InMemoryKeyRing Class
A key ring whose keys are minted in this process and never leave it.
public sealed class InMemoryKeyRing : Abblix.Jwt.ExternalKeys.IKeyRingInheritance System.Object → InMemoryKeyRing
Implements IKeyRing
Remarks
The default for a host that has no HSM or KMS, which is most of them. It gives what a ring is for - rotation without breaking what the retired key produced - and nothing more: the keys live in memory, so they are gone when the process is, and no other process shares them.
That last property is the whole of the difference from Abblix.Jwt.ExternalKeys.KeyRing, and it is a difference in guarantee, not in strength. A custodian-backed ring puts the private half somewhere this process cannot reach and every replica can; this one puts it somewhere only this process can reach. Which is right depends on how the host is deployed, so the host chooses rather than inheriting a default.
Constructors
InMemoryKeyRing(LocalKeys, IOptions<KeyRingOptions>, TimeProvider) Constructor
Creates the ring.
public InMemoryKeyRing(Abblix.Jwt.ExternalKeys.LocalKeys policy, Microsoft.Extensions.Options.IOptions<Abblix.Jwt.ExternalKeys.KeyRingOptions> options, System.TimeProvider timeProvider);Parameters
policy LocalKeys
options Microsoft.Extensions.Options.IOptions<KeyRingOptions>
timeProvider System.TimeProvider
Methods
InMemoryKeyRing.Get(string, bool) Method
Returns the keys for a role, the one to produce with leading.
public System.Collections.Generic.IEnumerable<Abblix.Jwt.JsonWebKey> Get(string usage, bool includePrivateKeys);Parameters
usage System.String
Which role to serve, signature or encryption.
includePrivateKeys System.Boolean
Whether the caller needs the private half, which only signing and decryption do. Publication must not.
Implements Get(string, bool)
Returns
System.Collections.Generic.IEnumerable<JsonWebKey>
Remarks
The ordering carries meaning: whoever produces takes the first key for an algorithm, while every key stays in the result so consumers can still verify or decrypt across a rotation.
InMemoryKeyRing.RefreshAsync(CancellationToken) Method
Brings the ring up to date: mints what the current period lacks, retires what has expired, and reloads what other instances have minted.
public System.Threading.Tasks.Task RefreshAsync(System.Threading.CancellationToken cancellationToken);Parameters
cancellationToken System.Threading.CancellationToken
Cancels the refresh.
Implements RefreshAsync(CancellationToken)