Class KeyManager

Namespace

Fdyay.IdentityServer.Services.KeyManagement

Assembly

Fdyay.IdentityServer.Core.dll

Supports all classes in the .NET class hierarchy and provides low-level services to derived classes. This is the ultimate base class of all .NET classes; it is the root of the type hierarchy.

public sealed class KeyManager : IKeyManager, IDisposable

Inheritance

object

KeyManager

Implements

IKeyManager

IDisposable

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

object.ToString()

Remarks

One current key per algorithm in SigningAlgorithms, each rotated on its own schedule, as Duende's KeyManager keeps them. Until 0.137.0 there was one RSA key for one algorithm.

Constructors

KeyManager(ISigningKeyStore, ISigningKeyProtector, TimeProvider, IOptions<IdentityServerOptions>, ILogger<KeyManager>)

A key manager over store.

public KeyManager(ISigningKeyStore store, ISigningKeyProtector protector, TimeProvider time, IOptions<IdentityServerOptions> options, ILogger<KeyManager> logger)

Parameters

store ISigningKeyStore

Where the keys are persisted.

protector ISigningKeyProtector

What protects a key on its way into the store and back.

time TimeProvider

The clock key ages are measured by.

options IOptions<IdentityServerOptions>

The server's options; KeyManagement is validated here.

logger ILogger<KeyManager>

Where key creation, deletion and unreadable keys are logged.

Exceptions

InvalidOperationException

KeyManagement names a duplicate or unsupported signing algorithm, asks for a certificate-wrapped EC key, or sets a negative or zero duration where it may not.

Methods

Dispose()

Releases the lock that serializes key creation and rotation.

public void Dispose()

GetAllKeysAsync()

Gets all currently-published keys (for the JWKS and token validation).

public Task<IReadOnlyCollection<KeyContainer>> GetAllKeysAsync()

Returns

Task<IReadOnlyCollection<KeyContainer>>

GetCurrentKeysAsync()

Gets the keys currently used for signing — one per configured algorithm — creating or rotating as needed. Duende's GetCurrentKeysAsync.

public Task<IReadOnlyCollection<KeyContainer>> GetCurrentKeysAsync()

Returns

Task<IReadOnlyCollection<KeyContainer>>

GetCurrentKeysAsync(CancellationToken)

The keys GetCurrentKeysAsync() answers, waiting for them no longer than the token allows. Duende's.

public Task<IReadOnlyCollection<KeyContainer>> GetCurrentKeysAsync(CancellationToken cancellationToken)

Parameters

cancellationToken CancellationToken

Returns

Task<IReadOnlyCollection<KeyContainer>>

Remarks

Duende 8.0.1's arity, as an overload: changing the method above would break every host's key manager. A default interface method answering with GetCurrentKeysAsync(), so a host's key manager written before 0.162.0 keeps compiling and keeps signing — this server's key material service asks this one since 0.162.0. Duende's interface has no default.