Class KeyMaterialService

Namespace

Fdyay.IdentityServer.Services.KeyManagement

Assembly

Fdyay.IdentityServer.Core.dll

Supports all classes in the .NET class hierarchy and provides low-level services to derived classes. This is the ultimate base class of all .NET classes; it is the root of the type hierarchy.

public sealed class KeyMaterialService : IKeyMaterialService

Inheritance

object

KeyMaterialService

Implements

IKeyMaterialService

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

object.ToString()

Remarks

The one place KeyManagementOptions.Enabled is read, and the only consumer of IKeyManager — which is what makes the flag able to mean what it says. With it off nothing calls the manager, so nothing generates, stores or rotates a key.

The two modes are not symmetric, deliberately. On (the default) the managed key signs and static keys are accepted for validation only, so a host migrating *to* automatic management keeps verifying tokens signed by the key it is leaving behind. Off, the static credential signs. What a host must never get is the third outcome — asking for its own key and silently being given a generated one — which is why running with the flag off and no credential registered is a boot failure rather than a fallback.

The cancellation tokens stop at the key manager. Key management is shared work behind a semaphore — it can create a key, write it and drop the cache — and one request walking away must not abandon that half-done for every other request queued on the gate. The parameters exist because callers in the request pipeline have a token and the interface is one a host implements against.

Constructors

KeyMaterialService(IKeyManager, IEnumerable<ISigningCredentialStore>, IEnumerable<IValidationKeysStore>, IOptions<IdentityServerOptions>)

A key material service over the key manager and the host's own stores.

public KeyMaterialService(IKeyManager keyManager, IEnumerable<ISigningCredentialStore> signingCredentials, IEnumerable<IValidationKeysStore> validationKeys, IOptions<IdentityServerOptions> options)

Parameters

keyManager IKeyManager

The automatic key manager, asked only while KeyManagement.Enabled is on.

signingCredentials IEnumerable<ISigningCredentialStore>

The host's signing credential stores, which sign while KeyManagement.Enabled is off.

validationKeys IEnumerable<IValidationKeysStore>

The host's validation key stores, published in either mode.

options IOptions<IdentityServerOptions>

The server's options.

Methods

GetAllSigningCredentialsAsync(CancellationToken)

Gets all signing credentials currently in use.

public Task<IEnumerable<SigningCredentials>> GetAllSigningCredentialsAsync(CancellationToken cancellationToken = default)

Parameters

cancellationToken CancellationToken

Returns

Task<IEnumerable<SigningCredentials>>

GetSigningCredentialsAsync(IEnumerable<string>?, CancellationToken)

Gets the signing credentials, optionally constrained to a set of algorithms.

public Task<SigningCredentials> GetSigningCredentialsAsync(IEnumerable<string>? allowedAlgorithms = null, CancellationToken cancellationToken = default)

Parameters

allowedAlgorithms IEnumerable<string>

cancellationToken CancellationToken

Returns

Task<SigningCredentials>

Exceptions

InvalidOperationException

No key or credential matches allowedAlgorithms, or automatic key management is off and no signing credential is registered.

GetValidationKeysAsync(CancellationToken)

Gets the public validation keys published in the JWKS.

public Task<IEnumerable<SecurityKeyInfo>> GetValidationKeysAsync(CancellationToken cancellationToken = default)

Parameters

cancellationToken CancellationToken

Returns

Task<IEnumerable<SecurityKeyInfo>>