Class SdJwtVcVerifierOptions
- Namespace
- Tessio.Verifier.Core
- Assembly
- Tessio.Verifier.Core.dll
Policy knobs for SdJwtVcVerifier.
public sealed class SdJwtVcVerifierOptions- Inheritance
-
SdJwtVcVerifierOptions
- Inherited Members
Properties
AcceptLegacyVcSdJwtTyp
Accepts the legacy vc+sd-jwt typ (pre-Nov-2024 credentials) in addition to the
standard dc+sd-jwt. Off by default.
public bool AcceptLegacyVcSdJwtTyp { get; set; }Property Value
CheckStatus
Whether to resolve and enforce the credential's status claim (Token Status List) when
present. Defaults to true — a revoked or suspended credential fails verification. Turn off
only for offline scenarios where the status host is unreachable by design.
public bool CheckStatus { get; set; }Property Value
ClockSkew
Tolerated clock skew for exp / nbf evaluation. Defaults to 5 minutes
(the Microsoft.IdentityModel ecosystem default).
public TimeSpan ClockSkew { get; set; }Property Value
MaxKeyBindingAge
How far in the past a KB-JWT iat (the time the holder created the presentation) may be
and still be accepted. Defaults to 5 minutes: a presentation is meant to be fresh, made in
response to this verifier's live request, so an iat older than this is stale or replayed.
ClockSkew is added on top for tolerance, and it also bounds how far in the future
an iat may be. Set to InfiniteTimeSpan to disable the past bound.
public TimeSpan MaxKeyBindingAge { get; set; }Property Value
RequireKeyBinding
Whether a Key Binding JWT is required. Defaults to true — HAIP-profile EUDI presentations are holder-bound. When false, a KB-JWT is still verified if present.
public bool RequireKeyBinding { get; set; }Property Value
ResolveX5u
Fetches the signing certificate an issuer JWT names by x5u when it carries no x5c. Off by
default, and off the x5u is ignored as it was before it was read: a credential with an HTTPS iss
resolves through JWT VC Issuer Metadata, and one without fails with
IssuerKeyUnresolvable, with a message saying x5u resolution is off.
public bool ResolveX5u { get; set; }Property Value
Remarks
The fetch goes to a URL the presented credential chooses, and it happens before trust is known, because the
trust seam judges the chain the URL returns. It is HTTPS only and bounded in size and time; the default HTTP
client also refuses internal addresses, which a client passed to SdJwtVcVerifier must do itself.
The x5u is used only when the header's x5t#S256 binds it, and then in preference to issuer
metadata, and the certificate must match that thumbprint. A resource is kept only for a credential that
verified in full, keyed by URL and thumbprint, and reused for an hour from when it was fetched. An x5u
with no x5t#S256 is ignored, so the credential resolves by its iss as it would with this off, and
is refused when it has none. The issuer whose URL it is learns when its credentials are verified, so turn this
on only for a trust source whose issuers name their certificate this way. A status list token is never
resolved by x5u, whatever this says: HAIP 1.0 section 6.1 has its key in x5c.
StatusListCacheDuration
How long a validated status list may be served from cache before refetching. This is the
ceiling: the token's own ttl claim shortens it and its exp caps it. Defaults to
5 minutes — the window in which a freshly revoked credential could still verify. Set to
Zero to fetch on every verification.
public TimeSpan StatusListCacheDuration { get; set; }