Table of Contents

Class KeyManagementOptions

Namespace
Fdyay.IdentityServer.Configuration
Assembly
Fdyay.IdentityServer.Core.dll

Automatic signing-key management options.

public class KeyManagementOptions
Inheritance
KeyManagementOptions
Inherited Members

Properties

AllowedSigningAlgorithmNames

The names of SigningAlgorithms, else RS256.

public IEnumerable<string> AllowedSigningAlgorithmNames { get; }

Property Value

IEnumerable<string>

DataProtectKeys

Whether a key is protected with ASP.NET Core Data Protection before it is stored. Defaults to true, as Duende's does.

public bool DataProtectKeys { get; set; }

Property Value

bool

Remarks

Off, the private key is stored as it is; for a store that protects what it holds by other means.

DefaultSigningAlgorithm

The algorithm signing when none is asked for: the first of SigningAlgorithms, else RS256.

public string DefaultSigningAlgorithm { get; }

Property Value

string

DeleteRetiredKeys

Whether a key past KeyRetirementAge is deleted from the store. Defaults to true, as Duende's does.

public bool DeleteRetiredKeys { get; set; }

Property Value

bool

Remarks

Off, a retired key stays in the store and is neither published nor used.

Enabled

Whether automatic key management is enabled. Defaults to true.

public bool Enabled { get; set; }

Property Value

bool

InitializationDuration

How long after the first key is created every instance treats the key set as new. Defaults to 5 minutes, as Duende's does; zero turns the initialisation window off.

public TimeSpan InitializationDuration { get; set; }

Property Value

TimeSpan

Remarks

Duende 8.0.1's, measured. While every key in the store is this young, an instance that has just created one waits InitializationSynchronizationDelay and reads the store again, so that instances starting together on one store see each other's keys, and caches the set for InitializationKeyCacheDuration rather than KeyCacheDuration. With the oldest current key signing, they converge on one.

InitializationKeyCacheDuration

How long the key set is cached while every key is within the initialisation window. Defaults to 1 minute, as Duende's does.

public TimeSpan InitializationKeyCacheDuration { get; set; }

Property Value

TimeSpan

InitializationSynchronizationDelay

How long an instance that created a key during the initialisation window waits before reading the store again. Defaults to 5 seconds, as Duende's does.

public TimeSpan InitializationSynchronizationDelay { get; set; }

Property Value

TimeSpan

Remarks

Not waited for on the in-memory store, which no other instance can share: there is nobody's key to wait for. Duende has no in-memory store.

KeyCacheDuration

How long loaded key material is cached in memory. Defaults to 24 hours.

public TimeSpan KeyCacheDuration { get; set; }

Property Value

TimeSpan

Remarks

Held to at most half of PropagationTime, as Duende holds it, so a new key is seen well before it signs.

KeyPath

Where the default key store writes keys. Defaults to a keys directory under the working directory, as Duende's does.

public string KeyPath { get; set; }

Property Value

string

Remarks

Read by the default FileSystemKeyStore; a host that registers its own store ignores it.

KeyRetirementAge

How long a key is in use and then published: RotationInterval plus RetentionDuration.

public TimeSpan KeyRetirementAge { get; }

Property Value

TimeSpan

Remarks

Duende's, measured. What the key-management client configuration validator holds a token lifetime to.

PropagationTime

How long before rotation a new key is announced. Defaults to 14 days.

public TimeSpan PropagationTime { get; set; }

Property Value

TimeSpan

RetentionDuration

How long a retired key remains published in the JWKS. Defaults to 14 days.

public TimeSpan RetentionDuration { get; set; }

Property Value

TimeSpan

RotationInterval

How long a key is used for signing before rotation. Defaults to 90 days.

public TimeSpan RotationInterval { get; set; }

Property Value

TimeSpan

RsaKeySize

The RSA key size in bits for generated keys. Defaults to 2048.

public int RsaKeySize { get; set; }

Property Value

int

SigningAlgorithms

The algorithms a key is kept for, one current key each; the first signs when a client or resource names none. Empty by default, which is RS256 alone, as Duende's is.

public ICollection<SigningAlgorithmOptions> SigningAlgorithms { get; set; }

Property Value

ICollection<SigningAlgorithmOptions>

Remarks

Duende 8.0.1's, measured: RS256/384/512, PS256/384/512 and ES256/384/512, each at most once, and UseX509Certificate for the RSA families only. Until 0.137.0 this was SigningAlgorithm, a single RSA algorithm.