IdentityServer Options

Endpoints¶

Allows enabling/disabling individual endpoints, e.g. token, authorize, userinfo etc.

By default all endpoints are enabled, but you can lock down your server by disabling endpoint that you don’t need.

• EnableJwtRequestUri

  JWT request_uri processing is enabled on the authorize endpoint. Defaults to false.

• EnablePushedAuthorizationRequestEndpoint

  Enables the pushed authorization request endpoint. Defaults to true. See Pushed Authorization Requests.

Discovery¶

Allows enabling/disabling various sections of the discovery document, e.g. endpoints, scopes, claims, grant types etc.

The CustomEntries dictionary allows adding custom elements to the discovery document.

• ExpandRelativePathsInCustomEntries

  Specifies whether relative paths in the CustomEntries dictionary should be expanded to absolute URLs based on the issuer URI. Defaults to true.

• ResponseCacheInterval

  Specifies the interval of the maxage cache control directive for the discovery document. 0 will set no-cache headers. null will not set a cache control header. Defaults to null

Authentication¶

• CookieAuthenticationScheme

  Sets the cookie authentication scheme configured by the host used for interactive users. If not set, the scheme will be inferred from the host’s default authentication scheme. This setting is typically used when AddPolicyScheme is used in the host as the default scheme.

• CookieLifetime

  The authentication cookie lifetime (only effective if the IdentityServer-provided cookie handler is used).

• CookieSlidingExpiration

  Specifies if the cookie should be sliding or not (only effective if the IdentityServer-provided cookie handler is used).

• CookieSameSiteMode

  Specifies the SameSite mode for the internal cookies.

• RequireAuthenticatedUserForSignOutMessage

  Indicates if user must be authenticated to accept parameters to end session endpoint. Defaults to false.

• CheckSessionCookieName

  The name of the cookie used for the check session endpoint.

• CheckSessionCookieDomain

  The domain of the cookie used for the check session endpoint.

• CheckSessionCookieSameSiteMode

  The SameSite mode of the cookie used for the check session endpoint.

• RequireCspFrameSrcForSignout

  If set, will require frame-src CSP headers being emitting on the end session callback endpoint which renders iframes to clients for front-channel signout notification. Defaults to true.

• CoordinateClientLifetimesWithUserSession

  If set, refresh token lifetimes will be tied to the users’ session. This setting can be overridden at the client level. Defaults to false.

Pushed Authorization Requests¶

See Pushed Authorization Requests for the complete PAR configuration and client settings.

• PushedAuthorization.Required

  Requires all authorization requests to use the pushed authorization endpoint. Defaults to false.

• PushedAuthorization.Expiration

  The default lifetime of a pushed authorization request URI. Defaults to 600 seconds (10 minutes).

Events¶

Allows configuring if and which events should be submitted to a registered event sink. See here for more information on events.

InputLengthRestrictions¶

Allows setting length restrictions on various protocol parameters like client id, scope, redirect URI etc.

UserInteraction¶

• LoginUrl, LogoutUrl, CreateAccountUrl, ConsentUrl, ErrorUrl, DeviceVerificationUrl

  Sets the URLs for the login, logout, create account, consent, error and device verification pages.

• LoginReturnUrlParameter

  Sets the name of the return URL parameter passed to the login page. Defaults to returnUrl.

• LogoutIdParameter

  Sets the name of the logout message id parameter passed to the logout page. Defaults to logoutId.

• CreateAccountReturnUrlParameter

  Sets the name of the return URL parameter passed to the create account page. Defaults to returnUrl.

• ConsentReturnUrlParameter

  Sets the name of the return URL parameter passed to the consent page. Defaults to returnUrl.

• ErrorIdParameter

  Sets the name of the error message id parameter passed to the error page. Defaults to errorId.

• CustomRedirectReturnUrlParameter

  Sets the name of the return URL parameter passed to a custom redirect from the authorization endpoint. Defaults to returnUrl.

• DeviceVerificationUserCodeParameter

  Sets the name of the user code parameter passed to the device verification page. Defaults to userCode.

• CookieMessageThreshold

  Certain interactions between IdentityServer and some UI pages require a cookie to pass state and context (any of the pages above that have a configurable “message id” parameter). Since browsers have limits on the number of cookies and their size, this setting is used to prevent too many cookies being created. The value sets the maximum number of message cookies of any type that will be created. The oldest message cookies will be purged once the limit has been reached. This effectively indicates how many tabs can be opened by a user when using IdentityServer.

• SupportedPromptModes

  Sets the prompt modes that are supported by IdentityServer. Defaults to login, consent, select_account and none. When CreateAccountUrl is set, then create is also added to the supported prompt modes. Prompts that are not in this list will cause authorization requests to fail with an invalid_request error.

Caching¶

These settings only apply if the respective caching has been enabled in the services configuration in startup.

• ClientStoreExpiration

  Cache duration of client configuration loaded from the client store. Default is 15 minutes.

• ResourceStoreExpiration

  Cache duration of identity and API resource configuration loaded from the resource store. Default is 15 minutes.

• CorsExpiration

  Cache duration the Caching CORS policy service. Default is 15 minutes.

CORS¶

IdentityServer supports CORS for some of its endpoints. The underlying CORS implementation is provided from ASP.NET Core, and as such it is automatically registered in the dependency injection system.

• CorsPolicyName

  Name of the CORS policy that will be evaluated for CORS requests into IdentityServer (defaults to "Open.IdentityServer"). The policy provider that handles this is implemented in terms of the ICorsPolicyService registered in the dependency injection system. If you wish to customize the set of CORS origins allowed to connect, then it is recommended that you provide a custom implementation of ICorsPolicyService.

• CorsPaths

  The endpoints within IdentityServer where CORS is supported. Defaults to the discovery, user info, token, and revocation endpoints.

• PreflightCacheDuration

  Nullable<TimeSpan> indicating the value to be used in the preflight Access-Control-Max-Age response header. Defaults to null indicating no caching header is set on the response.

CSP (Content Security Policy)¶

IdentityServer emits CSP headers for some responses, where appropriate.

• Level

  The level of CSP to use. CSP Level 2 is used by default, but if older browsers must be supported then this be changed to CspLevel.One to accommodate them.

• AddDeprecatedHeader

  Indicates if the older X-Content-Security-Policy CSP header should also be emitted (in addition to the standards-based header value). Defaults to true.

Device Flow¶

• DefaultUserCodeType

  The user code type to use, unless set at the client level. Defaults to Numeric, a 9-digit code.

• Interval

  Defines the minimum allowed polling interval on the token endpoint. Defaults to 5.

Mutual TLS¶

• Enabled

  Specifies if MTLS support should be enabled. Defaults to false.

• ClientCertificateAuthenticationScheme

  Specifies the name of the authentication handler for X.509 client certificates. Defaults to "Certificate".

• DomainName

  Specifies either the name of the sub-domain or full domain for running the MTLS endpoints (will use path-based endpoints if not set). Use a simple string (e.g. “mtls”) to set a sub-domain, use a full domain name (e.g. “identityserver-mtls.io”) to set a full domain name. When a full domain name is used, you also need to set the IssuerName to a fixed value.

• AlwaysEmitConfirmationClaim

  Specifies whether a cnf claim gets emitted for access tokens if a client certificate was present. Normally the cnf claims only gets emitted if the client used the client certificate for authentication, setting this to true, will set the claim regardless of the authentication method. (defaults to false).

Server-Side Sessions¶

• ExpiredSessionsTriggerBackchannelLogout

  Specifies if session expiry should trigger back channel logout, this will override any other settings that may cause back channel logout such as AuthenticationOptions.CoordinateClientLifetimesWithUserSession or Client.CoordinateLifetimeWithUserSession.

• RemoveExpiredSessions

  Specifies if expired sessions should be cleaned up automatically by Open.IdentityServer. The default value is true.

• RemoveExpiredSessionsFrequency

  Specifies the frequency with which expired sessions are looked for and removed. The default value is a TimeSpan of 10 minutes.

• FuzzExpiredSessionsFrequency

  Specifies if the start time of the hosted service should be randomised. This avoids the scenario where multiple running instances of identityserver run cleanup jobs simultaneously. The default value is true.

• RemoveExpiredSessionsBatchSize

  Specifies how many expired sessions should be removed in a single pass. The default value is 100.

Validation Options¶

• InvalidRedirectUriPrefixes

  URI scheme prefixes rejected in authorization redirect_uri values. Defaults to javascript:, file:, data:, mailto:, ftp:, blob:, about:, ssh:, tel:, view-source:, ws:, and wss:.

Logging Options¶

• TokenRequestSensitiveValuesFilter

  Names of token-endpoint request parameters whose values must be redacted when the request is written to the log. Defaults to client_secret, password, client_assertion, refresh_token and device_code.

• AuthorizeRequestSensitiveValuesFilter

  Names of authorize-endpoint request parameters whose values must be redacted when the request is written to the log. Defaults to id_token_hint.