Unify Your SAML and OIDC Signing Keys with Automatic Rotation and Duende IdentityServer

Csharp

builder.Services.AddIdentityServer(options =>
{
    options.KeyManagement.SigningAlgorithms =
    [
        new SigningAlgorithmOptions(SecurityAlgorithms.RsaSha256)
        {
            // Wrap the auto-managed key in a self-signed X.509 certificate
            UseX509Certificate = true
        }
    ];

    // Tune rotation based on your SP metadata cache durations
    options.KeyManagement.RotationInterval = TimeSpan.FromDays(90);
    options.KeyManagement.PropagationTime = TimeSpan.FromDays(14);
    options.KeyManagement.RetentionDuration = TimeSpan.FromDays(14);
})
.AddSaml()
// ... rest of configuration

Csharp

#:sdk Microsoft.NET.Sdk.Web
#:property JsonSerializerIsReflectionEnabledByDefault=true
#:package Duende.IdentityServer@8.*

using System.Security.Cryptography.X509Certificates;
using System.Xml.Linq;
using Duende.IdentityServer.Configuration;
using Duende.IdentityServer.Models;
using Duende.IdentityServer.Saml;
using Microsoft.AspNetCore.DataProtection;
using Microsoft.IdentityModel.Tokens;
using static Microsoft.AspNetCore.Http.Results;

var builder = WebApplication.CreateBuilder(args);

// Data Protection is required for automatic key management to persist and retrieve keys.
// Without this, keys may not survive restarts or may not be accessible.
var keysDirectory = Path.Combine(builder.Environment.ContentRootPath, "keys");
builder.Services.AddDataProtection()
    .PersistKeysToFileSystem(new DirectoryInfo(keysDirectory))
    .SetApplicationName("SamlWithAutoKeyManagement");

builder.Services.AddIdentityServer(options =>
    {
        // --- Automatic Key Management with X.509 certificates ---
        // This is the key configuration: wrapping managed keys in X.509 certificates
        // makes them compatible with SAML signing (which requires X509 key info).
        options.KeyManagement.SigningAlgorithms =
        [
            new SigningAlgorithmOptions(SecurityAlgorithms.RsaSha256)
            {
                // This wraps the auto-managed RSA key in a self-signed X.509 certificate.
                // SAML requires X.509 certificates in the <KeyInfo> element of signed assertions.
                UseX509Certificate = true
            }
        ];

        // Key rotation settings — tune these based on your SP metadata cache durations.
        // PropagationTime MUST exceed the longest SP metadata cache duration to ensure
        // all SPs have fetched the new certificate before it starts signing.
        options.KeyManagement.RotationInterval = TimeSpan.FromDays(90);
        options.KeyManagement.PropagationTime = TimeSpan.FromDays(14);
        options.KeyManagement.RetentionDuration = TimeSpan.FromDays(14);
    })
    // AddSaml() registers SAML protocol handlers that consume credentials from the shared
    // ISigningCredentialStore. No explicit wiring needed — the SAML component automatically
    // uses the X.509-wrapped keys configured above for signing assertions and metadata.
    .AddSaml()
    .AddInMemoryIdentityResources(
    [
        new IdentityResources.OpenId(),
        new IdentityResources.Profile(),
        new IdentityResources.Email()
    ])
    .AddInMemoryApiScopes([])
    .AddInMemoryClients([])
    .AddInMemorySamlServiceProviders(
    [
        new SamlServiceProvider
        {
            EntityId = "https://sp.example.com",
            DisplayName = "Example SAML SP",
            AssertionConsumerServiceUrls =
            [
                new IndexedEndpoint
                {
                    Location = "https://sp.example.com/saml/acs",
                    Binding = SamlBinding.HttpPost,
                    Index = 0,
                    IsDefault = true
                }
            ],
            SingleLogoutServiceUrls =
            [
                new SamlEndpointType
                {
                    Location = "https://sp.example.com/saml/slo",
                    Binding = SamlBinding.HttpRedirect
                }
            ],
            // The signing behavior determines what gets signed.
            // SignAssertion is the default and most interoperable.
            SigningBehavior = SamlSigningBehavior.SignAssertion,
            AllowedScopes = ["openid", "profile", "email"],
            ClaimMappings = new Dictionary<string, string>
            {
                ["email"] = "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress",
                ["name"] = "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name"
            },
            // DefaultNameIdFormat is a string — use SamlConstants.NameIdentifierFormats
            DefaultNameIdFormat = SamlConstants.NameIdentifierFormats.EmailAddress
        }
    ])
    .AddTestUsers(
    [
        new Duende.IdentityServer.Test.TestUser
        {
            SubjectId = "1",
            Username = "alice",
            Password = "password",
            Claims =
            [
                new("name", "Alice Smith"),
                new("email", "alice@example.com")
            ]
        }
    ]);

var app = builder.Build();

app.UseIdentityServer();

// Root endpoint fetches SAML metadata and OIDC JWKS, extracts certificates, and verifies they match
app.MapGet("/", async (HttpContext context, IHttpClientFactory httpClientFactory) =>
{
    var request = context.Request;
    var baseUrl = $"{request.Scheme}://{request.Host}";
    var samlMetadataUrl = $"{baseUrl}/Saml2";
    var jwksUrl = $"{baseUrl}/.well-known/openid-configuration/jwks";
    
    using var httpClient = httpClientFactory.CreateClient();
    
    // Fetch SAML metadata and extract certificate
    var metadataXml = await httpClient.GetStringAsync(samlMetadataUrl);
    var doc = XDocument.Parse(metadataXml);
    XNamespace ds = "http://www.w3.org/2000/09/xmldsig#";
    
    var samlCertElement = doc.Descendants(ds + "X509Certificate").FirstOrDefault();
    var samlBase64 = samlCertElement?.Value.Trim();
    
    if (string.IsNullOrEmpty(samlBase64))
    {
        return Json(new
        {
            Error = "No certificate found in SAML metadata",
            SamlMetadataUrl = samlMetadataUrl
        });
    }
    
    var samlCertBytes = Convert.FromBase64String(samlBase64);
    var samlCert = X509CertificateLoader.LoadCertificate(samlCertBytes);
    
    // Fetch JWKS and extract certificate from x5c
    var jwksJson = await httpClient.GetStringAsync(jwksUrl);
    var jwksDoc = System.Text.Json.JsonDocument.Parse(jwksJson);
    var keys = jwksDoc.RootElement.GetProperty("keys");
    
    X509Certificate2? oidcCert = null;
    foreach (var key in keys.EnumerateArray())
    {
        if (key.TryGetProperty("x5c", out var x5c) && x5c.GetArrayLength() > 0)
        {
            var oidcBase64 = x5c[0].GetString();
            if (!string.IsNullOrEmpty(oidcBase64))
            {
                var oidcCertBytes = Convert.FromBase64String(oidcBase64);
                oidcCert = X509CertificateLoader.LoadCertificate(oidcCertBytes);
                break;
            }
        }
    }
    
    if (oidcCert is null)
    {
        return Json(new
        {
            Error = "No x5c certificate found in JWKS",
            JwksUrl = jwksUrl,
            SamlCertificate = new
            {
                samlCert.Subject,
                samlCert.Thumbprint
            }
        });
    }
    
    var certificatesMatch = samlCert.Thumbprint == oidcCert.Thumbprint;
    
    return Json(new
    {
        CertificatesMatch = certificatesMatch,
        Message = certificatesMatch 
            ? "SAML and OIDC use the same X.509-wrapped signing key" 
            : "WARNING: Certificates differ!",
        SamlCertificate = new
        {
            Source = samlMetadataUrl,
            samlCert.Subject,
            samlCert.Issuer,
            samlCert.Thumbprint,
            samlCert.NotBefore,
            samlCert.NotAfter,
            samlCert.SerialNumber,
            SignatureAlgorithm = samlCert.SignatureAlgorithm.FriendlyName
        },
        OidcCertificate = new
        {
            Source = jwksUrl,
            oidcCert.Subject,
            oidcCert.Issuer,
            oidcCert.Thumbprint,
            oidcCert.NotBefore,
            oidcCert.NotAfter,
            oidcCert.SerialNumber,
            SignatureAlgorithm = oidcCert.SignatureAlgorithm.FriendlyName
        }
    });
});

app.Run();