Derive an opaque principal id from identifying values, such as an OAuth
issuer and subject, so that logs and audit records can name a caller
without recording who they are.
A keyed HMAC-SHA256 rather than a plain hash: subjects are often guessable
(an email address, an employee number), and the issuer is public, so a
plain hash of the two could be reversed by anyone holding the logs and a
list of likely subjects. Without the key, that list is useless. The same
key gives the same id, so ids are stable for as long as the key is.
Derive an opaque principal id from identifying values, such as an OAuth issuer and subject, so that logs and audit records can name a caller without recording who they are.
A keyed HMAC-SHA256 rather than a plain hash: subjects are often guessable (an email address, an employee number), and the issuer is public, so a plain hash of the two could be reversed by anyone holding the logs and a list of likely subjects. Without the key, that list is useless. The same key gives the same id, so ids are stable for as long as the key is.