Multi RS256 Keys support in OpenID

[Rainshaw]

hello, it is really nice to hear that we now add support for openid, we now use django-oidc-provider to build openid service but its last release was in 2019, so we try to use another active project.

After read the docs and code , i find that this project not provide multi rs256 keys support, right?

as describe in the document: https://openid.net/specs/openid-connect-core-1_0.html#SigEnc , we can manully add keys.

will this feat be considered? thanks a lot for your work 😊

[tevansuk]

Yes, its necessary for key rotation to be able to support multiple keys. It's on my to-do list for sure.

Would you want to be able to have specific RSA keys for applications, or would you just want the ability to add a new RSA key that is used by default, whilst still advertising the old key in jwks.json (ie a typical key rotation).

It might be that we just do the latter, since a downstream project can already choose a key per application by overriding the Application.jwk_key property.

[Rainshaw]

Hi, thanks for your reply, the latter is LGTM. thanks for your work again 😀
I notice that now we add RSA keys in system env or file, will we add a model to store keys in db? I mean like django-oidc-provider

[dylantack]

I'm working on a PR for this; should be ready for review in the next few days.