Best practise for SAS rotation about azure-iot-sdk-csharp HOT 4 CLOSED

@eggapauli -

What is the preferred way when we want to rotate SAS's regularly?

• If you mean "renewing" of the SAS token, today the SDKs will do that for you automatically at 1 hour intervals.

Should the device then have two connection strings (one with primary and one with secondary key) and just try both of them? Is something like this supported in the SDK or is it even a common scenario?

• Today this is not implemented out of the box in the SDK. However, this can be implemented on top of the SDK by using the SAS token as part of the connection string.

from azure-iot-sdk-csharp.

It's nice that the SDK automatically regenerates SAS Tokens.
But I think I used the wrong terminology, sorry. We want to rotate Shared Access Keys (the things that are part of the connection string). So if a shared access key is stolen we want to disable the key while keeping the device online (using the secondary key).
Is there some guidance or documentation if this is a good idea or if there are alternatives?

from azure-iot-sdk-csharp.

@eggapauli - The primary and secondary keys are provided to support rollover scenarios.
I've attached a sample on how to do that.

Program.txt

from azure-iot-sdk-csharp.

Nice, thanks. We thought of something like that, but we just weren't sure if it's a good idea because we couldn't find anything going in this direction. All the samples we found use a single connection string directly. This is now solved for me. Thanks for your support.

from azure-iot-sdk-csharp.