Class KeyVaultSigningKeyProvider

Namespace

NuvTools.Security.Signing.Azure

Assembly

NuvTools.Security.Signing.Azure.dll

Signs with an RSA key kept in Azure Key Vault. The private key never leaves the vault: this process holds the public half of each version and asks the vault for every signature.

public class KeyVaultSigningKeyProvider : ISigningKeyProvider, IDisposable

Inheritance

object

KeyVaultSigningKeyProvider

Implements

ISigningKeyProvider

IDisposable

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.MemberwiseClone()

object.ReferenceEquals(object, object)

object.ToString()

Remarks

Every enabled version of the key that is within its validity period is offered, so tokens signed before a rotation keep validating. A new version starts signing once it has been published for ActivationDelay.

The list of versions is read again every RefreshInterval. When the vault cannot be reached for that, the last list read keeps being served: a rotation noticed late is better than no token at all.

The identity used needs to list and read the key and to sign with it — the Key Vault Crypto User role covers both.

Constructors

KeyVaultSigningKeyProvider(KeyClient, TokenCredential, IOptions<KeyVaultSigningOptions>, TimeProvider, ILogger<KeyVaultSigningKeyProvider>)

Creates the provider.

public KeyVaultSigningKeyProvider(KeyClient keys, TokenCredential credential, IOptions<KeyVaultSigningOptions> options, TimeProvider time, ILogger<KeyVaultSigningKeyProvider> logger)

Parameters

keys KeyClient

The client for the vault holding the key.

credential TokenCredential

The identity the signatures are requested with.

options IOptions<KeyVaultSigningOptions>

Which key to use and how its rotation is followed.

time TimeProvider

The clock the activation delay and the refresh are measured on.

logger ILogger<KeyVaultSigningKeyProvider>

Where a failed refresh is reported.

Methods

Dispose()

Performs application-defined tasks associated with freeing, releasing, or resetting unmanaged resources.

public void Dispose()

GetSigningCredentialsAsync(CancellationToken)

Returns the current signing credentials.

public Task<IReadOnlyList<SigningCredentials>> GetSigningCredentialsAsync(CancellationToken cancellationToken = default)

Parameters

cancellationToken CancellationToken

Cancels the lookup.

Returns

Task<IReadOnlyList<SigningCredentials>>

The credentials in order of preference: the first is the one to sign with, and every one of them must be published, because tokens signed by the others may still be in use. Never empty.