Identity Server Null 'License' parameter

Question

I'm working on an application that uses IdentityServer 4 and .Net 5 I created the project based on the 'with React.js' with Individual Authentication template.

I'm trying to configure Key management for identity server...

services.AddIdentityServer()
                .AddApiAuthorization<ApplicationUser, ApplicationDbContext>()
                .AddSigningKeyManagement()
                .PersistKeysWith<ApplicationDbContext>();

public ApplicationDbContext(
            DbContextOptions options,
            IOptions<OperationalStoreOptions> operationalStoreOptions) : base(options, operationalStoreOptions)
        {
        }
        public DbSet<SerializedKey> SerializedKeys { get; set; }

        public async Task<IEnumerable<SerializedKey>> LoadKeysAsync()
        {
            return await SerializedKeys.ToListAsync();
        }

        public async Task StoreKeyAsync(SerializedKey key)
        {
            await SerializedKeys.AddAsync(key);
            await this.SaveChangesAsync();
        }

        public async Task DeleteKeyAsync(string id)
        {
            SerializedKey key = SerializedKeys.First(x => x.Id == id);
            SerializedKeys.Remove(key);
            await this.SaveChangesAsync();
        }

I was able to successfully run a migration and get the table created -

But if I try to run the application I get an exception on startup

ArgumentNullException: Value cannot be null. (Parameter 'license')
IdentityServer4.KeyManagement.License.LicenseHandler.Verify(string license)
IdentityServer4.KeyManagement.License.LicenseHandler.Validate(string licence, LicenseAudience audience)
IdentityServer4.KeyManagement.License.LicenseHandler.Validate(string license, string licensee, LicenseAudience audience, DateTime buildDate)
IdentityServer4.KeyManagement.KeyManagerOptions.Validate(ILicenseHandler handler)
IdentityServer4.KeyManagement.KeyManagerOptions.Validate()
IdentityServer4.KeyManagement.KeyManager..ctor(KeyManagerOptions options, ISigningKeyStore store, ISigningKeyStoreCache cache, ISigningKeyProtector protector, IClock clock, INewKeyLock newKeyLock, ILogger<KeyManager> logger, IHttpContextAccessor httpContextAccessor)
System.RuntimeMethodHandle.InvokeMethod(object target, object[] arguments, Signature sig, bool constructor, bool wrapExceptions)
System.Reflection.RuntimeConstructorInfo.Invoke(BindingFlags invokeAttr, Binder binder, object[] parameters, CultureInfo culture)
Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteRuntimeResolver.VisitConstructor(ConstructorCallSite constructorCallSite, RuntimeResolverContext context)
Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteVisitor<TArgument, TResult>.VisitCallSiteMain(ServiceCallSite callSite, TArgument argument)
Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteRuntimeResolver.VisitDisposeCache(ServiceCallSite transientCallSite, RuntimeResolverContext context)
Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteVisitor<TArgument, TResult>.VisitCallSite(ServiceCallSite callSite, TArgument argument)
Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteRuntimeResolver.VisitConstructor(ConstructorCallSite constructorCallSite, RuntimeResolverContext context)
Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteVisitor<TArgument, TResult>.VisitCallSiteMain(ServiceCallSite callSite, TArgument argument)
Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteRuntimeResolver.VisitDisposeCache(ServiceCallSite transientCallSite, RuntimeResolverContext context)
Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteVisitor<TArgument, TResult>.VisitCallSite(ServiceCallSite callSite, TArgument argument)
Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteRuntimeResolver.VisitIEnumerable(IEnumerableCallSite enumerableCallSite, RuntimeResolverContext context)
Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteVisitor<TArgument, TResult>.VisitCallSiteMain(ServiceCallSite callSite, TArgument argument)
Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteVisitor<TArgument, TResult>.VisitNoCache(ServiceCallSite callSite, TArgument argument)
Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteVisitor<TArgument, TResult>.VisitCallSite(ServiceCallSite callSite, TArgument argument)
Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteRuntimeResolver.VisitConstructor(ConstructorCallSite constructorCallSite, RuntimeResolverContext context)
Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteVisitor<TArgument, TResult>.VisitCallSiteMain(ServiceCallSite callSite, TArgument argument)
Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteRuntimeResolver.VisitDisposeCache(ServiceCallSite transientCallSite, RuntimeResolverContext context)
Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteVisitor<TArgument, TResult>.VisitCallSite(ServiceCallSite callSite, TArgument argument)
Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteRuntimeResolver.VisitConstructor(ConstructorCallSite constructorCallSite, RuntimeResolverContext context)
Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteVisitor<TArgument, TResult>.VisitCallSiteMain(ServiceCallSite callSite, TArgument argument)
Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteRuntimeResolver.VisitDisposeCache(ServiceCallSite transientCallSite, RuntimeResolverContext context)
Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteVisitor<TArgument, TResult>.VisitCallSite(ServiceCallSite callSite, TArgument argument)
Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteRuntimeResolver.VisitConstructor(ConstructorCallSite constructorCallSite, RuntimeResolverContext context)
Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteVisitor<TArgument, TResult>.VisitCallSiteMain(ServiceCallSite callSite, TArgument argument)
Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteRuntimeResolver.VisitDisposeCache(ServiceCallSite transientCallSite, RuntimeResolverContext context)
Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteVisitor<TArgument, TResult>.VisitCallSite(ServiceCallSite callSite, TArgument argument)
Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteRuntimeResolver.VisitConstructor(ConstructorCallSite constructorCallSite, RuntimeResolverContext context)
Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteVisitor<TArgument, TResult>.VisitCallSiteMain(ServiceCallSite callSite, TArgument argument)
Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteRuntimeResolver.VisitDisposeCache(ServiceCallSite transientCallSite, RuntimeResolverContext context)
Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteVisitor<TArgument, TResult>.VisitCallSite(ServiceCallSite callSite, TArgument argument)
Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteRuntimeResolver.VisitConstructor(ConstructorCallSite constructorCallSite, RuntimeResolverContext context)
Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteVisitor<TArgument, TResult>.VisitCallSiteMain(ServiceCallSite callSite, TArgument argument)
Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteRuntimeResolver.VisitDisposeCache(ServiceCallSite transientCallSite, RuntimeResolverContext context)
Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteVisitor<TArgument, TResult>.VisitCallSite(ServiceCallSite callSite, TArgument argument)
Microsoft.Extensions.DependencyInjection.ServiceLookup.CallSiteRuntimeResolver.Resolve(ServiceCallSite callSite, ServiceProviderEngineScope scope)
Microsoft.Extensions.DependencyInjection.ServiceLookup.DynamicServiceProviderEngine+<>c__DisplayClass1_0.<RealizeService>b__0(ServiceProviderEngineScope scope)
Microsoft.Extensions.DependencyInjection.ServiceLookup.ServiceProviderEngine.GetService(Type serviceType, ServiceProviderEngineScope serviceProviderEngineScope)
Microsoft.Extensions.DependencyInjection.ServiceLookup.ServiceProviderEngineScope.GetService(Type serviceType)
Microsoft.Extensions.DependencyInjection.ServiceProviderServiceExtensions.GetRequiredService(IServiceProvider provider, Type serviceType)
Microsoft.Extensions.DependencyInjection.ServiceProviderServiceExtensions.GetRequiredService<T>(IServiceProvider provider)
Microsoft.AspNetCore.Authentication.AuthenticationHttpContextExtensions.AuthenticateAsync(HttpContext context, string scheme)
Microsoft.AspNetCore.Authentication.AuthenticationMiddleware.Invoke(HttpContext context)
Microsoft.AspNetCore.Diagnostics.EntityFrameworkCore.MigrationsEndPointMiddleware.Invoke(HttpContext context)
Microsoft.AspNetCore.Diagnostics.DeveloperExceptionPageMiddleware.Invoke(HttpContext context)

I'm not sure how to provide that license parameter, any help is greatly appreciated.

Thanks!

score 1 · Accepted Answer · answered May 22 '22 at 20:18

You can look video tutorial on youtube. Timestamp 09:19.
AddSigningKeyManagement has overload where you can pass Licensee and License received from https://www.identityserver.com/products/KeyManagement/. It is paid feature. Next two are free.
For development purposes you can use AddDeveloperSigningCredential method;
For production purposes I can recommend you to use self-signed x509 certs via AddSigningCredential method. Example code:

if (certificateConfiguration.UseSigningCertificatePfxFile)
{
    if (string.IsNullOrWhiteSpace(certificateConfiguration.SigningCertificatePfxFilePath))
    {
        throw new Exception(SigningCertificatePathIsNotSpecified);
    }

    if (File.Exists(certificateConfiguration.SigningCertificatePfxFilePath))
    {

        try
        {
            builder.AddSigningCredential(new X509Certificate2(certificateConfiguration.SigningCertificatePfxFilePath, certificateConfiguration.SigningCertificatePfxFilePassword));
        }
        catch (Exception e)
        {
            throw new Exception("There was an error adding the key file - during the creation of the signing key", e);
        }
    }
    else
    {
        throw new Exception($"Signing key file: {certificateConfiguration.SigningCertificatePfxFilePath} not found");
    }
}
else if (certificateConfiguration.UseTemporarySigningKeyForDevelopment)
{
    builder.AddDeveloperSigningCredential();
}

More info here: How to create a signing certificate and use it in IdentityServer4 in production?

Thanks, I was able to get it working based on your answer...in production I am getting "This attempt to set a cookie via a Set-Cookie header was blocked because it had the 'SameSite=None' attribute but did not have the 'Secure' attribute, do you know how to address that? — Jeremy Farmer, May 22 '22 at 21:07
You can only set a cookie, samesite=none if you also mark it secure, (ie uses HTTPS) — Tore Nestenius, May 23 '22 at 07:34

Identity Server Null 'License' parameter

1 Answers1