| PairwiseSubjectSettings | Configuration for pairwise subject identifier generation. The salt is a server-side secret that keys the reversible pairwise seal, so that even with knowledge of the user's real subject and the sector, an attacker cannot derive or open the pairwise identifier. |
| PairwiseSubjectSettingsValidator | Fails loudly at startup when the configured seal key cannot key the pairwise seal, instead of letting the first pairwise token request answer 500. |
| SubjectTypeConverter | Implements the OIDC Core Section 8 subject types. A public client's subject passes through unchanged. A pairwise client's subject is sealed into a per-sector pseudonym that is stable (the same user and sector always map to the same value), opaque and unlinkable to outsiders, yet reversible by this server - so the real subject rides inside the pseudonym itself and no separate protected claim is needed. The seal is a deterministic (SIV-style) authenticated encryption keyed by the pairwise salt and bound to the sector as associated data, so different sectors seal the same user to unlinkable values and a pseudonym cannot be opened under the wrong sector. |
| SubjectTypeConverterExtensions | Comparing a session against the end users a client named. |