Class SdJwtVcVerifierOptions
Policy knobs for SdJwtVcVerifier.
public sealed class SdJwtVcVerifierOptions- Inheritance
-
SdJwtVcVerifierOptions
- Inherited Members
Properties
AcceptLegacyVcSdJwtTyp
Accepts the legacy vc+sd-jwt typ (pre-Nov-2024 credentials) in addition to the
standard dc+sd-jwt. Off by default.
public bool AcceptLegacyVcSdJwtTyp { get; set; }Property Value
CheckStatus
Whether to resolve and enforce the credential's status claim (Token Status List) when
present. Defaults to true — a revoked or suspended credential fails verification. Turn off
only for offline scenarios where the status host is unreachable by design.
public bool CheckStatus { get; set; }Property Value
ClockSkew
Tolerated clock skew for exp / nbf evaluation. Defaults to 5 minutes
(the Microsoft.IdentityModel ecosystem default).
public TimeSpan ClockSkew { get; set; }Property Value
MaxKeyBindingAge
How far in the past a KB-JWT iat (the time the holder created the presentation) may be
and still be accepted. Defaults to 5 minutes: a presentation is meant to be fresh, made in
response to this verifier's live request, so an iat older than this is stale or replayed.
ClockSkew is added on top for tolerance, and it also bounds how far in the future
an iat may be. Set to InfiniteTimeSpan to disable the past bound.
public TimeSpan MaxKeyBindingAge { get; set; }Property Value
RequireKeyBinding
Whether a Key Binding JWT is required. Defaults to true — HAIP-profile EUDI presentations are holder-bound. When false, a KB-JWT is still verified if present.
public bool RequireKeyBinding { get; set; }Property Value
StatusListCacheDuration
How long a validated status list may be served from cache before refetching. This is the
ceiling: the token's own ttl claim shortens it and its exp caps it. Defaults to
5 minutes — the window in which a freshly revoked credential could still verify. Set to
Zero to fetch on every verification.
public TimeSpan StatusListCacheDuration { get; set; }