Class OidcAuthenticationOptions

Namespace

Arc4u.OAuth2.Options

Assembly

Arc4u.OAuth2.AspNetCore.Authentication.dll

The options of the OpenID Connect authentication. They are given to AddOidcAuthentication or filled from the configuration by the configuration based overload. They are registered as IOptions<OidcAuthenticationOptions> and read by the cookie and OpenID Connect events.

public class OidcAuthenticationOptions

Inheritance

object

OidcAuthenticationOptions

Derived

HybridAuthenticationOptions

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.MemberwiseClone()

object.ReferenceEquals(object, object)

object.ToString()

Properties

ApplicationName

Gets or sets the application name used to isolate the data protection keys of the application.

public string ApplicationName { get; set; }

Property Value

string

AuthenticationCacheTicketStoreOption

Gets or sets the action that fills the CacheTicketStoreOptions. When set, the authentication tickets are stored in a cache instead of the cookie. Optional.

public Action<CacheTicketStoreOptions> AuthenticationCacheTicketStoreOption { get; set; }

Property Value

Action<CacheTicketStoreOptions>

AuthenticationMethod

Gets or sets how the request is sent to the authority. The default is RedirectGet.

public OpenIdConnectRedirectBehavior AuthenticationMethod { get; set; }

Property Value

OpenIdConnectRedirectBehavior

AuthenticationTicketTtl

Gets or sets the time to live of the authentication ticket. The cookie expires after the shorter of this value and RefreshTokenLifetime. The default is 7 days.

public TimeSpan AuthenticationTicketTtl { get; set; }

Property Value

TimeSpan

CallbackPath

Gets or sets the path the identity provider redirects to after the sign-in. The default is /signin-oidc.

public string CallbackPath { get; set; }

Property Value

string

CertSecurityKey

Gets or sets an optional certificate used as issuer signing key to validate tokens.

public X509Certificate2? CertSecurityKey { get; set; }

Property Value

X509Certificate2

ClaimsIdentifierOptions

Gets or sets the action that fills the claim types identifying a user.

public Action<ClaimsIdentifierOption> ClaimsIdentifierOptions { get; set; }

Property Value

Action<ClaimsIdentifierOption>

CookieName

Gets or sets the name of the authentication cookie. Use a name specific to the application.

public string CookieName { get; set; }

Property Value

string

DataProtectionCacheStoreOption

Gets or sets the action that fills the CacheStoreOption describing the cache in which the data protection keys are persisted. Required.

public Action<CacheStoreOption> DataProtectionCacheStoreOption { get; set; }

Property Value

Action<CacheStoreOption>

DataProtectionCertificate

Gets or sets the certificate that protects the data protection keys. Required.

public X509Certificate2 DataProtectionCertificate { get; set; }

Property Value

X509Certificate2

DefaultAuthority

Gets or sets the default authority (identity provider). Required.

public AuthorityOptions DefaultAuthority { get; set; }

Property Value

AuthorityOptions

DefaultKeyLifetime

Gets or sets the lifetime of the data protection keys. The default is 365 days.

public TimeSpan DefaultKeyLifetime { get; set; }

Property Value

TimeSpan

ForceRefreshTimeoutTimeSpan

Gets or sets the remaining lifetime under which the access token is refreshed. The default is 5 minutes.

public TimeSpan ForceRefreshTimeoutTimeSpan { get; set; }

Property Value

TimeSpan

NameClaimType

Gets or sets the claim type holding the name of the user. The default is name.

public string NameClaimType { get; set; }

Property Value

string

OpenIdSettingsOptions

Gets or sets the action that fills the OpenIdSettingsOption (client id, secret, scopes, ...). Required.

public Action<OpenIdSettingsOption> OpenIdSettingsOptions { get; set; }

Property Value

Action<OpenIdSettingsOption>

RefreshTokenLifetime

Gets or sets the assumed lifetime of a refresh token, which is also the maximum lifetime of the authentication cookie. The default is 90 days.

public TimeSpan RefreshTokenLifetime { get; set; }

Property Value

TimeSpan

ResponseType

Gets or sets the OpenID Connect response type. The default is Code. For AzureAD, AzureB2C and Adfs use Code; for other identity providers CodeIdTokenToken may be needed.

public string ResponseType { get; set; }

Property Value

string

RoleClaimType

Gets or sets the claim type holding the roles of the user. The default is role.

public string RoleClaimType { get; set; }

Property Value

string

ValidateAudience

Gets or sets a value indicating whether the audience of the access token received from the token endpoint must be one of the audiences of the OpenID settings. The default is true. Identity providers like Keycloak do not issue an audience by default: disable it or configure the audience in the identity provider. With the configuration based registrations, it is read from ValidateAudience. When ValidateAudience is false, no audience is registered in the OpenID settings and the audience is not validated, whatever this value.

public bool ValidateAudience { get; set; }

Property Value

bool

ValidateAuthority

Gets or sets a value indicating whether the issuer of the access token received from the token endpoint is validated. The default is true. The issuer must be Issuer of the DefaultAuthority when it is set, or the issuer of its metadata otherwise. With AddHybridAuthentication, the same rule applies to the bearer tokens. With the configuration based registrations, it is read from ValidateAuthority.

public bool ValidateAuthority { get; set; }

Property Value

bool