ServiceJwtEncryption Class
The encryption policy a caller hands to AuthServiceJwtFormatter when formatting a JWT the server issues for itself. It is the service-side mirror of ClientJwtEncryption: it makes explicit whether the token is encrypted and, if so, to which of the server's own keys and with which algorithms, so the formatter no longer encrypts implicitly whenever any encryption key happens to exist. Each service-token type supplies its own policy via the static factories below, projected from ServiceTokens.
public sealed record ServiceJwtEncryption : System.IEquatable<Abblix.Oidc.Server.Features.Tokens.Formatters.ServiceJwtEncryption>Inheritance System.Object → ServiceJwtEncryption
Implements System.IEquatable<ServiceJwtEncryption>
Constructors
ServiceJwtEncryption(Nullable<bool>, string, string, string) Constructor
The encryption policy a caller hands to AuthServiceJwtFormatter when formatting a JWT the server issues for itself. It is the service-side mirror of ClientJwtEncryption: it makes explicit whether the token is encrypted and, if so, to which of the server's own keys and with which algorithms, so the formatter no longer encrypts implicitly whenever any encryption key happens to exist. Each service-token type supplies its own policy via the static factories below, projected from ServiceTokens.
public ServiceJwtEncryption(System.Nullable<bool> Encrypt, string? KeyManagementAlgorithm, string? KeyId, string ContentEncryptionAlgorithm);Parameters
Encrypt System.Nullable<System.Boolean>
Whether to encrypt the token. false yields a signed-only JWS and the
server's encryption keys are not even resolved. true requires encryption and fails when no key can
be resolved. null states nothing: encrypt if a key is available, sign only if not.
KeyManagementAlgorithm System.String
The JWE key-management alg, or null to derive it from
the selected encryption key's declared alg (RFC 7517 Section 4.4), falling back to
RSA-OAEP-256.
KeyId System.String
The kid of the encryption key to select, or null to take the first
configured encryption key.
ContentEncryptionAlgorithm System.String
The JWE content-encryption enc, taken from
DefaultContentEncryptionAlgorithm.
Properties
ServiceJwtEncryption.ContentEncryptionAlgorithm Property
The JWE content-encryption enc, taken from
DefaultContentEncryptionAlgorithm.
public string ContentEncryptionAlgorithm { get; init; }Property Value
ServiceJwtEncryption.Encrypt Property
Whether to encrypt the token. false yields a signed-only JWS and the
server's encryption keys are not even resolved. true requires encryption and fails when no key can
be resolved. null states nothing: encrypt if a key is available, sign only if not.
public System.Nullable<bool> Encrypt { get; init; }Property Value
System.Nullable<System.Boolean>
ServiceJwtEncryption.Key Property
The key to encrypt to, when it is not one of this server's own. Set for an access token whose named audience publishes a key: the token is then readable by the party it was minted for, instead of only by this server.
public Abblix.Jwt.JsonWebKey? Key { get; init; }Property Value
Remarks
Carried as data rather than resolved by the formatter, so the formatter stays unaware of resources and the decision is made where the request context is. When null the server's own encryption keys are selected as before.
ServiceJwtEncryption.KeyId Property
The kid of the encryption key to select, or null to take the first
configured encryption key.
public string? KeyId { get; init; }Property Value
ServiceJwtEncryption.KeyManagementAlgorithm Property
The JWE key-management alg, or null to derive it from
the selected encryption key's declared alg (RFC 7517 Section 4.4), falling back to
RSA-OAEP-256.
public string? KeyManagementAlgorithm { get; init; }Property Value
Methods
ServiceJwtEncryption.ForAccessToken(OidcOptions) Method
Policy for the access token, projected from ServiceTokens.AccessToken.
public static Abblix.Oidc.Server.Features.Tokens.Formatters.ServiceJwtEncryption ForAccessToken(Abblix.Oidc.Server.Common.Configuration.OidcOptions options);Parameters
options OidcOptions
Returns
ServiceJwtEncryption.ForInitialAccessToken(OidcOptions) Method
Policy for the initial access token, projected from ServiceTokens.InitialAccessToken.
public static Abblix.Oidc.Server.Features.Tokens.Formatters.ServiceJwtEncryption ForInitialAccessToken(Abblix.Oidc.Server.Common.Configuration.OidcOptions options);Parameters
options OidcOptions
Returns
ServiceJwtEncryption.ForRefreshToken(OidcOptions) Method
Policy for the refresh token, projected from ServiceTokens.RefreshToken.
public static Abblix.Oidc.Server.Features.Tokens.Formatters.ServiceJwtEncryption ForRefreshToken(Abblix.Oidc.Server.Common.Configuration.OidcOptions options);Parameters
options OidcOptions
Returns
ServiceJwtEncryption.ForRegistrationAccessToken(OidcOptions) Method
Policy for the registration access token, projected from ServiceTokens.RegistrationAccessToken.
public static Abblix.Oidc.Server.Features.Tokens.Formatters.ServiceJwtEncryption ForRegistrationAccessToken(Abblix.Oidc.Server.Common.Configuration.OidcOptions options);