Open.IdentityServer

Adding Key Rotation to Open.IdentityServer

This guide outlines the steps to integrate the Key Rotation component into an existing Open.IdentityServer server implementation. A completed example is available on GitHub.

Note: This component requires a license to operate. You can request a demo or contact us at sales@identityserver.com for purchasing information.

NuGet Installation

Install the Rsk.KeyRotation.IdentityServer package from NuGet in your Open.IdentityServer project:

dotnet add package Rsk.KeyRotation.OpenIdentityServer
dotnet add package Rsk.KeyRotation.EntityFrameworkCore

Initial Configuration

To enable Key Rotation, call IIdentityServerServerBuilder.AddRskKeyRotation within your Open.IdentityServer configuration. This method accepts a delegate that provides an instance of IdentityServerKeyRotationBuilder for configuring the component. Below is a basic example:

using Rsk.KeyRotation.OpenIdentityServer.DependencyInjection;
using Rsk.KeyRotation.EntityFrameworkCore.DependencyInjection;
...

services.AddIdentityServer()
    .AddOperationalStore(options =>
    {
        // operational store config
    })
    .AddConfigurationStore(options =>
    {
        // configuration store config
    })
    .AddRskKeyRotation(keyRotationBuilder =>
    {
        keyRotationBuilder.UseEntityFrameworkCore()
            .AddKeyRotationDbContext(dbBuilder =>
            {
                // Example using the SQL Server provider; you may use any supported EF Core provider.
                // The MigrationsAssembly should match the current project’s assembly name.
                // You could use a class name within your assembly to do this dynamically:
                // typeof(SomeClass).GetTypeInfo().Assembly.GetName().Name
                dbBuilder.UseSqlServer("***ConnectionString***", opt => 
                    opt.MigrationsAssembly("CurrentProject.Assembly.Name"));
            });

        keyRotationBuilder.AddLicense("DEMO", "***LicenseKey***");
    });

Check for Static Signing Keys

Key Rotation registers its own implementations of ISigningCredentialStore and IValidationKeysStore, so you will need to check that you don't have any conflicting stores registered to ensure your signing key is rotated correctly. It's best to remove all other stores and leave KeyRotation as your source of signing and validation keys.

Open.IdentityServer retrieves signing keys by getting the first available, and if a client requires a specific algorithm, it will retrieve the first that is available for that algorithm. So, in order for the KeyRotation key to be the default, it is best to register any other keys after you call IIdentityServerServerBuilder.AddRskKeyRotation.

Setting Up the Database with EF Core

The Key Rotation component requires two database tables. You can use Entity Framework Core tools to generate and apply the necessary migrations, or apply them manually using our provided SQL script.

Prerequisites

Install the Microsoft.EntityFrameworkCore.Design package:

dotnet add package Microsoft.EntityFrameworkCore.Design

Generate the migration files:

dotnet ef migrations add KeyRotation_Initial --context KeyRotationDbContext

Apply the migration to the database:

dotnet ef database update --context KeyRotationDbContext