Discovery 1.0 §3 and RFC 8414 (OAuth 2.0 Authorization Server Metadata).
- [IConsentConstraintEnforcer Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.IConsentConstraintEnforcer.md): Defense-in-depth backstop that asserts the anti-escalation invariant on the consent decision: the set granted by IUserConsentsProvider MUST be a subset of what the authorization request carried. This mirrors the strictly narrowing-only ITokenAutho...
- [ICriticalHeaderHandler Interface](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ICriticalHeaderHandler.md): Recipient-side handler for one JWS 'crit' header extension spec (RFC 7515 §4.1.11). Covers «understood AND processed»: the handler applies the extension's recipient-side semantics via HandleAsync(CriticalHeaderContext, CancellationToken) 'Abblix.J...
- [IDataSigner<TJsonWebKey> Interface](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Signing.IDataSigner_TJsonWebKey_.md): Defines the contract for signing and verifying JWT tokens using a specific cryptographic algorithm.
- [IDeviceAuthorizationContextValidator Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.IDeviceAuthorizationContextValidator.md): Defines the contract for validating device authorization request contexts.
- [IDeviceAuthorizationHandler Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Interfaces.IDeviceAuthorizationHandler.md): Defines the contract for handling device authorization requests as specified in RFC 8628.
- [IDeviceAuthorizationRequestProcessor Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Interfaces.IDeviceAuthorizationRequestProcessor.md): Defines the contract for processing validated device authorization requests.
- [IDeviceAuthorizationRequestValidator Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Interfaces.IDeviceAuthorizationRequestValidator.md): Defines the contract for validating device authorization requests.
- [IDeviceAuthorizationStorage Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IDeviceAuthorizationStorage.md): Defines the contract for a storage system responsible for persisting and retrieving device authorization requests as defined in RFC 8628.
- [IDeviceCodeGenerator Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IDeviceCodeGenerator.md): Defines the contract for generating device codes used in the Device Authorization Grant (RFC 8628).
- [IDPoPUserInfoValidator Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IDPoPUserInfoValidator.md): Validates the DPoP-binding contract on a UserInfo request per RFC 9449 §7.1: when the inbound access token is DPoP-bound (carries `cnf.jkt`), the request MUST present `Authorization: DPoP <token>` together with a valid `DPoP` header proof whose ke...
- [IdTokenHintValidator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Validation.IdTokenHintValidator.md): Validates the `id_token_hint` parameter (OpenID Connect RP-Initiated Logout 1.0 §2): verifies signature/issuer/audience but deliberately accepts expired tokens (since the hint's role is to identify a no-longer-active session), then either populate...
- [IdTokenResponseBuilder Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ImplicitFlow.IdTokenResponseBuilder.md): Builds the `id_token` response-type component of an authorization endpoint success response — the OIDC identity-token contributor of the Implicit / Hybrid Flow. Generates an ID token via IIdentityTokenService and stores it on the running Successfu...
- [IEndSessionContextValidator Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Validation.IEndSessionContextValidator.md): One step in the end-session validation pipeline. Each implementation inspects (and may enrich) a shared EndSessionValidationContext; returning a non-null OidcError aborts the pipeline. Implementations are composed via EndSessionContextValidatorCom...
- [IEndSessionHandler Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.IEndSessionHandler.md): Top-level entry point for the OpenID Connect RP-Initiated Logout endpoint. Validates the incoming request and, on success, performs sign-out and produces the post-logout redirect target plus any front-channel logout URIs to be invoked by the relyi...
- [IEndSessionRequestProcessor Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Interfaces.IEndSessionRequestProcessor.md): Performs the side-effects of RP-initiated logout once a request has been validated: signs the end user out of the OP session, notifies every client that participated in the session (back-channel and/or front-channel logout), and assembles the post...
- [IEndSessionRequestValidator Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Interfaces.IEndSessionRequestValidator.md): Validates incoming RP-initiated logout requests against the rules of OpenID Connect RP-Initiated Logout 1.0 §2 (e.g. `id_token_hint` integrity, `post_logout_redirect_uri` against the client's registered list, end-user confirmation when no `id_toke...
- [IEntityStorage Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Storages.IEntityStorage.md): Key/value storage abstraction over short-lived OIDC entities (authorization codes, PAR requests, CIBA/device authorization records, JWT statuses, rate-limit counters). Each entry has an expiration policy expressed via StorageOptions; implementatio...
- [IEntityStorageKeyFactory Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Storages.IEntityStorageKeyFactory.md): Defines a contract for generating entity storage keys with consistent formatting. Provides standardized key generation for all OIDC storage entities.
- [IFrontChannelLogoutService Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.IFrontChannelLogoutService.md): Service for generating front-channel logout HTML responses in accordance with OpenID Connect Front-Channel Logout 1.0 specification.
- [IGrantIdGenerator Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.IGrantIdGenerator.md): Produces unique identifiers for refresh-token grants, used as the `grant_id` claim that binds every refresh token derived from one authorization grant into a single lineage (a "token family" in RFC 9700 terms). Rotation and family revocation (RFC ...
- [IGrantTypeInformer Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer.md): Provides information about OAuth 2.0 grant types supported by a component. Components implementing this interface can be registered in dependency injection to contribute their supported grant types to the OpenID Connect discovery endpoint.
- [IHashService Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Hashing.IHashService.md): Offers hashing functionality for data using various Secure Hash Algorithms (SHA). This service is essential for securely storing and comparing sensitive information like passwords or client secrets without exposing the actual values.
- [IIdentityTokenService Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.IIdentityTokenService.md): Issues OpenID Connect ID Tokens (OIDC Core §2 and §3.1.3.6) for authenticated end-users, embedding the standard claims of OIDC Core §5.1, the client's nonce, and where applicable the `c_hash`/`at_hash` binding claims (OIDC Core §3.1.3.6 and §3.2.2...
- [IInitialAccessTokenRevocationProvider Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IInitialAccessTokenRevocationProvider.md): Checks whether an initial access token has been revoked. Implementations may use a database, distributed cache, or other store.
- [IInitialAccessTokenService Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IInitialAccessTokenService.md): Issues initial access tokens that authorize calls to the client registration endpoint per RFC 7591 Section 3.
- [IIntrospectionHandler Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.IIntrospectionHandler.md): Defines the contract for handling introspection requests to determine the current state and validity of OAuth 2.0 tokens, such as access tokens or refresh tokens.
- [IIntrospectionRequestProcessor Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.IIntrospectionRequestProcessor.md): Builds the RFC 7662 introspection response for an already-validated request: returns `active=true` with claims for a live token, or `active=false` alone when the token is missing, expired, revoked, or issued to a different client (§2.2).
- [IIntrospectionRequestValidator Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.IIntrospectionRequestValidator.md): Authenticates the calling client (RFC 7662 §2.1, "the protected resource calls the introspection endpoint using an HTTP request") and validates the supplied `token`. Implementations are expected to coerce token problems (expired, signed by a diffe...
- [IIssuerProvider Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Issuer.IIssuerProvider.md): Provides a mechanism to retrieve the issuer identifier for the OpenID Connect provider. The issuer identifier is a fundamental part of the token validation process, as it indicates the origin of the token.
- [IJsonObjectBinder Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IJsonObjectBinder.md): Provides a mechanism to bind data from a JsonObject to a model, enabling the conversion of JSON data into a strongly typed object. This interface abstracts the process of mapping JSON properties to a model's properties, facilitating the dynamic po...
- [IJsonWebTokenCreator Interface](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.IJsonWebTokenCreator.md): Defines the contract for a service that creates JSON Web Tokens (JWTs).
- [IJsonWebTokenValidator Interface](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.IJsonWebTokenValidator.md): Defines the contract for a service that validates JSON Web Tokens (JWTs).
- [IJwtAlgorithmsProvider Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IJwtAlgorithmsProvider.md): Provides metadata about supported JWT signing and validation algorithms for OpenID Connect discovery.
- [IJwtBearerIssuerProvider Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.JwtBearer.IJwtBearerIssuerProvider.md): Provides comprehensive JWT Bearer grant type (RFC 7523) functionality including issuer management, key resolution, and replay protection.
- [IJwtReplayCache Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.JwtBearer.IJwtReplayCache.md): Legacy two-step replay-cache contract: a separate IsReplayedAsync(string) 'Abblix.Oidc.Server.Features.JwtBearer.IJwtReplayCache.IsReplayedAsync(string)') read followed by a MarkAsUsedAsync(string, Nullable&lt;DateTimeOffset&gt;) 'Abblix.Oidc.Serv...
- [IJwtReplayCache Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ReplayPrevention.IJwtReplayCache.md): Tracks JWT IDs (jti claims) presented to the server, so a JWT-bearing flow can detect replay attempts. Both RFC 7523 §5.2 (JWT-bearer-grant assertion replay) and RFC 9449 §11.1 (DPoP proof replay) want this primitive; it is intentionally namespace...
- [IKeyEncryptor<TJsonWebKey> Interface](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Encryption.IKeyEncryptor_TJsonWebKey_.md): Interface for JWE (JSON Web Encryption) key encryption and decryption operations. Encrypts and decrypts the Content Encryption Key (CEK) using a specific key management algorithm. Implements RFC 7516 Section 5 (Key Encryption) and RFC 7518 Section...
- [ILicenseJwtProvider Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Licensing.ILicenseJwtProvider.md): Defines a provider for accessing the license JSON Web Token (JWT) used in OIDC service configuration.
- [ILogoutNotifier Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.ILogoutNotifier.md): Defines an interface for a service responsible for notifying clients about logout events. This interface supports both front-channel and back-channel logout mechanisms, allowing implementations to handle client notifications through direct user ag...
- [ILogoutTokenSender Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.ILogoutTokenSender.md): Defines the interface for a service responsible for sending logout tokens to clients via the back-channel.
- [ILogoutTokenService Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.ILogoutTokenService.md): Issues OpenID Connect Back-Channel Logout tokens (OIDC Back-Channel Logout 1.0 §2.4): JWTs with an `events` claim containing the back-channel logout event URI, addressed to a specific RP and identifying the affected end-user via `sub` and/or `sid`...
- [IMtlsUserInfoValidator Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IMtlsUserInfoValidator.md): Validates the mutual-TLS certificate-binding contract on a UserInfo request per RFC 8705 §3: when the inbound access token is certificate-bound (carries `cnf.x5t#S256`), the protected resource MUST obtain the client certificate used for mutual TLS...
- [InitialAccessTokenRevocationProvider Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.InitialAccessTokenRevocationProvider.md): Default implementation that checks revocation against RevokedInitialAccessTokenSubjects. For production use with large or dynamic revocation lists, replace with a database- or cache-backed implementation.
- [InitialAccessTokenService Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.InitialAccessTokenService.md): Issues initial access tokens for authorizing client registration per RFC 7591 Section 3.
- [InitialAccessTokenValidator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.InitialAccessTokenValidator.md): Validates the initial access token on client registration requests per RFC 7591 Section 3 and RFC 6750 Bearer Token Usage. When RequireInitialAccessToken is enabled, checks JWT signature, expiration, type, and revocation status. Skipped for update...
- [InitiateLoginUriValidator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.InitiateLoginUriValidator.md): Validates the OIDC DCR 1.0 §2 `initiate_login_uri`: when supplied it must be an absolute URI using the `https` scheme.
- [InMemoryLongPollingService Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.InMemoryLongPollingService.md): In-memory implementation of backchannel authentication status notifier using TaskCompletionSource. Suitable for single-server deployments or development environments.
- [INonceService Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Nonces.INonceService.md): Issues and validates server-issued opaque, time-bounded nonces. The current consumer is DPoP-Nonce per RFC 9449 §8 / §9 — the server returns a nonce via the `DPoP-Nonce` response header and the client echoes it back in the `nonce` claim of a subse...
- [INotificationDeliveryService Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.INotificationDeliveryService.md): Provides HTTP-based notification services for CIBA ping and push modes.
- [Integrating ASP.NET Core Identity with Abblix OIDC Server](https://www.abblix.com/en/docs/aspnet-identity-integration.md): How to put ASP.NET Core Identity behind Abblix OIDC Server: Identity owns users, passwords, and lockout; the library owns the protocol and the session. Two seams, complete glue code.
- [InteractionRequired Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.InteractionRequired.md): Outcome signalling that an end-user is signed in but additional UI interaction (a step-up, missing claim, MFA challenge or similar) must complete before the authorization request can be fulfilled. Maps to OpenID Connect Core 1.0 §3.1.2.6 `interact...
- [Introduction to Abblix OIDC Server](https://www.abblix.com/en/docs/introduction-to-abblix-oidc-server.md): Abblix OIDC Server: a certified .NET library implementing OpenID Connect with native ASP.NET Core integration, Hexagonal Architecture, and official OpenID Foundation certification.
- [IntrospectionHandler Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection.IntrospectionHandler.md): Manages the processing of token introspection requests according to OAuth 2.0 specifications, facilitating the validation and introspection of tokens to determine their current state and metadata.
- [IntrospectionRequest Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.IntrospectionRequest.md): Parameters of an OAuth 2.0 token introspection request (RFC 7662 §2.1) sent to the `introspection_endpoint`, used by protected resources to determine the active state and metadata of a token. Client authentication is required and is supplied along...
- [IntrospectionRequest.Parameters Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.IntrospectionRequest.Parameters.md): Wire-level parameter names accepted at the OAuth 2.0 introspection endpoint (RFC 7662 §2.1).
- [IntrospectionRequestProcessor Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection.IntrospectionRequestProcessor.md): Implements the logic for processing introspection requests and generating introspection responses.
- [IntrospectionRequestValidator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection.IntrospectionRequestValidator.md): Validates the introspection request properties and authenticates a client that initiated the request.
- [IntrospectionSuccess Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.IntrospectionSuccess.md): Server-side model of the introspection response defined by RFC 7662 §2.2: a Boolean `active` flag and, when active, the token's metadata claims. Hosts may extend the JSON via additional top-level members; cross-domain extensions should be listed i...
- [IntrospectionSuccess.Parameters Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.IntrospectionSuccess.Parameters.md): Wire-level member names of the introspection response, as registered in the IANA "OAuth Token Introspection Response" registry (RFC 7662 §3.1).
- [InvalidDPoPProofError Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.InvalidDPoPProofError.md): Subtype of OidcError tagging an RFC 9449 §7.1 DPoP proof rejection at a protected endpoint (UserInfo, introspection, revocation). The typed marker lets the response formatter pattern-match deterministically and emit the `WWW-Authenticate: DPoP err...
- [InvalidUserCode Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.InvalidUserCode.md): Indicates that the user code was not found or has expired.
- [IParametersProvider Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IParametersProvider.md): Extracts a flat set of name/value pairs from a response object — the reverse of binding — for delivery as query, fragment or form_post parameters. The transport adapters (MVC, Minimal API) share this contract because flattening a response DTO is f...
- [IParameterValidator Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IParameterValidator.md): Provides a method for validating that a parameter is and not null.
- [IProofValidator Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DPoP.IProofValidator.md): Validates a DPoP proof JWT per RFC 9449 §4.2 / §4.3 (structure, signature, claim shape) but excluding replay-cache and nonce checks. Those layered checks land alongside the `jti`-replay-cache and DPoP-Nonce service in a separate slice and build on...
- [IPushedAuthorizationHandler Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.PushedAuthorization.Interfaces.IPushedAuthorizationHandler.md): Defines the contract for handling Pushed Authorization Requests (PAR) as specified in OAuth 2.0 and OpenID Connect. Ensures that implementations can validate and process these requests in a secure and compliant manner.
- [IPushedAuthorizationRequestProcessor Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.PushedAuthorization.Interfaces.IPushedAuthorizationRequestProcessor.md): Processes valid pushed authorization requests, generating a response that includes the request's URI and its expiration.
- [IPushedAuthorizationRequestValidator Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.PushedAuthorization.Interfaces.IPushedAuthorizationRequestValidator.md): Provides validation for pushed authorization requests in an OAuth 2.0 context, ensuring they adhere to protocol specifications. This interface evaluates the conformity of authorization requests with expected parameters and limitations before their...
- [IReadClientHandler Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IReadClientHandler.md): Handles `GET` requests to the client configuration endpoint per RFC 7592 §2.1, returning the registered metadata of the authenticated client.
- [IReadClientRequestProcessor Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IReadClientRequestProcessor.md): Builds the RFC 7592 §2.1 read-client response from a request that has already been validated. Reads stored metadata, formats it for the wire, and issues a fresh `registration_access_token` as recommended by RFC 7592 §3.
- [IRefreshTokenService Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.IRefreshTokenService.md): Issues and consumes OAuth 2.0 refresh tokens (RFC 6749 §6) used to obtain renewed access tokens without re-prompting the user. Implementations apply the configured absolute and sliding expiration policies and may revoke the previous refresh token ...
- [IRegisterClientHandler Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegisterClientHandler.md): Handles `POST` requests to the registration endpoint per RFC 7591 §3 and the OpenID Connect Dynamic Client Registration 1.0 specification, validating supplied metadata and provisioning a new client.
- [IRegisterClientRequestProcessor Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegisterClientRequestProcessor.md): Persists a new client and constructs the RFC 7591 §3.2.1 success response from a request whose metadata has already been validated. Generates credentials and the `registration_access_token` bound to the new `client_id`.
- [IRegisterClientRequestValidator Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegisterClientRequestValidator.md): Validates client metadata supplied to the registration endpoint per RFC 7591 §2 and OpenID Connect Dynamic Client Registration 1.0. Produces a typed ValidClientRegistrationRequest on success or an OidcError describing the rejected metadata field.
- [IRegistrationAccessTokenService Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenService.md): Provides functionality to issue registration access tokens for managing registered clients. Per RFC 7592 Section 3, the registration access token is used to authenticate subsequent operations on the client configuration endpoint.
- [IRegistrationAccessTokenStore Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenStore.md): Records, for each registered client, the identifier (jti) of the registration access token currently authorized to manage it via the RFC 7592 client configuration endpoint. The token validator accepts only a token whose jti matches the stored valu...
- [IRegistrationAccessTokenValidator Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRegistrationAccessTokenValidator.md): Validates the registration access token presented on calls to the client configuration endpoint per RFC 7592 §3. Verifies the bearer token from the `Authorization` header is bound to the requested `client_id`.
- [IRemoveClientHandler Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRemoveClientHandler.md): Handles `DELETE` requests to the client configuration endpoint per RFC 7592 §2.3, deregistering an existing client after verifying its registration access token. A successful deletion invalidates the client's `client_id`, `client_secret`, the regi...
- [IRemoveClientRequestProcessor Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IRemoveClientRequestProcessor.md): Performs the storage-level deregistration of a client whose request has already been validated for authentication and existence per RFC 7592 §2.3.
- [IRequestInfoProvider Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IRequestInfoProvider.md): Provides information about the current request, including URIs and security details.
- [IRequestObjectFetcher Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RequestObject.IRequestObjectFetcher.md): Defines the interface for fetching and processing JWT request objects, validating their content and binding their payloads to a request model. This is typically used in OpenID Connect flows where request parameters are passed as JWTs.
- [IResourceManager Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ResourceIndicators.IResourceManager.md): Looks up ResourceDefinition entries registered for the authorization server, supporting validation of the `resource` parameter defined by RFC 8707 (Resource Indicators for OAuth 2.0) at the authorization, token, and PAR endpoints.
- [IResponseJwtBuilder Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ResponseObject.IResponseJwtBuilder.md): Encodes authorization endpoint response parameters into a JWT secured for a specific client, as defined by JWT Secured Authorization Response Mode for OAuth 2.0 (JARM), JARM. This is the framework-agnostic core of JARM: it builds, signs and option...
- [IRevocationHandler Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.IRevocationHandler.md): Defines a contract for handling revocation requests for access or refresh tokens as per OAuth 2.0 Token Revocation specifications.  Ensures implementations can securely validate and process such requests to revoke tokens effectively.
- [IRevocationRequestProcessor Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.IRevocationRequestProcessor.md): Represents the capability to handle token revocation requests. The authorization server invalidates tokens immediately upon revocation, preventing their future use. Depending on the server's policy, revoking a token may also affect related tokens ...
- [IRevocationRequestValidator Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.IRevocationRequestValidator.md): Represents the capability to validate revocation requests. The authorization server validates client credentials (for confidential clients) and checks if the token was issued to the requesting client. If validation fails, the request is refused, a...
- [IScopeClaimsProvider Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.UserInfo.IScopeClaimsProvider.md): Defines a service responsible for determining the claims associated with specific OAuth 2.0 and OpenID Connect scopes. This interface facilitates the mapping of requested scopes to their corresponding claims, enabling effective claims management b...
- [IScopeManager Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ScopeManagement.IScopeManager.md): Registry of OAuth 2.0 scope definitions known to the authorization server (RFC 6749 §3.3), including the OIDC standard scopes (`openid`, `profile`, `email`, `address`, `phone`, `offline_access`; OIDC Core §5.4) and any host-defined custom scopes. ...
- [IScopesAndClaimsProvider Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.Interfaces.IScopesAndClaimsProvider.md): Provides metadata about supported scopes, claims, grants, and subject types for OpenID Connect discovery.
- [ISecureHttpFetcher Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.SecureHttpFetch.ISecureHttpFetcher.md): Defines a contract for securely fetching content from external URIs with SSRF protection.
- [ISecureUriValidator Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.SecureHttpFetch.ISecureUriValidator.md): Applies the synchronous portion of the SSRF policy (scheme allow-list, internal-hostname and private/reserved IP-literal blocking) configured by SecureHttpFetchOptions to a URI. Used both by the outbound HTTP handler immediately before a request a...
- [ISessionIdGenerator Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.ISessionIdGenerator.md): Defines the interface for generating new session identifiers, which are crucial for tracking user sessions in web applications, especially in scenarios involving authentication and authorization processes.
- [ISessionManagementService Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.SessionManagement.ISessionManagementService.md): Provides methods and properties for managing user sessions in the context of an OpenID Connect or OAuth 2.0 authorization server. This interface enables the implementation of session management features, such as creating session cookies, generatin...
- [ISubjectTokenResolver Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.TokenExchange.ISubjectTokenResolver.md): Resolves a wire-level `subject_token` of a specific RFC 8693 §3 token type into a portable SubjectTokenContext. One resolver per supported token type URI, registered with keyed DI under the URI as key; the TokenExchangeGrantHandler dispatches by r...
- [ISubjectTypeConverter Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.UserInfo.ISubjectTypeConverter.md): Defines the interface for a service that converts user subject identifiers according to the client's specified subject type. This conversion ensures that the subject identifier presented to the client is in the format that the client expects, base...
- [ITokenAuthorizationContextEvaluator Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenAuthorizationContextEvaluator.md): Defines an evaluator for determining the AuthorizationContext based on token requests.
- [ITokenContextValidator Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation.ITokenContextValidator.md): Defines the contract for a token context validator, responsible for validating different aspects of a token request within a given context. Implementations of this interface ensure that the token request adheres to the expected security and busine...
- [ITokenHandler Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenHandler.md): Defines a contract for handling OAuth 2.0 token requests, encompassing validation, processing, and issuance of tokens based on authorization grants.
- [ITokenIdGenerator Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.ITokenIdGenerator.md): Produces unique identifiers for JSON Web Tokens, used as the `jti` claim defined in RFC 7519 §4.1.7. A unique `jti` per token is required to support replay detection and one-time token semantics, so implementations must generate values with suffic...
- [ITokenRegistry Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Storages.ITokenRegistry.md): Represents a registry that manages the statuses of JSON Web Tokens (JWTs). This registry allows for tracking and updating the status of tokens, such as marking them as used or revoked.
- [ITokenRequestProcessor Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenRequestProcessor.md): Processes incoming token requests from clients, ensuring they are valid and authorized before issuing the appropriate token response. Depending on the request type and granted permissions, the response can include various types of tokens such as A...
- [ITokenRequestValidator Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.ITokenRequestValidator.md): Validates an incoming OAuth 2.0 token request (RFC 6749 §3.2) against the rules required by the requested `grant_type`: client authentication, grant ownership (e.g. an authorization code MUST have been issued to the authenticated client per OIDC C...
- [IUpdateClientHandler Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IUpdateClientHandler.md): Defines a contract for handling requests to update client configurations, as part of client management in OAuth 2.0 and OpenID Connect frameworks per RFC 7592 Section 2.2.
- [IUpdateClientRequestProcessor Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IUpdateClientRequestProcessor.md): Represents an interface for processing update client requests in the context of OpenID Connect per RFC 7592.
- [IUpdateClientRequestValidator Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.IUpdateClientRequestValidator.md): Represents an interface for validating update client requests in the context of OpenID Connect per RFC 7592.
- [IUriValidator Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.UriValidation.IUriValidator.md): Decides whether a URI received from a client is acceptable for a given OAuth/OIDC use, most commonly the redirect URI matching rules of RFC 6749 §3.1.2 and the loopback / custom-scheme accommodations of RFC 8252 (OAuth 2.0 for Native Apps).
- [IUserClaimsProvider Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.UserInfo.IUserClaimsProvider.md): Defines an interface for retrieving user-specific claims based on authentication sessions and requested claims. This interface plays a crucial role in authentication flows, where it extracts and formats user data for inclusion in tokens or other a...
- [IUserCodeGenerator Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeGenerator.md): Defines the contract for generating user codes used in the Device Authorization Grant (RFC 8628).
- [IUserCodeNormalizer Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeNormalizer.md): Canonicalizes a user-entered user code before it is matched against a stored code in the Device Authorization Grant (RFC 8628). RFC 8628 Section 6.1 recommends that the server strip readability punctuation the user may have copied (dashes, spaces)...
- [IUserCodeRateLimiter Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeRateLimiter.md): Defines the contract for rate limiting user code verification attempts to prevent brute force attacks. Per RFC 8628 Section 5.2, implementations SHOULD implement rate limiting to prevent abuse.
- [IUserCodeVerificationService Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.Interfaces.IUserCodeVerificationService.md): Defines the contract for a service that handles user code verification in the Device Authorization Grant flow (RFC 8628).
- [IUserConsentsProvider Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Consents.IUserConsentsProvider.md): Defines an interface for a service that provides user consents. This service is responsible for retrieving and managing user consent decisions related to authorization requests. It ensures that the application adheres to user preferences and legal...
- [IUserCredentialsAuthenticator Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IUserCredentialsAuthenticator.md): Validates a username and password pair against the host's user store and produces an authorized grant when the credentials are correct. Used by the Resource Owner Password Credentials grant (`grant_type=password`) at the token endpoint, so the hos...
- [IUserDeviceAuthenticationHandler Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.Interfaces.IUserDeviceAuthenticationHandler.md): Defines the contract for initiating user authentication on a device in the context of a backchannel authentication flow. This interface is responsible for handling the initiation of the authentication process for the end-user on their device, base...
- [IUserInfoHandler Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IUserInfoHandler.md): Endpoint contract for the OpenID Connect UserInfo endpoint (OIDC Core 1.0 §5.3), which returns claims about the authenticated end-user identified by the bearer access token presented per RFC 6750.
- [IUserInfoProvider Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.UserInfo.IUserInfoProvider.md): Provides functionality to retrieve user information as JWT claims, supporting both simple and structured claim values. This interface enables the dynamic extraction and packaging of user attributes into JWT claims, accommodating a variety of claim...
- [IUserInfoRequestProcessor Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IUserInfoRequestProcessor.md): Generates a response containing information about a user account.
- [IUserInfoRequestValidator Interface](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.IUserInfoRequestValidator.md): Parses and validates an access token provided in a user info request.
- [JsonArrayExtensions Class](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonArrayExtensions.md): Conversion helpers between a raw System.Text.Json.Nodes.JsonArray wire form and a sequence of AuthorizationDetail wrappers. Parallels JsonObjectExtensions for object-shaped claims; here the shape is a JSON array and each element is a wrapper over ...
- [JsonBinarySerializer Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Implementation.JsonBinarySerializer.md): Provides functionality to serialize and deserialize objects to and from JSON binary representations. Implements the IBinarySerializer interface using the System.Text.Json library for serialization.
- [JsonObjectAttribute Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.DeclarativeBinding.JsonObjectAttribute.md): Declares that the value travels on the wire as a JSON document carried inside a single parameter — e.g. the OIDC `claims` parameter or RFC 9396 `authorization_details`. Purely semantic: it names the wire format and leaves the parsing mechanism to ...
- [JsonObjectExtensions Class](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonObjectExtensions.md): Provides extension methods for the System.Text.Json.Nodes.JsonObject class, enhancing its usability by simplifying the process of accessing and manipulating JSON properties.
- [JsonSerializationBinder Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Implementation.JsonSerializationBinder.md): Implements the IJsonObjectBinder interface to bind JSON data from a System.Text.Json.Nodes.JsonObject to a specified model type. This binder utilizes System.Text.Json for serialization to dynamically bind the JSON data to the model's properties, a...
- [JsonWebKey Class](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey.md): Base class representing a JSON Web Key (JWK), a versatile structure for representing cryptographic keys using JSON. JWKs are crucial for digital signatures, encryption, and ensuring secure communication in web-based protocols.
- [JsonWebKeyConverter Class](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKeyConverter.md): Custom JSON converter for JsonWebKey that handles polymorphic serialization/deserialization based on the "kty" (key type) discriminator while ensuring the KeyType property is serialized in both polymorphic and direct serialization scenarios.
- [JsonWebKeyExtensions Class](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKeyExtensions.md): Provides extension methods for the JsonWebKey model to simplify the process of populating its properties from different sources. These methods enable easy conversion between JsonWebKey and various cryptographic representations.
- [JsonWebKeyExtensions Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.JsonWebKeyExtensions.md): Provides extensions for asynchronous operations on a sequence of JsonWebKey objects.
- [JsonWebKeyFactory Class](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKeyFactory.md): A factory for creating JsonWebKey objects for various cryptographic key types. Supports RSA, Elliptic Curve, and symmetric (HMAC) keys for JWT operations.
- [JsonWebKeyPropertyNames Class](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKeyPropertyNames.md): JSON property names used in the JSON serialization of a JWK as defined in RFC 7517 Section 4 and RFC 7518 Section 6. These are the wire-level names; consumers normally interact with the strongly-typed properties on JsonWebKey and its subclasses.
- [JsonWebKeySet Class](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKeySet.md): A JSON Web Key Set (JWK Set) per RFC 7517 Section 5: a JSON document containing an array of JSON Web Keys. Authorization servers publish their JWK Set at the `jwks_uri` endpoint so that relying parties can discover the keys used to validate or enc...
- [JsonWebKeySetSettings Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.JsonWebKeySetSettings.md): Flat configuration DTO for a JsonWebKeySet, mirroring RFC 7517 Section 5 (a JSON object with a single `keys` array). See JsonWebKeySettings for the per-key DTO and the design rationale.
- [JsonWebKeySettings Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.JsonWebKeySettings.md): Flat configuration DTO for a single JSON Web Key, suitable for binding via `Microsoft.Extensions.Configuration` which cannot instantiate the abstract JsonWebKey base type directly. All cryptographic byte-array members are bound as base64url-encode...
- [JsonWebKeyTypes Class](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKeyTypes.md): Values for the JWK "kty" parameter (RFC 7517 Section 4.1, RFC 7518 Section 6.1) identifying the cryptographic family a key belongs to. Used as the discriminator when deserializing a JsonWebKey into the correct concrete subtype.
- [JsonWebToken Class](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebToken.md): Represents a JSON Web Token (JWT), a compact, URL-safe means of representing claims to be transferred between two parties. This record encapsulates the standard JWT structure, offering properties to access and manipulate the header, payload, and c...
- [JsonWebTokenConfirmation Class](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenConfirmation.md): Typed wrapper over the `cnf` confirmation-method JSON object (RFC 7800 §3.1). Exposes the proof-of-possession binding members an issued JWT can carry: the mutual-TLS client certificate thumbprint (`x5t#S256`, RFC 8705 §3.1) and the DPoP proof-key ...
- [JsonWebTokenExtensions Class](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenExtensions.md): Provides extension methods for handling JSON data within JWTs.
- [JsonWebTokenHeader Class](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenHeader.md): Represents the header part of a JSON Web Token (JWT), containing metadata about the token such as the type and the algorithm used for signing.
- [JsonWebTokenPayload Class](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenPayload.md): Represents the payload part of a JSON Web Token (JWT), containing the claims or statements about the subject.
- [JsonWebTokenStatus Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Storages.Proto.JsonWebTokenStatus.md): Wrapper message for JsonWebTokenStatus enum to enable serialization
- [JsonWebTokenStatus Enum](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.Revocation.JsonWebTokenStatus.md): Defines the possible states of a JSON Web Token within the system.
- [JsonWebTokenStatusEnum Enum](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Storages.Proto.JsonWebTokenStatusEnum.md): The possible states of a JSON Web Token
- [JsonWebTokenStatusReflection Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Storages.Proto.JsonWebTokenStatusReflection.md): Holder for reflection information generated from Features/Storages/Proto/JsonWebTokenStatus.proto
- [JwtAlgorithmsProvider Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.JwtAlgorithmsProvider.md): Provides JWT algorithm metadata by delegating to JWT creator and validator.
- [JwtAssertionAuthenticatorBase Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.JwtAssertionAuthenticatorBase.md): Base class for JWT assertion-based client authenticators, providing common validation logic for both private_key_jwt and client_secret_jwt authentication methods.
- [JwtBearerGrantHandler Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.JwtBearerGrantHandler.md): Handles the JWT Bearer grant type per RFC 7523, allowing clients to exchange a JWT assertion for an access token. This grant type is used when a client has obtained a JWT from a trusted identity provider and wants to exchange it for an access toke...
- [JwtBearerIssuerProvider Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.JwtBearer.JwtBearerIssuerProvider.md): Default implementation of IJwtBearerIssuerProvider that loads trusted issuers from JwtBearer configuration, fetches JWKS with SSRF protection, and provides JWT replay protection.
- [JwtBearerOptions Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.JwtBearerOptions.md): Configuration options for JWT Bearer grant type (RFC 7523). Defines trusted external identity providers whose JWT assertions can be exchanged for access tokens.
- [JwtClaimTypes Class](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JwtClaimTypes.md): Names of the JWT claims and JOSE header parameters used by this library, including the registered claims from RFC 7519 Section 4.1, common OpenID Connect claims, and several extensions (token exchange, security event tokens, etc.). Use these const...
- [JwtError Enum](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JwtError.md): High-level categories of JWT processing failures returned by the validator and by callers that consume validated tokens. Pair with ErrorDescription for a human-readable explanation. Categories let callers branch on the failure cause without parsin...
- [JwtSubjectTokenResolver Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.TokenExchange.JwtSubjectTokenResolver.md): ISubjectTokenResolver for JWT-formatted subject tokens. Validates the JWT via IAuthServiceJwtValidator (signature, lifetime, registered claims) and projects the payload's `sub`, `scope`, and `authorization_details` claims into a SubjectTokenContext.
- [JwtTypes Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.JwtTypes.md): This class defines JWT (JSON Web Token) types used in various contexts.
- [JwtValidationError Class](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JwtValidationError.md): Represents an error encountered during the validation of a JSON Web Token (JWT).
- [License Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Licensing.License.md): Represents the licensing constraints applied to the application, including limits on the number of clients and issuers, as well as the validity period of the license.
- [LicenseChecker Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Licensing.LicenseChecker.md): Manages and enforces licensing constraints on clients and issuers within the application, ensuring compliance with defined licensing terms.
- [LicenseLoader Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Licensing.LicenseLoader.md): Handles the loading and validation of application licenses provided as JSON Web Tokens (JWT).
- [LicenseManager Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Licensing.LicenseManager.md): Manages the application's licenses, ensuring that the current license is appropriately evaluated based on its validity period.
- [LicenseStatus Enum](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Licensing.LicenseStatus.md): Specifies the status of a license in relation to its validity period and current date and time.
- [LoginRequired Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.LoginRequired.md): Outcome signalling that the host must surface its login UI: either no eligible session exists, or the client requested forced reauthentication via `prompt=login` / `max_age`. Maps to OpenID Connect Core 1.0 §3.1.2.6 `login_required` when `prompt=n...
- [LogoutContext Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.LogoutNotification.LogoutContext.md): Represents the context for a logout operation, containing details necessary for processing the logout. This context includes the session identifier, the subject identifier of the user, the issuer of the authentication token, and a collection of UR...
- [LogoutTokenService Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.LogoutTokenService.md): Implements the ILogoutTokenService interface to generate logout tokens.
- [MediaTypes Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.MediaTypes.md): Represents common media types used in HTTP requests and responses.
- [Migrating from IdentityServer4 or Duende to Abblix OIDC Server](https://www.abblix.com/en/docs/migrate-from-identityserver.md): A map of moving a .NET identity provider off IdentityServer4 or Duende to Abblix OIDC Server: the concepts map one to one, the JWT format does not change, and the real work is persistence.
- [MissingAuthenticationError Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.MissingAuthenticationError.md): Subtype of OidcError tagging a request to a protected endpoint that carried no authentication information at all. RFC 6750 §3.1: in that case the challenge SHOULD NOT include an error code or other error attributes — a bare `WWW-Authenticate` head...
- [Modern Authentication: OpenID Connect, BFF Pattern, and SPAs](https://www.abblix.com/en/docs/net-authentication-openid-connect-bff-spa.md): Comprehensive guide to Backend-For-Frontend (BFF) pattern for securing Single Page Applications with .NET and React. Learn OAuth 2.0 best practices for modern web apps.
- [MtlsAliases Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.MtlsAliases.md): Discovery metadata block published as `mtls_endpoint_aliases` per RFC 8705 §5, advertising alternate endpoint URLs that are served on a host configured for mutual TLS. Clients performing certificate-bound authentication or requesting certificate-b...
- [MtlsAliasesOptions Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.MtlsAliasesOptions.md): Options for RFC 8705 mTLS endpoint aliases in discovery. Allows explicitly setting alias URIs. Use DiscoveryOptions.MtlsBaseUri to auto-compute aliases.
- [MtlsUserInfoValidator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Validation.MtlsUserInfoValidator.md): Resource-server-side enforcement of RFC 8705 §3 mutual-TLS certificate-bound access tokens at the UserInfo endpoint. Mirrors the role of DPoPUserInfoValidator for the `cnf.x5t#S256` binding: when the access token is certificate-bound, the SHA-256 ...
- [NewClientOptions Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.NewClientOptions.md): Defaults used by the dynamic client registration endpoint when minting credentials for a newly registered client: how its client identifier and client secret are generated and how long the secret stays valid.
- [NonceOptions Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Nonces.NonceOptions.md): Base configuration class for the generic stateless-nonce service. Each feature that needs server-issued, time-bounded opaque tokens (DPoP-Nonce per RFC 9449 §8 / §9 is the current consumer; future candidates include state-parameter validation and ...
- [NonceValidationFailure Enum](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Nonces.NonceValidationFailure.md): Reasons a server-issued nonce can fail validation. The categories are for log filters and metrics — at the protocol layer DPoP-Nonce flows surface every failure as the same RFC 9449 §8 `use_dpop_nonce` error with a freshly issued nonce in the resp...
- [NonceValidator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.NonceValidator.md): Implements nonce validation for authorization requests in compliance with OAuth 2.0 and OpenID Connect specifications. This validator ensures the presence of a nonce parameter when the response type includes an ID token, as by OpenID Connect Core ...
- [NoneClientAuthenticator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.NoneClientAuthenticator.md): Authenticates clients that are configured as public, without requiring client secrets.
- [NoneResponseBuilder Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.NoneFlow.NoneResponseBuilder.md): Builds the `none` response-type component of an authorization endpoint success response (OAuth 2.0 Multiple Response Type Encoding Practices §4). The none response type authorizes the request without returning any credentials, so this builder cont...
- [NullConsentService Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Consents.NullConsentService.md): Default no-op consent provider that auto-grants every requested scope and resource and never marks consent as pending. Suitable for trusted first-party deployments and as the starting placeholder during integration; replace with a host-supplied im...
- [OAuth 2.0 & OpenID Connect Standards Implementation](https://www.abblix.com/en/docs/implemented-standards.md): Complete list of OAuth 2.0, OpenID Connect, and JWT standards implemented in Abblix OIDC Server including PKCE, CIBA, JAR, PAR, and token management protocols.
- [OAuth 2.0 and OpenID Connect Glossary](https://www.abblix.com/en/docs/glossary-overview.md): Comprehensive glossary of OAuth 2.0, OpenID Connect, and authentication terms - access tokens, PKCE, CIBA, BFF, identity providers, and more.
- [OctetJsonWebKey Class](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.OctetJsonWebKey.md): Represents a Symmetric JSON Web Key (JWK) containing symmetric key material for algorithms like HMAC. Supports symmetric keys per RFC 7518 Section 6.4.
- [OidcConstants Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.OidcConstants.md): Shared identifiers the HTTP transport adapters (MVC, Minimal API) agree on. The core declares them so both adapters reference one value rather than each carrying its own copy.
- [OidcEndpoints Enum](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcEndpoints.md): Flags representing the various OpenID Connect (OIDC) endpoints that the provider can expose. These flags enable fine-grained control over which endpoints are enabled or disabled.
- [OidcError Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError.md): Represents an error that occurred during OAuth 2.0/OpenID Connect request processing.
- [OidcOptions Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.OidcOptions.md): The root of the OIDC configuration. Provides the simplest way to configure and start your OIDC server.
- [OidcOptionsSecurityProfileValidator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.OidcOptionsSecurityProfileValidator.md): Validates that every statically-configured client whose effective profile mandates a control bundle has a configuration that can satisfy it, failing loudly the first time OidcOptions is resolved rather than letting a contradiction surface as a per...
- [One Validation Rule, Three OIDC Servers: The Cognitive Cost of Extensibility](https://www.abblix.com/en/docs/cognitive-cost-of-extensibility.md): One realistic authorization rule, rejecting a money-moving scope for a public client, built three ways in Duende IdentityServer, OpenIddict, and Abblix OIDC Server, to compare what each asks a developer to learn before the rule runs.
- [OpenIddict vs Duende IdentityServer vs Abblix OIDC Server: .NET Comparison](https://www.abblix.com/en/docs/comparison-duende-openiddict.md): Source-verified comparison of the three .NET OpenID Connect server frameworks: protocol coverage, licensing model, storage, security posture, ecosystem, where each product leads, and what you trade by choosing Abblix.
- [OptionsLicenseJwtProvider Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Licensing.OptionsLicenseJwtProvider.md): An ILicenseJwtProvider backed by the LicenseJwt value resolved through the options pattern.
- [PairwiseSubjectSettings Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.UserInfo.PairwiseSubjectSettings.md): Configuration for pairwise subject identifier generation. The salt is a server-side secret that prevents external computation of pairwise identifiers, ensuring that even with knowledge of the user's real subject and the client ID, an attacker cann...
- [ParametersProvider Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.ParametersProvider.md): Extracts parameters from an object by serializing it to a JSON element and enumerating its properties. Pure System.Text.Json, framework-neutral — the single implementation both the MVC and Minimal API transports use.
- [PasswordGrantHandler Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.PasswordGrantHandler.md): Handles the authorization process for the password grant type within the OAuth 2.0 framework. This handler validates the user's credentials and processes token requests based on the password grant type. The password grant type allows clients to di...
- [Persisting JWT Signing Keys in Production](https://www.abblix.com/en/docs/signing-key-persistence.md): Configure durable signing keys for Abblix OIDC Server. Avoid multi-pod divergence, restart invalidation, and secrets in git. Recipes for static, Redis, and database-backed storage plus a key rotation discipline.
- [PingModeCompletionHandler Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.PingModeCompletionHandler.md): Handles CIBA ping mode token delivery where the client receives a notification that authentication is complete and can then retrieve tokens from the token endpoint. In ping mode, the authenticated request is stored and a notification is sent to th...
- [PingModeGrantProcessor Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.GrantProcessors.PingModeGrantProcessor.md): Handles CIBA ping mode token retrieval at the token endpoint. In ping mode, the server notifies the client, then the client makes a single token request. The auth_req_id is single-use (CIBA Core 1.0 Section 7.3), so the grant is removed from stora...
- [PingModeValidator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.PingModeValidator.md): Validates required parameters for CIBA ping mode authentication requests. Ensures that clients using ping mode have proper configuration and provide necessary tokens.
- [PkceValidator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.PkceValidator.md): Validates the PKCE (Proof Key for Code Exchange) parameters in an authorization request. PKCE adds another layer of security for the OAuth 2.0 authorization code flow, particularly in public clients. It ensures that the authorization request confo...
- [PollModeCompletionHandler Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.PollModeCompletionHandler.md): Handles CIBA poll mode token delivery where the client periodically polls the token endpoint to retrieve tokens. In poll mode, the authenticated request is stored and remains available until the client retrieves it or it expires. Supports optional...
- [PollModeGrantProcessor Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.GrantProcessors.PollModeGrantProcessor.md): Handles CIBA poll mode token retrieval at the token endpoint. In poll mode, clients repeatedly poll until authentication completes. Tokens are removed from storage immediately after retrieval to prevent duplicate issuance. Uses atomic try-remove o...
- [PostLogoutRedirectUrisValidator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.PostLogoutRedirectUrisValidator.md): Validates the OpenID Connect RP-Initiated Logout 1.0 `post_logout_redirect_uris`: each URI must be absolute, fragment-free, and consistent with the OIDC DCR 1.0 §2 scheme rules for the declared `application_type` (Web = `https`, non-localhost; Nat...
- [PostLogoutRedirectUrisValidator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Validation.PostLogoutRedirectUrisValidator.md): Verifies that the request's `post_logout_redirect_uri` is one of the URIs the resolved client previously registered (OpenID Connect RP-Initiated Logout 1.0 §2). A request without `post_logout_redirect_uri` is allowed; if one is present but the cli...
- [PrivateKeyJwtAuthenticator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.PrivateKeyJwtAuthenticator.md): Authenticates clients using the Private Key JWT method, verifying the client's identity through a signed JWT that the client provides. This method is suitable for clients that can securely store and use private keys.
- [Production Hardening Checklist for Abblix OIDC Server](https://www.abblix.com/en/docs/production-hardening-checklist.md): The settings that separate a working Abblix OIDC Server from a production-ready one: refresh-token rotation, client policy, cache encryption, signing-key hygiene, consent enforcement, HTTPS behind a proxy, CORS, and licensing, with what is on by default and what you must turn on.
- [PromptConsentDecorator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Consents.PromptConsentDecorator.md): Honours the OIDC Core §3.1.2.1 `prompt=consent` parameter by short-circuiting the wrapped IUserConsentsProvider: when the client explicitly requests consent re-confirmation, every requested scope and resource is forced into the pending bucket so t...
- [Prompts Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.Prompts.md): Values accepted in the OpenID Connect `prompt` authorization request parameter, instructing the authorization server how to interact with the end user before issuing a response.
- [Proof Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DPoP.Proof.md): The product of a successfully validated DPoP proof: the parsed JWT (so callers can read claims the validator does not consume itself, e.g. `nonce`), the public-only JWK extracted from the proof's `jwk` header, its base64url-encoded RFC 7638 JWK Th...
- [ProofError Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DPoP.ProofError.md): Describes why a DPoP proof was rejected. Reason is a stable token suitable for log filters and metric labels; Detail is a human-readable hint that MUST NOT contain attacker-controllable input verbatim, since this string can surface in error respon...
- [ProofErrorReasons Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DPoP.ProofErrorReasons.md): Stable, machine-friendly reason tokens that Abblix.Oidc.Server.Features.DPoP.ProofValidator assigns to Reason for log filters and metric labels. These are the internal fine-grained failure categories; the OAuth-protocol-level error code surfaced t...
- [ProofKeyThumbprintValidator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.ProofKeyThumbprintValidator.md): Syntactic validator for the RFC 9449 §10 `dpop_jkt` authorization-request parameter: surfaces malformed thumbprints at the authorize / PAR endpoint with `invalid_request` instead of letting them slip through to /token where they would surface only...
- [ProtobufSerializer Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Storages.ProtobufSerializer.md): Provides functionality to serialize and deserialize objects to and from Protocol Buffer binary representations. Implements the IBinarySerializer interface using Google.Protobuf for efficient serialization.
- [PublicKeyUsages Class](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.PublicKeyUsages.md): Values for the JWK "use" parameter (RFC 7517 Section 4.2), declaring whether a key is intended for signing or encryption. Lets clients pick the right key from a JWK Set when a JWKS contains keys for both purposes.
- [PushedAuthorizationHandler Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.PushedAuthorization.PushedAuthorizationHandler.md): Handles the processing of Pushed Authorization Requests (PAR) by validating the requests and then processing them if valid. This class acts as an intermediary between the validation and processing stages of the PAR workflow.
- [PushedAuthorizationRequestProcessor Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.PushedAuthorization.PushedAuthorizationRequestProcessor.md): Processes pushed authorization requests by storing them and generating a response that includes the request URI and expiration information.
- [PushedAuthorizationRequestProcessorDecorator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.PushedAuthorization.PushedAuthorizationRequestProcessorDecorator.md): Enforces single-use of a pushed authorization `request_uri` (RFC 9126 §7.3) by decorating the authorization request processor. Once processing yields a terminal success — an authorization code or token has been minted — the `request_uri` is remove...
- [PushedAuthorizationRequestValidator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.PushedAuthorization.PushedAuthorizationRequestValidator.md): Validates pushed authorization requests by enforcing OAuth 2.0 protocol constraints. This validator ensures that requests do not use prohibited parameters and comply with standard authorization request requirements.
- [PushedAuthorizationResponse Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.PushedAuthorization.Interfaces.PushedAuthorizationResponse.md): Successful response from the Pushed Authorization Request endpoint (RFC 9126 §2.2): the opaque `request_uri` the client must echo to the authorization endpoint, and the lifetime `expires_in` in seconds after which the server may discard the stored...
- [PushedAuthorizationResponse Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.PushedAuthorizationResponse.md): The wire response to a pushed authorization request (RFC 9126): the request URI the client refers to on the authorization endpoint, and how long it stays valid. This is the framework-neutral wire projection both transport adapters serialize. It is...
- [PushedRequestFetcher Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.PushedRequestFetcher.md): Fetches pushed authorization request objects identified by a URN (Uniform Resource Name) from a storage system.
- [PushModeCompletionHandler Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.AuthenticationNotifiers.PushModeCompletionHandler.md): Handles CIBA push mode token delivery where tokens are sent directly to the client's notification endpoint immediately upon authentication completion. In push mode, tokens are generated, delivered via HTTP POST, and the request is removed from sto...
- [PushModeGrantProcessor Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.BackChannelAuthentication.GrantProcessors.PushModeGrantProcessor.md): Handles CIBA push mode token retrieval validation at the token endpoint. In push mode, tokens are delivered directly to the client's notification endpoint. Push mode clients should NEVER poll the token endpoint - this is an error.
- [PushModeValidator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.PushModeValidator.md): Validates required parameters for CIBA push mode authentication requests. Ensures that clients using push mode have proper HTTPS endpoint configuration.
- [RateLimitState Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Storages.Proto.RateLimitState.md): Represents the rate limiting state for a user code or IP address
- [RateLimitStateReflection Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Storages.Proto.RateLimitStateReflection.md): Holder for reflection information generated from Features/Storages/Proto/RateLimitState.proto
- [ReadClientHandler Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.ReadClientHandler.md): Handles client configuration retrieval requests in OAuth 2.0 Dynamic Client Registration protocol. Coordinates validation and processing to securely fetch registered client information.
- [ReadClientRequestProcessor Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.ReadClientRequestProcessor.md): Builds the RFC 7592 §2.1 read-client response from stored client metadata. The `client_secret` is intentionally omitted because secrets are persisted only as hashes; a registration access token bearing the client's current jti is re-issued so the ...
- [ReadClientSuccessfulResponse Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.ReadClientSuccessfulResponse.md): Represents the response for a successful client read request, detailing the configuration and metadata of an OAuth or OpenID Connect client. Per RFC 7592 Section 3, this response includes the registration access token and all registered client met...
- [RedirectUriValidator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.RedirectUriValidator.md): Validates the redirect URI specified in the authorization request. This class checks whether the provided redirect URI matches one of the client's registered redirect URIs, as part of the authorization validation process. It is essential for ensur...
- [RefreshTokenAuthorizedGrant Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.RefreshTokenAuthorizedGrant.md): Represents an authorized grant result for a refresh token request. Contains the authenticated session, authorization context, and the associated refresh token.
- [RefreshTokenGrantHandler Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.RefreshTokenGrantHandler.md): IAuthorizationGrantHandler for `grant_type=refresh_token` (RFC 6749 §6). Verifies the refresh token's signature and lifetime, requires the JWT `typ` header to be `rt+jwt`, recovers the original AuthorizedGrant, and rejects the request with `invali...
- [RefreshTokenOptions Struct](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.RefreshTokenOptions.md): Lifetime and reuse policy for refresh tokens issued by the token endpoint. Combines an absolute ceiling with an optional sliding window so long-running sessions stay alive only while the client keeps using them.
- [RefreshTokenService Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.RefreshTokenService.md): Manages refresh tokens, key components in OAuth 2.0 for extending authentication sessions without requiring user re-authentication. This service handles the creation and validation of refresh tokens, supporting seamless and secure user experiences...
- [RefreshTokenSubjectTokenResolver Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.TokenExchange.RefreshTokenSubjectTokenResolver.md): ISubjectTokenResolver for the `urn:ietf:params:oauth:token-type:refresh_token` subject type. Refresh tokens issued by this AS are JWT-formatted with `typ=rt+jwt`; the resolver validates the JWT, enforces the typ header, and recovers the original A...
- [RegisterClientHandler Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RegisterClientHandler.md): Default implementation of IRegisterClientHandler that runs validation (RFC 7591 §2 metadata + OIDC DCR 1.0) followed by processing (credential issuance, persistence, and registration access token generation per RFC 7591 §3.2.1 / RFC 7592 §3).
- [RegisterClientRequestProcessor Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RegisterClientRequestProcessor.md): Handles the registration of new clients by generating the necessary credentials and adding client information to the system. Ensures the secure and compliant registration of clients as per OAuth 2.0 and OpenID Connect standards.
- [RegisterClientRequestValidator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RegisterClientRequestValidator.md): Default validator for new-client registration (POST), wrapping the request in a ClientRegistrationValidationContext with Register and delegating to the configured IClientRegistrationContextValidator pipeline.
- [RegistrationAccessTokenService Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RegistrationAccessTokenService.md): Issues registration access tokens for managing registered clients per RFC 7592 Section 3.
- [RegistrationAccessTokenStore Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RegistrationAccessTokenStore.md): Default IRegistrationAccessTokenStore backed by the distributed IEntityStorage, so the client-to-token-jti binding is shared across all server replicas. The entry is stored without expiration — it lives as long as the client is registered — and is...
- [RegistrationAccessTokenValidator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RegistrationAccessTokenValidator.md): Default implementation of IRegistrationAccessTokenValidator. Requires a `Bearer` scheme, validates the JWT signature and lifetime via IAuthServiceJwtValidator, then enforces that the token's `typ` is `registration_access_token` and that its `sub` ...
- [RegistrationRequired Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.RegistrationRequired.md): Outcome signalling that the host must surface its account-creation UI: the client requested user registration via `prompt=create` (Initiating User Registration via OpenID Connect 1.0). Per that specification the registration experience is shown re...
- [RemoveClientHandler Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RemoveClientHandler.md): Default implementation of IRemoveClientHandler that authenticates the registration access token via IClientRequestValidator and, on success, delegates to the processor to delete the client per RFC 7592 §2.3.
- [RemoveClientRequestProcessor Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.RemoveClientRequestProcessor.md): Performs the storage-level deregistration of a client through the configured IClientInfoManager per RFC 7592 §2.3.
- [RemoveClientSuccessfulResponse Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.RemoveClientSuccessfulResponse.md): Represents the internal result of a successful client deletion operation.
- [RequestedClaimDetails Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Storages.Proto.RequestedClaimDetails.md): Details of a requested claim per OpenID Connect Core specification
- [RequestedClaimDetails Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.RequestedClaimDetails.md): Represents the details of a requested claim in OAuth2 or OpenID Connect scenarios. This can include whether the claim is essential, and specific values or a range of values for the claim.
- [RequestedClaims Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Storages.Proto.RequestedClaims.md): Claims requested for UserInfo response and ID Token per OpenID Connect specification. Stores claim requests as structured data without JSON string encoding.
- [RequestedClaims Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.RequestedClaims.md): Represents claims requested for inclusion in the UserInfo response and ID Token in OAuth2 or OpenID Connect authentication flows.
- [RequestedClaims.Parameters Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.RequestedClaims.Parameters.md): Wire-level member names of the OIDC Core 1.0 §5.5 `claims` request parameter (the top-level `userinfo` / `id_token` objects within it).
- [RequestedClaimsReflection Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Storages.Proto.RequestedClaimsReflection.md): Holder for reflection information generated from Features/Storages/Proto/RequestedClaims.proto
- [RequestedExpiryValidator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.RequestedExpiryValidator.md): Validates the requested expiry time for a backchannel authentication request. Ensures that the requested expiry is within the allowed range and assigns a valid expiry time to the context.
- [RequestHeaderAttribute Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.DeclarativeBinding.RequestHeaderAttribute.md): Declares that the value arrives in the named HTTP request header rather than in the request payload — e.g. the compact DPoP proof JWT carried in the `DPoP` header per RFC 9449 §4.1. Purely semantic: it names the transport source and leaves the ext...
- [RequestObjectFetchAdapter Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.RequestObjectFetchAdapter.md): Adapter class that implements IAuthorizationRequestFetcher to delegate the fetching and processing of request objects to an instance of IRequestObjectFetcher.
- [RequestObjectFetchAdapter Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.RequestFetching.RequestObjectFetchAdapter.md): Adapts the generic IRequestObjectFetcher (signed-JWT Request Object handling) to the CIBA-specific IBackChannelAuthenticationRequestFetcher contract, passing the request's `request` parameter through unchanged for JWT validation and parameter merg...
- [RequestObjectFetcher Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RequestObject.RequestObjectFetcher.md): Provides functionality to validate and process JWT request objects, binding their payloads to a request model. This class is typically used in OpenID Connect flows where request parameters are passed as JWTs.
- [RequestUriFetcher Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.RequestFetching.RequestUriFetcher.md): Handles fetching of authorization request objects from a specified request URI. This class is responsible for retrieving pre-registered request objects from an external location indicated by a URI, ensuring the request is complete and valid. It en...
- [RequestUrn Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.RequestUrn.md): Provides constants for OAuth request URIs, ensuring they conform to the standardized URN notation.
- [ResourceDefinition Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ResourceDefinition.md): Represents a resource with associated scopes, defining the permissions and access levels within an application. This record is typically used to configure and enforce authorization policies based on resource identifiers and their corresponding sco...
- [ResourceManager Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ResourceIndicators.ResourceManager.md): In-memory IResourceManager backed by Resources. Indexes the configured ResourceDefinition entries by their absolute URI for O(1) lookup during RFC 8707 resource indicator validation.
- [ResourceManagerExtensions Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ResourceIndicators.ResourceManagerExtensions.md): Provides extension methods for resource validation, leveraging a resource manager to ensure the validity and permissibility of requested resources.
- [ResourceValidator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.ResourceValidator.md): Validates resources specified in authorization requests to ensure they conform to registered definitions and policies. This validator checks whether the resources requested in the authorization process are recognized by the system and permitted fo...
- [ResourceValidator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.ResourceValidator.md): Validates resources specified in authorization requests to ensure they conform to registered definitions and policies. This validator checks whether the resources requested in the authorization process are recognized by the system and permitted fo...
- [ResourceValidator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.ResourceValidator.md): Validates the resources requested in a device authorization request.
- [ResourceValidator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation.ResourceValidator.md): Provides validation for resource-related data within token requests, ensuring that all requested resources are recognized and appropriately scoped according to OAuth 2.0 and OpenID Connect standards.
- [ResponseJwtBuilder Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ResponseObject.ResponseJwtBuilder.md): Default IResponseJwtBuilder: resolves the client, builds the JARM (JWT Secured Authorization Response Mode) response JWT and hands it to IClientJwtFormatter for signing and — when the client registered an encryption algorithm — encryption to the c...
- [ResponseModeExtensions Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ResponseObject.ResponseModeExtensions.md): Helpers over the `response_mode` value for JARM (JWT Secured Authorization Response Mode).
- [ResponseModes Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ResponseModes.md): Represents common response modes used in OAuth 2.0 and OpenID Connect flows.
- [ResponseModeValidator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.ResponseModeValidator.md): Verifies that an explicit `response_mode` is compatible with the OAuth 2.0 flow derived from `response_type` (OAuth 2.0 Multiple Response Types §2.1, OAuth 2.0 Form Post Response Mode). For the authorization-code flow any of `query`, `fragment`, `...
- [ResponseTypes Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ResponseTypes.md): Represents common response types used in OAuth 2.0 and OpenID Connect flows.
- [ResponseTypesExtensions Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ResponseTypesExtensions.md): Extension methods that classify an OAuth 2.0 `response_type` combination — the array of its space-separated parts (`code`, `token`, `id_token`). They centralise the shared response-type predicates so the same rule is applied wherever a request's f...
- [Retries Where You Want Them: HTTP Resilience for Abblix OIDC Server](https://www.abblix.com/en/docs/http-resilience.md): Add retries and a circuit breaker to every outbound call Abblix OIDC Server makes, with one line for all of them or a name for each, using the standard .NET resilience APIs and nothing of ours.
- [RevocationHandler Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Revocation.RevocationHandler.md): Manages the handling of token revocation requests in accordance with OAuth 2.0 specifications, ensuring that such requests are properly validated and processed to revoke tokens as intended.
- [RevocationRequest Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.RevocationRequest.md): Parameters of an OAuth 2.0 token revocation request (RFC 7009 §2.1) sent to the `revocation_endpoint`. Client authentication is required and is supplied alongside this payload.
- [RevocationRequest.Parameters Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.RevocationRequest.Parameters.md): Wire-level parameter names accepted at the OAuth 2.0 revocation endpoint (RFC 7009 §2.1).
- [RevocationRequestProcessor Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Revocation.RevocationRequestProcessor.md): Processes revocation requests for tokens. This class is responsible for handling the logic associated with revoking tokens, such as access tokens or refresh tokens.
- [RevocationRequestValidator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Revocation.RevocationRequestValidator.md): Validates revocation requests in accordance with OAuth 2.0 standards. This class is responsible for ensuring that revocation requests meet the criteria specified in OAuth 2.0 Token Revocation (RFC 7009). It validates the authenticity of the client...
- [RollingHmacNonceService Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Nonces.RollingHmacNonceService.md): HMAC-SHA256 backed implementation of INonceService. Issues stateless nonces of the form `Base64Url(timestamp_8B || HMAC-SHA256(secret, timestamp_8B)[..16])` where `secret` is rotated on a configurable cadence and shared across server instances via...
- [RsaJsonWebKey Class](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.RsaJsonWebKey.md): Represents an RSA JSON Web Key (JWK) containing RSA-specific cryptographic parameters. Supports both public and private RSA keys per RFC 7518 Section 6.3.
- [ScopeClaimsProvider Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.UserInfo.ScopeClaimsProvider.md): Implements the IScopeClaimsProvider interface to provide claim names based on requested scopes and claims. This class manages the association between scopes and the specific claims they include, facilitating the retrieval of appropriate claims for...
- [ScopeDefinition Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.ScopeDefinition.md): Defines a structure for OAuth 2.0 scope definitions, specifying the scope and associated claim types.
- [ScopeManager Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ScopeManagement.ScopeManager.md): In-memory IScopeManager that seeds the registry with the six OIDC Core §5.4 standard scopes (`openid`, `profile`, `email`, `address`, `phone`, `offline_access`) and merges any host-defined scopes from Scopes. Lookups are case-sensitive (RFC 6749 §...
- [ScopeManagerExtensions Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ScopeManagement.ScopeManagerExtensions.md): Provides extension methods for scope validation, leveraging a scope manager and resource definitions to ensure the validity and permissibility of requested scopes.
- [Scopes Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.Scopes.md): Represents common OAuth 2.0 and OpenID Connect scopes.
- [ScopesAndClaimsProvider Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Configuration.ScopesAndClaimsProvider.md): Aggregates metadata about supported scopes, claims, grants, and subject types.
- [ScopeValidator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.ScopeValidator.md): Validates the scopes specified in the OAuth 2.0 authorization request. This class checks if the requested scopes are permissible based on the client's configuration and the OAuth flow type in use. It ensures that only allowed scopes are requested,...
- [ScopeValidator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.ScopeValidator.md): Validates the scopes in OAuth 2.0 authorization requests for backchannel authentication. This validator ensures that the requested scopes are allowed based on the client's configuration and the type of OAuth flow being used. It checks for scope co...
- [ScopeValidator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Validation.ScopeValidator.md): Validates the scopes requested in a device authorization request.
- [ScopeValidator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.ScopeValidator.md): Validates the scope values in a client registration request per RFC 7591 Section 2. Each requested scope must be recognized by the server.
- [ScopeValidator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation.ScopeValidator.md): Validates the scopes specified in token requests using a scope manager to ensure their validity and availability. This validator checks whether each requested scope is recognized and authorized for use, ensuring that clients only receive permissio...
- [SecureHttpFetcher Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.SecureHttpFetch.SecureHttpFetcher.md): Securely fetches content from external URIs with SSRF protection. This class should be registered with AddHttpClient for proper HTTP client configuration.
- [SecureHttpFetcherExtensions Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.SecureHttpFetch.SecureHttpFetcherExtensions.md): Provides reusable functionality for fetching JSON Web Key Sets (JWKS) from remote URIs with SSRF protection and consistent error handling.
- [SecureHttpFetchOptions Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.SecureHttpFetch.SecureHttpFetchOptions.md): Configuration options for secure HTTP fetching with SSRF protection.
- [SecureUriValidator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.SecureHttpFetch.SecureUriValidator.md): Default ISecureUriValidator implementation: applies the scheme allow-list and the internal-hostname / private-or-reserved IP-literal rules from SecureHttpFetchOptions.
- [Securing a React SPA with the BFF Pattern and Abblix OIDC Server](https://www.abblix.com/en/docs/react-spa-bff-guide.md): Advanced step-by-step guide: build a React single-page app and a protected API secured by a .NET Backend-for-Frontend and Abblix OIDC Server, with no tokens ever in the browser.
- [SecurityProfileConsistency Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileConsistency.md): Checks whether a client's configuration can actually satisfy the profile it selects, so a contradiction surfaces loudly at registration or startup instead of as a per-request rejection the operator has to reverse-engineer. The runtime validators a...
- [SecurityProfileRequirements Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.SecurityProfileRequirements.md): The bundle of controls a ClientSecurityProfile forces on a client, expressed as individual flags the request-pipeline validators consult. This is the single place the profile-to-controls mapping lives, so a validator never needs to know what "FAPI...
- [SecurityProfileValidator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SecurityProfileValidator.md): Fail-loud companion to the request-time profile enforcement: rejects a registration whose declared response types can never satisfy the security profile the client falls under, so the contradiction surfaces at registration with a clear `invalid_cl...
- [ServiceCollectionExtensions Class](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ServiceCollectionExtensions.md): Provides extension methods for Microsoft.Extensions.DependencyInjection.IServiceCollection to register JwT-related services within the application.
- [ServiceCollectionExtensions Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.ServiceCollectionExtensions.md): Extension methods that register endpoint pipelines (handler + validator + processor + per-step validators / fetchers / grant handlers) for the OAuth 2.0 / OpenID Connect endpoints exposed by this library: configuration, authorization (with PAR), t...
- [ServiceCollectionExtensions Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ImplicitFlow.ServiceCollectionExtensions.md): DI extensions that opt the host into the OAuth 2.0 / OIDC Implicit and Hybrid Flows.
- [ServiceCollectionExtensions Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.NoneFlow.ServiceCollectionExtensions.md): DI extensions that opt the host into the OAuth 2.0 `none` response type.
- [ServiceCollectionExtensions Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RichAuthorizationRequests.ServiceCollectionExtensions.md): Service-collection extensions for the RFC 9396 Rich Authorization Requests feature.
- [ServiceCollectionExtensions Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ServiceCollectionExtensions.md): Provides extension methods to Microsoft.Extensions.DependencyInjection.IServiceCollection for configuring OpenID Connect (OIDC) server services.
- [ServiceCollectionExtensions Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.ServiceCollectionExtensions.md): Extension methods for integrating OpenID Connect (OIDC) core services into an application's service collection.
- [SessionIdGenerator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.SessionIdGenerator.md): Implements the ISessionIdGenerator interface to generate unique session identifiers. The session IDs are generated using a cryptographically strong random number generator and are encoded to be safely included in HTTP URLs, avoiding characters tha...
- [SessionManagementService Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.SessionManagement.SessionManagementService.md): Implements session management functionality in accordance with OpenID Connect session management standards. This service is responsible for managing browser sessions by utilizing cookies and providing mechanisms to check and maintain the session s...
- [SignedRequestObjectRequirementValidator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.SignedRequestObjectRequirementValidator.md): Enforces the RFC 9101 §10.5 `require_signed_request_object` client metadata: a client that committed to it must deliver its authorization parameters as a signed request object. A request that came neither from a request object nor from a PAR-store...
- [SignedResponseAlgorithmsValidator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SignedResponseAlgorithmsValidator.md): Validates the algorithms a client requests for tokens this server signs: `id_token_signed_response_alg` and `userinfo_signed_response_alg` (OIDC DCR 1.0 §2), and `authorization_signed_response_alg` (JARM §3). Each must appear in the server's set o...
- [SigningAlgorithms Class](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.SigningAlgorithms.md): JWS signing algorithm identifiers ("alg" header values) defined in RFC 7518 Section 3. Used to indicate how a JWT was signed and to look up the matching signer or verifier.
- [SigningAlgorithmsValidator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SigningAlgorithmsValidator.md): Validates the algorithms a client commits to using on inbound JWTs the server will verify: `request_object_signing_alg` (OIDC Core §6.1), `backchannel_authentication_request_signing_alg` (CIBA §7.1.1), and `token_endpoint_auth_signing_alg` (RFC 75...
- [SoftwareStatementOptions Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.SoftwareStatementOptions.md): Configuration options for software statement validation per RFC 7591 Section 2.3. Software statements are signed JWTs issued by a third-party authority asserting metadata values about the client software.
- [SoftwareStatementValidator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SoftwareStatementValidator.md): Validates the software_statement parameter in a client registration request per RFC 7591 Section 2.3. Software statements are signed JWTs issued by a third-party authority asserting metadata about client software.
- [SpaceSeparatedStringAttribute Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.DeclarativeBinding.SpaceSeparatedStringAttribute.md): Declares that the value travels on the wire as a single space-separated string while the model exposes it as an array — e.g. the OAuth 2.0 `scope` and `acr_values` parameters. Purely semantic: it names the wire format and leaves the parsing mechan...
- [SsrfHttpClientServiceCollectionExtensions Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.SecureHttpFetch.SsrfHttpClientServiceCollectionExtensions.md): Registers HTTP clients that initiate requests to client-supplied URLs (CIBA notification endpoints, back-channel logout URIs, JWKS/issuer fetches). Every such client must route through SsrfValidatingHttpMessageHandler; bundling the handler with th...
- [SsrfValidatingHttpMessageHandler Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.SecureHttpFetch.SsrfValidatingHttpMessageHandler.md): HTTP message handler that prevents SSRF attacks through comprehensive validation: 1. Hostname-based blocking (localhost, internal, .local TLDs, etc.) 2. DNS resolution and IP-based blocking (private ranges, loopback, link-local) 3. Re-validation i...
- [StandardScopes Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.StandardScopes.md): Provides definitions for standard OpenID Connect scopes and their associated claims.
- [StaticLicenseJwtProvider Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Licensing.StaticLicenseJwtProvider.md): An implementation of ILicenseJwtProvider that returns a predefined license JWT string.
- [Stop Writing Boilerplate Conversions: The Result Pattern in C#](https://www.abblix.com/en/docs/result-pattern-migration.md): How migrating Abblix OIDC Server to the Result pattern eliminated about 20 duplicate error types, collapsed pipeline handlers to 2 lines, and turned runtime type checks into compile-time guarantees.
- [StorageOptions Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Storages.StorageOptions.md): Provides configuration settings for cache entry behaviors in storage operations.
- [Strategic Guide to Identity Management Solutions](https://www.abblix.com/en/docs/navigating-identity-management.md): Explore the strategic shift from cloud identity providers to on-premise and in-house authentication solutions. Learn the benefits of custom identity management development.
- [SubjectTokenContext Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.TokenExchange.SubjectTokenContext.md): The portable state extracted by an ISubjectTokenResolver from a wire-level `subject_token`. Independent of the token's on-wire format -- JWT-based resolvers parse the payload, opaque-token resolvers recover the equivalent fields from a previously ...
- [SubjectTypeConverter Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.UserInfo.SubjectTypeConverter.md): Implements conversion of subject identifiers for end-users based on the subject type requested by the client. Uses HMAC-SHA256 with a server-side secret salt for pairwise identifiers, per OpenID Connect Core Section 8.1.
- [SubjectTypes Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.SubjectTypes.md): Represents subject types used in OpenID Connect.
- [SubjectTypeValidator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SubjectTypeValidator.md): Validates the OIDC Core §8 `subject_type` metadata and computes the pairwise sector identifier per OIDC Core §8.1: when `pairwise` is requested, either a supplied `sector_identifier_uri` (HTTPS, JSON document of redirect URIs) is dereferenced and ...
- [SuccessfullyAuthenticated Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.SuccessfullyAuthenticated.md): Represents a successful authentication response, encapsulating details about the outcome of an authentication request, including any tokens issued as a result.
- [SupportedGrantTypeValidator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SupportedGrantTypeValidator.md): Rejects client registration when any value in `grant_types` is not advertised as supported by this server, returning `invalid_client_metadata` per OIDC DCR §3.2. Without this gate the registration would succeed and the client would only fail later...
- [SupportedResponseTypeValidator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SupportedResponseTypeValidator.md): Server-level support gate for the `response_types` registration parameter (OIDC DCR §3.2): every part of every requested combination must have a registered IAuthorizationResponseBuilder. Without `EnableImplicitFlow()` the `token` / `id_token` proc...
- [SyncAuthorizationContextValidatorBase Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Validation.SyncAuthorizationContextValidatorBase.md): Provides a base for implementing synchronous authorization request validation steps. This abstract class allows for creating validators that perform synchronous validation of authorization requests, while adhering to the IAuthorizationContextValid...
- [SyncClientRegistrationContextValidator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SyncClientRegistrationContextValidator.md): Convenience base for validation steps whose checks are purely in-memory: implements the async contract by wrapping the synchronous Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.SyncClientRegistrationContextValidator.Validate(Abbl...
- [SyncTokenContextValidatorBase Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation.SyncTokenContextValidatorBase.md): Provides a base class for implementing synchronous token context validators. This class simplifies the creation of token context validators by offering a synchronous validation method that is automatically wrapped in an asynchronous call.
- [TlsClientAuthenticator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.TlsClientAuthenticator.md): Implements RFC 8705 self-signed TLS client authentication (self_signed_tls_client_auth). Validates the presented client certificate by matching its public key against the client's registered JWKS (jwks or jwks_uri). If matched and the client's con...
- [TlsClientAuthOptions Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.TlsClientAuthOptions.md): RFC 8705 metadata for tls_client_auth method. Defines match rules for Subject DN and/or Subject Alternative Name entries.
- [TlsClientAuthValidator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.TlsClientAuthValidator.md): Validates tls_client_auth metadata fields for RFC 8705 mutual TLS client authentication. Ensures that required metadata is present and properly formatted when tls_client_auth method is selected.
- [TlsMetadataClientAuthenticator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientAuthentication.TlsMetadataClientAuthenticator.md): RFC 8705 tls_client_auth authenticator. Matches presented client certificate against client metadata: subject DN and/or Subject Alternative Name entries.
- [Token Inventory and Incident Revocation](https://www.abblix.com/en/docs/token-inventory-and-revocation.md): Abblix OIDC Server issues stateless JWTs and keeps no list of them; this guide builds one: recording decorators on the token-issuance seams, a queryable inventory table, and bulk revocation that writes through the same registry every server-side validation consults.
- [TokenAuthorizationContextEvaluator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.TokenAuthorizationContextEvaluator.md): Default ITokenAuthorizationContextEvaluator: narrows the originally granted scope and resource sets to the intersection with what the token request asks for (RFC 6749 §6 / RFC 8707 §2.2), and, when the client authenticated via mTLS, derives the RF...
- [TokenContextValidatorComposite Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation.TokenContextValidatorComposite.md): Represents a composite validator for token context validation, executing a sequence of individual validators. This class allows multiple validators to be combined, each responsible for a specific validation step, and short-circuits the validation ...
- [TokenEndpointAuthMethodValidator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Validation.TokenEndpointAuthMethodValidator.md): Validates that the requested `token_endpoint_auth_method` (RFC 7591 §2) is one this server announces in `token_endpoint_auth_methods_supported` on its discovery document.
- [TokenExchangeGrantHandler Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.TokenExchangeGrantHandler.md): IAuthorizationGrantHandler for RFC 8693 Token Exchange (`grant_type=urn:ietf:params:oauth:grant-type:token-exchange`).
- [TokenExchangeTokenTypes Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.TokenExchangeTokenTypes.md): Token type identifiers for RFC 8693 Token Exchange. Used as the value of the wire-level `subject_token_type`, `actor_token_type`, and `requested_token_type` parameters, and echoed back in the token response's `issued_token_type` field.
- [TokenHandler Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.TokenHandler.md): Manages the processing of token requests according to OAuth 2.0 and OpenID Connect specifications. This includes validating the request for compliance with the protocol requirements and processing it to issue, renew or exchange tokens as appropriate.
- [TokenIdGenerator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.TokenIdGenerator.md): Default ITokenIdGenerator implementation. Draws random bytes from a cryptographically secure source (System.Security.Cryptography.RandomNumberGenerator via `CryptoRandom`) using the byte count configured in TokenIdLength, then URL-safe Base64 enco...
- [TokenInfo Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.TokenInfo.md): Identity of an issued token, recorded against an authorization grant so that the token can be revoked by JTI if the grant is later invalidated (for example when an authorization code is reused).
- [TokenInfo Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Storages.Proto.TokenInfo.md): Represents information about an issued token
- [TokenInfoReflection Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Storages.Proto.TokenInfoReflection.md): Holder for reflection information generated from Features/Storages/Proto/TokenInfo.proto
- [TokenIssued Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.TokenIssued.md): Successful token endpoint response per RFC 6749 §5.1, optionally extended with the OIDC Core 1.0 §3.1.3.3 `id_token`.
- [TokenRegistry Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Storages.TokenRegistry.md): Manages the registration and tracking of JSON Web Token (JWT) statuses within a persistent storage. This class is responsible for determining the current status of JWTs, such as whether they are active, revoked, or expired, and updating these stat...
- [TokenRequest Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.TokenRequest.md): Represents a request to get various types of tokens (e.g., access token, refresh token) from the authorization server. This is part of the OAuth 2.0 and OpenID Connect token exchange flow, where clients can request tokens based on different grant ...
- [TokenRequest.Parameters Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.TokenRequest.Parameters.md): Wire-level parameter names accepted at the token endpoint per RFC 6749 §4, RFC 7636 (PKCE), RFC 7523 (JWT Bearer), RFC 8628 (Device Authorization Grant), RFC 8707 (Resource Indicators), and OpenID Connect CIBA Core.
- [TokenRequestProcessor Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.TokenRequestProcessor.md): Default ITokenRequestProcessor: always issues an access token (RFC 6749 §5.1), adds a refresh token when `offline_access` is in the granted scope (OIDC Core 1.0 §11), and adds an ID token when `openid` is in scope (OIDC Core 1.0 §3.1.3.3, with `at...
- [TokenRequestValidator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.TokenRequestValidator.md): Validates token requests against OAuth 2.0 specifications, ensuring that requests are properly formed and authorized. This class plays a critical role in the OAuth 2.0 authentication and authorization process by verifying the integrity and authent...
- [TokenResponse Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.TokenResponse.md): The response from an OAuth 2.0 / OpenID Connect token endpoint. This is the framework-neutral wire DTO both transport adapters (MVC, Minimal API) serialize; serialization is identical across frameworks, so a single core type serves both.
- [TokenResponseBuilder Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ImplicitFlow.TokenResponseBuilder.md): Builds the `token` response-type component of an authorization endpoint success response — the access-token contributor of the Implicit / Hybrid Flow. Generates an access token via IAccessTokenService and stores it on the running SuccessfullyAuthe...
- [TokenRevoked Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.TokenRevoked.md): Represents a response indicating that the token has been successfully revoked.
- [TokenStatusValidatorDecorator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.Revocation.TokenStatusValidatorDecorator.md): Enhances the functionality of an existing IJsonWebTokenValidator by adding token revocation validation capabilities. This decorator checks whether the JSON Web Token (JWT) has been revoked or used before and, if so, invalidates the token. It utili...
- [TokenTypeIdentifiers Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.TokenTypeIdentifiers.md): Represents token type identifiers for various token types as specified in RFC 8693.
- [TokenTypes Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Constants.TokenTypes.md): Represents token types used in authentication and authorization.
- [TokenValidationContext Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Validation.TokenValidationContext.md): Encapsulates the context required for validating token requests, including client and authorization grant details.
- [TotalSecondsAttribute Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.DeclarativeBinding.TotalSecondsAttribute.md): Declares that the value travels on the wire as an integer number of seconds while the model exposes it as a System.TimeSpan — e.g. the OIDC `max_age` and CIBA `requested_expiry` parameters. Purely semantic: it names the wire format and leaves the ...
- [TrustedIssuer Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Configuration.TrustedIssuer.md): Represents a trusted external identity provider for JWT Bearer grant type.
- [UnexpectedTypeException Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Exceptions.UnexpectedTypeException.md): Represents an exception that is thrown when an unexpected data type is encountered.
- [UpdateClientHandler Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.UpdateClientHandler.md): Handles client configuration update requests in OAuth 2.0 Dynamic Client Registration Management protocol per RFC 7592. Coordinates validation and processing to securely update registered client information.
- [UpdateClientRegistrationValidator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.UpdateClientRegistrationValidator.md): Variant of RegisterClientRequestValidator used by the RFC 7592 §2.2 update flow. Wraps the request in a ClientRegistrationValidationContext with Update so steps such as `ClientIdValidator` require the client to already exist instead of forbidding it.
- [UpdateClientRequest Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.UpdateClientRequest.md): Represents a request to update an existing client's configuration per RFC 7592 Section 2.2. Combines client authentication (ClientRequest) with updated metadata (ClientRegistrationRequest).
- [UpdateClientRequestProcessor Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.UpdateClientRequestProcessor.md): Processes requests to update existing client configurations per RFC 7592 Section 2.2. Updates client metadata while preserving credentials and system-managed fields.
- [UpdateClientRequestValidator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.UpdateClientRequestValidator.md): Validates an RFC 7592 §2.2 update request: authenticates the registration access token and confirms the client exists, then validates the supplied replacement metadata via the update-specific keyed IRegisterClientRequestValidator. Also enforces th...
- [UriValidatorFactory Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.UriValidation.UriValidatorFactory.md): Provides a factory method for creating URI validators. Depending on the number of URIs provided, it creates either a single exact match validator or a composite validator that combines multiple exact match validators.
- [UseDPoPNonceError Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.UseDPoPNonceError.md): Subtype of OidcError that signals an RFC 9449 §8 nonce-challenge: the DPoP proof either omitted the `nonce` claim or carried a stale one, and the server is responding with `use_dpop_nonce` plus a fresh nonce the client must echo on the next attemp...
- [UserClaimsProvider Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.UserInfo.UserClaimsProvider.md): Handles the retrieval of user claims for authentication sessions, ensuring compliance with requested scopes and specific claim details. This class integrates directly with user information providers and scope-to-claim mappings to fetch and validat...
- [UserCodeAlreadyUsed Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeAlreadyUsed.md): Indicates that the user code has already been used (approved or denied).
- [UserCodeGenerator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeGenerator.md): Generates user codes for the Device Authorization Grant (RFC 8628). The alphabet used for code generation is configurable to support numeric, alphabetic, or alphanumeric codes.
- [UserCodeNormalizer Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeNormalizer.md): Canonicalizes user-entered user codes for the Device Authorization Grant (RFC 8628) following the input-processing guidance in Section 6.1: punctuation added for readability (dashes, spaces) and any other characters outside the configured alphabet...
- [UserCodeRateLimiter Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeRateLimiter.md): Implements rate limiting for user code verification attempts to prevent brute force attacks. Uses exponential backoff and per-IP rate limiting as recommended by RFC 8628 Section 5.2.
- [UserCodeValidator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.UserCodeValidator.md): Validates the presence of a UserCode in backchannel authentication requests, based on the client and provider configuration. This validator ensures that if the client or provider requires the UserCode parameter for backchannel authentication, it i...
- [UserCodeVerificationResult Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeVerificationResult.md): Represents the result of a user code verification attempt. This is a discriminated union with three concrete implementations.
- [UserCodeVerificationService Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.UserCodeVerificationService.md): Implements the user code verification service for the Device Authorization Grant flow (RFC 8628). This service handles the verification, approval, and denial of device authorization requests with built-in brute force protection.
- [UserConsents Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Consents.UserConsents.md): Represents the state of user consents in an authorization flow, categorizing them into granted, denied, and pending.
- [UserIdentityValidator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Validation.UserIdentityValidator.md): Validates the user's identity in a backchannel authentication request, ensuring that valid identity hints (e.g., login hints, tokens) are provided and correctly processed.
- [UserInfoFoundResponse Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.UserInfoFoundResponse.md): Represents a successful response containing the found user information.
- [UserInfoHandler Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.UserInfoHandler.md): Handles user information requests in an OpenID Connect compliant manner. It ensures that requests for user info are correctly validated and processed, returning the requested user information if the request is authorized.
- [UserInfoRequest Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.UserInfoRequest.md): Parameters of a request to the OIDC `userinfo_endpoint` (OIDC Core §5.3). The access token is normally presented in the HTTP `Authorization` header per RFC 6750 §2.1, but RFC 6750 §2.2 also permits the form-encoded `access_token` body parameter mo...
- [UserInfoRequest.Parameters Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.UserInfoRequest.Parameters.md): Wire-level parameter names accepted at the OIDC UserInfo endpoint (OIDC Core §5.3, RFC 6750 §2 token transport).
- [UserInfoRequestProcessor Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.UserInfoRequestProcessor.md): Default IUserInfoRequestProcessor: assembles the UserInfo claims set from IUserClaimsProvider, filtered by the access token's authorized scopes and any `userinfo` entry of the OIDC Core §5.5 `claims` request. Returns InvalidToken if no claims are ...
- [UserInfoRequestValidator Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.UserInfoRequestValidator.md): Validates a UserInfo request: extracts the access token (per RFC 6750, either the `Authorization: Bearer` header or the `access_token` form/query parameter, but not both), verifies its JWT signature and claims, asserts the `typ` header equals `at+...
- [ValidationOptions Enum](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ValidationOptions.md): Set of flags for specifying various validation options for JWT tokens. These options can be combined using bitwise operations to create a customized set of validation rules.
- [ValidationParameters Class](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ValidationParameters.md): Defines parameters used during the validation of a JSON Web Token (JWT).
- [ValidationParameters.ResolveIssuerSigningKeysDelegate(string) Delegate](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ValidationParameters.ResolveIssuerSigningKeysDelegate(string).md): Resolves signing keys (JWKs) asynchronously for a specified issuer.
- [ValidationParameters.ResolveTokenDecryptionKeysDelegate(string) Delegate](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ValidationParameters.ResolveTokenDecryptionKeysDelegate(string).md): Resolves decryption keys (JWKs) asynchronously for a specified issuer.
- [ValidationParameters.ValidateAudienceDelegate(IEnumerable<string>) Delegate](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ValidationParameters.ValidateAudienceDelegate(System.Collections.Generic.IEnumerable_string_).md): Validates a collection of audiences against expected values.
- [ValidationParameters.ValidateIssuersDelegate(string) Delegate](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ValidationParameters.ValidateIssuersDelegate(string).md): Validates a token issuer against expected values.
- [ValidAuthorizationRequest Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Authorization.Interfaces.ValidAuthorizationRequest.md): Output of IAuthorizationRequestValidator handed to IAuthorizationRequestProcessor. Snapshot of the data resolved during validation: the wire-level request, the authenticated client, the negotiated response mode (per OAuth 2.0 Multiple Response Typ...
- [ValidBackChannelAuthenticationRequest Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.BackChannelAuthentication.Interfaces.ValidBackChannelAuthenticationRequest.md): Represents a validated backchannel authentication request, encapsulating the original request model and the associated client information.
- [ValidClientRegistrationRequest Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidClientRegistrationRequest.md): A registration request whose metadata has passed all validators, paired with the resolved `sector_identifier` derived either from `sector_identifier_uri` or from the registered redirect URIs (used for pairwise PPID computation per OIDC Core §8.1).
- [ValidClientRequest Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidClientRequest.md): A client configuration endpoint request (RFC 7592) that has been authenticated via the registration access token, paired with the resolved ClientInfo from storage.
- [ValidDeviceAuthorizationRequest Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DeviceAuthorization.Interfaces.ValidDeviceAuthorizationRequest.md): A device authorization request (RFC 8628 §3.1) that has passed all validators, paired with the authenticated client and the scope/resource sets resolved against the provider's catalog.
- [ValidEndSessionRequest Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.EndSession.Interfaces.ValidEndSessionRequest.md): Represents a valid end-session request with the associated client information.
- [ValidIntrospectionRequest Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Introspection.Interfaces.ValidIntrospectionRequest.md): Output of IIntrospectionRequestValidator handed to the processor: pairs the original request with either the parsed token (active branch) or a `null` token (inactive branch produced via InvalidToken(IntrospectionRequest, ClientInfo) 'Abblix.Oidc.S...
- [ValidJsonWebToken Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.Tokens.Validation.ValidJsonWebToken.md): Represents a successfully validated client JWT with associated client information.
- [ValidRevocationRequest Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Revocation.Interfaces.ValidRevocationRequest.md): Represents a valid revocation request, including the request model and the associated token, if available.
- [ValidTokenRequest Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.ValidTokenRequest.md): Represents a valid token request along with related authentication and authorization information.
- [ValidUpdateClientRequest Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.DynamicClientManagement.Interfaces.ValidUpdateClientRequest.md): Represents a validated request to update a client's configuration per RFC 7592. Contains the original request, validated client info, and registration request.
- [ValidUserCode Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.DeviceAuthorization.ValidUserCode.md): Indicates that the user code was successfully verified and the request is pending authorization.
- [ValidUserInfoRequest Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.UserInfo.Interfaces.ValidUserInfoRequest.md): Represents a valid user info request with associated authentication and authorization details.
- [We Built Our Own OIDC Library. Why?](https://www.abblix.com/en/docs/we-built-our-own-identity-server.md): The story behind Abblix OIDC Server: why we decided to build a certified .NET OAuth 2.0/OIDC library from scratch.
- [WwwAuthenticateBuilder Class](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.WwwAuthenticateBuilder.md): Builds `WWW-Authenticate` challenge values for the Bearer scheme (RFC 6750 §3) and the DPoP scheme (RFC 9449 §7.1). Endpoint-agnostic and framework-agnostic so the same emission logic serves UserInfo, introspection, revocation, and any future prot...

## Company

- [About Abblix](https://www.abblix.com/en/about): who we are, what we build, how we work.
- [Contact](https://www.abblix.com/en/contact): questions about licensing, integration, security reviews.
- [Privacy Policy](https://www.abblix.com/en/privacy) · [Terms of Service](https://www.abblix.com/en/terms)

## Optional

- [Certification registry](https://openid.net/certification/#OPENID-OP-P): third-party proof
  of the certification claims made on this site.