Class PublicJsonWebKey
- Namespace
- Fdyay.IdentityServer.Services.KeyManagement
- Assembly
- Fdyay.IdentityServer.Core.dll
Reduces a signing key to the public JWK that can be published in the JWKS.
public static class PublicJsonWebKey- Inheritance
-
PublicJsonWebKey
- Inherited Members
Remarks
Every validation key has to arrive at the discovery endpoint as a JsonWebKey, because that is
the only shape CreateJwksAsync can serialise — anything else it drops. Until a host could supply its
own signing credential that was safe by construction: the only producer was
RsaKeyContainer.ToPublicJsonWebKey. It is not safe any more, and a key silently missing from the JWKS
is the worst possible failure here — tokens sign fine and every relying party rejects them.
Public parameters only, and built field by field rather than converted wholesale. JsonWebKeyConverter carries the private half across when the source has one, and a JWKS is published to anyone who asks.
RSA and EC, as of 0.66.0, and the EC half is the one this type used to name as impossible.
It refused an EC key because it emitted n and e and nothing emitted crv, x and
y — which was a true description of a function nobody had written, and was read for four releases as
a reason it could not be written. The refusal for everything else stays: a symmetric key signs tokens a JWKS
must not publish, because every relying party holding the shared secret already has it and a public document
would hand it to everybody else.
Methods
From(SecurityKey, string)
Converts a key to its public JWK form.
public static JsonWebKey From(SecurityKey key, string signingAlgorithm)Parameters
keySecurityKeysigningAlgorithmstring
Returns
Exceptions
- InvalidOperationException
The key is neither RSA nor EC, or its algorithm does not match its curve.