Skip to content

docs: add guidance for using HSMs and cloud KMS in key management - #1258

Merged
maartenba merged 6 commits into
mainfrom
mb/key-management-hsm-kms
Oct 14, 2026
Merged

docs: add guidance for using HSMs and cloud KMS in key management#1258
maartenba merged 6 commits into
mainfrom
mb/key-management-hsm-kms

Conversation

@maartenba

@maartenba maartenba commented Oct 13, 2026

Copy link
Copy Markdown
Member

No description provided.

@maartenba maartenba added this to the 2026-Q4 milestone Oct 13, 2026
@maartenba
maartenba requested review from ProgrammerAL, khalidabuhakmeh and wcabus and a balanced review from Copilot October 13, 2026 11:13
@maartenba maartenba self-assigned this Oct 13, 2026
@maartenba maartenba added the documentation Improvements or additions to documentation label Oct 13, 2026
Copilot AI reviewed Oct 13, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

The remote KMS guidance names the wrong IdentityModel extension point, and the list markers violate repository conventions.

2 open findings
What changed in this PR

Adds guidance for integrating HSMs and cloud KMS providers with IdentityServer key management.

Changes:

  • Explains local provider-backed and remote KMS signing.
  • Clarifies that ISigningKeyStore cannot use non-exportable keys.
File Description
astro/​src/​content/​docs/​identityserver/​fundamentals/​key-management.md Adds HSM and cloud KMS integration guidance.

🧠 Review effort: Balanced

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Comment thread astro/src/content/docs/identityserver/fundamentals/key-management.md Outdated
Comment thread astro/src/content/docs/identityserver/fundamentals/key-management.md Outdated
@wcabus

wcabus commented Oct 13, 2026

Copy link
Copy Markdown
Member

I wonder if we should add that the currently discussed solution (CryptoProviderFactory) is synchronous by design, offering a solution by subclassing the DefaultTokenCreationService to achieve a custom solution where you can use the async methods offered by, e.g. Key Vault

@maartenba maartenba mentioned this pull request Oct 13, 2026
Merged
@maartenba

maartenba commented Oct 13, 2026

Copy link
Copy Markdown
Member Author

Good point! Would this be an option? #1261

Copilot AI and others added 2 commits October 14, 2026 09:01
@maartenba
docs: default JWT type header in KMS example
91ab44e 
Co-authored-by: maartenba <485230+maartenba@users.noreply.github.com>
@maartenba
Merge pull request #1261 from DuendeSoftware/mb/key-management-hsm-km…
70a1279 
…s-async

docs: async signing with a remote KMS via DefaultTokenCreationService
@maartenba

maartenba commented Oct 14, 2026

Copy link
Copy Markdown
Member Author

OK merged that alternative in, @wcabus think this one is ready to go?

@maartenba
maartenba merged commit d31ea7c into main Oct 14, 2026
6 checks passed
@maartenba
maartenba deleted the mb/key-management-hsm-kms branch October 14, 2026 09:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@wcabus wcabus wcabus approved these changes
@khalidabuhakmeh khalidabuhakmeh Awaiting requested review from khalidabuhakmeh
@ProgrammerAL ProgrammerAL Awaiting requested review from ProgrammerAL

Assignees

@maartenba maartenba

Labels

documentation Improvements or additions to documentation

Projects

None yet

Milestone

2026-Q4

Development

Successfully merging this pull request may close these issues.

4 participants

@maartenba @wcabus