XiHan.Framework.Security.OpenIdConnect 5.0.0-preview.1

Prefix Reserved
.NET 10.0 This package targets .NET 10.0. The package is compatible with this framework or higher.
This is a prerelease version of XiHan.Framework.Security.OpenIdConnect.
There is a newer prerelease version of this package available.
See the version list below for details. 
dotnet add package XiHan.Framework.Security.OpenIdConnect --version 5.0.0-preview.1
                    


                    

                
NuGet\Install-Package XiHan.Framework.Security.OpenIdConnect -Version 5.0.0-preview.1
This command is intended to be used within the Package Manager Console in Visual Studio, as it uses the NuGet module's version of Install-Package. 
<PackageReference Include="XiHan.Framework.Security.OpenIdConnect" Version="5.0.0-preview.1" />
For projects that support PackageReference, copy this XML node into the project file to reference the package. 
<PackageVersion Include="XiHan.Framework.Security.OpenIdConnect" Version="5.0.0-preview.1" />
                    


                            Directory.Packages.props
                        

                    

                
<PackageReference Include="XiHan.Framework.Security.OpenIdConnect" />
                    


                            Project file
For projects that support Central Package Management (CPM), copy this XML node into the solution Directory.Packages.props file to version the package. 
paket add XiHan.Framework.Security.OpenIdConnect --version 5.0.0-preview.1
                    


                    

                
#r "nuget: XiHan.Framework.Security.OpenIdConnect, 5.0.0-preview.1"
#r directive can be used in F# Interactive and Polyglot Notebooks. Copy this into the interactive tool or source code of the script to reference the package. 
#:package XiHan.Framework.Security.OpenIdConnect@5.0.0-preview.1
#:package directive can be used in C# file-based apps starting in .NET 10 preview 4. Copy this into a .cs file before any lines of code to reference the package. 
#addin nuget:?package=XiHan.Framework.Security.OpenIdConnect&version=5.0.0-preview.1&prerelease
                    


                            Install as a Cake Addin
                        

                    

                
#tool nuget:?package=XiHan.Framework.Security.OpenIdConnect&version=5.0.0-preview.1&prerelease
                    


                            Install as a Cake Tool

XiHan.Framework.Security.OpenIdConnect

security.authentication@1 的 OpenID Connect Provider（Ring 3，role: provider）。注册后顶替内存实现的认证部分；授权仍由被选中的授权 Provider（默认 Security.InMemory）承担。与 Security.Jwt 同一时刻只装配其一。

builder.AddXiHan(x => x.UseFeature<InMemorySecurityFeature>().UseFeature<OpenIdConnectSecurityFeature>());

{ "XiHan": { "Security": { "OpenIdConnect": { "Authority": "https://login.example.com/realms/shop", "Audience": "api" } } } }
键 默认 说明
Authority 必填 签发者地址（绝对 URI）；发现文档默认在 <Authority>/.well-known/openid-configuration
MetadataAddress 由 Authority 推出 发现文档地址
Issuer 发现文档的 issuer 期望的签发者
Audience 不校验 期望的受众
RequireHttpsMetadata true 发现文档与 JWKS 必须经 HTTPS；只在本地开发时关闭
ClockSkewSeconds 60 有效期校验允许的时钟偏移
RefreshIntervalSeconds 43200 元数据自动刷新间隔
MinimumRefreshIntervalSeconds 300 两次按需刷新的最短间隔，也是刷新失败后沿用旧密钥的时长
BackchannelTimeoutSeconds 30 取发现文档与 JWKS 的 HTTP 超时
NameClaim sub 作为主体 ID 的声明类型

语义

  • 凭据方案 Bearer；签名密钥来自签发者 JWKS（RS256、ES256 等非对称算法）。签名、过期与有效期始终强制；签发者取 Issuer 或发现文档；受众配置了才校验。
  • 元数据首次认证时按需取得并缓存（OpenIdConnectMetadataCache），按 RefreshInterval 自动刷新；并发认证只发一次请求。
  • 令牌的 kid 不在 JWKS 里时按需刷新一次再校验，两次按需刷新至少间隔 MinimumRefreshInterval；伪造 kid 不能让签发者被打爆。
  • 刷新失败沿用最后一份密钥并记日志；从未取到元数据时返回 SECURITY_UNAVAILABLE_003（5 秒退避后再试）。读不出的令牌不访问签发者。
  • 主体 ID 取 NameClaim；全部声明按原始类型名保留（不做 .NET 长声明类型映射），角色声明类型由 XiHan:Security:RoleClaim 决定。校验失败返回 SECURITY_DENIED_003，不区分原因对外暴露。
  • 测试或自带 HTTP 客户端时，先注册 OpenIdConnectMetadataCache 单例，特性以 TryAdd 让位。

依赖方向

依赖 Security.Abstractions 与 Microsoft.IdentityModel.JsonWebTokens；发现文档与 JWKS 用 HttpClient 直接取，不依赖 Microsoft.IdentityModel.Protocols.*。

状态

P3：可用。

Product Compatible and additional computed target framework versions.
.NET net10.0 is compatible.  net10.0-android was computed.  net10.0-browser was computed.  net10.0-ios was computed.  net10.0-maccatalyst was computed.  net10.0-macos was computed.  net10.0-tvos was computed.  net10.0-windows was computed. 
Compatible target framework(s)
Included target framework(s) (in package)
Learn more about Target Frameworks and .NET Standard.

NuGet packages

This package is not used by any NuGet packages.

GitHub repositories

This package is not used by any popular GitHub repositories.

Version Downloads Last Updated
5.0.0-preview.2 47 11/6/2026
5.0.0-preview.1 47 11/4/2026