JwksKeyResolutionOptionsExtensions Class
What Shared Signals adds to key resolution: the "jwks_uri" a transmitter advertises about itself.
public static class JwksKeyResolutionOptionsExtensionsInheritance System.Object → JwksKeyResolutionOptionsExtensions
Remarks
The family word is in the method name rather than only in the namespace because the type extended
here belongs to another package, and several packages hang their own vocabulary off it - the same
reason RegisterSharedSignalsEvents, RegisterCaepEvents and RegisterRiscEvents
each carry theirs.
Methods
JwksKeyResolutionOptionsExtensions.AddSharedSignalsJwksUri(this JwksKeyResolutionOptions, TransmitterConfiguration) Method
Records the transmitter's issuer and the JWK Set it advertises, so events it signs verify.
public static Abblix.SecurityEvents.Infrastructure.JwksKeyResolutionOptions AddSharedSignalsJwksUri(this Abblix.SecurityEvents.Infrastructure.JwksKeyResolutionOptions options, Abblix.SharedSignals.Model.TransmitterConfiguration transmitter);Parameters
options Abblix.SecurityEvents.Infrastructure.JwksKeyResolutionOptions
Where key sets live.
transmitter TransmitterConfiguration
The configuration document just read from the transmitter.
Returns
Abblix.SecurityEvents.Infrastructure.JwksKeyResolutionOptions
The same options, so several transmitters read as a list.
Exceptions
System.InvalidOperationException
The document advertises no jwks_uri. Refused rather than skipped: every SET is signed,
so a transmitter whose keys are unreachable has no verifiable events at all, and letting
resolution fall through to a guessed address answers that with a wrong document instead of a
failure anybody can act on.
Remarks
Called when the configuration document has been read, not when the host is composed - a receiver learns both values over the network, and the map it writes into is safe to write while resolution reads it.
It exists so no receiver has to copy the pair out by hand. The two mistakes that copy invites are silent and identical from the outside: taking the advertised address on faith when SSF 1.0 Section 7.1 leaves "jwks_uri" out of the REQUIRED set, and comparing the issuer some way of its own. Both end at the well-known convention - a document that, for a transmitter, is very likely not its key set at all - so a signature stops verifying and the reason reads as forgery rather than as wiring.