ComplexSubject Class
A Complex Subject: several Simple Subject Members - a user, the device they are on, the session they hold - that all describe attributes of, and together refer to, exactly one Subject Principal (SSF 1.0 Sections 3.3, 3.3.1).
public sealed class ComplexSubject : Abblix.SecurityEvents.Subjects.SubjectIdentifierInheritance System.Object → SubjectIdentifier → ComplexSubject
Remarks
Section 3.3 requires at least one member, a rule spanning all of them at once, so it belongs to no single property; HasMembers is how a caller asks it, and the transmitter's subject door refuses the empty shape. What IS enforced per member is simplicity: a Complex Subject holds Simple Subject Members, so a nested Complex Subject is refused on the way in - built in code or read off the wire alike.
Section 3.3 also allows additional member names beyond the registered seven. They land in AdditionalMembers as raw JSON and are written back verbatim, which is exactly the posture Section 3.6 asks of a receiver: members it cannot interpret stay visible - so the check for an unprocessable Critical member can see them - rather than being dropped or refused.
Constructors
ComplexSubject() Constructor
A Complex Subject: several Simple Subject Members - a user, the device they are on, the session they hold - that all describe attributes of, and together refer to, exactly one Subject Principal (SSF 1.0 Sections 3.3, 3.3.1).
public ComplexSubject();Remarks
Section 3.3 requires at least one member, a rule spanning all of them at once, so it belongs to no single property; HasMembers is how a caller asks it, and the transmitter's subject door refuses the empty shape. What IS enforced per member is simplicity: a Complex Subject holds Simple Subject Members, so a nested Complex Subject is refused on the way in - built in code or read off the wire alike.
Section 3.3 also allows additional member names beyond the registered seven. They land in AdditionalMembers as raw JSON and are written back verbatim, which is exactly the posture Section 3.6 asks of a receiver: members it cannot interpret stay visible - so the check for an unprocessable Critical member can see them - rather than being dropped or refused.
Properties
ComplexSubject.AdditionalMembers Property
The members beyond the registered seven that SSF 1.0 Section 3.3 permits, kept as raw JSON: this package cannot interpret them, and preserving them verbatim is what lets a receiver's critical-member check (Section 3.6) and a re-transmission see them intact.
public System.Collections.Generic.IDictionary<string,System.Text.Json.JsonElement>? AdditionalMembers { get; init; }Property Value
System.Collections.Generic.IDictionary<System.String,System.Text.Json.JsonElement>
ComplexSubject.Application Property
OPTIONAL. Identifies an application (SSF 1.0 Section 3.3).
public Abblix.SecurityEvents.Subjects.SubjectIdentifier? Application { get; init; }Property Value
ComplexSubject.Device Property
OPTIONAL. Identifies a device (SSF 1.0 Section 3.3).
public Abblix.SecurityEvents.Subjects.SubjectIdentifier? Device { get; init; }Property Value
ComplexSubject.Group Property
OPTIONAL. Identifies a group (SSF 1.0 Section 3.3).
public Abblix.SecurityEvents.Subjects.SubjectIdentifier? Group { get; init; }Property Value
ComplexSubject.HasMembers Property
Whether this subject names anything at all.
public bool HasMembers { get; }Property Value
Remarks
Section 3.3's "at least one member" spans every property at once, so it cannot live on any one of them - but the question can be asked here and answered where a subject enters. It is worth asking rather than shrugging at: a matcher reads an absent member as "no restriction on this field", so a subject naming none restricts nothing and stands for every event.
ComplexSubject.OrgUnit Property
OPTIONAL. Identifies an organizational unit (SSF 1.0 Section 3.3).
public Abblix.SecurityEvents.Subjects.SubjectIdentifier? OrgUnit { get; init; }Property Value
ComplexSubject.Session Property
OPTIONAL. Identifies a session (SSF 1.0 Section 3.3).
public Abblix.SecurityEvents.Subjects.SubjectIdentifier? Session { get; init; }Property Value
ComplexSubject.Tenant Property
OPTIONAL. Identifies a tenant (SSF 1.0 Section 3.3).
public Abblix.SecurityEvents.Subjects.SubjectIdentifier? Tenant { get; init; }Property Value
ComplexSubject.User Property
OPTIONAL. Identifies a user (SSF 1.0 Section 3.3).
public Abblix.SecurityEvents.Subjects.SubjectIdentifier? User { get; init; }