#### [Abblix\.SecurityEvents](https://www.abblix.com/en/docs/api/abblix-securityevents 'index') ### [Abblix\.SecurityEvents\.Infrastructure](https://www.abblix.com/en/docs/api/abblix-securityevents/Abblix.SecurityEvents.Infrastructure 'Abblix\.SecurityEvents\.Infrastructure') ## SecurityEventsOptions Class What a host configures once about its security\-event handling: the event dictionary, signing, and \- for a profile that weakens the default validation \- the reasoned acknowledgement of that weakening\. The pipeline itself is composed through the service collection: the default steps register as an ordinary family, and a consumer profile edits them in place through the live composition cursor after `AddSecurityEvents`\. ```csharp public sealed class SecurityEventsOptions ``` Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → SecurityEventsOptions ### Properties ## SecurityEventsOptions\.AllowedSigningAlgorithms Property {#Abblix.SecurityEvents.Infrastructure.SecurityEventsOptions.AllowedSigningAlgorithms} The signature algorithms this deployment will sign a security event token with, and accept one under\. ```csharp public string[]? AllowedSigningAlgorithms { get; set; } ``` #### Property Value [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') #### Exceptions [System\.ArgumentException](https://learn.microsoft.com/en-us/dotnet/api/system.argumentexception 'System\.ArgumentException') The set is empty, or contains `none`\. ### Remarks One set for both directions on purpose\. A deployment that widens what it accepts and not what it emits, or the reverse, has two policies to keep in step and no place that says they disagree\. The DEFAULT is RS256 alone, which two specifications independently arrive at: the CAEP Interoperability Profile 1.0 draft 01 Section 2.6 requires it of security events, and OpenID Back-Channel Logout 1.0 Section 2.6 names it as the default for a Logout Token. It is also what this server's own logout tokens carry unless a client registered otherwise, so the two ends of a deployment that uses only our own pieces agree without anybody configuring anything. WIDENING is the host's move, and the host that has to make it is the one that already knows why: this verifier is shared, so `AddBackChannelLogoutReceiver` resolves the same one, and a deployment whose clients registered ES256 or PS256 as their `id_token_signed_response_alg` must name those here. Of the FAPI 2.0 direction this library offers PS256 and ES256; EdDSA it does not implement, so naming that would name an algorithm nothing can use. The refusal such a host meets names the algorithm that was rejected AND the set that would have been accepted, so the way out is readable from the message with no configuration in front of you. It arrives as `SignatureInvalid`, which RFC 8935 Section 2.4 renders on the wire as `invalid_key` - a key "unacceptable to the SET Recipient", which is what this is. What the set cannot contain is `none`: an unsigned security event is not a weaker signature but the absence of one, and a set that could hold it would make the receiver's `RequireSignedTokens` the only thing standing between a deployment and an unauthenticated event. NULL means the default, and the default is deliberately not the property's initial value: the configuration binder reads whatever is there, ADDS the configured entries and writes the result back, so a deployment narrowing the list to ES256 would get ES256 alongside everything the default carried and would believe it had excluded the rest. Measured on both a set and an array - the binder unions either. With nothing there, what it writes back is exactly what was configured. [DefaultSigningAlgorithms](https://www.abblix.com/en/docs/api/abblix-securityevents/Abblix.SecurityEvents.Infrastructure.SecurityEventsOptions#Abblix.SecurityEvents.Infrastructure.SecurityEventsOptions.DefaultSigningAlgorithms 'Abblix\.SecurityEvents\.Infrastructure\.SecurityEventsOptions\.DefaultSigningAlgorithms') is public so a host can still read what null means. The value is copied in BOTH directions, and one direction alone is worth nothing: a caller holding the array it passed could add `none` to it afterwards, and a caller reading the property back could write into what it got. Both reach the resolved signer, which asks the array live - measured, a write through the getter made it sign PS256 under an RS256-only policy. An invariant a caller can break after assignment is not one, in either direction. ## SecurityEventsOptions\.DefaultSigningAlgorithms Property {#Abblix.SecurityEvents.Infrastructure.SecurityEventsOptions.DefaultSigningAlgorithms} What [AllowedSigningAlgorithms](https://www.abblix.com/en/docs/api/abblix-securityevents/Abblix.SecurityEvents.Infrastructure.SecurityEventsOptions#Abblix.SecurityEvents.Infrastructure.SecurityEventsOptions.AllowedSigningAlgorithms 'Abblix\.SecurityEvents\.Infrastructure\.SecurityEventsOptions\.AllowedSigningAlgorithms') means when a host has set nothing: RS256 alone\. ```csharp public static System.Collections.Generic.IReadOnlyList DefaultSigningAlgorithms { get; } ``` #### Property Value [System\.Collections\.Generic\.IReadOnlyList<](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ireadonlylist-1 'System\.Collections\.Generic\.IReadOnlyList\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[>](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ireadonlylist-1 'System\.Collections\.Generic\.IReadOnlyList\`1') ## SecurityEventsOptions\.Events Property {#Abblix.SecurityEvents.Infrastructure.SecurityEventsOptions.Events} The event dictionary: which event identifier URIs deserialize into which payload models\. An event dictionary package is a set of calls against this registry\. ```csharp public Abblix.SecurityEvents.Events.EventTypeRegistry Events { get; } ``` #### Property Value [EventTypeRegistry](https://www.abblix.com/en/docs/api/abblix-securityevents/Abblix.SecurityEvents.Events.EventTypeRegistry 'Abblix\.SecurityEvents\.Events\.EventTypeRegistry') ## SecurityEventsOptions\.SigningKeySource Property {#Abblix.SecurityEvents.Infrastructure.SecurityEventsOptions.SigningKeySource} Supplies the private key each signing uses \- the one thing a transmitter must configure and a pure receiver never does\. Left null, resolving the signer fails loudly naming this property, instead of a transmitter discovering at first delivery that it signs nothing\. ```csharp public System.Func>? SigningKeySource { get; set; } ``` #### Property Value [System\.Func<](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2')[System\.Threading\.CancellationToken](https://learn.microsoft.com/en-us/dotnet/api/system.threading.cancellationtoken 'System\.Threading\.CancellationToken')[,](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2')[System\.Threading\.Tasks\.Task<](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey')[>](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[>](https://learn.microsoft.com/en-us/dotnet/api/system.func-2 'System\.Func\`2')