IAudienceKeyResolver Interface
Finds the one encryption key a token's audience published, if any.
public interface IAudienceKeyResolverDerived
↳ AudienceKeyResolver
Remarks
Owns the question rather than leaving its two halves - resolving a resource to its definition and reading that definition's keys - to every consumer that asks it. A token service needs the answer, not the mechanics.
Methods
IAudienceKeyResolver.FindEncryptionKeyAsync(IReadOnlyCollection<Uri>) Method
The encryption key published by the audience named in resources, or null
when none of them publishes one.
System.Threading.Tasks.Task<Abblix.Jwt.JsonWebKey?> FindEncryptionKeyAsync(System.Collections.Generic.IReadOnlyCollection<System.Uri> resources);Parameters
resources System.Collections.Generic.IReadOnlyCollection<System.Uri>
The resources the token is minted for.
Returns
System.Threading.Tasks.Task<JsonWebKey>
Exceptions
System.InvalidOperationException
Several of the named resources each publish an encryption key.
Remarks
A resource that publishes no key contributes nothing, which is how it says a signed JWS is what it
expects. Several resources each publishing a key have no correct answer: compact JWE serialization
carries one recipient, so encrypting to one of them would silently leave the token unreadable to the
rest - refuse instead of choosing. Unknown resources never reach here, having been rejected as
invalid_target during request validation (RFC 8707 Section 2).