JwksIssuerKeyResolver Class
Resolves issuers' verification keys from their published JWK Set documents, cached so the hot path of validation performs no network I/O.
public sealed class JwksIssuerKeyResolver : Abblix.SecurityEvents.Abstractions.IIssuerKeyResolverInheritance System.Object → JwksIssuerKeyResolver
Implements IIssuerKeyResolver
Remarks
A key rollover is noticed two ways: the cache lifetime expires, or a token names a "kid" the cached set lacks - the earliest possible signal - which forces one refetch, rate-limited so a flood of bogus identifiers cannot turn it into hammering the issuer. Concurrent resolutions may fetch the same document twice; the copies are identical and the last write wins, which is cheaper than a lock on every validation.
A fetch failure propagates as its exception rather than as an empty key set: empty means "this issuer is not trusted", a verdict about the token, while an unreachable JWKS endpoint is an infrastructure failure the delivery endpoint should answer with a retryable status, not with "invalid key".
Constructors
JwksIssuerKeyResolver(IHttpClientFactory, TimeProvider, IOptions<JwksKeyResolutionOptions>) Constructor
Resolves issuers' verification keys from their published JWK Set documents, cached so the hot path of validation performs no network I/O.
public JwksIssuerKeyResolver(System.Net.Http.IHttpClientFactory httpClientFactory, System.TimeProvider clock, Microsoft.Extensions.Options.IOptions<Abblix.SecurityEvents.Infrastructure.JwksKeyResolutionOptions> options);Parameters
httpClientFactory System.Net.Http.IHttpClientFactory
Supplies the HTTP client, created per fetch under HttpClientName so a host can configure the named client - timeouts, proxy, resilience - without touching this type.
clock System.TimeProvider
Drives cache expiry and the rollover cooldown.
options Microsoft.Extensions.Options.IOptions<JwksKeyResolutionOptions>
Where key sets live and how long they answer from cache.
Remarks
A key rollover is noticed two ways: the cache lifetime expires, or a token names a "kid" the cached set lacks - the earliest possible signal - which forces one refetch, rate-limited so a flood of bogus identifiers cannot turn it into hammering the issuer. Concurrent resolutions may fetch the same document twice; the copies are identical and the last write wins, which is cheaper than a lock on every validation.
A fetch failure propagates as its exception rather than as an empty key set: empty means "this issuer is not trusted", a verdict about the token, while an unreachable JWKS endpoint is an infrastructure failure the delivery endpoint should answer with a retryable status, not with "invalid key".
Methods
JwksIssuerKeyResolver.ResolveSigningKeysAsync(string, string, CancellationToken) Method
Resolves the signature verification keys of an issuer.
public System.Collections.Generic.IAsyncEnumerable<Abblix.Jwt.JsonWebKey> ResolveSigningKeysAsync(string issuer, string? keyId=null, System.Threading.CancellationToken cancellationToken=default(System.Threading.CancellationToken));Parameters
issuer System.String
The issuer as its tokens spell it in "iss".
keyId System.String
The "kid" the token's header names, when it names one. This is the key-rollover signal: a caching implementation that holds keys for the issuer but none under this identifier knows its copy predates a rotation and refreshes before answering, instead of failing a token signed with a key newer than the cache.
cancellationToken System.Threading.CancellationToken
Cancels retrieval mid-flight.
Implements ResolveSigningKeysAsync(string, string, CancellationToken)
Returns
System.Collections.Generic.IAsyncEnumerable<JsonWebKey>
The issuer's current verification keys; empty when the issuer is not trusted.