With Open.IdentityServer we have decided to match the current Duende IdentityServer schema to enable the use of the existing IdentityServer database with no migration needed.
With Open.IdentityServer version 1, most of these additional tables and fields will be unused until we come to implement these features in Open.IdentityServer.
Keys Compatibility Store¶
You will be able to configure read-only access to the Keys table in Open.IdentityServer. This will register the active
key for each configured algorithm when found in the database.
An active key is one that was created before the CompatibilityKeyStoreOptions.KeyPropagationTime and younger than the CompatibilityKeyStoreOptions.MaxLifetime. If all keys are younger than the propagation time setting, then the oldest of these keys will be registered. All non-expired signing keys in the table will be used for validation.
Key stores are registered per-algorithm based on CompatibilityKeyStoreOptions.SupportedAlgorithms. We have added the extension method IIdentityServerBuilder.AddCompatibilityKeyStores which will register these key stores in the DI container for you.
services.AddIdentityServer(options =>
{
//IdS Config
})
.AddCompatibilityKeyStores();
Note
The default propagation time will be respected if possible, and only RS256 keys will be loaded for signing by default. Default key expiry (i.e. keys not used for signing or validation) is 90 days.
This store is intended only for transitioning to Open.IdentityServer. More robust key management should be set up before keys reach expiry. If you need automatic key rotation, see our KeyRotation component on identityserver.com products page.