Class DataProtectionKeyProtector

Namespace

Fdyay.IdentityServer.Services.KeyManagement

Assembly

Fdyay.IdentityServer.Core.dll

Protects signing key material at rest using ASP.NET Core Data Protection.

public sealed class DataProtectionKeyProtector : ISigningKeyProtector

Inheritance

object

DataProtectionKeyProtector

Implements

ISigningKeyProtector

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

object.ToString()

Remarks

Version 2, since 0.137.0, stores the key's kind with its private key — RSA as PKCS#1, EC as PKCS#8, a certificate-wrapped key as PKCS#12 — so every container comes back as itself; the kind travels inside Data, so a store's schema does not change. Version 1 held an RSA private key alone and is still read. Protected unless DataProtectKeys is off, as Duende's is.

Constructors

DataProtectionKeyProtector(IDataProtectionProvider, IOptions<IdentityServerOptions>?)

A protector drawing on provider.

public DataProtectionKeyProtector(IDataProtectionProvider provider, IOptions<IdentityServerOptions>? options = null)

Parameters

provider IDataProtectionProvider

The Data Protection provider the key material is protected with.

options IOptions<IdentityServerOptions>

The server's options, whose DataProtectKeys decides whether keys are protected; null protects them.

Exceptions

ArgumentNullException

provider is null.

Methods

Protect(KeyContainer)

Serializes and protects a key for storage.

public SerializedKey Protect(KeyContainer key)

Parameters

key KeyContainer

Returns

SerializedKey

Exceptions

NotSupportedException

key is not an RsaKeyContainer, EcKeyContainer or X509KeyContainer.

Unprotect(SerializedKey)

Unprotects and deserializes a stored key.

public KeyContainer Unprotect(SerializedKey key)

Parameters

key SerializedKey

Returns

KeyContainer

Exceptions

InvalidOperationException

The stored key holds no key, or a kind this server does not read.