XMLKeyManager doesn't implement IDeletableKeyManager interface for .NET 9 target.

[ashishdhingra]

Documentation at Delete keys has an example approach on how to delete old expired data protection keys as below:

using Microsoft.AspNetCore.DataProtection.KeyManagement;

var services = new ServiceCollection();
services.AddDataProtection();

var serviceProvider = services.BuildServiceProvider();

var keyManager = serviceProvider.GetService<IKeyManager>();

if (keyManager is IDeletableKeyManager deletableKeyManager)
{
    var utcNow = DateTimeOffset.UtcNow;
    var yearAgo = utcNow.AddYears(-1);

    if (!deletableKeyManager.DeleteKeys(key => key.ExpirationDate < yearAgo))
    {
        Console.WriteLine("Failed to delete keys.");
    }
    else
    {
        Console.WriteLine("Old keys deleted successfully.");
    }
}
else
{
    Console.WriteLine("Key manager does not support deletion.");
}

There is a condition which checks for keyManager is IDeletableKeyManager deletableKeyManager.

However, the default XmlKeyManager doesn't implement IDeletableKeyManager interface. Just curious if this was intentional or a miss.

Thanks,
Ashish

[BrennanConroy]

That seems like a mistake. The API was approved with XmlKeyManager implementing IDeletableKeyManager and the PR that added support for deletion added the APIs in XmlKeyManager to support deleting.

You can workaround this by doing a type check (and the code sample seems wrong since it doesn't check CanDeleteKeys):

if (keyManager is XmlKeyManager xmlKeyManager && xmlKeyManager.CanDeleteKeys)
{
    if (!xmlKeyManager.DeleteKeys(key => key.ExpirationDate < yearAgo))
    {
        Console.WriteLine("Failed to delete keys.");
    }
   // ...
}

[ashishdhingra]

@BrennanConroy Thanks for the quick response. Please advise if the fix would be implemented soon.

Thanks,
Ashish

[BrennanConroy]

If you'd like you could contribute the fix to main.

I don't know if we'd backport to 9.0 as there is a workaround and adding APIs to patch releases isn't allowed.