KeyVaultClient Class

Thin wrapper over the Azure Key Vault SDK. Signing and unwrapping run inside the vault against a key whose private half never leaves it, so this type only moves bytes across the boundary. The Azure SDK is pointed at the host's System.Net.Http.IHttpClientFactory transport (like the Vault client), so it inherits the host's HTTP handlers, logging and pooling. A Azure.Security.KeyVault.Keys.Cryptography.CryptographyClient is cached per key name because creating one resolves the key's metadata on first use.

public sealed class KeyVaultClient : Abblix.Jwt.ExternalKeys.IKeyCustodian

Inheritance System.Object → KeyVaultClient

Implements IKeyCustodian

Constructors

KeyVaultClient(ILogger<KeyVaultClient>, IOptions<AzureKeyVaultOptions>, HttpClient) Constructor

Creates the client for the vault named by options, selecting a client-secret credential when the service-principal fields are set, or the default Azure credential chain otherwise.

public KeyVaultClient(Microsoft.Extensions.Logging.ILogger<Abblix.Jwt.Azure.KeyVaultClient> logger, Microsoft.Extensions.Options.IOptions<Abblix.Jwt.Azure.AzureKeyVaultOptions> options, System.Net.Http.HttpClient httpClient);

Parameters

logger Microsoft.Extensions.Logging.ILogger<KeyVaultClient>

Logs an unwrap the vault rejected.

options Microsoft.Extensions.Options.IOptions<AzureKeyVaultOptions>

The configured Azure Key Vault options.

httpClient System.Net.Http.HttpClient

The transport for every Key Vault call, supplied by AddHttpClient so the Azure SDK rides the host's HTTP pipeline.

Methods

KeyVaultClient.AgreeKeyAsync(string, string, JsonWebKey, CancellationToken) Method

Derives the ECDH-ES shared secret. Azure Key Vault exposes no key-agreement primitive, so this store does not support ECDH-ES; a store built on AWS KMS (DeriveSharedSecret) or a PKCS#11 HSM (CKM_ECDH1_DERIVE) can.

public System.Threading.Tasks.Task<byte[]> AgreeKeyAsync(string keyId, string algorithm, Abblix.Jwt.JsonWebKey ephemeralPublicKey, System.Threading.CancellationToken cancellationToken);

Parameters

keyId System.String

algorithm System.String

ephemeralPublicKey JsonWebKey

cancellationToken System.Threading.CancellationToken

Implements AgreeKeyAsync(string, string, JsonWebKey, CancellationToken)

Returns

System.Threading.Tasks.Task<System.Byte[]>

KeyVaultClient.GetKeyVersionsAsync(string, CancellationToken) Method

Enumerates every enabled version of the Key Vault key as a public-only JWK (RSA or EC, per the key type), each carrying the version-specific kid (<name>/<version>) and the version's creation time. Key Vault lists version metadata but not the public key, so each version's key is fetched. Called at publication time, so JWKS publishing and signature verification run locally against the result and never touch the vault on the hot path. The versioned kid is a Key Vault key identifier, which the crypto client turns straight back into a versioned URI for sign/unwrap, so no separate handle mapping is needed.

public System.Collections.Generic.IAsyncEnumerable<Abblix.Jwt.KeyVersion> GetKeyVersionsAsync(string keyName, System.Threading.CancellationToken cancellationToken);

Parameters

keyName System.String

cancellationToken System.Threading.CancellationToken

Implements GetKeyVersionsAsync(string, CancellationToken)

Returns

System.Collections.Generic.IAsyncEnumerable<KeyVersion>

KeyVaultClient.SignAsync(string, string, byte[], CancellationToken) Method

Signs the JWS signing input with a Key Vault key under the given JWS algorithm. Key Vault hashes the data and returns the raw signature already in JWS wire format (R||S for EC).

public System.Threading.Tasks.Task<byte[]> SignAsync(string keyId, string algorithm, byte[] data, System.Threading.CancellationToken cancellationToken);

Parameters

keyId System.String

algorithm System.String

data System.Byte[]

cancellationToken System.Threading.CancellationToken

Implements SignAsync(string, string, byte[], CancellationToken)

Returns

System.Threading.Tasks.Task<System.Byte[]>

KeyVaultClient.UnwrapKeyAsync(string, string, JsonWebTokenHeader, byte[], CancellationToken) Method

Unwraps (decrypts) a CEK with a Key Vault RSA key under the given key-management algorithm (RSA-OAEP-256, RSA-OAEP or RSA1_5). Key Vault decrypts a raw JWE ciphertext directly. Returns null when the vault rejects the ciphertext, so a wrong key or tampered ciphertext is indistinguishable, which the seam's padding-oracle mitigation relies on. The JWE header is unused: an RSA unwrap needs only the ciphertext.

public System.Threading.Tasks.Task<byte[]?> UnwrapKeyAsync(string keyId, string algorithm, Abblix.Jwt.JsonWebTokenHeader header, byte[] encryptedKey, System.Threading.CancellationToken cancellationToken);

Parameters

keyId System.String

algorithm System.String

header JsonWebTokenHeader

encryptedKey System.Byte[]

cancellationToken System.Threading.CancellationToken

Implements UnwrapKeyAsync(string, string, JsonWebTokenHeader, byte[], CancellationToken)

Returns

System.Threading.Tasks.Task<System.Byte[]>