Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Azure KeyVault for signing sample #38

Open
leastprivilege opened this issue Jan 19, 2022 · 1 comment
Open

Azure KeyVault for signing sample #38

leastprivilege opened this issue Jan 19, 2022 · 1 comment
Milestone

Comments

@leastprivilege
Copy link
Member

  • get public key from KV
  • use KV for signing tokens
@amadard
Copy link

amadard commented Apr 22, 2022

I have looked into how to use the KeyVault for signing tokens and I ran into a couple items:

  1. KeyVault has a 2000 request per 10 second hard limit. My thought was to build a solution that allowed multiple KeyVaults to be hooked up to scale past the rate limit when approaching that request rate. It would require retrieving the public key from all connected KeyVaults.
    https://docs.microsoft.com/en-us/azure/key-vault/general/service-limits
    https://docs.microsoft.com/en-us/azure/key-vault/general/overview-throttling
  2. All of the examples I found for using the KeyVault to sign tokens were based on the premise of only one signing algorithm, and that created potential difficulties if specific certificates were used for specific algorithms. There needs to be one implementation of ISigningCredentialStore per signing algorithm, and the DefaultTokenCreationService needs to know the correct certificate URL to use based on the requested signing algorithm.

@leastprivilege leastprivilege removed their assignment Dec 22, 2022
@brockallen brockallen added this to the Future milestone Jan 23, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

3 participants