Class StrataraOpenIdConnectOptions

Namespace

Stratara.Identity.AspNetCore.Authentication

Assembly

Stratara.Identity.AspNetCore.dll

Bindable configuration for the Stratara OpenID Connect helper — the interactive "log in with <provider>" flow (Microsoft Entra, Keycloak, generic OIDC/Google). Bound from a configuration section (default Identity:OpenIdConnect) and applied to the ASP.NET Core OpenIdConnect handler by AddStrataraOpenIdConnect(AuthenticationBuilder, IConfiguration, string, string).

[ExcludeFromCodeCoverage]
public sealed class StrataraOpenIdConnectOptions

Inheritance

object

StrataraOpenIdConnectOptions

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

object.ToString()

Extension Methods

FieldChangedEventExtensions.ApplyPropertyChanged<TAggregate>(TAggregate, FieldChangedEvent<TAggregate>)

EventStream.ApplyEvents(object, IReadOnlyList<IEvent>)

Remarks

Entra vs. Keycloak vs. generic OIDC differ only in these three config blocks — authority, client credentials, and scopes; the handler wiring is identical. External logins are linked by the issuer's sub (never by email — see the JIT provisioning security invariants), so the helper keeps sub as the principal's name-identifier.

Fields

DefaultScopes

The scopes applied when Scopes is left empty — openid, profile, email. email is required so the JIT provisioning verified-email checks can run.

public static readonly IReadOnlyList<string> DefaultScopes

Field Value

IReadOnlyList<string>

DefaultSectionName

The default configuration section this options object binds from.

public const string DefaultSectionName = "Identity:OpenIdConnect"

Field Value

string

Properties

Authority

The OIDC authority (issuer) URL — for example https://login.microsoftonline.com/<tenant>/v2.0 (Entra) or https://keycloak.example.com/realms/<realm> (Keycloak).

public string? Authority { get; set; }

Property Value

string

CallbackPath

The path the provider redirects back to after authentication. Defaults to /signin-oidc (the ASP.NET Core convention).

public string CallbackPath { get; set; }

Property Value

string

ClientId

The application (client) id registered with the provider.

public string? ClientId { get; set; }

Property Value

string

ClientSecret

The client secret for the confidential-client authorization-code flow. Leave unset for public clients using PKCE only.

public string? ClientSecret { get; set; }

Property Value

string

GetClaimsFromUserInfoEndpoint

Whether to call the provider's user-info endpoint to enrich the principal. Defaults to true — some providers assert email/email_verified only there.

public bool GetClaimsFromUserInfoEndpoint { get; set; }

Property Value

bool

RequireHttpsMetadata

Whether HTTPS is required for the authority metadata endpoint. Defaults to true; set to false only for local development against a plain-HTTP provider.

public bool RequireHttpsMetadata { get; set; }

Property Value

bool

ResponseType

The OAuth/OIDC response type. Defaults to code (authorization-code flow with PKCE), the only flow recommended for server-side apps.

public string ResponseType { get; set; }

Property Value

string

SaveTokens

Whether the handler stores the issued tokens in the authentication properties. Defaults to true so downstream code (for example the JIT provisioning callback) can read the external principal's claims.

public bool SaveTokens { get; set; }

Property Value

bool

Scopes

The scopes requested from the provider. Left empty by default; when empty the helper applies DefaultScopes. Set this to request a specific set (it replaces the defaults).

public IList<string> Scopes { get; set; }

Property Value

IList<string>

SignedOutCallbackPath

The path the provider redirects back to after sign-out. Defaults to /signout-callback-oidc.

public string SignedOutCallbackPath { get; set; }

Property Value

string