#### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index')
### [Abblix\.Oidc\.Server\.Features\.PairwiseIdentifiers](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.PairwiseIdentifiers 'Abblix\.Oidc\.Server\.Features\.PairwiseIdentifiers')

## PairwiseSubjectSettings Class

Configuration for pairwise subject identifier generation\.
The salt is a server\-side secret that keys the reversible pairwise seal, so that even with knowledge of the
user's real subject and the sector, an attacker cannot derive or open the pairwise identifier\.

```csharp
public record PairwiseSubjectSettings : System.IEquatable<Abblix.Oidc.Server.Features.PairwiseIdentifiers.PairwiseSubjectSettings>
```

Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → PairwiseSubjectSettings

Implements [System\.IEquatable&lt;](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[PairwiseSubjectSettings](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.PairwiseIdentifiers.PairwiseSubjectSettings 'Abblix\.Oidc\.Server\.Features\.PairwiseIdentifiers\.PairwiseSubjectSettings')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')
### Properties

## PairwiseSubjectSettings\.HashAlgorithm Property {#Abblix.Oidc.Server.Features.PairwiseIdentifiers.PairwiseSubjectSettings.HashAlgorithm}

The hash algorithm used for the HKDF key derivation that keys the pairwise seal\. Defaults to SHA\-256\.
Supported algorithms: SHA256, SHA384, SHA512, SHA1\.

```csharp
public System.Security.Cryptography.HashAlgorithmName HashAlgorithm { get; init; }
```

#### Property Value
[System\.Security\.Cryptography\.HashAlgorithmName](https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.hashalgorithmname 'System\.Security\.Cryptography\.HashAlgorithmName')

## PairwiseSubjectSettings\.Salt Property {#Abblix.Oidc.Server.Features.PairwiseIdentifiers.PairwiseSubjectSettings.Salt}

A base64\-encoded cryptographic key that keys the deterministic authenticated\-encryption seal producing
pairwise identifiers\. This value MUST be kept secret, generated once, and never changed
\(changing it would invalidate all existing pairwise identifiers \- none could be opened back\)\.
Minimum length: 32 bytes \(256 bits\) before encoding\.

```csharp
public string Salt { get; init; }
```

#### Property Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

#### Exceptions

[System\.ArgumentException](https://learn.microsoft.com/en-us/dotnet/api/system.argumentexception 'System\.ArgumentException')  
The salt is missing, is not valid base64, or decodes to fewer than
            32 bytes\.

### Remarks
Judged by whoever wires it rather than on assignment: settings the host bound are judged when the host
starts, by [PairwiseSubjectSettingsValidator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.PairwiseIdentifiers.PairwiseSubjectSettingsValidator 'Abblix\.Oidc\.Server\.Features\.PairwiseIdentifiers\.PairwiseSubjectSettingsValidator'), and an instance handed to
`AddPairwiseSubjectIdentifiers` is judged there\. Refusing in the accessor would sound stricter and
be worse \- the configuration binder assigns properties by reflection, so the refusal would reach the
host wrapped in a `TargetInvocationException` naming reflection instead of the setting, and it
would fire before any validator could say which rule failed\.
### Methods

## PairwiseSubjectSettings\.SaltRefusal\(string\) Method {#Abblix.Oidc.Server.Features.PairwiseIdentifiers.PairwiseSubjectSettings.SaltRefusal(string)}

Why this salt cannot key the seal, or null when it can\.

```csharp
public static string? SaltRefusal(string? salt);
```
#### Parameters

###### `salt` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.PairwiseIdentifiers.PairwiseSubjectSettings.SaltRefusal(string).salt}

The base64 value a deployment configured\.

#### Returns
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

### Remarks
Returned rather than thrown, so one rule serves both callers: whoever HOLDS the value throws on it,
and whoever REPORTS on it \- a startup options validator \- hands the same sentence to the host\. Two
shapes of one rule cannot disagree; two rules would\.

## PairwiseSubjectSettings\.ValidateSalt\(string\) Method {#Abblix.Oidc.Server.Features.PairwiseIdentifiers.PairwiseSubjectSettings.ValidateSalt(string)}

Refuses a salt that cannot key the seal\.

```csharp
public static void ValidateSalt(string? salt);
```
#### Parameters

###### `salt` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Oidc.Server.Features.PairwiseIdentifiers.PairwiseSubjectSettings.ValidateSalt(string).salt}

The base64 value a deployment configured\.

#### Exceptions

[System\.ArgumentException](https://learn.microsoft.com/en-us/dotnet/api/system.argumentexception 'System\.ArgumentException')  
It is missing, is not valid base64, or decodes to fewer than 32 bytes\.

### Remarks
Reachable because the property cannot be the only judge\. The configuration binder constructs the
object and then sets only the properties whose keys are present, so an absent key never enters the
accessor \- `required` is a compiler rule and the binder does not enforce it\. A caller holding an
instance it did not write asks here instead\.