[Feature Request] Enable several JWE decrypt keys to help handling certificate rotations

[jmprieur]

Is your feature request related to a problem? Please describe.
We need to help partners using JWE to handle certificate rotation. Today,

microsoft-identity-web/src/Microsoft.Identity.Web/WebApiServiceCollectionExtensions.cs

Line 67 in 14b5a41

public static AuthenticationBuilder AddProtectedWebApi(

takes one certificate, which is used as an entry to TokenValidationParameters.

microsoft-identity-web/src/Microsoft.Identity.Web/WebApiServiceCollectionExtensions.cs

Lines 108 to 111 in 14b5a41

	if (tokenDecryptionCertificate != null)
	{
	options.TokenValidationParameters.TokenDecryptionKey = new X509SecurityKey(tokenDecryptionCertificate);
	}

Describe the solution you'd like
When the certificates are rotated, we'd like to pass several certificates and:

• either try to decryp with one, and if this does not work try the other
• or implement a TokenDecryptionKeyResolver that inspects the JWT token header for the encrypt cert thumbprint and then return the corresponding encrypt cert for decrypting the token.

See also https://github.com/AzureAD/microsoft-identity-web/wiki/Spec-certificates

See also SNI: AzureAD/microsoft-authentication-library-for-python#60

[jmprieur]

cc: @brentschmaltz @henrik-me

[henrik-me]

@jmprieur : I'm thinking most of this support should be in IdentityModel and not in Identity.Web.

[jmprieur]

note that the JWE header contains the kid:

    "kid": "value of inUseEncryptionKeyId" 

[brentschmaltz]

@jmprieur @henrik-me with the KeyVaultExtensions in IdentityModel we could have a really simple model for users to use KeyVault to do the direct decryption. This requires a off-box call, FOR EACH decrytpion, but with ManagedIdentities, this would be excellent.
We could also use SymmetricKey with KeyWrap, in this scenario KeyVault would be contacted once for a SymmetricKey that is used. For added security we could start using derived keys.

To hook up KeyVault, we would need an api somewhere to put the KeyVault url.
IdentityModel has a KeyVaultSecurityKey that hides all the details.

[jmprieur]

Duplicate of #165

[jmprieur]

This is done in #165
However we need to deprecate the API. Proposing to do it at the same time as #193
Closing as a duplicate