Class ExternalLoginProvisioningOptions
- Namespace
- Stratara.Identity.AspNetCore.Authentication
- Assembly
- Stratara.Identity.AspNetCore.dll
Options for the JIT external-login provisioning service. Every default encodes a security invariant, not a convenience — the safe behavior is on out of the box and must be deliberately relaxed.
[ExcludeFromCodeCoverage]
public sealed class ExternalLoginProvisioningOptions- Inheritance
-
ExternalLoginProvisioningOptions
- Inherited Members
- Extension Methods
Remarks
The most important invariant is that an external login is auto-linked to a pre-existing local account only when the email is provably verified on both sides (nOAuth defense against IdPs that expose a mutable, unverified email claim). Relaxing RequireVerifiedEmailForLinking re-opens that account-takeover vector; do it only for a provider you fully trust.
Properties
AutoProvision
Whether a first-time external sign-in with no matching local account creates one. Defaults to
true. Set to false to require accounts to be pre-created (or invitation-gated);
an unmatched sign-in then returns Denied.
public bool AutoProvision { get; set; }Property Value
EmailVerifiedClaimTypes
The claim types read to decide whether the provider asserted the email as verified. Defaults
to email_verified (standard OIDC) and xms_edov (Entra "email domain owner
verified"). A claim value of true/1 counts as verified.
public IList<string> EmailVerifiedClaimTypes { get; set; }Property Value
InvitationGate
An optional gate invoked before any account is created or linked. Return false to
reject the sign-in (for example, no pending invitation) — provisioning then returns
Denied. When null, no gate is applied.
public Func<ExternalLoginProvisioningContext, CancellationToken, Task<bool>>? InvitationGate { get; set; }Property Value
RequireVerifiedEmailForLinking
Whether auto-linking an external login to an existing local account requires the email to be
verified by the provider and already confirmed locally. Defaults to true.
When it cannot be satisfied, provisioning returns
RequiresInteractiveLinking instead of merging.
public bool RequireVerifiedEmailForLinking { get; set; }