Class ManagedKeySigningOptions

Namespace

AsiBackbone.Signing.ManagedKey

Assembly

AsiBackbone.Signing.ManagedKey.dll

Configures the managed-key signing provider.

public sealed class ManagedKeySigningOptions

Inheritance

object

ManagedKeySigningOptions

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

object.ToString()

Remarks

The options carry provider-neutral key references and operational behavior. They must not contain private keys, credentials, connection strings, client secrets, or managed identity tokens.

Fields

DefaultHashAlgorithm

Gets the default supported hash algorithm descriptor.

public const string DefaultHashAlgorithm = "SHA-256"

Field Value

string

DefaultProviderName

Gets the default provider descriptor returned in signing metadata.

public const string DefaultProviderName = "managed-key"

Field Value

string

DefaultSignatureAlgorithm

Gets the default provider-neutral signature algorithm descriptor.

public const string DefaultSignatureAlgorithm = "RSASSA-PSS-SHA256-MANAGED-KEY"

Field Value

string

Properties

DefaultMaxRetryDelay

Gets the default maximum retry delay.

public static TimeSpan DefaultMaxRetryDelay { get; }

Property Value

TimeSpan

HashAlgorithm

Gets or sets the hash algorithm expected on incoming signing requests.

public string HashAlgorithm { get; set; }

Property Value

string

KeyId

Gets or sets the managed key identifier or key URI reference.

public string KeyId { get; set; }

Property Value

string

KeyVersion

Gets or sets the managed key version expected for signing.

public string? KeyVersion { get; set; }

Property Value

string

MaxRetryAttempts

Gets or sets the maximum number of retry attempts after the initial managed-key signing call.

public int MaxRetryAttempts { get; set; }

Property Value

int

MaxRetryDelay

Gets or sets the maximum delay applied before any single retry attempt.

public TimeSpan MaxRetryDelay { get; set; }

Property Value

TimeSpan

ProviderName

Gets or sets the provider descriptor returned in signing metadata.

public string ProviderName { get; set; }

Property Value

string

RequireKeyVersion

Gets or sets a value indicating whether signing requests must specify or resolve a key version.

public bool RequireKeyVersion { get; set; }

Property Value

bool

RetryDelay

Gets or sets the base delay used by the exponential retry backoff calculation.

public TimeSpan RetryDelay { get; set; }

Property Value

TimeSpan

Remarks

A zero value keeps retries immediate and disables jittered waiting.

ReturnUnsignedOnFailure

Gets or sets a value indicating whether signing failures should return unsigned failure metadata instead of throwing.

public bool ReturnUnsignedOnFailure { get; set; }

Property Value

bool

Remarks

The production-oriented default is false so signing failures fail closed unless a host explicitly opts into unsigned failure metadata for local validation, samples, or policy-routed fallback behavior.

SignatureAlgorithm

Gets or sets the provider-neutral signature algorithm descriptor requested from the managed-key client.

public string SignatureAlgorithm { get; set; }

Property Value

string

Methods

Create(string, string?, string?, string?, string?, bool, bool, int, TimeSpan?)

Creates production-oriented managed-key signing options that fail closed by default when signing cannot complete.

public static ManagedKeySigningOptions Create(string keyId, string? keyVersion = null, string? providerName = null, string? signatureAlgorithm = null, string? hashAlgorithm = null, bool requireKeyVersion = true, bool returnUnsignedOnFailure = false, int maxRetryAttempts = 2, TimeSpan? retryDelay = null)

Parameters

keyId string

keyVersion string

providerName string

signatureAlgorithm string

hashAlgorithm string

requireKeyVersion bool

returnUnsignedOnFailure bool

maxRetryAttempts int

retryDelay TimeSpan?

Returns

ManagedKeySigningOptions

CreateLocalValidation(string, string?, string?, string?, string?, bool, int, TimeSpan?)

Creates local-validation managed-key signing options that return unsigned failure metadata instead of throwing.

public static ManagedKeySigningOptions CreateLocalValidation(string keyId, string? keyVersion = null, string? providerName = null, string? signatureAlgorithm = null, string? hashAlgorithm = null, bool requireKeyVersion = true, int maxRetryAttempts = 2, TimeSpan? retryDelay = null)

Parameters

keyId string

keyVersion string

providerName string

signatureAlgorithm string

hashAlgorithm string

requireKeyVersion bool

maxRetryAttempts int

retryDelay TimeSpan?

Returns

ManagedKeySigningOptions

Remarks

Use this only for samples, tests, diagnostics, or hosts that explicitly route unsigned failure metadata through policy. Production signing paths should prefer Create(string, string?, string?, string?, string?, bool, bool, int, TimeSpan?) or set ReturnUnsignedOnFailure to false.

Validate()

Validates the managed-key signing options.

public void Validate()