CustodianHeldKeys Class
Selects which of the custodian's keys the host produces with, for a host that chose to keep the private halves
where they never leave the custodian (UseKeysInCustodian). The keys belong to the operator: they are
already provisioned in the custodian, so this only names them. Each algorithm is advertised on the published key
and forwarded to the custodian on every operation, so it must be one the custodian provisions for that key.
public sealed record CustodianHeldKeys : System.IEquatable<Abblix.Jwt.ExternalKeys.CustodianHeldKeys>Inheritance System.Object → CustodianHeldKeys
Implements System.IEquatable<CustodianHeldKeys>
Remarks
A name here is the custodian's name for the LOGICAL key, not a published kid. Every version of that key
is published under its own version-qualified kid minted by the custodian (Vault Transit
<name>:<version>, Azure Key Vault <name>/<version>), which is what lets a
rotation overlap and routes each private operation back to the exact version that signed. The bare name is the
published kid only for a custodian that does not version its keys and leaves the kid unset.
Properties
CustodianHeldKeys.EncryptionAlgorithm Property
The JWE key-management algorithm the encryption key uses. Has no effect unless EncryptionKeyName names a key.
public string EncryptionAlgorithm { get; init; }Property Value
CustodianHeldKeys.EncryptionKeyName Property
The custodian's name for the encryption key, whose versions are published and unwrapped with. Name it when anything encrypts to this provider: it both encrypts the provider's own tokens (a service token configured to be encrypted) and decrypts inbound JWE a client sent, such as an encrypted request object or client assertion, and its published half is what tells a client where to encrypt.
public string? EncryptionKeyName { get; init; }Property Value
Remarks
Optional, and unset means no encryption key is published at all, rather than a guessed name the custodian may not hold: a signing-only deployment is the common high-assurance case.
CustodianHeldKeys.SigningAlgorithm Property
The JWS algorithm the signing key uses, for example RS256, PS384 or ES256 (an EC one
needs a custodian key on the matching curve).
public string SigningAlgorithm { get; init; }Property Value
CustodianHeldKeys.SigningKeyName Property
The custodian's name for the signing key, whose versions are published and signed with. Required: a host with no signing key cannot issue a token at all, so the compiler asks for it instead of a startup failure.
public string SigningKeyName { get; init; }