Microsoft.IdentityModel.Tokens.TokenValidationParameters

public class TokenValidationParameters

Contains a set of parameters that are used by a SecurityTokenHandler when validating a SecurityToken.

public static readonly string DefaultAuthenticationType

This is the default value of AuthenticationType when creating a ClaimsIdentity. The value is "AuthenticationTypes.Federation". To change the value, set AuthenticationType to a different value.

public static readonly TimeSpan DefaultClockSkew

Default for the clock skew.

public const int DefaultMaximumTokenSizeInBytes = 256000

Default for the maximum token size.

public TokenValidationParameters ActorValidationParameters { get; set; }

Gets or sets TokenValidationParameters.

public AlgorithmValidator AlgorithmValidator { get; set; }

Gets or sets a delegate used to validate the cryptographic algorithm used.

public AudienceValidator AudienceValidator { get; set; }

Gets or sets a delegate that will be used to validate the audience.

public string AuthenticationType { get; set; }

Gets or sets the AuthenticationType when creating a ClaimsIdentity.

public TimeSpan ClockSkew { get; set; }

Gets or sets the clock skew to apply when validating a time.

public BaseConfigurationManager ConfigurationManager { get; set; }

If set, this property will be used to obtain the issuer and signing keys associated with the metadata endpoint of Issuer. The obtained issuer and signing keys will then be used along with those present on the TokenValidationParameters for validation of the incoming token.

public CryptoProviderFactory CryptoProviderFactory { get; set; }

Users can override the default CryptoProviderFactory with this property. This factory will be used for creating signature providers.

public string DebugId { get; set; }

Gets or sets a string that helps with setting breakpoints when debugging.

public bool IgnoreTrailingSlashWhenValidatingAudience { get; set; }

Gets or sets a boolean that controls if a '/' is significant at the end of the audience. The default is true.

public bool IncludeTokenOnFailedValidation { get; set; }

Gets or sets the flag that indicates whether to include the SecurityToken when the validation fails.

public IDictionary<string, object> InstancePropertyBag { get; }

Gets a IDictionary<T, U> that is unique to this instance. Calling Clone will result in a new instance of this IDictionary.

public bool IsClone { get; protected set; }

Gets a value indicating if Clone was called to obtain this instance.

public SecurityKey IssuerSigningKey { get; set; }

Gets or sets the SecurityKey that is to be used for signature validation.

public IssuerSigningKeyResolver IssuerSigningKeyResolver { get; set; }

Gets or sets a delegate that will be called to retrieve a SecurityKey used for signature validation.

public IssuerSigningKeyResolverUsingConfiguration IssuerSigningKeyResolverUsingConfiguration { get; set; }

Gets or sets a delegate that will be called to retrieve a SecurityKey used for signature validation using the TokenValidationParameters and BaseConfiguration.

public IEnumerable<SecurityKey> IssuerSigningKeys { get; set; }

Gets or sets an IEnumerable<T> used for signature validation.

public IssuerSigningKeyValidator IssuerSigningKeyValidator { get; set; }

Gets or sets a delegate for validating the SecurityKey that signed the token.

public IssuerSigningKeyValidatorUsingConfiguration IssuerSigningKeyValidatorUsingConfiguration { get; set; }

Gets or sets a delegate for validating the SecurityKey that signed the token.

public IssuerValidator IssuerValidator { get; set; }

Gets or sets a delegate that will be used to validate the issuer of the token.

public IssuerValidatorUsingConfiguration IssuerValidatorUsingConfiguration { get; set; }

Gets or sets a delegate that will be used to validate the issuer of the token.

public LifetimeValidator LifetimeValidator { get; set; }

Gets or sets a delegate that will be used to validate the lifetime of the token

public bool LogTokenId { get; set; }

Gets or sets a Boolean that will decide if the token identifier claim needs to be logged. Default value is true.

public bool LogValidationExceptions { get; set; }

Gets or sets a Boolean that will decide if validation failure needs to be logged as an error. Default value is true for backward compatibility of the behavior. If set to false, validation failures are logged as Information and then thrown.

public string NameClaimType { get; set; }

Gets or sets a String that defines the NameClaimType.

public Func<SecurityToken, string, string> NameClaimTypeRetriever { get; set; }

Gets or sets a delegate that will be called to set the property NameClaimType after validating a token.

public IDictionary<string, object> PropertyBag { get; set; }

Gets or sets the IDictionary<T, U> that contains a collection of custom key/value pairs. This allows addition of parameters that could be used in custom token validation scenarios.

public bool RefreshBeforeValidation { get; set; }

Gets or sets a boolean to control if configuration required to be refreshed before token validation.

public bool RequireAudience { get; set; }

Gets or sets a value indicating whether SAML or JWT tokens must have at least one AudienceRestriction. The default is true.

public bool RequireExpirationTime { get; set; }

Gets or sets a value indicating whether tokens must have an 'expiration' value. The default is true.

public bool RequireSignedTokens { get; set; }

Gets or sets a value indicating whether a SecurityToken can be considered valid if not signed. The default is true.

public string RoleClaimType { get; set; }

Gets or sets the String that defines the RoleClaimType.

public Func<SecurityToken, string, string> RoleClaimTypeRetriever { get; set; }

Gets or sets a delegate that will be called to set the property RoleClaimType after validating a token.

public bool SaveSigninToken { get; set; }

Gets or sets a boolean to control if the original token should be saved after the security token is validated.

public SignatureValidator SignatureValidator { get; set; }

Gets or sets a delegate that will be used to validate the signature of the token.

public SignatureValidatorUsingConfiguration SignatureValidatorUsingConfiguration { get; set; }

Gets or sets a delegate that will be used to validate the signature of the token using the TokenValidationParameters and the BaseConfiguration.

public SecurityKey TokenDecryptionKey { get; set; }

Gets or sets the SecurityKey that is to be used for decryption.

public TokenDecryptionKeyResolver TokenDecryptionKeyResolver { get; set; }

Gets or sets a delegate that will be called to retrieve a SecurityKey used for decryption.

public IEnumerable<SecurityKey> TokenDecryptionKeys { get; set; }

Gets or sets the IEnumerable<T> that is to be used for decrypting inbound tokens.

public TokenReader TokenReader { get; set; }

Gets or sets a delegate that will be used to read the token.

public ITokenReplayCache TokenReplayCache { get; set; }

Gets or set the ITokenReplayCache that store tokens that can be checked to help detect token replay.

public TokenReplayValidator TokenReplayValidator { get; set; }

Gets or sets a delegate that will be used to validate the token replay of the token

public TransformBeforeSignatureValidation TransformBeforeSignatureValidation { get; set; }

Gets or sets a delegate that will be called to transform a token to a supported format before validation.

public bool TryAllDecryptionKeys { get; set; }

Gets or sets a value indicating whether all TokenDecryptionKeys should be tried during token decryption when a key is not matched to token 'kid' or if token 'kid' is empty. The default is true.

public bool TryAllIssuerSigningKeys { get; set; }

Gets or sets a value indicating whether all IssuerSigningKeys should be tried during signature validation when a key is not matched to token 'kid' or if token 'kid' is empty. The default is true.

public TryReadJwtClaim TryReadJwtClaim { get; set; }

Gets or sets the delegate that will be called when reading JSON Web Token header and payload claims.

public TypeValidator TypeValidator { get; set; }

Gets or sets a delegate that will be used to validate the type of the token. If the token type cannot be validated, an exception MUST be thrown by the delegate. Note: the 'type' parameter may be null if it couldn't be extracted from its usual location. Implementations that need to resolve it from a different location can use the 'token' parameter.

public IEnumerable<string> ValidAlgorithms { get; set; }

Gets or sets the valid algorithms for cryptographic operations.

public bool ValidateActor { get; set; }

Gets or sets a value indicating if an actor token is detected, whether it should be validated. The default is false.

public bool ValidateAudience { get; set; }

Gets or sets a boolean to control if the audience will be validated during token validation.

public bool ValidateIssuer { get; set; }

Gets or sets a boolean to control if the issuer will be validated during token validation.

public bool ValidateIssuerSigningKey { get; set; }

Gets or sets a boolean that controls if validation of the SecurityKey that signed the securityToken is called.

public bool ValidateLifetime { get; set; }

Gets or sets a boolean to control if the lifetime will be validated during token validation.

public bool ValidateSignatureLast { get; set; }

Gets or sets a boolean that controls the validation order of the payload and signature during token validation.

public bool ValidateTokenReplay { get; set; }

Gets or sets a boolean to control if the token replay will be validated during token validation.

public bool ValidateWithLKG { get; set; }

Gets or sets a boolean to control if the LKG configuration will be used for token validation.

public string ValidAudience { get; set; }

Gets or sets a string that represents a valid audience that will be used to check against the token's audience. The default is null.

public IEnumerable<string> ValidAudiences { get; set; }

Gets or sets the IEnumerable<T> that contains valid audiences that will be used to check against the token's audience. The default is null.

public string ValidIssuer { get; set; }

Gets or sets a String that represents a valid issuer that will be used to check against the token's issuer. The default is null.

public IEnumerable<string> ValidIssuers { get; set; }

Gets or sets the IEnumerable<T> that contains valid issuers that will be used to check against the token's issuer. The default is null.

public IEnumerable<string> ValidTypes { get; set; }

Gets or sets the IEnumerable<T> that contains valid types that will be used to check against the JWT header's 'typ' claim. If this property is not set, the 'typ' header claim will not be validated and all types will be accepted. In the case of a JWE, this property will ONLY apply to the inner token header. The default is null.

protected TokenValidationParameters(TokenValidationParameters other)

Copy constructor for TokenValidationParameters.

public TokenValidationParameters()

Initializes a new instance of the TokenValidationParameters class.

public virtual TokenValidationParameters Clone()

Returns a new instance of TokenValidationParameters with values copied from this object.

public virtual ClaimsIdentity CreateClaimsIdentity(SecurityToken securityToken, string issuer)

Creates a ClaimsIdentity using:

AuthenticationType

'NameClaimType': If NameClaimTypeRetriever is set, call delegate, else call NameClaimType. If the result is a null or empty string, use DefaultNameClaimType

'RoleClaimType': If RoleClaimTypeRetriever is set, call delegate, else call RoleClaimType. If the result is a null or empty string, use DefaultRoleClaimType