Class StrataraJwtBearerOptions

Namespace

Stratara.Identity.AspNetCore.Authentication

Assembly

Stratara.Identity.AspNetCore.dll

Bindable configuration for the Stratara JWT-bearer helper — validating access tokens on API requests (the machine/service-to-service and SPA/mobile counterpart to the interactive OpenID Connect flow). Bound from a configuration section (default Identity:JwtBearer) and applied to the ASP.NET Core JwtBearer handler by AddStrataraJwtBearer(AuthenticationBuilder, IConfiguration, string, string).

[ExcludeFromCodeCoverage]
public sealed class StrataraJwtBearerOptions

Inheritance

object

StrataraJwtBearerOptions

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

object.ToString()

Extension Methods

FieldChangedEventExtensions.ApplyPropertyChanged<TAggregate>(TAggregate, FieldChangedEvent<TAggregate>)

EventStream.ApplyEvents(object, IReadOnlyList<IEvent>)

Remarks

A single API can accept tokens from several issuers (multi-tenant Entra, Keycloak, an internal authority) by listing them in ValidIssuers — the handler routes by the token's iss. The principal's name-identifier is kept as the issuer sub so a bearer request flows through the same membership/permission plane as an interactive sign-in.

Fields

DefaultSectionName

The default configuration section this options object binds from.

public const string DefaultSectionName = "Identity:JwtBearer"

Field Value

string

Properties

Audience

The audience (aud) the token must be issued for — this API's identifier.

public string? Audience { get; set; }

Property Value

string

Authority

The primary token authority (issuer) URL used to discover signing keys. Optional when ValidIssuers and explicit metadata are supplied.

public string? Authority { get; set; }

Property Value

string

NameClaimType

The claim type read as the principal's name-identifier. Defaults to sub so the bearer principal is keyed on the stable subject identifier, never a mutable email.

public string NameClaimType { get; set; }

Property Value

string

RequireHttpsMetadata

Whether HTTPS is required for the authority metadata endpoint. Defaults to true; set to false only for local development.

public bool RequireHttpsMetadata { get; set; }

Property Value

bool

RoleClaimType

The claim type read for roles. Defaults to roles (the Entra/OIDC convention).

public string RoleClaimType { get; set; }

Property Value

string

ValidIssuers

Additional acceptable issuers for multi-issuer APIs. When set, the token's iss must match one of these (or Authority); leave empty to trust only Authority.

public IList<string> ValidIssuers { get; set; }

Property Value

IList<string>