Identity server communication with DB - Security concerns

Question

I need quick help regarding Identity server.

There is a client requirement to not allow any public hosted application to directly talk to the database. In Identity server's case, the Identity server will be hosted publicly for token endpoint, and it queries the database for operational data (went for Db approach with reference tokens because IDsrv will be on NLB). Is there any workaround for this? or is this standard practice?

Thanks

Answer 1

If you don't want IdentityServer to talk directly to the database, you will need to implement & register custom implementations of ICorsPolicyService, IAuthorizationCodeStore, IClientStore, IConsentStore, IRefreshTokenStore, IScopeStore, and ITokenHandleStore, that call off to some an external app that can talk to the database.

Normal operating procedure is to have IdentityServer talk directly to the database. I don't see much merit in separating the two.

FYI: You don't need to use reference tokens if you are using load balancing. Check out the deployment docs.