0

The default Commerce Engine implementation has a hard-coded Identity Server Api name & secret:

.AddIdentityServerAuthentication(options =>
{
    options.Authority = this.Configuration.GetSection("AppSettings:SitecoreIdentityServerUrl").Value;
    options.RequireHttpsMetadata = false;
    options.EnableCaching = false;
    options.ApiName = "EngineAPI";
    options.ApiSecret = "secret";
});

Should I change the ApiSecret to a more secure string for production usage?

  • will your identity server be available publicly? – Vipin Banka Aug 12 at 13:21
  • Only internally, but still, some security is required. – Joost Aug 12 at 13:33
  • you can change to something more secured but you also need to change same in identity server configuration. – Vipin Banka Aug 12 at 14:05
0

Turns out the ApiSecret is actually unused as the Commerce Engine uses JWT and not Reference tokens. See Identity Server documentation: http://docs.identityserver.io/en/latest/topics/apis.html#supporting-reference-tokens

One could change the code to:

.AddIdentityServerAuthentication(options =>
{
    options.Authority = this.Configuration.GetSection("AppSettings:SitecoreIdentityServerUrl").Value;
    options.ApiName = "EngineAPI";
});

NB. As the Identity Server by default uses RSA encryption it uses the JSON Web Keyset (available at e.g. https://identity/.well-known/openid-configuration/jwks) to verify the JWT.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.