access token - Identity server communication with DB - Security concerns -
i need quick regarding identity server.
there client requirement not allow public hosted application directly talk database. in identity server's case, identity server hosted publicly token endpoint, , queries database operational data (went db approach reference tokens because idsrv on nlb). there workaround this? or standard practice?
thanks
if don't want identityserver talk directly database, need implement & register custom implementations of icorspolicyservice, iauthorizationcodestore, iclientstore, iconsentstore, irefreshtokenstore, iscopestore, , itokenhandlestore, call off external app can talk database.
normal operating procedure have identityserver talk directly database. don't see merit in separating two.
fyi: don't need use reference tokens if using load balancing. check out deployment docs.
Comments
Post a Comment