Skip to content

ServiceJwtEncryption Class

The encryption policy a caller hands to AuthServiceJwtFormatter when formatting a JWT the server issues for itself. It is the service-side mirror of ClientJwtEncryption: it makes explicit whether the token is encrypted and, if so, to which of the server's own keys and with which algorithms, so the formatter no longer encrypts implicitly whenever any encryption key happens to exist. Each service-token type supplies its own policy via the static factories below, projected from ServiceTokens.

C#
public sealed record ServiceJwtEncryption : System.IEquatable<Abblix.Oidc.Server.Features.Tokens.Formatters.ServiceJwtEncryption>

Inheritance System.Object → ServiceJwtEncryption

Implements System.IEquatable<ServiceJwtEncryption>

Constructors

ServiceJwtEncryption(Nullable<bool>, string, string, string) Constructor

The encryption policy a caller hands to AuthServiceJwtFormatter when formatting a JWT the server issues for itself. It is the service-side mirror of ClientJwtEncryption: it makes explicit whether the token is encrypted and, if so, to which of the server's own keys and with which algorithms, so the formatter no longer encrypts implicitly whenever any encryption key happens to exist. Each service-token type supplies its own policy via the static factories below, projected from ServiceTokens.

C#
public ServiceJwtEncryption(System.Nullable<bool> Encrypt, string? KeyManagementAlgorithm, string? KeyId, string ContentEncryptionAlgorithm);

Parameters

Encrypt System.Nullable<System.Boolean>

Whether to encrypt the token. false yields a signed-only JWS and the server's encryption keys are not even resolved. true requires encryption and fails when no key can be resolved. null states nothing: encrypt if a key is available, sign only if not.

KeyManagementAlgorithm System.String

The JWE key-management alg, or null to derive it from the selected encryption key's declared alg (RFC 7517 Section 4.4), falling back to RSA-OAEP-256.

KeyId System.String

The kid of the encryption key to select, or null to take the first configured encryption key.

ContentEncryptionAlgorithm System.String

The JWE content-encryption enc, taken from DefaultContentEncryptionAlgorithm.

Properties

ServiceJwtEncryption.ContentEncryptionAlgorithm Property

The JWE content-encryption enc, taken from DefaultContentEncryptionAlgorithm.

C#
public string ContentEncryptionAlgorithm { get; init; }

Property Value

System.String

ServiceJwtEncryption.Encrypt Property

Whether to encrypt the token. false yields a signed-only JWS and the server's encryption keys are not even resolved. true requires encryption and fails when no key can be resolved. null states nothing: encrypt if a key is available, sign only if not.

C#
public System.Nullable<bool> Encrypt { get; init; }

Property Value

System.Nullable<System.Boolean>

ServiceJwtEncryption.Key Property

The key to encrypt to, when it is not one of this server's own. Set for an access token whose named audience publishes a key: the token is then readable by the party it was minted for, instead of only by this server.

C#
public Abblix.Jwt.JsonWebKey? Key { get; init; }

Property Value

JsonWebKey

Remarks

Carried as data rather than resolved by the formatter, so the formatter stays unaware of resources and the decision is made where the request context is. When null the server's own encryption keys are selected as before.

ServiceJwtEncryption.KeyId Property

The kid of the encryption key to select, or null to take the first configured encryption key.

C#
public string? KeyId { get; init; }

Property Value

System.String

ServiceJwtEncryption.KeyManagementAlgorithm Property

The JWE key-management alg, or null to derive it from the selected encryption key's declared alg (RFC 7517 Section 4.4), falling back to RSA-OAEP-256.

C#
public string? KeyManagementAlgorithm { get; init; }

Property Value

System.String

Methods

ServiceJwtEncryption.ForAccessToken(OidcOptions) Method

Policy for the access token, projected from ServiceTokens.AccessToken.

C#
public static Abblix.Oidc.Server.Features.Tokens.Formatters.ServiceJwtEncryption ForAccessToken(Abblix.Oidc.Server.Common.Configuration.OidcOptions options);

Parameters

options OidcOptions

Returns

ServiceJwtEncryption

ServiceJwtEncryption.ForInitialAccessToken(OidcOptions) Method

Policy for the initial access token, projected from ServiceTokens.InitialAccessToken.

C#
public static Abblix.Oidc.Server.Features.Tokens.Formatters.ServiceJwtEncryption ForInitialAccessToken(Abblix.Oidc.Server.Common.Configuration.OidcOptions options);

Parameters

options OidcOptions

Returns

ServiceJwtEncryption

ServiceJwtEncryption.ForRefreshToken(OidcOptions) Method

Policy for the refresh token, projected from ServiceTokens.RefreshToken.

C#
public static Abblix.Oidc.Server.Features.Tokens.Formatters.ServiceJwtEncryption ForRefreshToken(Abblix.Oidc.Server.Common.Configuration.OidcOptions options);

Parameters

options OidcOptions

Returns

ServiceJwtEncryption

ServiceJwtEncryption.ForRegistrationAccessToken(OidcOptions) Method

Policy for the registration access token, projected from ServiceTokens.RegistrationAccessToken.

C#
public static Abblix.Oidc.Server.Features.Tokens.Formatters.ServiceJwtEncryption ForRegistrationAccessToken(Abblix.Oidc.Server.Common.Configuration.OidcOptions options);

Parameters

options OidcOptions

Returns

ServiceJwtEncryption