Class IdentityServerBuilderExtensionsSigningKeys

Namespace

Microsoft.Extensions.DependencyInjection

Assembly

Fdyay.IdentityServer.Core.dll

Registering a signing key the host owns, instead of one this server generates.

public static class IdentityServerBuilderExtensionsSigningKeys

Inheritance

object

IdentityServerBuilderExtensionsSigningKeys

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.MemberwiseClone()

object.ReferenceEquals(object, object)

object.ToString()

Remarks

Pair either of these with KeyManagement.Enabled = false. On its own a registered credential changes nothing about signing — its public half joins the JWKS so tokens it signed still validate, which is what a migration needs, but the managed key keeps signing until the flag says otherwise.

Methods

AddSigningCredential(IIdentityServerBuilder, SecurityKey, string)

Signs with the given key and algorithm.

public static IIdentityServerBuilder AddSigningCredential(this IIdentityServerBuilder builder, SecurityKey key, string signingAlgorithm)

Parameters

builder IIdentityServerBuilder

key SecurityKey

signingAlgorithm string

Returns

IIdentityServerBuilder

AddSigningCredential(IIdentityServerBuilder, SigningCredentials)

Signs with the given credential.

public static IIdentityServerBuilder AddSigningCredential(this IIdentityServerBuilder builder, SigningCredentials credentials)

Parameters

builder IIdentityServerBuilder

credentials SigningCredentials

Returns

IIdentityServerBuilder

AddSigningCredential(IIdentityServerBuilder, X509Certificate2, string)

Signs with the given certificate's private key.

public static IIdentityServerBuilder AddSigningCredential(this IIdentityServerBuilder builder, X509Certificate2 certificate, string signingAlgorithm = "RS256")

Parameters

builder IIdentityServerBuilder

certificate X509Certificate2

signingAlgorithm string

Returns

IIdentityServerBuilder

AddValidationKey(IIdentityServerBuilder, SecurityKey, string)

Publishes a key in the JWKS and accepts it on validation, without signing with it.

public static IIdentityServerBuilder AddValidationKey(this IIdentityServerBuilder builder, SecurityKey key, string signingAlgorithm = "RS256")

Parameters

builder IIdentityServerBuilder

key SecurityKey

signingAlgorithm string

Returns

IIdentityServerBuilder

Remarks

The other half of a manual rotation: sign with the new key, keep publishing the old one until every token it signed has expired. Without this, deploying a new key invalidates every token issued before it.