Resolvning token signing / token encryption certificate dynamically in multi-tenant setup

Confirm you’ve already contributed to this project or that you sponsor it

• I confirm I’m a sponsor or a contributor

Version

3.x

Question

I have done a PoC to setup openiddict in a multi-tenant (per-path) configuration mouting each tenant under its own path as follows: https://<fqdn>/ls/<tenantid>/.well-known/openid-configuration etc.

However, I have not found a way to dynamically configure token signing and token encryption options for each tenant (typically cached per-path request) as this is normally done globally using:

options.AddSigningCertificate(signingCertificate);

Preferable I would like to do this using an injected service / scoped store etc . What/where do I need to change in order to implement this.

[indranilatcal]

As mentioned in comments of the custom code, “in a real world application, the credentials would be retrieved from a persistent storage like a database or a key vault” - is there a sample/example of that?

[atrauzzi]

Yeah, I recall you mentioning it. I’ll definitely be establishing that as part of my tenant provisioning and management.