Early Preview

This is currently very much a preview. Please feel free to try things out, but don't be upset if anything is not yet working. Feedback is welcome over on our GitHub Dicussions page.

class Microsoft.​IdentityModel.​Tokens.​TokenValidationParameters

Assembly: Microsoft.IdentityModel.Tokens

Inheritance: object → TokenValidationParameters

Contains a set of parameters that are used by a <see cref="T:Microsoft.IdentityModel.Tokens.SecurityTokenHandler" /> when validating a <see cref="T:Microsoft.IdentityModel.Tokens.SecurityToken" /> .

Fields and Constants

public static readonly string
DefaultAuthenticationType
This is the default value of <see cref="P:System.Security.Claims.ClaimsIdentity.AuthenticationType" /> when creating a <see cref="T:System.Security.Claims.ClaimsIdentity" /> . The value is <c>"AuthenticationTypes.Federation"</c> . To change the value, set <see cref="P:Microsoft.IdentityModel.Tokens.TokenValidationParameters.AuthenticationType" /> to a different value.
public static readonly System.​TimeSpan
DefaultClockSkew
Default for the clock skew.
Remarks 300 seconds (5 minutes).
public const int
DefaultMaximumTokenSizeInBytes
Default for the maximum token size.
Remarks 250 KB (kilobytes).

Properties

ActorValidationParameters
Gets or sets <see cref="T:Microsoft.IdentityModel.Tokens.TokenValidationParameters" /> .
AlgorithmValidator
Gets or sets a delegate used to validate the cryptographic algorithm used.
Remarks If set, this delegate will validate the cryptographic algorithm used and the algorithm will not be checked against <see cref="P:Microsoft.IdentityModel.Tokens.TokenValidationParameters.ValidAlgorithms" /> .
AudienceValidator
Gets or sets a delegate that will be used to validate the audience.
Remarks If set, this delegate will be called to validate the 'audience', instead of default processing. This means that no default 'audience' validation will occur. Even if <see cref="P:Microsoft.IdentityModel.Tokens.TokenValidationParameters.ValidateAudience" /> is false, this delegate will still be called.
public string
AuthenticationType
Gets or sets the AuthenticationType when creating a <see cref="T:System.Security.Claims.ClaimsIdentity" /> .
ClockSkew
Gets or sets the clock skew to apply when validating a time.
ConfigurationManager
If set, this property will be used to obtain the issuer and signing keys associated with the metadata endpoint of <see cref="P:Microsoft.IdentityModel.Tokens.BaseConfiguration.Issuer" /> . The obtained issuer and signing keys will then be used along with those present on the TokenValidationParameters for validation of the incoming token.
CryptoProviderFactory
Users can override the default <see cref="P:Microsoft.IdentityModel.Tokens.TokenValidationParameters.CryptoProviderFactory" /> with this property. This factory will be used for creating signature providers.
public string
DebugId
Gets or sets a string that helps with setting breakpoints when debugging.
public bool
IgnoreTrailingSlashWhenValidatingAudience
Gets or sets a boolean that controls if a '/' is significant at the end of the audience. The default is <c>true</c> .
public bool
IncludeTokenOnFailedValidation
Gets or sets the flag that indicates whether to include the <see cref="T:Microsoft.IdentityModel.Tokens.SecurityToken" /> when the validation fails.
IssuerSigningKeyValidator
Gets or sets a delegate for validating the <see cref="T:Microsoft.IdentityModel.Tokens.SecurityKey" /> that signed the token.
Remarks If set, this delegate will be called to validate the <see cref="T:Microsoft.IdentityModel.Tokens.SecurityKey" /> that signed the token, instead of default processing. This means that no default <see cref="T:Microsoft.IdentityModel.Tokens.SecurityKey" /> validation will occur. Even if <see cref="P:Microsoft.IdentityModel.Tokens.TokenValidationParameters.ValidateIssuerSigningKey" /> is false, this delegate will still be called. If both <see cref="P:Microsoft.IdentityModel.Tokens.TokenValidationParameters.IssuerSigningKeyValidatorUsingConfiguration" /> and <see cref="P:Microsoft.IdentityModel.Tokens.TokenValidationParameters.IssuerSigningKeyValidator" /> are set, IssuerSigningKeyResolverUsingConfiguration takes priority.
IssuerSigningKeyValidatorUsingConfiguration
Gets or sets a delegate for validating the <see cref="T:Microsoft.IdentityModel.Tokens.SecurityKey" /> that signed the token.
Remarks If set, this delegate will be called to validate the <see cref="T:Microsoft.IdentityModel.Tokens.SecurityKey" /> that signed the token, instead of default processing. This means that no default <see cref="T:Microsoft.IdentityModel.Tokens.SecurityKey" /> validation will occur. Even if <see cref="P:Microsoft.IdentityModel.Tokens.TokenValidationParameters.ValidateIssuerSigningKey" /> is false, this delegate will still be called. This delegate should be used if properties from the configuration retrieved from the authority are necessary to validate the issuer signing key. If both <see cref="P:Microsoft.IdentityModel.Tokens.TokenValidationParameters.IssuerSigningKeyValidatorUsingConfiguration" /> and <see cref="P:Microsoft.IdentityModel.Tokens.TokenValidationParameters.IssuerSigningKeyValidator" /> are set, IssuerSigningKeyValidatorUsingConfiguration takes priority.
InstancePropertyBag
Gets a <see cref="T:System.Collections.Generic.IDictionary`2" /> that is unique to this instance. Calling <see cref="M:Microsoft.IdentityModel.Tokens.TokenValidationParameters.Clone" /> will result in a new instance of this IDictionary.
public bool
IsClone
Gets a value indicating if <see cref="M:Microsoft.IdentityModel.Tokens.TokenValidationParameters.Clone" /> was called to obtain this instance.
public SecurityKey
IssuerSigningKey
Gets or sets the <see cref="T:Microsoft.IdentityModel.Tokens.SecurityKey" /> that is to be used for signature validation.
IssuerSigningKeyResolver
Gets or sets a delegate that will be called to retrieve a <see cref="T:Microsoft.IdentityModel.Tokens.SecurityKey" /> used for signature validation.
Remarks This <see cref="T:Microsoft.IdentityModel.Tokens.SecurityKey" /> will be used to check the signature. This can be helpful when the <see cref="T:Microsoft.IdentityModel.Tokens.SecurityToken" /> does not contain a key identifier. If both <see cref="P:Microsoft.IdentityModel.Tokens.TokenValidationParameters.IssuerSigningKeyResolverUsingConfiguration" /> and <see cref="P:Microsoft.IdentityModel.Tokens.TokenValidationParameters.IssuerSigningKeyResolver" /> are set, IssuerSigningKeyResolverUsingConfiguration takes priority.
IssuerSigningKeyResolverUsingConfiguration
Gets or sets a delegate that will be called to retrieve a <see cref="T:Microsoft.IdentityModel.Tokens.SecurityKey" /> used for signature validation using the <see cref="T:Microsoft.IdentityModel.Tokens.TokenValidationParameters" /> and <see cref="T:Microsoft.IdentityModel.Tokens.BaseConfiguration" /> .
Remarks This <see cref="T:Microsoft.IdentityModel.Tokens.SecurityKey" /> will be used to check the signature. This can be helpful when the <see cref="T:Microsoft.IdentityModel.Tokens.SecurityToken" /> does not contain a key identifier. This delegate should be used if properties from the configuration retrieved from the authority are necessary to resolve the issuer signing key. If both <see cref="P:Microsoft.IdentityModel.Tokens.TokenValidationParameters.IssuerSigningKeyResolverUsingConfiguration" /> and <see cref="P:Microsoft.IdentityModel.Tokens.TokenValidationParameters.IssuerSigningKeyResolver" /> are set, IssuerSigningKeyResolverUsingConfiguration takes priority.
IssuerSigningKeys
Gets or sets an <see cref="T:System.Collections.Generic.IEnumerable`1" /> used for signature validation.
IssuerValidator
Gets or sets a delegate that will be used to validate the issuer of the token.
Remarks If set, this delegate will be called to validate the 'issuer' of the token, instead of default processing. This means that no default 'issuer' validation will occur. Even if <see cref="P:Microsoft.IdentityModel.Tokens.TokenValidationParameters.ValidateIssuer" /> is false, this delegate will still be called. If both <see cref="P:Microsoft.IdentityModel.Tokens.TokenValidationParameters.IssuerValidatorUsingConfiguration" /> and <see cref="P:Microsoft.IdentityModel.Tokens.TokenValidationParameters.IssuerValidator" /> are set, IssuerValidatorUsingConfiguration takes priority.
IssuerValidatorUsingConfiguration
Gets or sets a delegate that will be used to validate the issuer of the token.
Remarks If set, this delegate will be called to validate the 'issuer' of the token, instead of default processing. This means that no default 'issuer' validation will occur. Even if <see cref="P:Microsoft.IdentityModel.Tokens.TokenValidationParameters.ValidateIssuer" /> is false, this delegate will still be called. This delegate should be used if properties from the configuration retrieved from the authority are necessary to validate the issuer. If both <see cref="P:Microsoft.IdentityModel.Tokens.TokenValidationParameters.IssuerValidatorUsingConfiguration" /> and <see cref="P:Microsoft.IdentityModel.Tokens.TokenValidationParameters.IssuerValidator" /> are set, IssuerValidatorUsingConfiguration takes priority.
TransformBeforeSignatureValidation
Gets or sets a delegate that will be called to transform a token to a supported format before validation.
LifetimeValidator
Gets or sets a delegate that will be used to validate the lifetime of the token
Remarks If set, this delegate will be called to validate the lifetime of the token, instead of default processing. This means that no default lifetime validation will occur. Even if <see cref="P:Microsoft.IdentityModel.Tokens.TokenValidationParameters.ValidateLifetime" /> is false, this delegate will still be called.
public bool
LogTokenId
Gets or sets a <see cref="T:System.Boolean" /> that will decide if the token identifier claim needs to be logged. Default value is <c>true</c> .
public bool
LogValidationExceptions
Gets or sets a <see cref="T:System.Boolean" /> that will decide if validation failure needs to be logged as an error. Default value is <c>true</c> for backward compatibility of the behavior. If set to false, validation failures are logged as Information and then thrown.
public string
NameClaimType
Gets or sets a <see cref="T:System.String" /> that defines the <see cref="P:System.Security.Claims.ClaimsIdentity.NameClaimType" /> .
Remarks Controls the value <see cref="P:System.Security.Claims.ClaimsIdentity.Name" /> returns. It will return the first <see cref="P:System.Security.Claims.Claim.Value" /> where the <see cref="P:System.Security.Claims.Claim.Type" /> equals <see cref="P:Microsoft.IdentityModel.Tokens.TokenValidationParameters.NameClaimType" /> . The default is <see cref="F:System.Security.Claims.ClaimsIdentity.DefaultNameClaimType" /> .
public System.​Func<​SecurityToken, string, string>
NameClaimTypeRetriever
Gets or sets a delegate that will be called to set the property <see cref="P:System.Security.Claims.ClaimsIdentity.NameClaimType" /> after validating a token.
Remarks The function will be passed: <para>The <see cref="T:Microsoft.IdentityModel.Tokens.SecurityToken" /> that is being validated.</para> <para>The issuer associated with the token.</para> <para>Returns the value that will set the property <see cref="P:System.Security.Claims.ClaimsIdentity.NameClaimType" />.</para>
PropertyBag
Gets or sets the <see cref="T:System.Collections.Generic.IDictionary`2" /> that contains a collection of custom key/value pairs. This allows addition of parameters that could be used in custom token validation scenarios.
public bool
RefreshBeforeValidation
Gets or sets a boolean to control if configuration required to be refreshed before token validation.
Remarks The default is <c>false</c> .
public bool
RequireAudience
Gets or sets a value indicating whether SAML tokens must have at least one AudienceRestriction. The default is <c>true</c> .
public bool
RequireExpirationTime
Gets or sets a value indicating whether tokens must have an 'expiration' value. The default is <c>true</c> .
public bool
RequireSignedTokens
Gets or sets a value indicating whether a <see cref="T:Microsoft.IdentityModel.Tokens.SecurityToken" /> can be considered valid if not signed. The default is <c>true</c> .
public string
RoleClaimType
Gets or sets the <see cref="T:System.String" /> that defines the <see cref="P:System.Security.Claims.ClaimsIdentity.RoleClaimType" /> .
Remarks <para>Controls the results of <see cref="M:System.Security.Claims.ClaimsPrincipal.IsInRole(System.String)" />.</para> <para>Each <see cref="T:System.Security.Claims.Claim" /> where <see cref="P:System.Security.Claims.Claim.Type" /> == <see cref="P:Microsoft.IdentityModel.Tokens.TokenValidationParameters.RoleClaimType" /> will be checked for a match against the 'string' passed to <see cref="M:System.Security.Claims.ClaimsPrincipal.IsInRole(System.String)" />.</para> The default is <see cref="F:System.Security.Claims.ClaimsIdentity.DefaultRoleClaimType" /> .
public System.​Func<​SecurityToken, string, string>
RoleClaimTypeRetriever
Gets or sets a delegate that will be called to set the property <see cref="P:System.Security.Claims.ClaimsIdentity.RoleClaimType" /> after validating a token.
Remarks The function will be passed: <para>The <see cref="T:Microsoft.IdentityModel.Tokens.SecurityToken" /> that is being validated.</para> <para>The issuer associated with the token.</para> <para>Returns the value that will set the property <see cref="P:System.Security.Claims.ClaimsIdentity.RoleClaimType" />.</para>
public bool
SaveSigninToken
Gets or sets a boolean to control if the original token should be saved after the security token is validated.
Remarks The runtime will consult this value and save the original token that was validated. The default is <c>false</c> .
SignatureValidator
Gets or sets a delegate that will be used to validate the signature of the token.
Remarks If set, this delegate will be called to validate the signature of the token, instead of default processing.
SignatureValidatorUsingConfiguration
Gets or sets a delegate that will be used to validate the signature of the token using the <see cref="T:Microsoft.IdentityModel.Tokens.TokenValidationParameters" /> and the <see cref="T:Microsoft.IdentityModel.Tokens.BaseConfiguration" /> .
Remarks If set, this delegate will be called to validate the signature of the token, instead of default processing.
public SecurityKey
TokenDecryptionKey
Gets or sets the <see cref="T:Microsoft.IdentityModel.Tokens.SecurityKey" /> that is to be used for decryption.
TokenDecryptionKeyResolver
Gets or sets a delegate that will be called to retreive a <see cref="T:Microsoft.IdentityModel.Tokens.SecurityKey" /> used for decryption.
Remarks This <see cref="T:Microsoft.IdentityModel.Tokens.SecurityKey" /> will be used to decrypt the token. This can be helpful when the <see cref="T:Microsoft.IdentityModel.Tokens.SecurityToken" /> does not contain a key identifier.
TokenDecryptionKeys
Gets or sets the <see cref="T:System.Collections.Generic.IEnumerable`1" /> that is to be used for decrypting inbound tokens.
public TokenReader
TokenReader
Gets or sets a delegate that will be used to read the token.
Remarks If set, this delegate will be called to read the token instead of default processing.
TokenReplayCache
Gets or set the <see cref="T:Microsoft.IdentityModel.Tokens.ITokenReplayCache" /> that store tokens that can be checked to help detect token replay.
Remarks If set, then tokens must have an expiration time or the runtime will fault.
TokenReplayValidator
Gets or sets a delegate that will be used to validate the token replay of the token
Remarks If set, this delegate will be called to validate the token replay of the token, instead of default processing. This means no default token replay validation will occur. Even if <see cref="P:Microsoft.IdentityModel.Tokens.TokenValidationParameters.ValidateTokenReplay" /> is false, this delegate will still be called.
public bool
TryAllIssuerSigningKeys
Gets or sets a value indicating whether all <see cref="P:Microsoft.IdentityModel.Tokens.TokenValidationParameters.IssuerSigningKeys" /> should be tried during signature validation when a key is not matched to token kid or if token kid is empty. The default is <c>true</c> .
public TypeValidator
TypeValidator
Gets or sets a delegate that will be used to validate the type of the token. If the token type cannot be validated, an exception MUST be thrown by the delegate. Note: the 'type' parameter may be null if it couldn't be extracted from its usual location. Implementations that need to resolve it from a different location can use the 'token' parameter.
Remarks If set, this delegate will be called to validate the 'type' of the token, instead of default processing. This means that no default 'type' validation will occur.
public bool
ValidateActor
Gets or sets a value indicating if an actor token is detected, whether it should be validated. The default is <c>false</c> .
public bool
ValidateAudience
Gets or sets a boolean to control if the audience will be validated during token validation.
Remarks Validation of the audience, mitigates forwarding attacks. For example, a site that receives a token, could not replay it to another site. A forwarded token would contain the audience of the original site. This boolean only applies to default audience validation. If <see cref="P:Microsoft.IdentityModel.Tokens.TokenValidationParameters.AudienceValidator" /> is set, it will be called regardless of whether this property is true or false. The default is <c>true</c> .
public bool
ValidateIssuer
Gets or sets a boolean to control if the issuer will be validated during token validation.
Remarks Validation of the issuer mitigates forwarding attacks that can occur when an IdentityProvider represents multiple tenants and signs tokens with the same keys. It is possible that a token issued for the same audience could be from a different tenant. For example an application could accept users from contoso.onmicrosoft.com but not fabrikam.onmicrosoft.com, both valid tenants. An application that accepts tokens from fabrikam could forward them to the application that accepts tokens for contoso. This boolean only applies to default issuer validation. If <see cref="P:Microsoft.IdentityModel.Tokens.TokenValidationParameters.IssuerValidator" /> is set, it will be called regardless of whether this property is true or false. The default is <c>true</c> .
public bool
ValidateWithLKG
Gets or sets a boolean to control if the LKG configuration will be used for token validation.
Remarks The default is <c>false</c> .
public bool
ValidateIssuerSigningKey
Gets or sets a boolean that controls if validation of the <see cref="T:Microsoft.IdentityModel.Tokens.SecurityKey" /> that signed the securityToken is called.
Remarks It is possible for tokens to contain the public key needed to check the signature. For example, X509Data can be hydrated into an X509Certificate, which can be used to validate the signature. In these cases it is important to validate the SigningKey that was used to validate the signature. This boolean only applies to default signing key validation. If <see cref="P:Microsoft.IdentityModel.Tokens.TokenValidationParameters.IssuerSigningKeyValidator" /> is set, it will be called regardless of whether this property is true or false. The default is <c>false</c> .
public bool
ValidateLifetime
Gets or sets a boolean to control if the lifetime will be validated during token validation.
Remarks This boolean only applies to default lifetime validation. If <see cref="P:Microsoft.IdentityModel.Tokens.TokenValidationParameters.LifetimeValidator" /> is set, it will be called regardless of whether this property is true or false. The default is <c>true</c> .
public bool
ValidateSignatureLast
Gets or sets a boolean that controls the validation order of the payload and signature during token validation.
Remarks If <see cref="P:Microsoft.IdentityModel.Tokens.TokenValidationParameters.ValidateSignatureLast" /> is set to true, it will validate payload ahead of signature. The default is <c>false</c> .
public bool
ValidateTokenReplay
Gets or sets a boolean to control if the token replay will be validated during token validation.
Remarks This boolean only applies to default token replay validation. If <see cref="P:Microsoft.IdentityModel.Tokens.TokenValidationParameters.TokenReplayValidator" /> is set, it will be called regardless of whether this property is true or false. The default is <c>false</c> .
ValidAlgorithms
Gets or sets the valid algorithms for cryptographic operations.
Remarks If set to a non-empty collection, only the algorithms listed will be considered valid. The default is <c>null</c> .
public string
ValidAudience
Gets or sets a string that represents a valid audience that will be used to check against the token's audience. The default is <c>null</c> .
ValidAudiences
Gets or sets the <see cref="T:System.Collections.Generic.IEnumerable`1" /> that contains valid audiences that will be used to check against the token's audience. The default is <c>null</c> .
public string
ValidIssuer
Gets or sets a <see cref="T:System.String" /> that represents a valid issuer that will be used to check against the token's issuer. The default is <c>null</c> .
ValidIssuers
Gets or sets the <see cref="T:System.Collections.Generic.IEnumerable`1" /> that contains valid issuers that will be used to check against the token's issuer. The default is <c>null</c> .
ValidTypes
Gets or sets the <see cref="T:System.Collections.Generic.IEnumerable`1" /> that contains valid types that will be used to check against the JWT header's 'typ' claim. If this property is not set, the 'typ' header claim will not be validated and all types will be accepted. In the case of a JWE, this property will ONLY apply to the inner token header. The default is <c>null</c> .

Methods

Clone​()
Returns a new instance of <see cref="T:Microsoft.IdentityModel.Tokens.TokenValidationParameters" /> with values copied from this object.
Returns A new <see cref="T:Microsoft.IdentityModel.Tokens.TokenValidationParameters" /> object copied from this object
Remarks This is a shallow Clone.
CreateClaimsIdentity​(SecurityToken securityToken, string issuer)
Creates a <see cref="T:System.Security.Claims.ClaimsIdentity" /> using: <para> <see cref="P:Microsoft.IdentityModel.Tokens.TokenValidationParameters.AuthenticationType" /> </para> <para>'NameClaimType': If NameClaimTypeRetriever is set, call delegate, else call NameClaimType. If the result is a null or empty string, use <see cref="F:System.Security.Claims.ClaimsIdentity.DefaultNameClaimType" /></para> . <para>'RoleClaimType': If RoleClaimTypeRetriever is set, call delegate, else call RoleClaimType. If the result is a null or empty string, use <see cref="F:System.Security.Claims.ClaimsIdentity.DefaultRoleClaimType" /></para> .
Returns A <see cref="T:System.Security.Claims.ClaimsIdentity" /> with Authentication, NameClaimType and RoleClaimType set.
public bool
Equals​(object obj)
Inherited from object
protected void
Finalize​()
Inherited from object
public int
GetHashCode​()
Inherited from object
GetType​()
Inherited from object
protected object
MemberwiseClone​()
Inherited from object
public string
ToString​()
Inherited from object