Eneuman
commented
6 years ago Of course :)
I'm just gonna add the code in this post and you can pick the parts you like.
The idea is like this: When you create a new certificate in Azure Key Vault you can set it to automaticly renew (create a new version) at a certain time. The extension will add all "Enabled" versions if the certificate to the ValidationKey set, and add the currect active version as the signing certificate. The extension caches the keys for 1 day because of performance reasons. When you decide that your key rollover periode is over, you go into Azure Key Vault and disable the old version.
Note: MSI (Managed Service Identities) does not work out of the box on a local dev machine so its better to check environment and use the methods where you add client id and secret.
MSI should work on Azure Scale Sets and Azure App Services (but not in deployment slot scenarios yet, as far as I know, long post on github about it)
The code needs the following nuget packages to work:
<PackageReference Include="IdentityServer4" Version="2.2.0" />
<PackageReference Include="Microsoft.Azure.KeyVault" Version="3.0.0" />
<PackageReference Include="Microsoft.Azure.Services.AppAuthentication" Version="1.0.3" />DISCLAIMER: I have not fully tested the code yet so there might be bugs left ;)
using IdentityServer4.Stores;
using Microsoft.Azure.KeyVault;
using Microsoft.Azure.Services.AppAuthentication;
using Microsoft.Extensions.Caching.Memory;
using Microsoft.Extensions.DependencyInjection;
using Microsoft.IdentityModel.Clients.ActiveDirectory;
using Microsoft.IdentityModel.Tokens;
using System;
using System.Collections.Generic;
using System.Linq;
using System.Security.Cryptography.X509Certificates;
using System.Threading.Tasks;
namespace Authentication.Identity.Service.Extensions
{
/// <summary>
/// Extension methods for using Azure Key Vault with <see cref="IIdentityServerBuilder"/>.
/// </summary>
public static class IdentityServerAzureKeyVaultConfigurationExtensions
{
/// <summary>
/// Adds a SigningCredentialStore and a ValidationKeysStore that reads the signing certificate from the Azure KeyVault.
/// </summary>
/// <param name="identityServerbuilder">The <see cref="IIdentityServerBuilder"/> to add to.</param>
/// <param name="vault">The Azure KeyVault uri.</param>
/// <param name="clientId">The application client id.</param>
/// <param name="clientSecret">The client secret to use for authentication.</param>
/// <param name="certificateName">The name of the certificate to use as the signing certificate.</param>
/// <returns>The <see cref="IIdentityServerBuilder"/>.</returns>
public static IIdentityServerBuilder AddSigningCredentialFromAzureKeyVault(this IIdentityServerBuilder identityServerbuilder, string vault, string clientId, string clientSecret, string certificateName, int signingKeyRolloverTimeInHours)
{
KeyVaultClient.AuthenticationCallback authenticationCallback = (authority, resource, scope) => GetTokenFromClientSecret(authority, resource, clientId, clientSecret);
var keyVaultClient = new KeyVaultClient(authenticationCallback);
identityServerbuilder.Services.AddMemoryCache();
var sp = identityServerbuilder.Services.BuildServiceProvider();
identityServerbuilder.Services.AddSingleton<ISigningCredentialStore>(new AzureKeyVaultSigningCredentialStore(sp.GetService<IMemoryCache>(), keyVaultClient, vault, certificateName, signingKeyRolloverTimeInHours));
identityServerbuilder.Services.AddSingleton<IValidationKeysStore>(new AzureKeyVaultValidationKeysStore(sp.GetService<IMemoryCache>(), keyVaultClient, vault, certificateName));
return identityServerbuilder;
}
/// <summary>
/// Adds a SigningCredentialStore and a ValidationKeysStore that reads the signing certificate from the Azure KeyVault.
/// </summary>
/// <param name="identityServerbuilder">The <see cref="IIdentityServerBuilder"/> to add to.</param>
/// <param name="vault">The Azure KeyVault uri.</param>
/// <param name="certificateName">The name of the certificate to use as the signing certificate.</param>
/// <remarks>Use this if you are using MSI (Managed Service Identity)</remarks>
/// <returns>The <see cref="IIdentityServerBuilder"/>.</returns>
public static IIdentityServerBuilder AddSigningCredentialFromAzureKeyVault(this IIdentityServerBuilder builder, string vault, string certificateName, int signingKeyRolloverTimeInHours)
{
var azureServiceTokenProvider = new AzureServiceTokenProvider();
var authenticationCallback = new KeyVaultClient.AuthenticationCallback(azureServiceTokenProvider.KeyVaultTokenCallback);
var keyVaultClient = new KeyVaultClient(authenticationCallback);
builder.Services.AddMemoryCache();
var sp = builder.Services.BuildServiceProvider();
builder.Services.AddSingleton<ISigningCredentialStore>(new AzureKeyVaultSigningCredentialStore(sp.GetService<IMemoryCache>(), keyVaultClient, vault, certificateName, signingKeyRolloverTimeInHours));
builder.Services.AddSingleton<IValidationKeysStore>(new AzureKeyVaultValidationKeysStore(sp.GetService<IMemoryCache>(), keyVaultClient, vault, certificateName));
return builder;
}
private static async Task<string> GetTokenFromClientSecret(string authority, string resource, string clientId, string clientSecret)
{
var authContext = new AuthenticationContext(authority);
var clientCred = new ClientCredential(clientId, clientSecret);
var result = await authContext.AcquireTokenAsync(resource, clientCred);
return result.AccessToken;
}
}
public class AzureKeyVaultSigningCredentialStore : KeyStore, ISigningCredentialStore
{
private readonly IMemoryCache _cache;
private readonly KeyVaultClient _keyVaultClient;
private readonly string _vault;
private readonly string _certificateName;
private readonly int _signingKeyRolloverTimeInHours;
public AzureKeyVaultSigningCredentialStore(IMemoryCache memoryCache, KeyVaultClient keyVaultClient, string vault, string certificateName, int signingKeyRolloverTimeInHours) : base(keyVaultClient, vault)
{
_cache = memoryCache;
_keyVaultClient = keyVaultClient;
_vault = vault;
_certificateName = certificateName;
_signingKeyRolloverTimeInHours = signingKeyRolloverTimeInHours;
}
public async Task<SigningCredentials> GetSigningCredentialsAsync()
{
// Try get the signing credentials from the cache
if (_cache.TryGetValue("SigningCredentials", out SigningCredentials signingCredentials))
return signingCredentials;
signingCredentials = await GetFirstValidSigningCredentials();
if (signingCredentials == null)
return null;
// Cache it
var options = new MemoryCacheEntryOptions();
options.AbsoluteExpiration = DateTime.Now.AddDays(1);
_cache.Set("SigningCredentials", signingCredentials, options);
return signingCredentials;
}
private async Task<SigningCredentials> GetFirstValidSigningCredentials()
{
// Find all enabled versions of the certificate
var enabledCertificateVersions = await GetAllEnabledCertificateVersionsAsync(_certificateName);
if (!enabledCertificateVersions.Any())
{
return null;
}
// Find the first certificate version that has a passed rollover time
var certificateVersionWithPassedRolloverTime = enabledCertificateVersions
.FirstOrDefault(certVersion => certVersion.Attributes.Created.HasValue && certVersion.Attributes.Created.Value < DateTime.UtcNow.AddHours(-_signingKeyRolloverTimeInHours));
// If no certificate with passed rollovertime was found, pick the first enabled version of the certificate (This can happen if it's a newly created certificate)
if (certificateVersionWithPassedRolloverTime == null)
{
return await GetSigningCredentialsFromCertificateAsync(enabledCertificateVersions.First());
}
else
{
return await GetSigningCredentialsFromCertificateAsync(certificateVersionWithPassedRolloverTime);
}
}
}
public class AzureKeyVaultValidationKeysStore : KeyStore, IValidationKeysStore
{
private readonly IMemoryCache _cache;
private readonly KeyVaultClient _keyVaultClient;
private readonly string _vault;
private readonly string _certificateName;
public AzureKeyVaultValidationKeysStore(IMemoryCache memoryCache, KeyVaultClient keyVaultClient, string vault, string certificateName) : base(keyVaultClient, vault)
{
_cache = memoryCache;
_keyVaultClient = keyVaultClient;
_vault = vault;
_certificateName = certificateName;
}
public async Task<IEnumerable<SecurityKey>> GetValidationKeysAsync()
{
// Try get the signing credentials from the cache
if (_cache.TryGetValue("ValidationKeys", out List<SecurityKey> validationKeys))
return validationKeys;
validationKeys = new List<SecurityKey>();
// Get all the certificate versions (this will also get the currect active version)
var enabledCertificateVersions = await GetAllEnabledCertificateVersionsAsync(_certificateName);
foreach (var certificateItem in enabledCertificateVersions)
{
// Add the security key to validation keys so any JWT tokens signed with a older version of the signing certificate
validationKeys.Add(await GetSecurityKeyFromCertificateAsync(certificateItem));
}
// Add the validation keys to the cache
var options = new MemoryCacheEntryOptions();
options.AbsoluteExpiration = DateTime.Now.AddDays(1);
_cache.Set("ValidationKeys", validationKeys, options);
return validationKeys;
}
}
public abstract class KeyStore
{
private readonly KeyVaultClient _keyVaultClient;
private readonly string _vault;
public KeyStore(KeyVaultClient keyVaultClient, string vault)
{
_keyVaultClient = keyVaultClient;
_vault = vault;
}
internal async Task<List<Microsoft.Azure.KeyVault.Models.CertificateItem>> GetAllEnabledCertificateVersionsAsync(string certificateName)
{
// Get all the certificate versions (this will also get the currect active version)
var certificateVersions = await _keyVaultClient.GetCertificateVersionsAsync(_vault, certificateName);
// Find all enabled versions of the certificate and sort them by creation date in decending order
return certificateVersions
.Where(certVersion => certVersion.Attributes.Enabled.HasValue && certVersion.Attributes.Enabled.Value)
.OrderByDescending(certVersion => certVersion.Attributes.Created)
.ToList();
}
internal async Task<SigningCredentials> GetSigningCredentialsFromCertificateAsync(Microsoft.Azure.KeyVault.Models.CertificateItem certificateItem)
{
var certificateVersionSecurityKey = await GetSecurityKeyFromCertificateAsync(certificateItem);
return new SigningCredentials(certificateVersionSecurityKey, SecurityAlgorithms.RsaSha256);
}
internal async Task<SecurityKey> GetSecurityKeyFromCertificateAsync(Microsoft.Azure.KeyVault.Models.CertificateItem certificateItem)
{
var certificateVersionBundle = await _keyVaultClient.GetCertificateAsync(certificateItem.Identifier.Identifier);
var certificatePrivateKeySecretBundle = await _keyVaultClient.GetSecretAsync(certificateVersionBundle.SecretIdentifier.Identifier);
var privateKeyBytes = Convert.FromBase64String(certificatePrivateKeySecretBundle.Value);
var certificateWithPrivateKey = new X509Certificate2(privateKeyBytes, (string)null, X509KeyStorageFlags.MachineKeySet);
return new X509SecurityKey(certificateWithPrivateKey);
}
}
}
You use the code by calling one of the public methods above from "ConfigureServices" inside your startup.cs like this
var identityServerBuilder = services.AddIdentityServer();
identityServerBuilder.AddSigningCredentialFromAzureKeyVault(Configuration["AzureKeyVault:Url"], "<My Key vault client id>", "<My key vault secret>", "<My Cert Name>", <Signing Key Rollover period in hours>);or if you are using MSI, you can do it like this:
var identityServerBuilder = services.AddIdentityServer();
identityServerBuilder.AddSigningCredentialFromAzureKeyVault(Configuration["AzureKeyVault:Url"], "<My Cert Name>", <Signing Key Rollover period in hours>);
kroymann
damienbod
abergs
gcbenjamin
sguryev
rvplauborg
PeterOrneholm
Simon-Gregory-LG
skoruba
connelhooley
@Eneuman Would you be interested in adding your code here?
Saw this issue: SigningKey Azure Key Vault Provider
I have some helpers for this, maybe your solution is better. I use this as a template or quick starter for creating STS servers, which can be deployed easily to Azure App Services or IIS
Greetings Damien