search

IdentityServer / IdentityServer3

OpenID Connect Provider and OAuth 2.0 Authorization Server Framework for ASP.NET 4.x/Katana
https://identityserver.github.io/Documentation/
Apache License 2.0
2.01k stars 764 forks source link

Suggestion: Implement a hashing service, rather than the extension methods #3424

Closed eckersalld closed 7 years ago

eckersalld commented 7 years ago

I'm currently creating a set of encryption services for my implementation of IdSrv, and it struck me that such a thing may be a better fit for the IoC pattern than the current extension methods?

Suggestions:

Create a hashing service, with a default implementation Create a peppering service, with a default implementation Extend the Secret object to hold a 'Salt' property

What do you think?

leastprivilege commented 7 years ago

We are not planning to add such a feature to IdentityServer3 for now - can you use IdentityServer4?

eckersalld commented 7 years ago

I've already written what I need for IdentityServer3, it was just that as I was coding it, I thought I'd suggest your own implementation as a future feature.

I can appreciate you focusing on 4, but with this being a public sector client I can't see moving up a version for another 2 years at least.

Does IdentityServer4 have that functionality baked in?

brockallen commented 7 years ago

We don't, but I think we opened issues to investigate. Feel free to comment on them (or if we're missing the feature you're asking for, open new ones)