Class SecurityServiceCollectionExtensions

Namespace

Microsoft.Extensions.DependencyInjection

Assembly

Stratara.Security.dll

DI extensions for the Stratara.Security key store + envelope encryption primitives.

public static class SecurityServiceCollectionExtensions

Inheritance

object

SecurityServiceCollectionExtensions

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.MemberwiseClone()

object.ReferenceEquals(object, object)

object.ToString()

Methods

AddStrataraBlobEncryption(IServiceCollection)

Register the AES-GCM blob encryptor and encryption factory. Used on its own when only the field/JSON encryption stack is needed, and called internally by AddStrataraFileKeyStore(IServiceCollection, IConfiguration).

public static IServiceCollection AddStrataraBlobEncryption(this IServiceCollection services)

Parameters

services IServiceCollection

The service collection to mutate.

Returns

IServiceCollection

The same service collection, to enable chaining.

Examples

The blob encryptor on its own, without the rest of AddSecurity(). Reads Stratara:BlobEncryption for the legacy-stream compatibility switch:

services.AddStrataraBlobEncryption();

Remarks

Uses TryAdd so a consumer-registered implementation (or the file key store's registration) takes precedence. Reads StrataraBlobEncryptionOptions from the Stratara:BlobEncryption section of the IConfiguration the container holds; a service collection that holds no configuration gets the defaults. A value configured in code with services.Configure<StrataraBlobEncryptionOptions>(...) after this call takes precedence over the section. The section is applied once, at the position of the first call, so calling this method again — directly or through AddSecurity() — does not re-apply it.

AddStrataraFileKeyStore(IServiceCollection, IConfiguration)

Register the production file-backed key store: a Stratara.Security.FileMasterKeyProvider (KEK custody), the Stratara.Security.EnvelopeFileKeyStore as IKeyStore, the AES-GCM blob encryptor, and a startup probe that validates the KEK eagerly.

public static IServiceCollection AddStrataraFileKeyStore(this IServiceCollection services, IConfiguration configuration)

Parameters

services IServiceCollection

The service collection to mutate.

configuration IConfiguration

Configuration root or section used to bind the options.

Returns

IServiceCollection

The same service collection, to enable chaining.

Examples

Binds Stratara:KeyStore. Call it before AddSecurity(), whose development fallback uses TryAdd and would otherwise be the key store a misordered host gets:

services.AddStrataraFileKeyStore(configuration);
services.AddSecurity();

Remarks

Binds the options from the SectionName and SectionName sections of configuration; for the blob encryption options it takes precedence over the same section of the configuration the container holds. Call this before any composition that registers a development fallback so the envelope store wins the TryAdd race. A missing or too-short KEK fails the host at startup with an actionable message.