PairwiseSubjectSettings Class
Configuration for pairwise subject identifier generation. The salt is a server-side secret that keys the reversible pairwise seal, so that even with knowledge of the user's real subject and the sector, an attacker cannot derive or open the pairwise identifier.
public record PairwiseSubjectSettings : System.IEquatable<Abblix.Oidc.Server.Features.PairwiseIdentifiers.PairwiseSubjectSettings>Inheritance System.Object → PairwiseSubjectSettings
Implements System.IEquatable<PairwiseSubjectSettings>
Properties
PairwiseSubjectSettings.HashAlgorithm Property
The hash algorithm used for the HKDF key derivation that keys the pairwise seal. Defaults to SHA-256. Supported algorithms: SHA256, SHA384, SHA512, SHA1.
public System.Security.Cryptography.HashAlgorithmName HashAlgorithm { get; init; }Property Value
System.Security.Cryptography.HashAlgorithmName
PairwiseSubjectSettings.Salt Property
A base64-encoded cryptographic key that keys the deterministic authenticated-encryption seal producing pairwise identifiers. This value MUST be kept secret, generated once, and never changed (changing it would invalidate all existing pairwise identifiers - none could be opened back). Minimum length: 32 bytes (256 bits) before encoding.
public string Salt { get; init; }Property Value
Exceptions
System.ArgumentException
The salt is missing, is not valid base64, or decodes to fewer than
32 bytes.
Remarks
Judged by whoever wires it rather than on assignment: settings the host bound are judged when the host
starts, by PairwiseSubjectSettingsValidator, and an instance handed to
AddPairwiseSubjectIdentifiers is judged there. Refusing in the accessor would sound stricter and
be worse - the configuration binder assigns properties by reflection, so the refusal would reach the
host wrapped in a TargetInvocationException naming reflection instead of the setting, and it
would fire before any validator could say which rule failed.
Methods
PairwiseSubjectSettings.SaltRefusal(string) Method
Why this salt cannot key the seal, or null when it can.
public static string? SaltRefusal(string? salt);Parameters
salt System.String
The base64 value a deployment configured.
Returns
Remarks
Returned rather than thrown, so one rule serves both callers: whoever HOLDS the value throws on it, and whoever REPORTS on it - a startup options validator - hands the same sentence to the host. Two shapes of one rule cannot disagree; two rules would.
PairwiseSubjectSettings.ValidateSalt(string) Method
Refuses a salt that cannot key the seal.
public static void ValidateSalt(string? salt);Parameters
salt System.String
The base64 value a deployment configured.
Exceptions
System.ArgumentException
It is missing, is not valid base64, or decodes to fewer than 32 bytes.
Remarks
Reachable because the property cannot be the only judge. The configuration binder constructs the
object and then sets only the properties whose keys are present, so an absent key never enters the
accessor - required is a compiler rule and the binder does not enforce it. A caller holding an
instance it did not write asks here instead.