Repository navigation
docs: async signing with a remote KMS via DefaultTokenCreationService - #1261
Merged
maartenba merged 3 commits intoOct 14, 2026
Merged
Conversation
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The sample bypasses configured signing-algorithm restrictions and omits a required CryptographyClient registration prerequisite.
2 open findings
What changed in this PR
Adds guidance for asynchronous remote KMS signing through DefaultTokenCreationService.
Changes:
- Links remote KMS guidance to a new Azure Key Vault example.
- Documents registration, version differences, rotation, and latency concerns.
| File | Description |
|---|---|
astro/src/content/docs/identityserver/fundamentals/key-management.md |
Adds asynchronous KMS signing guidance and sample code. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Co-authored-by: maartenba <485230+maartenba@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #1258 based on review feedback:
SignatureProvidersigning is synchronous by design, so this adds a section showing how to subclassDefaultTokenCreationServiceand overrideCreateJwtAsyncto use a KMS SDK's async signing API (Azure Key Vault example).alg/kidfrom the registered signing credential so the JWT header matches discovery.AddSigningCredentialand disables automatic key management. Verified againstDuendeSoftware/products:DefaultTokenServiceandAuthorizeResponseGeneratorneed a signing credential forat_hash/c_hash/s_hash, andDiscoveryResponseGeneratoruses it forid_token_signing_alg_values_supported;AddSigningCredential(SigningCredentials)accepts a public-onlyAsymmetricSecurityKey.SamlSigningService) does not go throughITokenCreationServiceand needs a private key, so it is not covered.Targets
mb/key-management-hsm-kmsso it can be merged into #1258.