Class Client
- Namespace
- Fdyay.IdentityServer.Models
- Assembly
- Fdyay.IdentityServer.Core.dll
A relying party / OAuth client registration.
public class Client : IConnectedApplication- Inheritance
-
Client
- Implements
- Inherited Members
Properties
AbsoluteRefreshTokenLifetime
Absolute refresh token lifetime in seconds. Defaults to 2592000 (30 days).
public int AbsoluteRefreshTokenLifetime { get; set; }Property Value
Remarks
Under RefreshTokenExpiration Sliding, the most a token can slide to; zero there is no cap, so a
sliding token expires only when it goes unused for SlidingRefreshTokenLifetime — Duende's meaning,
and since 0.174.0 this server's (before it, zero issued a sliding token already expired).
AccessTokenLifetime
Lifetime of the access token in seconds. Defaults to 3600.
public int AccessTokenLifetime { get; set; }Property Value
AccessTokenType
Access token type. Defaults to a self-contained JWT.
public IdentityServerConstants.AccessTokenType AccessTokenType { get; set; }Property Value
AllowOfflineAccess
Whether offline access (refresh tokens) is allowed. Defaults to false.
public bool AllowOfflineAccess { get; set; }Property Value
AllowPlainTextPkce
Whether plain-text PKCE is allowed. Defaults to false (S256 only).
public bool AllowPlainTextPkce { get; set; }Property Value
AllowRememberConsent
If set, the user can choose to store a consent decision. Defaults to true.
public bool AllowRememberConsent { get; set; }Property Value
AllowedCorsOrigins
Allowed CORS origins for JavaScript clients.
public ICollection<string> AllowedCorsOrigins { get; set; }Property Value
AllowedGrantTypes
Grant types allowed for this client.
public ICollection<string> AllowedGrantTypes { get; set; }Property Value
AllowedIdentityTokenSigningAlgorithms
The algorithms this client's identity tokens may be signed with. Empty allows the server's default.
public ICollection<string> AllowedIdentityTokenSigningAlgorithms { get; set; }Property Value
Remarks
The identity token's counterpart of AllowedAccessTokenSigningAlgorithms: the client is
the identity token's only audience, so it is the client that says what it can verify. The hash claims in the
token — at_hash, urt_hash — are sized for the algorithm it is signed with.
AllowedScopes
Scopes the client is allowed to request.
public ICollection<string> AllowedScopes { get; set; }Property Value
AlwaysIncludeUserClaimsInIdToken
Whether access tokens include all identity/claims (JWT) or minimal claims.
public bool AlwaysIncludeUserClaimsInIdToken { get; set; }Property Value
AlwaysSendClientClaims
Whether Claims are also sent on tokens issued on behalf of a user, not just on machine
tokens. Defaults to false.
public bool AlwaysSendClientClaims { get; set; }Property Value
Remarks
Client claims describe the application. On a client_credentials token the application is the only
subject there is, so they are always sent. On a user-delegated token they sit beside claims about a
person, and a resource server reading one has to be able to tell which it got — hence off unless a host
asks, and ClientClaimsPrefix even then.
AuthorizationCodeLifetime
Lifetime of an authorization code in seconds. Defaults to 300.
public int AuthorizationCodeLifetime { get; set; }Property Value
BackChannelClientNotificationEndpoint
Where a ping or push notification is delivered (CIBA Core §4).
public string? BackChannelClientNotificationEndpoint { get; set; }Property Value
Remarks
Required of a client registered for ping or push, and unused by a polling one. A registration that asks for a callback and gives nowhere to send it is refused at the backchannel endpoint, because accepting the request would promise a notification that cannot be delivered and the client would wait out the expiry for it.
BackChannelLogoutSessionRequired
Whether the back-channel logout requires a session id. Defaults to true.
public bool BackChannelLogoutSessionRequired { get; set; }Property Value
BackChannelLogoutUri
Back-channel logout URI.
public string? BackChannelLogoutUri { get; set; }Property Value
BackChannelTokenDeliveryMode
How this client learns its backchannel request was answered — one of OidcConstants.BackChannelTokenDeliveryModes. Null means poll.
public string? BackChannelTokenDeliveryMode { get; set; }Property Value
Remarks
Null rather than the string "poll" as the default, because poll is what every client registered before this existed already does and a default that reads as a deliberate choice would make those registrations claim one.
A mode this server cannot deliver is refused where the request is made rather than at registration, because there is no client-configuration validator here — the decision recorded in 0.65.0. Discovery advertises exactly the modes that work, so a client has no honest way to arrive at one that does not.
CibaLifetime
How long this client's backchannel authentication requests stay answerable, in seconds. Null uses the server default.
public int? CibaLifetime { get; set; }Property Value
- int?
Remarks
Capped by MaximumLifetime, like the requested_expiry a
client may send per request. How long an unanswered request keeps a person interruptible is the
server's decision, not a registration's.
Claims
Fixed additional claims issued for the client.
public ICollection<ClientClaim> Claims { get; set; }Property Value
ClientClaimsPrefix
Prefix applied to Claims on issued tokens. Defaults to client_.
public string ClientClaimsPrefix { get; set; }Property Value
Remarks
So a client claim can never be mistaken for one asserted about the user. Without it a client configured
with a claim named role produces a token whose role is indistinguishable from the user's,
and an API authorizing on role cannot tell which it is reading.
Set it to the empty string to emit claims unprefixed, which is what this server did before the prefix existed. That restores the collision, so it is a deliberate choice rather than a default.
ClientId
Unique client identifier.
public string ClientId { get; set; }Property Value
ClientName
Client display name (used on the consent screen).
public string? ClientName { get; set; }Property Value
ClientSecrets
Client secrets — credentials to access the token endpoint.
public ICollection<Secret> ClientSecrets { get; set; }Property Value
ClientUri
URI to further information about the client.
public string? ClientUri { get; set; }Property Value
ConsentLifetime
How long a remembered consent lasts, in seconds. Null — the default — means it does not expire.
public int? ConsentLifetime { get; set; }Property Value
- int?
Remarks
Consulted only for a decision that is actually remembered. A client that forbids remembering, or a user who declines it, leaves nothing stored for a lifetime to apply to.
CoordinateLifetimeWithUserSession
Whether this client's tokens live only as long as the user's session here; null defers to CoordinateClientLifetimesWithUserSession.
public bool? CoordinateLifetimeWithUserSession { get; set; }Property Value
- bool?
DPoPClockSkew
How far this client's clock may differ from the server's when its proof's iat is checked.
public TimeSpan? DPoPClockSkew { get; set; }Property Value
Remarks
Null, the default, takes ClientClockSkew. Duende has no server-wide setting and defaults this to five minutes, the server-wide default here; a client whose clock is known to be good narrows it, and the window in which a stolen proof is still accepted narrows with it.
DPoPValidationMode
How this client's DPoP proofs are held to a time. Defaults to Iat.
public DPoPTokenExpirationValidationMode DPoPValidationMode { get; set; }Property Value
Description
A description of the client, for a host's own use. Read by nothing here, as by nothing in Duende.
public string? Description { get; set; }Property Value
DeviceCodeLifetime
How long a device code issued to this client may wait for approval, in seconds.
public int? DeviceCodeLifetime { get; set; }Property Value
- int?
Remarks
Null, the default, takes Lifetime. Duende has no server-wide setting and defaults this to 300; here the server-wide one existed first, so a registration that says nothing keeps it, and one that names a value gets that value, as Duende's does.
EnableLocalLogin
Whether a user may sign in to this client with a local account. Defaults to true.
public bool EnableLocalLogin { get; set; }Property Value
Remarks
False for a client whose users must come through an external provider. The login page then offers no local form and refuses a local sign-in posted anyway, and a session that was signed in locally — for another client, earlier — is sent to sign in again rather than reused, as Duende's authorize interaction does.
Enabled
Specifies whether the client is enabled. Defaults to true.
public bool Enabled { get; set; }Property Value
FrontChannelLogoutSessionRequired
Whether the front-channel logout requires a session id. Defaults to true.
public bool FrontChannelLogoutSessionRequired { get; set; }Property Value
FrontChannelLogoutUri
Front-channel logout URI.
public string? FrontChannelLogoutUri { get; set; }Property Value
IdentityProviderRestrictions
The external identity providers a user of this client may sign in through. Empty allows any.
public ICollection<string> IdentityProviderRestrictions { get; set; }Property Value
Remarks
Scheme names, as the idp claim records them. A restriction on providers, not on local accounts —
EnableLocalLogin is that — so a local session is never held to this list, which is the branch
Duende's authorize interaction takes (measured). Applied on the login page, to the idp: hint at
authorization and on a backchannel request (dropped when outside the list), and to a reused session.
IdentityTokenLifetime
Lifetime of the identity token in seconds. Defaults to 300.
public int IdentityTokenLifetime { get; set; }Property Value
IncludeJwtId
Whether this client's JWT access tokens carry a jti. Defaults to true.
public bool IncludeJwtId { get; set; }Property Value
Remarks
The access token only, as in Duende. RFC 9068 requires a jti on an at+jwt token, so false is for a
client whose resource servers neither need nor want one — a token that must stay small, say — and it gives up
the one value a resource server could use to recognise a replayed token.
InitiateLoginUri
The client's login-initiation URI (OpenID Connect Core §4), for a host's own use. Read by nothing here, as by nothing in Duende.
public string? InitiateLoginUri { get; set; }Property Value
LogoUri
URI to a client logo.
public string? LogoUri { get; set; }Property Value
PairWiseSubjectSalt
A salt for pairwise subject identifiers, for a host's own use. Read by nothing here, as by nothing in Duende.
public string? PairWiseSubjectSalt { get; set; }Property Value
PollingInterval
The minimum seconds this client must wait between polls for a backchannel request. Null uses the server default.
public int? PollingInterval { get; set; }Property Value
- int?
Remarks
Only ever longer than the server default, never shorter: a client may be asked to poll less often than everyone else, and a registration that let one poll faster than the server intended would be a rate limit a client configures for itself.
PostLogoutRedirectUris
Allowed post-logout redirect URIs.
public ICollection<string> PostLogoutRedirectUris { get; set; }Property Value
Properties
Custom properties a host keeps with the registration. Read by nothing here, as by nothing in Duende.
public IDictionary<string, string> Properties { get; set; }Property Value
ProtocolType
The protocol this client speaks. Defaults to OpenID Connect.
public string ProtocolType { get; set; }Property Value
Remarks
A client set to anything else is refused at the OIDC and OAuth endpoints rather than silently served by them. SAML service providers are configured separately and are not Clients, so OpenIdConnect is the only value this server can currently honour — but a client registered for another protocol should fail plainly rather than behave as though it had been registered for this one.
PushedAuthorizationLifetime
How long this client's pushed requests stay redeemable, in seconds. Zero uses the server default.
public int PushedAuthorizationLifetime { get; set; }Property Value
Remarks
Capped by the server default: a client may shorten its window, never lengthen it.
RedirectUris
Allowed redirect URIs to return authorization responses to.
public ICollection<string> RedirectUris { get; set; }Property Value
RefreshTokenExpiration
Refresh token expiration. Defaults to absolute.
public IdentityServerConstants.TokenExpiration RefreshTokenExpiration { get; set; }Property Value
RefreshTokenUsage
Refresh token usage. Defaults to one-time-only (rotation).
public IdentityServerConstants.TokenUsage RefreshTokenUsage { get; set; }Property Value
RequireClientSecret
If set, the client secret is required at the token endpoint. Defaults to true.
public bool RequireClientSecret { get; set; }Property Value
RequireConsent
If set, consent is required. Defaults to false.
public bool RequireConsent { get; set; }Property Value
RequireDPoP
Whether this client must present a DPoP proof to obtain or refresh a token (RFC 9449).
public bool RequireDPoP { get; set; }Property Value
Remarks
Off by default, because turning it on for a client that is not sending proofs stops it working. A public client that can hold a key should have it on: without it, presenting a proof is optional, and an attacker holding a stolen refresh token simply does not present one.
RequirePkce
Whether PKCE is required for authorization-code based flows. Defaults to true.
public bool RequirePkce { get; set; }Property Value
RequirePushedAuthorization
Whether this client must push its authorization requests (RFC 9126).
public bool RequirePushedAuthorization { get; set; }Property Value
Remarks
A pushed request travels client-to-server over a client-authenticated back channel, so its parameters never pass through the browser and cannot be altered there. Requiring it closes the door on a front-channel request being tampered with in transit.
RequireRequestObject
Whether this client must send every request as a signed request object. Defaults to false.
public bool RequireRequestObject { get; set; }Property Value
Remarks
request or a JAR request_uri at the authorization endpoint, request at the pushed
authorization and backchannel endpoints; anything else from this client is invalid_request, as in
Duende. The parameters such a client sends are then all signed by its own key, so none of them can have been
altered on the way, which a registration may want of a client whose requests pass through a browser.
SlidingRefreshTokenLifetime
Sliding refresh token lifetime in seconds. Defaults to 1296000 (15 days).
public int SlidingRefreshTokenLifetime { get; set; }Property Value
UpdateAccessTokenClaimsOnRefresh
Whether a refresh builds the access token afresh — running the profile service again — rather than handing
back the one the refresh token was issued with, renewed. Defaults to false, as in Duende.
public bool UpdateAccessTokenClaimsOnRefresh { get; set; }Property Value
UserCodeType
Which registered IUserCodeGenerator makes this client's user codes.
public string? UserCodeType { get; set; }Property Value
Remarks
Null, the default, takes DefaultUserCodeType. A device with a numeric keypad wants Numeric; one whose user types on a phone keyboard is better served by the default.
UserSsoLifetime
The most seconds that may have passed since the user last authenticated for a session to be reused by this client. Null, the default, sets no limit.
public int? UserSsoLifetime { get; set; }Property Value
- int?
Remarks
A client's standing max_age: past it, the user signs in again rather than being let through on an
older session. Strictly greater, as max_age is, and a session with no auth_time counts as
too old, because the claim is the only evidence of when it happened.