Skip to content

CustodianHeldKeys Class

Selects which of the custodian's keys the host produces with, for a host that chose to keep the private halves where they never leave the custodian (UseKeysInCustodian). The keys belong to the operator: they are already provisioned in the custodian, so this only names them. Each algorithm is advertised on the published key and forwarded to the custodian on every operation, so it must be one the custodian provisions for that key.

C#
public sealed record CustodianHeldKeys : System.IEquatable<Abblix.Jwt.ExternalKeys.CustodianHeldKeys>

Inheritance System.Object → CustodianHeldKeys

Implements System.IEquatable<CustodianHeldKeys>

Remarks

A name here is the custodian's name for the LOGICAL key, not a published kid. Every version of that key is published under its own version-qualified kid minted by the custodian (Vault Transit <name>:<version>, Azure Key Vault <name>/<version>), which is what lets a rotation overlap and routes each private operation back to the exact version that signed. The bare name is the published kid only for a custodian that does not version its keys and leaves the kid unset.

Properties

CustodianHeldKeys.EncryptionAlgorithm Property

The JWE key-management algorithm the encryption key uses. Has no effect unless EncryptionKeyName names a key.

C#
public string EncryptionAlgorithm { get; init; }

Property Value

System.String

CustodianHeldKeys.EncryptionKeyName Property

The custodian's name for the encryption key, whose versions are published and unwrapped with. Name it when anything encrypts to this provider: it both encrypts the provider's own tokens (a service token configured to be encrypted) and decrypts inbound JWE a client sent, such as an encrypted request object or client assertion, and its published half is what tells a client where to encrypt.

C#
public string? EncryptionKeyName { get; init; }

Property Value

System.String

Remarks

Optional, and unset means no encryption key is published at all, rather than a guessed name the custodian may not hold: a signing-only deployment is the common high-assurance case.

CustodianHeldKeys.SigningAlgorithm Property

The JWS algorithm the signing key uses, for example RS256, PS384 or ES256 (an EC one needs a custodian key on the matching curve).

C#
public string SigningAlgorithm { get; init; }

Property Value

System.String

CustodianHeldKeys.SigningKeyName Property

The custodian's name for the signing key, whose versions are published and signed with. Required: a host with no signing key cannot issue a token at all, so the compiler asks for it instead of a startup failure.

C#
public string SigningKeyName { get; init; }

Property Value

System.String