Class MutualTlsOptions

Namespace

Fdyay.IdentityServer.Configuration

Assembly

Fdyay.IdentityServer.Core.dll

Mutual-TLS client authentication and certificate-bound access tokens (RFC 8705).

public class MutualTlsOptions

Inheritance

object

MutualTlsOptions

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.MemberwiseClone()

object.ReferenceEquals(object, object)

object.ToString()

Properties

AlwaysEmitConfirmationClaim

Whether a token gets a cnf claim whenever the connection carried a client certificate, even if the client authenticated some other way. Defaults to false.

public bool AlwaysEmitConfirmationClaim { get; set; }

Property Value

bool

Remarks

Off by default because the certificate that authenticated the client is the one the client has committed to using, while a certificate that merely happened to be on the connection is not: binding a token to it makes every later call fail unless the client presents that same certificate again.

ClientCertificateAuthenticationScheme

The authentication scheme that must accept the client certificate before an mTLS alias is served. Defaults to Certificate, the name ASP.NET Core's certificate handler registers under, as Duende's does.

public string ClientCertificateAuthenticationScheme { get; set; }

Property Value

string

Remarks

Duende 8.0.1's, measured: a request to a connect/mtls/ alias is authenticated with this scheme first, and one it does not accept is refused with invalid_client before any endpoint runs. The handler — typically AddAuthentication().AddCertificate() — is where the chain, revocation and allowed issuers are checked; the client's registered thumbprint or name is still compared afterwards, as before.

Enabled

Whether the protocol endpoints are also served under connect/mtls/. Defaults to false.

public bool Enabled { get; set; }

Property Value

bool

Remarks

The aliases exist so that client certificates can be required on those paths without requiring them everywhere: a TLS listener asks for a certificate per host or per path, and asking for one at the authorize endpoint would prompt every browser user for a certificate they do not have. Turning this on only publishes the paths — the host still has to configure its listener to request a certificate there.

The aliases are path-based only. A subdomain form exists in the wider ecosystem and is deliberately not offered here: nothing in these options names a domain, so no configuration promises one.