Skip to content
Contact us

ServiceCollectionExtensions Class

Registers the HashiCorp Vault / OpenBao Transit custodian for any host that signs or decrypts JSON Web Tokens, whether or not it is an OpenID Provider.

C#
public static class ServiceCollectionExtensions

Inheritance System.Object → ServiceCollectionExtensions

Methods

ServiceCollectionExtensions.AddVaultCustodian(this IServiceCollection, Action<VaultTransitOptions>) Method

Registers Vault / OpenBao Transit as the custodian of the host's keys and opens the placement choice that completes the wiring. This call is only the transport: it points a client at the Vault server and carries the auth token. Which keys are used - and whether their private halves ever enter this process - is the placement call chained onto the returned builder, which must follow: a custodian without one fails at startup rather than silently falling back to whatever keys the configuration carries. Chain both calls AFTER AddJsonWebTokens (the OIDC registration performs it), which the placement call composes onto.

C#
public static Abblix.Jwt.ExternalKeys.IKeyCustodianBuilder AddVaultCustodian(this Microsoft.Extensions.DependencyInjection.IServiceCollection services, System.Action<Abblix.Jwt.Vault.VaultTransitOptions> configureOptions);

Parameters

services Microsoft.Extensions.DependencyInjection.IServiceCollection

The service collection to configure.

configureOptions System.Action<VaultTransitOptions>

Configures the Vault address, auth token and Transit mount.

Returns

IKeyCustodianBuilder
The builder whose placement call completes the wiring.

Example

C#
services
    .AddVaultCustodian(vault => configuration.GetSection("Vault").Bind(vault))
    .UseKeysInCustodian(new CustodianHeldKeys { SigningKeyName = "oidc-sign" });

ServiceCollectionExtensions.PersistRingToVaultKeyValue(this IMintedKeysBuilder, Action<VaultKeyValueOptions>) Method

Keeps the ring of minted keys in this Vault's KV version 2 engine, on the same server that holds the key protecting them.

C#
public static Microsoft.Extensions.DependencyInjection.IServiceCollection PersistRingToVaultKeyValue(this Abblix.Jwt.ExternalKeys.IMintedKeysBuilder builder, System.Action<Abblix.Jwt.Vault.VaultKeyValueOptions>? configureOptions=null);

Parameters

builder IMintedKeysBuilder

The builder returned by UseKeysInProcess.

configureOptions System.Action<VaultKeyValueOptions>

Configures the KV mount and the path the ring lives under.

Returns

Microsoft.Extensions.DependencyInjection.IServiceCollection
The service collection, for chaining.

Remarks

It hangs off the minting placement rather than the service collection because a ring belongs to it and to no other: the placement where the custodian holds every key has nothing to store.

The engine must be KV v2. Its cas=0 write is the insert-if-absent the ring is built on, and it is what makes exactly one pod mint a period without a lock service. What lands there is a JWE the server sealed to the custodian's key, so the engine holds ciphertext and never a secret.

Previous
KubernetesAuthenticationOptions
Next
VaultAuthenticationOptions