IIssuerKeyResolver Interface

Answers which keys an issuer's signatures may verify against - the trust decision the signature check delegates, since WHO holds an issuer's keys is deployment knowledge no library can carry.

public interface IIssuerKeyResolver

Derived
↳ JwksIssuerKeyResolver

Remarks

An issuer this resolver yields no keys for is an issuer whose tokens cannot be accepted, and the verifier reports that as a key miss rather than a bad signature: after a key rollover a refetch may heal a miss, which a wrong signature never becomes.

Methods

IIssuerKeyResolver.ResolveSigningKeysAsync(string, string, CancellationToken) Method

Resolves the signature verification keys of an issuer.

System.Collections.Generic.IAsyncEnumerable<Abblix.Jwt.JsonWebKey> ResolveSigningKeysAsync(string issuer, string? keyId=null, System.Threading.CancellationToken cancellationToken=default(System.Threading.CancellationToken));

Parameters

issuer System.String

The issuer as its tokens spell it in "iss".

keyId System.String

The "kid" the token's header names, when it names one. This is the key-rollover signal: a caching implementation that holds keys for the issuer but none under this identifier knows its copy predates a rotation and refreshes before answering, instead of failing a token signed with a key newer than the cache.

cancellationToken System.Threading.CancellationToken

Cancels retrieval mid-flight.

Returns

System.Collections.Generic.IAsyncEnumerable<JsonWebKey>
The issuer's current verification keys; empty when the issuer is not trusted.