ExternalKeysProvider Class
Publishes the public halves of an IKeyCustodian's signing and encryption keys to the OIDC
pipeline, one entry per current key version. It never returns private material: each key is public-only, which
is the signal the crypto seam reads to route the private operation to the custodian by kid.
Version-awareness rides the produce/publish split of IAuthServiceKeysProvider: every version is
published (so a client can verify a signature or encrypt a JWE to any of them, and a rotation overlaps), while
the ACTIVE version - the newest one past the server's KeyRolloverPropagation window -
leads the set, so the produce role signs and encrypts with it. A freshly rotated version stays announced
(published, trailing) until it clears the window, so a client that has not refreshed its JWKS cache never sees
a token produced with a version it lacks. One provider serves any custodian, so the Vault and Azure packages
carry no key provider of their own.
public sealed class ExternalKeysProvider : Abblix.Oidc.Server.Common.Interfaces.IAuthServiceKeysProviderInheritance System.Object → ExternalKeysProvider
Implements IAuthServiceKeysProvider
Constructors
ExternalKeysProvider(IKeyCustodian, CustodianHeldKeys, IOptions<OidcOptions>, TimeProvider) Constructor
Publishes the public halves of an IKeyCustodian's signing and encryption keys to the OIDC
pipeline, one entry per current key version. It never returns private material: each key is public-only, which
is the signal the crypto seam reads to route the private operation to the custodian by kid.
Version-awareness rides the produce/publish split of IAuthServiceKeysProvider: every version is
published (so a client can verify a signature or encrypt a JWE to any of them, and a rotation overlaps), while
the ACTIVE version - the newest one past the server's KeyRolloverPropagation window -
leads the set, so the produce role signs and encrypts with it. A freshly rotated version stays announced
(published, trailing) until it clears the window, so a client that has not refreshed its JWKS cache never sees
a token produced with a version it lacks. One provider serves any custodian, so the Vault and Azure packages
carry no key provider of their own.
public ExternalKeysProvider(Abblix.Jwt.ExternalKeys.IKeyCustodian custodian, Abblix.Jwt.ExternalKeys.CustodianHeldKeys keys, Microsoft.Extensions.Options.IOptions<Abblix.Oidc.Server.Common.Configuration.OidcOptions> options, System.TimeProvider timeProvider);Parameters
custodian IKeyCustodian
keys CustodianHeldKeys
options Microsoft.Extensions.Options.IOptions<OidcOptions>
timeProvider System.TimeProvider
Methods
ExternalKeysProvider.GetEncryptionKeys(bool) Method
Gets the encryption keys used by the service. The first key per algorithm is the one it encrypts outbound tokens with; the rest are published so inbound JWE can be decrypted and to overlap a rotation. See the ordering note in the interface remarks.
public System.Collections.Generic.IAsyncEnumerable<Abblix.Jwt.JsonWebKey> GetEncryptionKeys(bool includePrivateKeys=false);Parameters
includePrivateKeys System.Boolean
Whether to include private keys in the result.
Implements GetEncryptionKeys(bool)
Returns
System.Collections.Generic.IAsyncEnumerable<JsonWebKey>
ExternalKeysProvider.GetSigningKeys(bool) Method
Gets the signing keys used by the service. The first key per algorithm is the one it signs with; the rest are published for verification and to overlap a rotation. See the ordering note in the interface remarks.
public System.Collections.Generic.IAsyncEnumerable<Abblix.Jwt.JsonWebKey> GetSigningKeys(bool includePrivateKeys=false);Parameters
includePrivateKeys System.Boolean
Whether to include private keys in the result.
Implements GetSigningKeys(bool)