Class ClientAssertion

Namespace

MailFathom.Common.ClientAssertions

Assembly

MailFathom.Common.dll

The shape of the assertion a client signs with its private key to authenticate.

public static class ClientAssertion

Inheritance

object

ClientAssertion

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.MemberwiseClone()

object.ReferenceEquals(object, object)

object.ToString()

Remarks

It is the arrangement RFC 7523 already describes and OpenID Connect deploys as private_key_jwt: the client mints a short-lived JSON Web Token, signs it with a key only it holds, and presents it as an ordinary HTTP Bearer credential. Nothing about the transport changes, so the header, the refusal, and the rate-limit partition stay exactly what they are for a key or a token; the deployment holds one public key per client and there is nothing on the host worth stealing from it.

The values here are the contract between the two halves, which is why they live in a project both of them reference rather than beside either one. mfctl mints against them and the endpoint verifies against them, so a change to what an assertion must carry cannot reach one side and miss the other.

The whole assertion is minted per request. Nothing about it is stored, resumed, or renewed, which is what makes the operator's rotation a matter of replacing one registered public key rather than coordinating a secret across two machines.

Fields

AdminAudience

The audience an assertion presented to the administrative endpoint must name.

AudienceClaimName

The claim naming the surface the assertion was minted for.

DeclaredType

The media type an assertion declares in its typ header, which is what a MailFathom credential is recognized by.

ExpiresAtClaimName

The claim naming when the assertion stops being accepted.

IdentifierClaimName

The claim naming the assertion's own replay identifier.

IdentifierLengthLimit

The longest replay identifier an assertion may carry.

MaximumLifetime

The longest window an assertion may claim between the moment it is verified and its own expiry.

McpAudience

The audience an assertion presented to the MCP endpoint must name.

MintedLifetime

The lifetime mfctl mints an assertion with, well inside MaximumLifetime.