AudienceKeyResolver Class

Answers from the resource registry, taking the first published key per resource.

public class AudienceKeyResolver : Abblix.Oidc.Server.Features.ResourceIndicators.IAudienceKeyResolver

Inheritance System.Object → AudienceKeyResolver

Implements IAudienceKeyResolver

Constructors

AudienceKeyResolver(IResourceManager, IResourceKeysProvider) Constructor

Answers from the resource registry, taking the first published key per resource.

public AudienceKeyResolver(Abblix.Oidc.Server.Features.ResourceIndicators.IResourceManager resourceManager, Abblix.Oidc.Server.Features.ResourceIndicators.IResourceKeysProvider resourceKeysProvider);

Parameters

resourceManager IResourceManager

Resolves a requested resource URI to its registered definition.

resourceKeysProvider IResourceKeysProvider

Supplies that resource's published encryption keys.

Methods

AudienceKeyResolver.FindEncryptionKeyAsync(IReadOnlyCollection<Uri>) Method

The encryption key published by the audience named in resources, or null when none of them publishes one.

public System.Threading.Tasks.Task<Abblix.Jwt.JsonWebKey?> FindEncryptionKeyAsync(System.Collections.Generic.IReadOnlyCollection<System.Uri> resources);

Parameters

resources System.Collections.Generic.IReadOnlyCollection<System.Uri>

The resources the token is minted for.

Implements FindEncryptionKeyAsync(IReadOnlyCollection<Uri>)

Returns

System.Threading.Tasks.Task<JsonWebKey>

Exceptions

System.InvalidOperationException
Several of the named resources each publish an encryption key.

Remarks

A resource that publishes no key contributes nothing, which is how it says a signed JWS is what it expects. Several resources each publishing a key have no correct answer: compact JWE serialization carries one recipient, so encrypting to one of them would silently leave the token unreadable to the rest - refuse instead of choosing. Unknown resources never reach here, having been rejected as invalid_target during request validation (RFC 8707 Section 2).