I am trying to determine if the JwtBearer Service provided for .Net Core 3.0, actually uses the asymettric signing key that is provided by my oidc provider's well known configuration?
I can't find any documentation around this.
.AddJwtBearer(opt =>
{
opt.Authority = "http://localhost:8180/auth/realms/master";
opt.TokenValidationParameters = new Microsoft.IdentityModel.Tokens.TokenValidationParameters
{
ValidateIssuer = true,
ValidateAudience = false,
ValidateLifetime = true,
ValidateIssuerSigningKey = true
};
I am using Keycloak 4.8.3 as my oidc provider. The closest documentation I could find was here. https://developer.okta.com/blog/2018/03/23/token-authentication-aspnetcore-complete-guide
The relevant piece is here:
If you let the JwtBearer middleware auto-configure via the discovery document, this all works automatically!
Did that above code do all that? Is this still relevant in 3.0 since we don't register the middleware anymore??
I bet a lot of people don't know about Asymetric Signing keys, and why they are so important. We have abstracted away so much from the developer, that now I don't even know if my api is secure.
So the final question is:
Does the .AddJwtBearer service with "ValidateIssuerSigningKey" periodically check the wellknown or whatever discovery document to grab the latest asymettric signing key?