Implement ISigningKeyService about identityserver.contrib.azurekeyvaulttokensigningservice

[omerlh]

I've also opened an issue in identity server repo: IdentityServer/IdentityServer3#2727

[MattCotterellNZ]

I'm not sure how to resolve this one myself. I think you're right: on startup, we fetch the public key from Key Vault, use it to build an X509Certificate2 instance and pass it back to IdentityServer3/4 that way, but seeing as a public key != a certificate, it would be rather messy. I'll poke around the X509Certificate2 implementation in .NET and see what I can do. Watch this space :)

[omerlh]

I am working on it myself right now, it is not easy and the code is pretty much a mess. It is also very ugly because of the dependency between the ITokenSigningService and ISigningKeyService - especially the need to use the same kid. If I will have something that I feel good with, I will share it...

[MattCotterellNZ]

Sounds awesome. I do apologize if my code seems in a bit of a state, it's still very much a work in progress at this stage. Let me know if it gets in the way and I'll do what I can to help out.

[omerlh]

This is really fine :) I thought that's the situation...
I am also facing the same problem right now, so I might contribute some PR. My main problem is that I am looking for a generic solution that will allow me to switch between keyvault and PKCS11 easily.

[MattCotterellNZ]

Here's hoping your solution in IdentityServer/IdentityServer3#2732 goes through, it looks like this would solve a lot of our problems. Frankly, I've spent the past three hours banging my head against the IdentityServer, .NET and Key Vault APIs and I cannot see a clean way to do this beyond just changing IdentityServer to be more friendly with JWKs instead of requiring X509s.

[omerlh]

I was thinking the same, there is a way but the code become so ugly that I preferred to propose a PR to identity server and hope it will be accepted...

[omerlh]

Hey,
I've published a small adapter as a nuget package. This might help you with this...

[MattCotterellNZ]

Oh, that looks fantastic! I'll get to work on using this soon.

[omerlh]

Thank you! Hope it will be usefull :)