We are currently using ForgeRock as an Identity and Access Management solution, this is being hosted on Infrastructure-as-a-Service machines in Azure, i.e. Virtual Machine Scale Sets. There is a requirement to protect the private keys using FIPS-140-2 validated Hardware Security Modules, HSMs, research has indicated that the only way to achieve that is to use Azure Key Vault.
Now having looked into how to configure an HSM with ForgeRock this appears to be possible because you can change the Java Cryptographic Extensions provider to use the SunPKCS11 provider and configure the provider itself to communicate with the HSM to provide crypto offload.
Is it possible to do the same with Azure Key Vault? For reference, Azure Key Vault doesn't support JCE or PKCS11 natively, despite being backed by Thales nShield family of HSMs.
0 Answers