Class EndpointsOptions
- Namespace
- Fdyay.IdentityServer.Configuration
- Assembly
- Fdyay.IdentityServer.Core.dll
Controls which protocol endpoints are enabled.
public class EndpointsOptions- Inheritance
-
EndpointsOptions
- Inherited Members
- Extension Methods
Remarks
A disabled endpoint stops serving — the request falls through the identity server middleware — and drops out of the discovery document. Both halves apply: an endpoint that is withdrawn from discovery but still answers is unadvertised rather than off, and so is absent from any surface inventory built from the document.
Properties
EnableAuthorizeEndpoint
Serves the authorize endpoint at connect/authorize and advertises it as authorization_endpoint.
Defaults to true.
public bool EnableAuthorizeEndpoint { get; set; }Property Value
Remarks
While it is on, startup requires an authentication scheme to sign users in with — see UseIdentityServer();
a server that issues only machine tokens can turn it off instead.
EnableBackchannelAuthenticationEndpoint
Serves the backchannel authentication endpoint of OpenID Connect CIBA Core 1.0. Defaults to
false — the only endpoint here that does.
public bool EnableBackchannelAuthenticationEndpoint { get; set; }Property Value
Remarks
Every other endpoint can answer a request with what this library alone knows. This one cannot: a backchannel request names a user who is not present, so serving it needs a host-supplied way to resolve that name (IBackchannelAuthenticationUserValidator) and a host-supplied way to reach the person behind it (IBackchannelAuthenticationUserNotificationService). On by default would mean a discovery document advertising an endpoint that answers every request with a 500, for every host that upgraded without asking for CIBA.
Turning it on without registering both is refused at startup rather than discovered on the first
request — see UseIdentityServer().
EnableCheckSessionEndpoint
Serves the check-session iframe of OpenID Connect Session Management 1.0, and governs whether the
document advertises check_session_iframe.
public bool EnableCheckSessionEndpoint { get; set; }Property Value
EnableDeviceAuthorizationEndpoint
Serves the device authorization endpoint (RFC 8628) at connect/deviceauthorization and advertises it as
device_authorization_endpoint. Defaults to true.
public bool EnableDeviceAuthorizationEndpoint { get; set; }Property Value
EnableDiscoveryEndpoint
Serves the discovery document. Also governs the JWKS endpoint, which has no separate flag.
public bool EnableDiscoveryEndpoint { get; set; }Property Value
EnableEndSessionEndpoint
Serves the end-session (RP-initiated signout) endpoint at connect/endsession and advertises it as
end_session_endpoint. Defaults to true.
public bool EnableEndSessionEndpoint { get; set; }Property Value
EnableIntrospectionEndpoint
Serves the token introspection endpoint (RFC 7662) at connect/introspect and advertises it as
introspection_endpoint. Defaults to true.
public bool EnableIntrospectionEndpoint { get; set; }Property Value
EnableJwtRequestUri
Whether this server will fetch a JAR (RFC 9101) request object from a request_uri the client
hosts. Defaults to false.
public bool EnableJwtRequestUri { get; set; }Property Value
Remarks
Off by default because it is an outbound request to a location the client chooses: an authorization
request naming an internal address would have this server fetch it. Request objects sent by value
in request need no such fetch and are always accepted.
Unrelated to the request_uri of PAR (RFC 9126), which is an opaque reference this server issued
and is always on. The two are told apart by PAR's registered URN prefix.
EnableOAuth2MetadataEndpoint
Serves the OAuth 2.0 authorization server metadata (RFC 8414) at /.well-known/oauth-authorization-server:
the discovery document, for a client that reads OAuth's well-known path rather than OpenID Connect's.
Defaults to true, as in Duende.
public bool EnableOAuth2MetadataEndpoint { get; set; }Property Value
Remarks
Independent of EnableDiscoveryEndpoint, as Duende's is.
EnablePushedAuthorizationEndpoint
Serves the pushed authorization request endpoint (RFC 9126) at connect/par and advertises it as
pushed_authorization_request_endpoint. Defaults to true.
public bool EnablePushedAuthorizationEndpoint { get; set; }Property Value
Remarks
Turning it off while PushedAuthorization.Required is true is refused at startup, because no
client could then obtain the request_uri every authorization request would need.
EnableSamlLogoutEndpoint
Serves the SAML 2.0 single logout endpoint. Defaults to false, as Duende's does; AddSaml switches it on.
public bool EnableSamlLogoutEndpoint { get; set; }Property Value
EnableSamlMetadataEndpoint
Serves the SAML 2.0 metadata document. Defaults to false, as Duende's does; AddSaml switches it on.
public bool EnableSamlMetadataEndpoint { get; set; }Property Value
EnableSamlSigninCallbackEndpoint
Serves the SAML 2.0 sign-in callback, where the browser comes back from the login page to have its sign-on answered.
Defaults to false, as Duende's does; AddSaml switches it on.
public bool EnableSamlSigninCallbackEndpoint { get; set; }Property Value
EnableSamlSigninEndpoint
Serves the SAML 2.0 single sign-on endpoint, and the IdP-initiated door beneath it. Defaults to false, as
Duende's does; AddSaml switches it on.
public bool EnableSamlSigninEndpoint { get; set; }Property Value
Remarks
The four SAML switches are off here because the endpoints they govern exist only once AddSaml registers them,
and AddSaml turns all four on with a Configure<IdentityServerOptions> of its own — Duende's
arrangement, measured. A host switching one off configures after AddSaml, so its setting is applied last.
EnableTokenEndpoint
Serves the token endpoint at connect/token and advertises it as token_endpoint. Defaults to true.
public bool EnableTokenEndpoint { get; set; }Property Value
EnableTokenRevocationEndpoint
Serves the token revocation endpoint (RFC 7009) at connect/revocation and advertises it as
revocation_endpoint. Defaults to true.
public bool EnableTokenRevocationEndpoint { get; set; }Property Value
EnableUserInfoEndpoint
Serves the UserInfo endpoint at connect/userinfo and advertises it as userinfo_endpoint.
Defaults to true.
public bool EnableUserInfoEndpoint { get; set; }