ServiceCollectionExtensions Class

Registers the Azure Key Vault custodian for any host that signs or decrypts JSON Web Tokens, whether or not it is an OpenID Provider.

public static class ServiceCollectionExtensions

Inheritance System.Object → ServiceCollectionExtensions

Methods

ServiceCollectionExtensions.AddAzureCustodian(this IServiceCollection, Action<AzureKeyVaultOptions>) Method

Registers Azure Key Vault as the custodian of the host's keys and opens the placement choice that completes the wiring. This call is only the transport: it registers the vault client and its credential. Which keys are used - and whether their private halves ever enter this process - is the placement call chained onto the returned builder, which must follow: a custodian without one fails at startup rather than silently falling back to whatever keys the configuration carries. Chain both calls AFTER AddJsonWebTokens (the OIDC registration performs it), which the placement call composes onto.

public static Abblix.Jwt.ExternalKeys.IKeyCustodianBuilder AddAzureCustodian(this Microsoft.Extensions.DependencyInjection.IServiceCollection services, System.Action<Abblix.Jwt.Azure.AzureKeyVaultOptions> configureOptions);

Parameters

services Microsoft.Extensions.DependencyInjection.IServiceCollection

The service collection to configure.

configureOptions System.Action<AzureKeyVaultOptions>

Configures the vault URI and the service-principal credentials.

Returns

IKeyCustodianBuilder
The builder whose placement call completes the wiring.

Example

services
    .AddAzureCustodian(azure => configuration.GetSection("Azure").Bind(azure))
    .UseKeysInCustodian(new CustodianHeldKeys { SigningKeyName = "oidc-sign" });

ServiceCollectionExtensions.PersistRingToAzureBlob(this IMintedKeysBuilder, Action<AzureBlobKeyRingOptions>) Method

Keeps the ring of minted keys in an Azure Blob Storage container, using the same credential the custodian authenticates with.

public static Microsoft.Extensions.DependencyInjection.IServiceCollection PersistRingToAzureBlob(this Abblix.Jwt.ExternalKeys.IMintedKeysBuilder builder, System.Action<Abblix.Jwt.Azure.AzureBlobKeyRingOptions> configureOptions);

Parameters

builder IMintedKeysBuilder

The builder returned by UseKeysInProcess.

configureOptions System.Action<AzureBlobKeyRingOptions>

Configures the blob service endpoint and the container.

Returns

Microsoft.Extensions.DependencyInjection.IServiceCollection
The service collection, for chaining.

Remarks

It hangs off the minting placement rather than the service collection because a ring belongs to it and to no other: the placement where the vault holds every key has nothing to store.

Blob rather than a Key Vault secret, though the vault is already configured: a secret write has no conditional create, so two pods minting the same period would both succeed and each publish its own key. A blob upload takes If-None-Match: *, which is the insert-if-absent the ring needs. What lands there is a JWE sealed to the vault's key, so the container holds ciphertext and never a secret.