如何在AWS无服务器Lambda环境上替换AddDeveloperSigningCredential? [英] How we can replace AddDeveloperSigningCredential on AWS Serverless Lambda environment?

问题描述

我们将Identity Server4与EntityFrameworkCore一起使用，并且已使用aws工具包(" https://aws.amazon.com/blogs/developer/preview-of-the-aws-toolkit-for-visual -studio-2017/").那么我们如何在AWS无服务器Lambda环境上替换AddDeveloperSigningCredential?

We are using Identity Server4 with EntityFrameworkCore and we have deployed our .NET Core application as a lambda function using aws toolkit ("https://aws.amazon.com/blogs/developer/preview-of-the-aws-toolkit-for-visual-studio-2017/"). So how we can replace AddDeveloperSigningCredential on aws serverless lambda environment?

这是我们的ConfigurationServerices方法:

Here is our ConfigurationServerices method:

public void ConfigureServices(IServiceCollection services)
    {
        services.AddSingleton<IConfiguration>(Configuration);

        string connectionString = Configuration.GetConnectionString("IdentityServer");

        var migrationsAssembly = typeof(Startup).GetTypeInfo().Assembly.GetName().Name;

        services.AddIdentityServer()
            .AddDeveloperSigningCredential()
            // this adds the config data from DB (clients, resources)
            .AddConfigurationStore(options =>
            {
                options.ConfigureDbContext = builder =>
                builder.UseSqlServer(connectionString,
                sql => sql.MigrationsAssembly(migrationsAssembly));
            }) // this adds the operational data from DB (codes, tokens, consents)
            .AddOperationalStore(options =>
            {
                options.ConfigureDbContext = builder =>
                builder.UseSqlServer(connectionString,
            sql => sql.MigrationsAssembly(migrationsAssembly));

                // this enables automatic token cleanup. this is optional.
                // options.EnableTokenCleanup = true;
                // options.TokenCleanupInterval = 30;
            });

        // Add S3 to the ASP.NET Core dependency injection framework.
        services.AddAWSService<Amazon.S3.IAmazonS3>();
    }

推荐答案

这是一些从证书存储区加载证书的示例代码.如果这对您不可用，那么您只需要序列化并保留证书，就需要采取其他方法，但是最终会产生一个有效的X509Certificate2实例，您可以将该实例传递给X509SecurityKey.

This is some example code that loads certs from the certificate store. If this is unavailable to you then you just need to serialise and persist the certificate(s) you need some other way but that ultimately yields a valid X509Certificate2 instance that you can pass into X509SecurityKey.

private static void ConfigureSigningCerts(IServiceCollection services)
{
    var keys = new List<SecurityKey>();

    var name = "MyCertName";

    //The one that expires last at the top
    var certs = X509.LocalMachine.My.SubjectDistinguishedName.Find("CN=" + name, false)
        .Where(o => DateTime.UtcNow >= o.NotBefore)
        .OrderByDescending(o => o.NotAfter);

    if (!certs.Any()) throw new Exception("No valid certificates could be found.");

    //Get first (in desc order of expiry) th
    var signingCert = certs.FirstOrDefault();

    if (signingCert == null) throw new InvalidOperationException("No valid signing certificate could be found.");

    var signingCredential = new SigningCredentials(new X509SecurityKey(signingCert), "RS256");
    services.AddSingleton<ISigningCredentialStore>(new DefaultSigningCredentialsStore(signingCredential));

    foreach (var cert in certs)
    {
        var validationCredential = new SigningCredentials(new X509SecurityKey(cert), "RS256");
        keys.Add(validationCredential.Key);
    }

    services.AddSingleton<IValidationKeysStore>(new DefaultValidationKeysStore(keys));
}

X509Certificate2的构造函数可以采用原始字节[]或文件路径，因此在打包和分发签名/验证证书时，您有很多选择.

The constructor for X509Certificate2 can take a raw byte[] or a file path so you've got plenty of options when it comes to packaging and distributing the signing/validation certs.

要在Windows上创建自签名证书，可以使用以下命令:

To create a self signed certificate on windows you can use the command:

makecert -r -pe -n "CN=MyCertName" -b 01/01/2015 -e 01/01/2039 -eku 1.3.6.1.5.5.7.3.3 -sky signature -a sha256 -len 2048 mycert.cer

这将在名为mycert.cer的文件中创建名为MyCertName的证书.

That creates a certificate named MyCertName in a file called mycert.cer.

此处提供该工具的完整文档: https://msdn.microsoft.com/en-us/library/bfsktky3(VS.100).aspx

Full docs for the tool here: https://msdn.microsoft.com/en-us/library/bfsktky3(VS.100).aspx

这篇关于如何在AWS无服务器Lambda环境上替换AddDeveloperSigningCredential?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！