Jwks #59
Jwks #59
Conversation
# Conflicts: # src/core/security.tf
src/core/security.tf
Outdated
| key_properties { | ||
| exportable = true | ||
| key_size = 2048 | ||
| key_type = "RSA" | ||
| reuse_key = true | ||
| } |
There was a problem hiding this comment.
maybe it's better an EC algorithm or more length RSA key 4096
There was a problem hiding this comment.
@pp-ps have u a suggestion for algorithm/key length?
There was a problem hiding this comment.
As long as the call to forge a token (signed with this key) is authenticated and observable in metrics, I don't have any strong bias against RSA. EC verification (for receiveing systems) is much more expensive.
RSA 2048 bit looks fine too, as long as the key is periodically rotated (1y?, let's think about it as if it's an expiring certificate)
What I find strange is the choice to pack everything in a azurerm_key_vault_certificate. Why can't we use a azurerm_key_vault_key?
There was a problem hiding this comment.
@antonioT90 can u try to use azurerm_key_vault_key?
with azurerm_key_vault_key u can retrieve
n - The RSA modulus of this Key Vault Key
e - The RSA public exponent of this Key Vault Key
and remove python script
There was a problem hiding this comment.
@pasqualedevita i'm not able to retrieve the private key generated using key_vault_key, we need it in order to firm JWT token in hubSpidLogin application
There was a problem hiding this comment.
same answer to @pp-ps! the use of key_vault_key will not allow me to read the private key generated
the use of azurerm_key_vault_certificate is due to transform the private and public keys into a X509 certificate, simplifying the calculation of thumbprint
There was a problem hiding this comment.
regarding the rotation of the keys, there is a problem due to the inability to replace a previous version of a key: actually I obtain an error due to the safe delete feature enabled which will not allow to perform a delete and purge of previous value...
# Conflicts: # src/core/security.tf
|
I hear we need to speed up deployment of this, let's go ahead and refactor later.
Approving for now. |
List of changes
jwks file generation with jwt certificate
Motivation and context
Type of changes
Env to apply
Does this introduce a change to production resources with possible user impact?
Does this introduce an unwanted change on infrastructure? Check terraform plan execution result
Other information
If PR is partially applied, why? (reserved to mantainers)