add a new oidc key+ key version for encrypting oidc state payloads returned in auth URLs. (#884)

Makefile

@@ -126,7 +126,8 @@ protobuild:
 	@protoc-go-inject-tag -input=./internal/kms/store/database_key.pb.go	
 	@protoc-go-inject-tag -input=./internal/kms/store/oplog_key.pb.go	
 	@protoc-go-inject-tag -input=./internal/kms/store/token_key.pb.go	
-	@protoc-go-inject-tag -input=./internal/kms/store/session_key.pb.go	
+	@protoc-go-inject-tag -input=./internal/kms/store/session_key.pb.go
+	@protoc-go-inject-tag -input=./internal/kms/store/oidc_key.pb.go		
 	@protoc-go-inject-tag -input=./internal/target/store/target.pb.go
 
 	@rm -R ${TMP_DIR}

internal/db/schema/migrations/postgres/dev/82_kms.down.sql

@@ -0,0 +1,2 @@
+begin;
+commit;

internal/db/schema/migrations/postgres/dev/82_kms.up.sql

@@ -0,0 +1,65 @@
+begin;
+
+-- kms_oidc_key entries are DEKs for encrypting oidc entries.
+create table kms_oidc_key (
+  private_id wt_private_id primary key,
+  root_key_id wt_private_id not null unique -- there can be only one oidc dek per root key
+    references kms_root_key(private_id)
+    on delete cascade
+    on update cascade,
+  create_time wt_timestamp
+);
+
+ -- define the immutable fields for kms_oidc_key (all of them)
+create trigger 
+  immutable_columns
+before
+update on kms_oidc_key
+  for each row execute procedure immutable_columns('private_id', 'root_key_id', 'create_time');
+
+-- define the value of kms_oidc_key's create_time
+create trigger 
+  default_create_time_column
+before
+insert on kms_oidc_key
+  for each row execute procedure default_create_time();
+
+-- kms_oidc_key_version entries are version of DEK keys used to encrypt oidc
+-- entries. 
+create table kms_oidc_key_version (
+  private_id wt_private_id primary key,
+  oidc_key_id wt_private_id not null
+    references kms_oidc_key(private_id) 
+    on delete cascade 
+    on update cascade, 
+  root_key_version_id wt_private_id not null
+    references kms_root_key_version(private_id) 
+    on delete cascade 
+    on update cascade,
+  version wt_version,
+  key bytea not null,
+  create_time wt_timestamp,
+  unique(oidc_key_id, version)
+);
+
+ -- define the immutable fields for kms_oidc_key_version (all of them)
+create trigger 
+  immutable_columns
+before
+update on kms_oidc_key_version
+  for each row execute procedure immutable_columns('private_id', 'oidc_key_id', 'root_key_version_id', 'version', 'key', 'create_time');
+  
+-- define the value of kms_oidc_key_version's create_time
+create trigger 
+  default_create_time_column
+before
+insert on kms_oidc_key_version
+  for each row execute procedure default_create_time();
+
+-- define the value of kms_oidc_key_version's version column
+create trigger
+	kms_version_column
+before insert on kms_oidc_key_version
+	for each row execute procedure kms_version_column('oidc_key_id');
+
+commit;

internal/db/schema/postgres_migration.gen.go

@@ -5,7 +5,7 @@ package schema
 func init() {
 	migrationStates["postgres"] = migrationState{
 		devMigration:        true,
-		binarySchemaVersion: 1001,
+		binarySchemaVersion: 1082,
 		upMigrations: map[int][]byte{
 			1: []byte(`
 begin;
@@ -4988,6 +4988,73 @@ create table server_tag (
   primary key(server_id, key, value)
 );
 
+commit;
+`),
+			1082: []byte(`
+begin;
+
+-- kms_oidc_key entries are DEKs for encrypting oidc entries.
+create table kms_oidc_key (
+  private_id wt_private_id primary key,
+  root_key_id wt_private_id not null unique -- there can be only one oidc dek per root key
+    references kms_root_key(private_id)
+    on delete cascade
+    on update cascade,
+  create_time wt_timestamp
+);
+
+ -- define the immutable fields for kms_oidc_key (all of them)
+create trigger 
+  immutable_columns
+before
+update on kms_oidc_key
+  for each row execute procedure immutable_columns('private_id', 'root_key_id', 'create_time');
+
+-- define the value of kms_oidc_key's create_time
+create trigger 
+  default_create_time_column
+before
+insert on kms_oidc_key
+  for each row execute procedure default_create_time();
+
+-- kms_oidc_key_version entries are version of DEK keys used to encrypt oidc
+-- entries. 
+create table kms_oidc_key_version (
+  private_id wt_private_id primary key,
+  oidc_key_id wt_private_id not null
+    references kms_oidc_key(private_id) 
+    on delete cascade 
+    on update cascade, 
+  root_key_version_id wt_private_id not null
+    references kms_root_key_version(private_id) 
+    on delete cascade 
+    on update cascade,
+  version wt_version,
+  key bytea not null,
+  create_time wt_timestamp,
+  unique(oidc_key_id, version)
+);
+
+ -- define the immutable fields for kms_oidc_key_version (all of them)
+create trigger 
+  immutable_columns
+before
+update on kms_oidc_key_version
+  for each row execute procedure immutable_columns('private_id', 'oidc_key_id', 'root_key_version_id', 'version', 'key', 'create_time');
+  
+-- define the value of kms_oidc_key_version's create_time
+create trigger 
+  default_create_time_column
+before
+insert on kms_oidc_key_version
+  for each row execute procedure default_create_time();
+
+-- define the value of kms_oidc_key_version's version column
+create trigger
+	kms_version_column
+before insert on kms_oidc_key_version
+	for each row execute procedure kms_version_column('oidc_key_id');
+
 commit;
 `),
 		},

internal/kms/const.go

@@ -24,6 +24,10 @@ const (
 
 	// KeyPurposeSessions is used as a base key to derive session-specific encryption keys
 	KeyPurposeSessions
+
+	// KeyPurposeOidc is used for encrypting oidc states included in
+	// authentication URLs
+	KeyPurposeOidc
 )
 
 // String returns the key purpose cast as a string, just so it can be called as
@@ -40,6 +44,8 @@ func (k KeyPurpose) String() string {
 		return "tokens"
 	case KeyPurposeSessions:
 		return "sessions"
+	case KeyPurposeOidc:
+		return "oidc"
 	default:
 		return "unknown"
 	}
@@ -61,6 +67,8 @@ const (
 	KeyTypeTokenKeyVersion
 	KeyTypeSessionKey
 	KeyTypeSessionKeyVersion
+	KeyTypeOidcKey
+	KeyTypeOidcKeyVersion
 )
 
 // String returns the key type cast as a string, just so it can be called as
@@ -87,6 +95,10 @@ func (k KeyType) String() string {
 		return "sessionKey"
 	case KeyTypeSessionKeyVersion:
 		return "sessionKeyVersion"
+	case KeyTypeOidcKey:
+		return "oidcKey"
+	case KeyTypeOidcKeyVersion:
+		return "oidcKeyVersion"
 
 	default:
 		return "unknown"

internal/kms/ids.go

@@ -16,6 +16,8 @@ const (
 	TokenKeyVersionPrefix    = "ktv"
 	SessionKeyPrefix         = "ksk"
 	SessionKeyVersionPrefix  = "kskv"
+	OidcKeyPrefix            = "koidck"
+	OidcKeyVersionPrefix     = "koidckv"
 )
 
 func newRootKeyId() (string, error) {
@@ -107,3 +109,21 @@ func newSessionKeyVersionId() (string, error) {
 	}
 	return id, nil
 }
+
+func newOidcKeyId() (string, error) {
+	const op = "kms.newOidcKeyId"
+	id, err := db.NewPublicId(OidcKeyPrefix)
+	if err != nil {
+		return "", errors.Wrap(err, op)
+	}
+	return id, nil
+}
+
+func newOidcKeyVersionId() (string, error) {
+	const op = "kms.newOidcKeyVersionId"
+	id, err := db.NewPublicId(OidcKeyVersionPrefix)
+	if err != nil {
+		return "", errors.Wrap(err, op)
+	}
+	return id, nil
+}

internal/kms/ids_test.go

@@ -60,4 +60,14 @@ func Test_Ids(t *testing.T) {
 		require.NoError(t, err)
 		assert.True(t, strings.HasPrefix(id, SessionKeyVersionPrefix+"_"))
 	})
+	t.Run("koidck", func(t *testing.T) {
+		id, err := newOidcKeyId()
+		require.NoError(t, err)
+		assert.True(t, strings.HasPrefix(id, OidcKeyPrefix+"_"))
+	})
+	t.Run("koidckv", func(t *testing.T) {
+		id, err := newOidcKeyVersionId()
+		require.NoError(t, err)
+		assert.True(t, strings.HasPrefix(id, OidcKeyVersionPrefix+"_"))
+	})
 }

internal/kms/immutable_fields_test.go

@@ -340,3 +340,101 @@ func TestDatabaseKeyVersion_ImmutableFields(t *testing.T) {
 		})
 	}
 }
+
+func TestOidcKeyVersion_ImmutableFields(t *testing.T) {
+	t.Parallel()
+	conn, _ := db.TestSetup(t, "postgres")
+	wrapper := db.TestWrapper(t)
+	rw := db.New(conn)
+
+	ts := timestamp.Timestamp{Timestamp: &timestamppb.Timestamp{Seconds: 0, Nanos: 0}}
+
+	org, _ := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper))
+	require.NoError(t, conn.Where("1=1").Delete(kms.AllocRootKey()).Error)
+	rk := kms.TestRootKey(t, conn, org.PublicId)
+	_, rkvWrapper := kms.TestRootKeyVersion(t, conn, wrapper, rk.PrivateId)
+	dk := kms.TestOidcKey(t, conn, rk.PrivateId)
+	new := kms.TestOidcKeyVersion(t, conn, rkvWrapper, dk.PrivateId, []byte("oidc key"))
+
+	tests := []struct {
+		name      string
+		update    *kms.OidcKeyVersion
+		fieldMask []string
+	}{
+		{
+			name: "private_id",
+			update: func() *kms.OidcKeyVersion {
+				k := new.Clone().(*kms.OidcKeyVersion)
+				k.PrivateId = "o_thisIsNotAValidId"
+				return k
+			}(),
+			fieldMask: []string{"PrivateId"},
+		},
+		{
+			name: "create time",
+			update: func() *kms.OidcKeyVersion {
+				k := new.Clone().(*kms.OidcKeyVersion)
+				k.CreateTime = &ts
+				return k
+			}(),
+			fieldMask: []string{"CreateTime"},
+		},
+		{
+			name: "oidc_key_id",
+			update: func() *kms.OidcKeyVersion {
+				k := new.Clone().(*kms.OidcKeyVersion)
+				k.OidcKeyId = "o_thisIsNotAValidId"
+				return k
+			}(),
+			fieldMask: []string{"RootKeyId"},
+		},
+		{
+			name: "root_key_version_id",
+			update: func() *kms.OidcKeyVersion {
+				k := new.Clone().(*kms.OidcKeyVersion)
+				k.RootKeyVersionId = "o_thisIsNotAValidId"
+				return k
+			}(),
+			fieldMask: []string{"RootKeyId"},
+		},
+		{
+			name: "version",
+			update: func() *kms.OidcKeyVersion {
+				k := new.Clone().(*kms.OidcKeyVersion)
+				k.Version = uint32(22)
+				return k
+			}(),
+			fieldMask: []string{"Version"},
+		},
+		{
+			name: "key",
+			update: func() *kms.OidcKeyVersion {
+				k := new.Clone().(*kms.OidcKeyVersion)
+				k.Key = []byte("updated key")
+				return k
+			}(),
+			fieldMask: []string{"CtKey"},
+		},
+	}
+	for _, tt := range tests {
+		tt := tt
+		t.Run(tt.name, func(t *testing.T) {
+			assert, require := assert.New(t), require.New(t)
+			orig := new.Clone()
+			err := rw.LookupById(context.Background(), orig)
+			require.NoError(err)
+
+			err = tt.update.Encrypt(context.Background(), wrapper)
+			require.NoError(err)
+			rowsUpdated, err := rw.Update(context.Background(), tt.update, tt.fieldMask, nil, db.WithSkipVetForWrite(true))
+			require.Error(err)
+			assert.Equal(0, rowsUpdated)
+
+			after := new.Clone()
+			err = rw.LookupById(context.Background(), after)
+			require.NoError(err)
+
+			assert.True(proto.Equal(orig.(*kms.OidcKeyVersion), after.(*kms.OidcKeyVersion)))
+		})
+	}
+}

internal/kms/oidc_key.go

@@ -0,0 +1,83 @@
+package kms
+
+import (
+	"context"
+
+	"github.com/hashicorp/boundary/internal/db"
+	"github.com/hashicorp/boundary/internal/errors"
+	"github.com/hashicorp/boundary/internal/kms/store"
+	"google.golang.org/protobuf/proto"
+)
+
+const (
+	DefaultOidcKeyTableName = "kms_oidc_key"
+)
+
+type OidcKey struct {
+	*store.OidcKey
+	tableName string `gorm:"-"`
+}
+
+// NewOidcKey creates a new in memory oidc key.  This key is used to encrypt
+// oidc state before it's included in the oidc auth url.  No options are
+// currently supported.
+func NewOidcKey(rootKeyId string, _ ...Option) (*OidcKey, error) {
+	const op = "kms.NewOidcKey"
+	if rootKeyId == "" {
+		return nil, errors.New(errors.InvalidParameter, op, "missing root key id")
+	}
+	c := &OidcKey{
+		OidcKey: &store.OidcKey{
+			RootKeyId: rootKeyId,
+		},
+	}
+	return c, nil
+}
+
+// AllocOidcKey will allocate a OidcKey
+func AllocOidcKey() OidcKey {
+	return OidcKey{
+		OidcKey: &store.OidcKey{},
+	}
+}
+
+// Clone creates a clone of the OidcKey
+func (k *OidcKey) Clone() interface{} {
+	cp := proto.Clone(k.OidcKey)
+	return &OidcKey{
+		OidcKey: cp.(*store.OidcKey),
+	}
+}
+
+// VetForWrite implements db.VetForWrite() interface and validates the key
+// before it's written.
+func (k *OidcKey) VetForWrite(ctx context.Context, r db.Reader, opType db.OpType, opt ...db.Option) error {
+	const op = "kms.(OidcKey).VetForWrite"
+	if k.PrivateId == "" {
+		return errors.New(errors.InvalidParameter, op, "missing private id")
+	}
+	switch opType {
+	case db.CreateOp:
+		if k.RootKeyId == "" {
+			return errors.New(errors.InvalidParameter, op, "missing root key id")
+		}
+	case db.UpdateOp:
+		return errors.New(errors.InvalidParameter, op, "key is immutable")
+	}
+	return nil
+}
+
+// TableName returns the tablename to override the default gorm table name
+func (k *OidcKey) TableName() string {
+	if k.tableName != "" {
+		return k.tableName
+	}
+	return DefaultOidcKeyTableName
+}
+
+// SetTableName sets the tablename and satisfies the ReplayableMessage
+// interface. If the caller attempts to set the name to "" the name will be
+// reset to the default name.
+func (k *OidcKey) SetTableName(n string) {
+	k.tableName = n
+}

internal/kms/oidc_key_test.go

@@ -0,0 +1,206 @@
+package kms_test
+
+import (
+	"context"
+	"testing"
+
+	"github.com/hashicorp/boundary/internal/db"
+	"github.com/hashicorp/boundary/internal/errors"
+	"github.com/hashicorp/boundary/internal/iam"
+	"github.com/hashicorp/boundary/internal/kms"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/proto"
+)
+
+// NOTE: there are no update tests since all the OidcKey attributes are
+// immutable and those tests are covered by TestOidcKey_ImmutableFields
+
+func TestOidcKey_Create(t *testing.T) {
+	t.Parallel()
+	conn, _ := db.TestSetup(t, "postgres")
+	wrapper := db.TestWrapper(t)
+	org, _ := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper))
+	require.NoError(t, conn.Where("1=1").Delete(kms.AllocRootKey()).Error)
+	rk := kms.TestRootKey(t, conn, org.PublicId)
+
+	type args struct {
+		rootKeyId string
+		opt       []kms.Option
+	}
+	tests := []struct {
+		name          string
+		args          args
+		want          *kms.OidcKey
+		wantErr       bool
+		wantIsErr     errors.Code
+		create        bool
+		wantCreateErr bool
+	}{
+		{
+			name:      "empty-rootKeyId",
+			args:      args{},
+			wantErr:   true,
+			wantIsErr: errors.InvalidParameter,
+		},
+		{
+			name: "valid",
+			args: args{
+				rootKeyId: rk.PrivateId,
+			},
+			want: func() *kms.OidcKey {
+				k := kms.AllocOidcKey()
+				k.RootKeyId = rk.PrivateId
+				return &k
+			}(),
+			create: true,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert, require := assert.New(t), require.New(t)
+			require.NoError(conn.Where("1=1").Delete(kms.AllocOidcKey()).Error)
+			got, err := kms.NewOidcKey(tt.args.rootKeyId, tt.args.opt...)
+			if tt.wantErr {
+				require.Error(err)
+				assert.True(errors.Match(errors.T(tt.wantIsErr), err))
+				return
+			}
+			require.NoError(err)
+			assert.Equal(tt.want, got)
+			if tt.create {
+				id, err := db.NewPublicId(kms.OidcKeyPrefix)
+				require.NoError(err)
+				got.PrivateId = id
+				err = db.New(conn).Create(context.Background(), got)
+				if tt.wantCreateErr {
+					assert.Error(err)
+					return
+				} else {
+					assert.NoError(err)
+				}
+			}
+		})
+	}
+}
+
+func TestOidcKey_Delete(t *testing.T) {
+	t.Parallel()
+	conn, _ := db.TestSetup(t, "postgres")
+	rw := db.New(conn)
+	wrapper := db.TestWrapper(t)
+	org, _ := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper))
+	require.NoError(t, conn.Where("1=1").Delete(kms.AllocRootKey()).Error)
+	rk := kms.TestRootKey(t, conn, org.PublicId)
+	require.NoError(t, conn.Where("1=1").Delete(kms.AllocOidcKey()).Error)
+
+	tests := []struct {
+		name            string
+		key             *kms.OidcKey
+		wantRowsDeleted int
+		wantErr         bool
+		wantErrMsg      string
+	}{
+		{
+			name:            "valid",
+			key:             kms.TestOidcKey(t, conn, rk.PrivateId),
+			wantErr:         false,
+			wantRowsDeleted: 1,
+		},
+		{
+			name: "bad-id",
+			key: func() *kms.OidcKey {
+				k := kms.AllocOidcKey()
+				id, err := db.NewPublicId(kms.OidcKeyPrefix)
+				require.NoError(t, err)
+				k.PrivateId = id
+				k.RootKeyId = rk.PrivateId
+				return &k
+			}(),
+			wantErr:         false,
+			wantRowsDeleted: 0,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert, require := assert.New(t), require.New(t)
+			deleteKey := kms.AllocOidcKey()
+			deleteKey.PrivateId = tt.key.PrivateId
+			deletedRows, err := rw.Delete(context.Background(), &deleteKey)
+			if tt.wantErr {
+				require.Error(err)
+				return
+			}
+			require.NoError(err)
+			if tt.wantRowsDeleted == 0 {
+				assert.Equal(tt.wantRowsDeleted, deletedRows)
+				return
+			}
+			assert.Equal(tt.wantRowsDeleted, deletedRows)
+			foundKey := kms.AllocOidcKey()
+			foundKey.PrivateId = tt.key.PrivateId
+			err = rw.LookupById(context.Background(), &foundKey)
+			require.Error(err)
+			assert.True(errors.IsNotFoundError(err))
+		})
+	}
+}
+
+func TestOidcKey_Clone(t *testing.T) {
+	t.Parallel()
+	conn, _ := db.TestSetup(t, "postgres")
+	wrapper := db.TestWrapper(t)
+	t.Run("valid", func(t *testing.T) {
+		assert := assert.New(t)
+		org, _ := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper))
+		require.NoError(t, conn.Where("1=1").Delete(kms.AllocRootKey()).Error)
+		rk := kms.TestRootKey(t, conn, org.PublicId)
+		k := kms.TestOidcKey(t, conn, rk.PrivateId)
+		cp := k.Clone()
+		assert.True(proto.Equal(cp.(*kms.OidcKey).OidcKey, k.OidcKey))
+	})
+	t.Run("not-equal", func(t *testing.T) {
+		assert := assert.New(t)
+		org, _ := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper))
+		org2, _ := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper))
+		require.NoError(t, conn.Where("1=1").Delete(kms.AllocRootKey()).Error)
+		rk := kms.TestRootKey(t, conn, org.PublicId)
+		rk2 := kms.TestRootKey(t, conn, org2.PublicId)
+		k := kms.TestOidcKey(t, conn, rk.PrivateId)
+		k2 := kms.TestOidcKey(t, conn, rk2.PrivateId)
+
+		cp := k.Clone()
+		assert.True(!proto.Equal(cp.(*kms.OidcKey).OidcKey, k2.OidcKey))
+	})
+}
+
+func TestOidcKey_SetTableName(t *testing.T) {
+	t.Parallel()
+	defaultTableName := kms.DefaultOidcKeyTableName
+	tests := []struct {
+		name      string
+		setNameTo string
+		want      string
+	}{
+		{
+			name:      "new-name",
+			setNameTo: "new-name",
+			want:      "new-name",
+		},
+		{
+			name:      "reset to default",
+			setNameTo: "",
+			want:      defaultTableName,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert, require := assert.New(t), require.New(t)
+			def := kms.AllocOidcKey()
+			require.Equal(defaultTableName, def.TableName())
+			s := kms.AllocOidcKey()
+			s.SetTableName(tt.setNameTo)
+			assert.Equal(tt.want, s.TableName())
+		})
+	}
+}

internal/kms/oidc_key_version.go

@@ -0,0 +1,122 @@
+package kms
+
+import (
+	"context"
+
+	"github.com/hashicorp/boundary/internal/db"
+	"github.com/hashicorp/boundary/internal/errors"
+	"github.com/hashicorp/boundary/internal/kms/store"
+	wrapping "github.com/hashicorp/go-kms-wrapping"
+	"github.com/hashicorp/go-kms-wrapping/structwrapping"
+	"google.golang.org/protobuf/proto"
+)
+
+const (
+	DefaultOidcKeyVersionTableName = "kms_oidc_key_version"
+)
+
+type OidcKeyVersion struct {
+	*store.OidcKeyVersion
+	tableName string `gorm:"-"`
+}
+
+// NewOidcKeyVersion creates a new in memory oidc key version.  This key is used
+// to encrypt oidc state before it's included in the oidc auth url. No options
+// are currently supported.
+func NewOidcKeyVersion(oidcKeyId string, key []byte, rootKeyVersionId string, _ ...Option) (*OidcKeyVersion, error) {
+	const op = "kms.NewOidcKeyVersion"
+	if oidcKeyId == "" {
+		return nil, errors.New(errors.InvalidParameter, op, "missing oidc key id")
+	}
+	if len(key) == 0 {
+		return nil, errors.New(errors.InvalidParameter, op, "missing key")
+	}
+	if rootKeyVersionId == "" {
+		return nil, errors.New(errors.InvalidParameter, op, "missing root key version id")
+	}
+
+	k := &OidcKeyVersion{
+		OidcKeyVersion: &store.OidcKeyVersion{
+			OidcKeyId:        oidcKeyId,
+			RootKeyVersionId: rootKeyVersionId,
+			Key:              key,
+		},
+	}
+	return k, nil
+}
+
+// AllocOidcKeyVersion allocates a OidcKeyVersion
+func AllocOidcKeyVersion() OidcKeyVersion {
+	return OidcKeyVersion{
+		OidcKeyVersion: &store.OidcKeyVersion{},
+	}
+}
+
+// Clone creates a clone of the OidcKeyVersion
+func (k *OidcKeyVersion) Clone() interface{} {
+	cp := proto.Clone(k.OidcKeyVersion)
+	return &OidcKeyVersion{
+		OidcKeyVersion: cp.(*store.OidcKeyVersion),
+	}
+}
+
+// VetForWrite implements db.VetForWrite() interface and validates the oidc key
+// version before it's written.
+func (k *OidcKeyVersion) VetForWrite(ctx context.Context, r db.Reader, opType db.OpType, opt ...db.Option) error {
+	const op = "kms.(OidcKeyVersion).VetForWrite"
+	if k.PrivateId == "" {
+		return errors.New(errors.InvalidParameter, op, "missing private id")
+	}
+	switch opType {
+	case db.CreateOp:
+		if k.CtKey == nil {
+			return errors.New(errors.InvalidParameter, op, "missing key")
+		}
+		if k.OidcKeyId == "" {
+			return errors.New(errors.InvalidParameter, op, "missing oidc key id")
+		}
+		if k.RootKeyVersionId == "" {
+			return errors.New(errors.InvalidParameter, op, "missing root key version id")
+		}
+	case db.UpdateOp:
+		return errors.New(errors.InvalidParameter, op, "key is immutable")
+	}
+	return nil
+}
+
+// TableName returns the tablename to override the default gorm table name
+func (k *OidcKeyVersion) TableName() string {
+	if k.tableName != "" {
+		return k.tableName
+	}
+	return DefaultOidcKeyVersionTableName
+}
+
+// SetTableName sets the tablename and satisfies the ReplayableMessage
+// interface. If the caller attempts to set the name to "" the name will be
+// reset to the default name.
+func (k *OidcKeyVersion) SetTableName(n string) {
+	k.tableName = n
+}
+
+// Encrypt will encrypt the oidc key version's key
+func (k *OidcKeyVersion) Encrypt(ctx context.Context, cipher wrapping.Wrapper) error {
+	const op = "kms.(OidcKeyVersion).Encrypt"
+	// structwrapping doesn't support embedding, so we'll pass in the
+	// store.OidcKeyVersion directly
+	if err := structwrapping.WrapStruct(ctx, cipher, k.OidcKeyVersion, nil); err != nil {
+		return errors.Wrap(err, op, errors.WithCode(errors.Encrypt))
+	}
+	return nil
+}
+
+// Decrypt will decrypt the oidc key version's key
+func (k *OidcKeyVersion) Decrypt(ctx context.Context, cipher wrapping.Wrapper) error {
+	const op = "kms.(OidcKeyVersion).Decrypt"
+	// structwrapping doesn't support embedding, so we'll pass in the
+	// store.OidcKeyVersion directly
+	if err := structwrapping.UnwrapStruct(ctx, cipher, k.OidcKeyVersion, nil); err != nil {
+		return errors.Wrap(err, op, errors.WithCode(errors.Decrypt))
+	}
+	return nil
+}

internal/kms/oidc_key_version_test.go

@@ -0,0 +1,249 @@
+package kms_test
+
+import (
+	"context"
+	"testing"
+
+	"github.com/hashicorp/boundary/internal/db"
+	"github.com/hashicorp/boundary/internal/errors"
+	"github.com/hashicorp/boundary/internal/iam"
+	"github.com/hashicorp/boundary/internal/kms"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/proto"
+)
+
+// NOTE: there are no update tests since all the OidcKeyVersion attributes are
+// immutable and those tests are covered by TestOidcKey_ImmutableFields
+
+func TestOidcKeyVersion_Create(t *testing.T) {
+	t.Parallel()
+	conn, _ := db.TestSetup(t, "postgres")
+	wrapper := db.TestWrapper(t)
+	org, _ := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper))
+	require.NoError(t, conn.Where("1=1").Delete(kms.AllocRootKey()).Error)
+	rk := kms.TestRootKey(t, conn, org.PublicId)
+	rkv, rkvWrapper := kms.TestRootKeyVersion(t, conn, wrapper, rk.PrivateId)
+
+	dk := kms.TestOidcKey(t, conn, rk.PrivateId)
+
+	type args struct {
+		OidcKeyId        string
+		key              []byte
+		rootKeyVersionId string
+		opt              []kms.Option
+	}
+	tests := []struct {
+		name          string
+		args          args
+		want          *kms.OidcKeyVersion
+		wantErr       bool
+		wantIsErr     errors.Code
+		create        bool
+		wantCreateErr bool
+	}{
+		{
+			name: "empty-oidc-id",
+			args: args{
+				key:              []byte("oidc key"),
+				rootKeyVersionId: rkv.PrivateId,
+			},
+			wantErr:   true,
+			wantIsErr: errors.InvalidParameter,
+		},
+		{
+			name: "empty-key",
+			args: args{
+				OidcKeyId:        dk.PrivateId,
+				rootKeyVersionId: rkv.PrivateId,
+			},
+			wantErr:   true,
+			wantIsErr: errors.InvalidParameter,
+		},
+		{
+			name: "empty-root-key-version-id",
+			args: args{
+				OidcKeyId: dk.PrivateId,
+				key:       []byte("oidc key"),
+			},
+			wantErr:   true,
+			wantIsErr: errors.InvalidParameter,
+		},
+		{
+			name: "valid",
+			args: args{
+				OidcKeyId:        dk.PrivateId,
+				key:              []byte("oidc key"),
+				rootKeyVersionId: rkv.PrivateId,
+			},
+			want: func() *kms.OidcKeyVersion {
+				k := kms.AllocOidcKeyVersion()
+				k.RootKeyVersionId = rkv.PrivateId
+				k.Key = []byte("oidc key")
+				k.OidcKeyId = dk.PrivateId
+				return &k
+			}(),
+			create: true,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert, require := assert.New(t), require.New(t)
+			require.NoError(conn.Where("1=1").Delete(kms.AllocOidcKeyVersion()).Error)
+			got, err := kms.NewOidcKeyVersion(tt.args.OidcKeyId, tt.args.key, tt.args.rootKeyVersionId, tt.args.opt...)
+			if tt.wantErr {
+				require.Error(err)
+				assert.True(errors.Match(errors.T(tt.wantIsErr), err))
+				return
+			}
+			require.NoError(err)
+			assert.Equal(tt.want, got)
+			if tt.create {
+				id, err := db.NewPublicId(kms.OidcKeyPrefix)
+				require.NoError(err)
+				got.PrivateId = id
+				err = got.Encrypt(context.Background(), rkvWrapper)
+				require.NoError(err)
+				err = db.New(conn).Create(context.Background(), got)
+				if tt.wantCreateErr {
+					assert.Error(err)
+					return
+				} else {
+					assert.NoError(err)
+				}
+			}
+		})
+	}
+}
+
+func TestOidcKeyVersion_Delete(t *testing.T) {
+	t.Parallel()
+	conn, _ := db.TestSetup(t, "postgres")
+	rw := db.New(conn)
+	wrapper := db.TestWrapper(t)
+	org, _ := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper))
+	require.NoError(t, conn.Where("1=1").Delete(kms.AllocRootKey()).Error)
+	rk := kms.TestRootKey(t, conn, org.PublicId)
+	_, rkvWrapper := kms.TestRootKeyVersion(t, conn, wrapper, rk.PrivateId)
+	dk := kms.TestOidcKey(t, conn, rk.PrivateId)
+
+	require.NoError(t, conn.Where("1=1").Delete(kms.AllocOidcKeyVersion()).Error)
+
+	tests := []struct {
+		name            string
+		key             *kms.OidcKeyVersion
+		wantRowsDeleted int
+		wantErr         bool
+		wantErrMsg      string
+	}{
+		{
+			name:            "valid",
+			key:             kms.TestOidcKeyVersion(t, conn, rkvWrapper, dk.PrivateId, []byte("oidc key")),
+			wantErr:         false,
+			wantRowsDeleted: 1,
+		},
+		{
+			name: "bad-id",
+			key: func() *kms.OidcKeyVersion {
+				k := kms.AllocOidcKeyVersion()
+				id, err := db.NewPublicId(kms.OidcKeyVersionPrefix)
+				require.NoError(t, err)
+				k.PrivateId = id
+				return &k
+			}(),
+			wantErr:         false,
+			wantRowsDeleted: 0,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert, require := assert.New(t), require.New(t)
+			deleteKey := kms.AllocOidcKeyVersion()
+			deleteKey.PrivateId = tt.key.PrivateId
+			deletedRows, err := rw.Delete(context.Background(), &deleteKey)
+			if tt.wantErr {
+				require.Error(err)
+				return
+			}
+			require.NoError(err)
+			if tt.wantRowsDeleted == 0 {
+				assert.Equal(tt.wantRowsDeleted, deletedRows)
+				return
+			}
+			assert.Equal(tt.wantRowsDeleted, deletedRows)
+			foundKey := kms.AllocOidcKeyVersion()
+			foundKey.PrivateId = tt.key.PrivateId
+			err = rw.LookupById(context.Background(), &foundKey)
+			require.Error(err)
+			assert.True(errors.IsNotFoundError(err))
+		})
+	}
+}
+
+func TestOidcKeyVersion_Clone(t *testing.T) {
+	t.Parallel()
+	conn, _ := db.TestSetup(t, "postgres")
+	wrapper := db.TestWrapper(t)
+	t.Run("valid", func(t *testing.T) {
+		assert := assert.New(t)
+		org, _ := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper))
+		require.NoError(t, conn.Where("1=1").Delete(kms.AllocRootKey()).Error)
+
+		rk := kms.TestRootKey(t, conn, org.PublicId)
+		_, rkvWrapper := kms.TestRootKeyVersion(t, conn, wrapper, rk.PrivateId)
+
+		k := kms.TestOidcKey(t, conn, rk.PrivateId)
+		kv := kms.TestOidcKeyVersion(t, conn, rkvWrapper, k.PrivateId, []byte("test db key"))
+		cp := kv.Clone()
+		assert.True(proto.Equal(cp.(*kms.OidcKeyVersion).OidcKeyVersion, kv.OidcKeyVersion))
+	})
+	t.Run("not-equal", func(t *testing.T) {
+		assert := assert.New(t)
+		org, _ := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper))
+		org2, _ := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper))
+		require.NoError(t, conn.Where("1=1").Delete(kms.AllocRootKey()).Error)
+		rk := kms.TestRootKey(t, conn, org.PublicId)
+		rk2 := kms.TestRootKey(t, conn, org2.PublicId)
+		_, rkvWrapper := kms.TestRootKeyVersion(t, conn, wrapper, rk.PrivateId)
+		_, rkvWrapper2 := kms.TestRootKeyVersion(t, conn, wrapper, rk2.PrivateId)
+
+		k := kms.TestOidcKey(t, conn, rk.PrivateId)
+		k2 := kms.TestOidcKey(t, conn, rk2.PrivateId)
+		kv := kms.TestOidcKeyVersion(t, conn, rkvWrapper, k.PrivateId, []byte("test db key"))
+		kv2 := kms.TestOidcKeyVersion(t, conn, rkvWrapper2, k2.PrivateId, []byte("test db key 2"))
+
+		cp := kv.Clone()
+		assert.True(!proto.Equal(cp.(*kms.OidcKeyVersion).OidcKeyVersion, kv2.OidcKeyVersion))
+	})
+}
+
+func TestOidcKeyVersion_SetTableName(t *testing.T) {
+	t.Parallel()
+	defaultTableName := kms.DefaultOidcKeyVersionTableName
+	tests := []struct {
+		name      string
+		setNameTo string
+		want      string
+	}{
+		{
+			name:      "new-name",
+			setNameTo: "new-name",
+			want:      "new-name",
+		},
+		{
+			name:      "reset to default",
+			setNameTo: "",
+			want:      defaultTableName,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert, require := assert.New(t), require.New(t)
+			def := kms.AllocOidcKeyVersion()
+			require.Equal(defaultTableName, def.TableName())
+			s := kms.AllocOidcKeyVersion()
+			s.SetTableName(tt.setNameTo)
+			assert.Equal(tt.want, s.TableName())
+		})
+	}
+}

internal/kms/repository.go

@@ -149,6 +149,15 @@ func CreateKeysTx(ctx context.Context, dbReader db.Reader, dbWriter db.Writer, r
 		return nil, errors.Wrap(err, op, errors.WithMsg(fmt.Sprintf("unable to create token key in scope %s", scopeId)))
 	}
 
+	k, err = generateKey(randomReader)
+	if err != nil {
+		return nil, errors.Wrap(err, op, errors.WithMsg(fmt.Sprintf("error generating random bytes for oidc key in scope %s", scopeId)))
+	}
+	oidcKey, oidcKeyVersion, err := createOidcKeyTx(ctx, dbReader, dbWriter, rkvWrapper, k)
+	if err != nil {
+		return nil, errors.Wrap(err, op, errors.WithMsg(fmt.Sprintf("unable to create oidc key in scope %s", scopeId)))
+	}
+
 	keys := Keys{
 		KeyTypeRootKey:            rootKey,
 		KeyTypeRootKeyVersion:     rootKeyVersion,
@@ -160,6 +169,8 @@ func CreateKeysTx(ctx context.Context, dbReader db.Reader, dbWriter db.Writer, r
 		KeyTypeSessionKeyVersion:  sessionKeyVersion,
 		KeyTypeTokenKey:           tokenKey,
 		KeyTypeTokenKeyVersion:    tokenKeyVersion,
+		KeyTypeOidcKey:            oidcKey,
+		KeyTypeOidcKeyVersion:     oidcKeyVersion,
 	}
 	return keys, nil
 }

internal/kms/repository_oidc_key.go

@@ -0,0 +1,160 @@
+package kms
+
+import (
+	"context"
+	"fmt"
+	"strings"
+
+	"github.com/hashicorp/boundary/internal/db"
+	"github.com/hashicorp/boundary/internal/errors"
+	wrapping "github.com/hashicorp/go-kms-wrapping"
+)
+
+// CreateOidcKey inserts into the repository and returns the new oidc key and
+// oidc key version. There are no valid options at this time.
+func (r *Repository) CreateOidcKey(ctx context.Context, rkvWrapper wrapping.Wrapper, key []byte, _ ...Option) (*OidcKey, *OidcKeyVersion, error) {
+	const op = "kms.(Repository).CreateOidcKey"
+	var returnedDk, returnedDv interface{}
+	_, err := r.writer.DoTx(
+		ctx,
+		db.StdRetryCnt,
+		db.ExpBackoff{},
+		func(reader db.Reader, w db.Writer) error {
+			var err error
+			if returnedDk, returnedDv, err = createOidcKeyTx(ctx, reader, w, rkvWrapper, key); err != nil {
+				return errors.Wrap(err, op)
+			}
+			return nil
+		},
+	)
+	if err != nil {
+		return nil, nil, errors.Wrap(err, op)
+	}
+	return returnedDk.(*OidcKey), returnedDv.(*OidcKeyVersion), nil
+}
+
+// createOidcKeyTx inserts into the db (via db.Writer) and returns the new oidc key
+// and oidc key version. This function encapsulates all the work required within
+// a db.TxHandler and allows this capability to be shared with the iam repo.
+func createOidcKeyTx(ctx context.Context, r db.Reader, w db.Writer, rkvWrapper wrapping.Wrapper, key []byte) (*OidcKey, *OidcKeyVersion, error) {
+	const op = "kms.createOidcKeyTx"
+	if rkvWrapper == nil {
+		return nil, nil, errors.New(errors.InvalidParameter, op, "missing key wrapper")
+	}
+	if len(key) == 0 {
+		return nil, nil, errors.New(errors.InvalidParameter, op, "missing key")
+	}
+	rootKeyVersionId := rkvWrapper.KeyID()
+	switch {
+	case !strings.HasPrefix(rootKeyVersionId, RootKeyVersionPrefix):
+		return nil, nil, errors.New(errors.InvalidParameter, op, fmt.Sprintf("root key version id %s doesn't start with prefix %s", rootKeyVersionId, RootKeyVersionPrefix))
+	case rootKeyVersionId == "":
+		return nil, nil, errors.New(errors.InvalidParameter, op, "missing root key version id")
+	}
+	rv := AllocRootKeyVersion()
+	rv.PrivateId = rootKeyVersionId
+	err := r.LookupById(ctx, &rv)
+	if err != nil {
+		return nil, nil, errors.Wrap(err, op, errors.WithMsg(fmt.Sprintf("unable to lookup root key version %s", rootKeyVersionId)))
+	}
+
+	dk := AllocOidcKey()
+	dv := AllocOidcKeyVersion()
+	id, err := newOidcKeyId()
+	if err != nil {
+		return nil, nil, errors.Wrap(err, op)
+	}
+	dk.PrivateId = id
+	dk.RootKeyId = rv.RootKeyId
+
+	id, err = newOidcKeyVersionId()
+	if err != nil {
+		return nil, nil, errors.Wrap(err, op)
+	}
+	dv.PrivateId = id
+	dv.OidcKeyId = dk.PrivateId
+	dv.RootKeyVersionId = rootKeyVersionId
+	dv.Key = key
+	if err := dv.Encrypt(ctx, rkvWrapper); err != nil {
+		return nil, nil, errors.Wrap(err, op)
+	}
+
+	// no oplog entries for keys
+	if err := w.Create(ctx, &dk); err != nil {
+		return nil, nil, errors.Wrap(err, op, errors.WithMsg("keys create"))
+	}
+	// no oplog entries for key versions
+	if err := w.Create(ctx, &dv); err != nil {
+		return nil, nil, errors.Wrap(err, op, errors.WithMsg("key versions create"))
+	}
+
+	return &dk, &dv, nil
+}
+
+// LookupOidcKey will look up a key in the repository.  If the key is not
+// found, it will return nil, nil.
+func (r *Repository) LookupOidcKey(ctx context.Context, privateId string, _ ...Option) (*OidcKey, error) {
+	const op = "kms.(Repository).LookupOidcKey"
+	if privateId == "" {
+		return nil, errors.New(errors.InvalidParameter, op, "missing private id")
+	}
+	k := AllocOidcKey()
+	k.PrivateId = privateId
+	if err := r.reader.LookupById(ctx, &k); err != nil {
+		return nil, errors.Wrap(err, op, errors.WithMsg(fmt.Sprintf("failed for %s", privateId)))
+	}
+	return &k, nil
+}
+
+// DeleteOidcKey deletes the key for the provided id from the
+// repository returning a count of the number of records deleted.  All options
+// are ignored.
+func (r *Repository) DeleteOidcKey(ctx context.Context, privateId string, _ ...Option) (int, error) {
+	const op = "kms.(Repository).LookupOidcKey"
+	if privateId == "" {
+		return db.NoRowsAffected, errors.New(errors.InvalidParameter, op, "missing private id")
+	}
+	k := AllocOidcKey()
+	k.PrivateId = privateId
+	if err := r.reader.LookupById(ctx, &k); err != nil {
+		return db.NoRowsAffected, errors.Wrap(err, op, errors.WithMsg(fmt.Sprintf("failed for %s", privateId)))
+	}
+
+	var rowsDeleted int
+	_, err := r.writer.DoTx(
+		ctx,
+		db.StdRetryCnt,
+		db.ExpBackoff{},
+		func(_ db.Reader, w db.Writer) (err error) {
+			dk := k.Clone()
+			// no oplog entries for root keys
+			rowsDeleted, err = w.Delete(ctx, dk)
+			if err != nil {
+				return errors.Wrap(err, op)
+			}
+			if rowsDeleted > 1 {
+				return errors.New(errors.MultipleRecords, op, "more than 1 resource would have been deleted")
+			}
+			return nil
+		},
+	)
+	if err != nil {
+		return db.NoRowsAffected, errors.Wrap(err, op, errors.WithMsg(fmt.Sprintf("failed for %s", privateId)))
+	}
+	return rowsDeleted, nil
+}
+
+// ListOidcKeys will list the keys.  Supports the WithLimit option.
+func (r *Repository) ListOidcKeys(ctx context.Context, opt ...Option) ([]Dek, error) {
+	const op = "kms.(Repository).ListOidcKeys"
+	var keys []*OidcKey
+	err := r.list(ctx, &keys, "1=1", nil, opt...)
+	if err != nil {
+		return nil, errors.Wrap(err, op)
+	}
+	deks := make([]Dek, 0, len(keys))
+	for _, key := range keys {
+		deks = append(deks, key)
+	}
+	return deks, nil
+}

internal/kms/repository_oidc_key_test.go

@@ -0,0 +1,297 @@
+package kms_test
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/hashicorp/boundary/internal/db"
+	"github.com/hashicorp/boundary/internal/errors"
+	"github.com/hashicorp/boundary/internal/iam"
+	"github.com/hashicorp/boundary/internal/kms"
+	"github.com/hashicorp/boundary/internal/oplog"
+	wrapping "github.com/hashicorp/go-kms-wrapping"
+	"github.com/hashicorp/go-kms-wrapping/wrappers/aead"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/proto"
+)
+
+func TestRepository_CreateOidcKey(t *testing.T) {
+	t.Parallel()
+	conn, _ := db.TestSetup(t, "postgres")
+	rw := db.New(conn)
+	wrapper := db.TestWrapper(t)
+	repo, err := kms.NewRepository(rw, rw)
+	require.NoError(t, err)
+	org, _ := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper))
+	require.NoError(t, conn.Where("1=1").Delete(kms.AllocRootKey()).Error)
+	rk := kms.TestRootKey(t, conn, org.PublicId)
+	_, rkvWrapper := kms.TestRootKeyVersion(t, conn, wrapper, rk.PrivateId)
+
+	type args struct {
+		scopeId    string
+		key        []byte
+		keyWrapper wrapping.Wrapper
+		opt        []kms.Option
+	}
+	tests := []struct {
+		name        string
+		args        args
+		wantErr     bool
+		wantIsError errors.Code
+	}{
+		{
+			name: "valid-org",
+			args: args{
+				scopeId:    org.PublicId,
+				key:        []byte("test key"),
+				keyWrapper: rkvWrapper,
+			},
+			wantErr: false,
+		},
+		{
+			name: "nil-key",
+			args: args{
+				scopeId:    org.PublicId,
+				keyWrapper: rkvWrapper,
+			},
+			wantErr:     true,
+			wantIsError: errors.InvalidParameter,
+		},
+		{
+			name: "empty-key",
+			args: args{
+				scopeId:    org.PublicId,
+				keyWrapper: rkvWrapper,
+				key:        []byte(""),
+			},
+			wantErr:     true,
+			wantIsError: errors.InvalidParameter,
+		},
+		{
+			name: "nil-wrapper",
+			args: args{
+				scopeId:    org.PublicId,
+				key:        []byte("test key"),
+				keyWrapper: nil,
+			},
+			wantErr:     true,
+			wantIsError: errors.InvalidParameter,
+		},
+		{
+			name: "not-rkv-wrapper",
+			args: args{
+				scopeId:    org.PublicId,
+				key:        []byte("test key"),
+				keyWrapper: wrapper,
+			},
+			wantErr:     true,
+			wantIsError: errors.InvalidParameter,
+		},
+		{
+			name: "wrapper-missing-id",
+			args: args{
+				scopeId: org.PublicId,
+				key:     []byte("test key"),
+				keyWrapper: func() wrapping.Wrapper {
+					w := db.TestWrapper(t)
+					_, err = w.(*aead.Wrapper).SetConfig(map[string]string{
+						"key_id": "",
+					})
+					require.NoError(t, err)
+					return w
+				}(),
+			},
+			wantErr:     true,
+			wantIsError: errors.InvalidParameter,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert, require := assert.New(t), require.New(t)
+			dk, dv, err := repo.CreateOidcKey(context.Background(), tt.args.keyWrapper, tt.args.key, tt.args.opt...)
+			if tt.wantErr {
+				assert.Error(err)
+				assert.Nil(dk)
+				assert.True(errors.Match(errors.T(tt.wantIsError), err))
+				return
+			}
+			require.NoError(err)
+			assert.NotNil(dk.CreateTime)
+			foundKey, err := repo.LookupOidcKey(context.Background(), dk.PrivateId)
+			assert.NoError(err)
+			assert.True(proto.Equal(foundKey, dk))
+
+			// make sure there was no oplog written
+			err = db.TestVerifyOplog(t, rw, dk.PrivateId, db.WithOperation(oplog.OpType_OP_TYPE_CREATE), db.WithCreateNotBefore(10*time.Second))
+			assert.Error(err)
+			assert.True(errors.IsNotFoundError(err))
+
+			assert.NotNil(dv.CreateTime)
+			foundKeyVersion, err := repo.LookupOidcKeyVersion(context.Background(), tt.args.keyWrapper, dv.PrivateId)
+			assert.NoError(err)
+			assert.True(proto.Equal(foundKeyVersion, dv))
+
+			// make sure there was no oplog written
+			err = db.TestVerifyOplog(t, rw, dv.PrivateId, db.WithOperation(oplog.OpType_OP_TYPE_CREATE), db.WithCreateNotBefore(10*time.Second))
+			assert.Error(err)
+			assert.True(errors.IsNotFoundError(err))
+		})
+	}
+}
+
+func TestRepository_DeleteOidcKey(t *testing.T) {
+	t.Parallel()
+	conn, _ := db.TestSetup(t, "postgres")
+	rw := db.New(conn)
+	wrapper := db.TestWrapper(t)
+	repo, err := kms.NewRepository(rw, rw)
+	require.NoError(t, err)
+	org, _ := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper))
+	require.NoError(t, conn.Where("1=1").Delete(kms.AllocRootKey()).Error)
+	rk := kms.TestRootKey(t, conn, org.PublicId)
+
+	type args struct {
+		key *kms.OidcKey
+		opt []kms.Option
+	}
+	tests := []struct {
+		name            string
+		args            args
+		wantRowsDeleted int
+		wantErr         bool
+		wantIsError     errors.Code
+	}{
+		{
+			name: "valid",
+			args: args{
+				key: kms.TestOidcKey(t, conn, rk.PrivateId),
+			},
+			wantRowsDeleted: 1,
+			wantErr:         false,
+		},
+		{
+			name: "no-private-id",
+			args: args{
+				key: func() *kms.OidcKey {
+					k := kms.AllocOidcKey()
+					return &k
+				}(),
+			},
+			wantRowsDeleted: 0,
+			wantErr:         true,
+			wantIsError:     errors.InvalidParameter,
+		},
+		{
+			name: "not-found",
+			args: args{
+				key: func() *kms.OidcKey {
+					id, err := db.NewPublicId(kms.RootKeyPrefix)
+					require.NoError(t, err)
+					k := kms.AllocOidcKey()
+					k.PrivateId = id
+					require.NoError(t, err)
+					return &k
+				}(),
+			},
+			wantRowsDeleted: 0,
+			wantErr:         true,
+			wantIsError:     errors.RecordNotFound,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert, require := assert.New(t), require.New(t)
+			deletedRows, err := repo.DeleteOidcKey(context.Background(), tt.args.key.PrivateId, tt.args.opt...)
+			if tt.wantErr {
+				require.Error(err)
+				assert.Equal(0, deletedRows)
+				assert.True(errors.Match(errors.T(tt.wantIsError), err))
+				// make sure there was no oplog written
+				err = db.TestVerifyOplog(t, rw, tt.args.key.PrivateId, db.WithOperation(oplog.OpType_OP_TYPE_DELETE), db.WithCreateNotBefore(10*time.Second))
+				assert.Error(err)
+				assert.True(errors.IsNotFoundError(err))
+				return
+			}
+			require.NoError(err)
+			assert.Equal(tt.wantRowsDeleted, deletedRows)
+			foundKey, err := repo.LookupOidcKey(context.Background(), tt.args.key.PrivateId)
+			assert.Error(err)
+			assert.Nil(foundKey)
+			assert.True(errors.IsNotFoundError(err))
+
+			// make sure there was no oplog written
+			err = db.TestVerifyOplog(t, rw, tt.args.key.PrivateId, db.WithOperation(oplog.OpType_OP_TYPE_DELETE), db.WithCreateNotBefore(10*time.Second))
+			assert.Error(err)
+			assert.True(errors.IsNotFoundError(err))
+		})
+	}
+}
+
+func TestRepository_ListOidcKeys(t *testing.T) {
+	t.Parallel()
+	conn, _ := db.TestSetup(t, "postgres")
+	const testLimit = 10
+	rw := db.New(conn)
+	repo, err := kms.NewRepository(rw, rw, kms.WithLimit(testLimit))
+	require.NoError(t, err)
+	wrapper := db.TestWrapper(t)
+
+	type args struct {
+		opt []kms.Option
+	}
+	tests := []struct {
+		name      string
+		createCnt int
+		args      args
+		wantCnt   int
+		wantErr   bool
+	}{
+		{
+			name:      "no-limit",
+			createCnt: repo.DefaultLimit() + 1,
+			args: args{
+				opt: []kms.Option{kms.WithLimit(-1)},
+			},
+			wantCnt: repo.DefaultLimit() + 1, // org and project both have keys, plus global scope
+			wantErr: false,
+		},
+		{
+			name:      "default-limit",
+			createCnt: repo.DefaultLimit() + 1,
+			args:      args{},
+			wantCnt:   repo.DefaultLimit(),
+			wantErr:   false,
+		},
+		{
+			name:      "custom-limit",
+			createCnt: repo.DefaultLimit() + 1,
+			args: args{
+				opt: []kms.Option{kms.WithLimit(3)},
+			},
+			wantCnt: 3,
+			wantErr: false,
+		},
+	}
+	for _, tt := range tests {
+		require.NoError(t, conn.Where("1=1").Delete(kms.AllocRootKey()).Error)
+		t.Run(tt.name, func(t *testing.T) {
+			assert, require := assert.New(t), require.New(t)
+			for i := 0; i < tt.createCnt; i++ {
+				org, proj := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper))
+				require.NoError(conn.Where("scope_id in(?)", []interface{}{"global", org.PublicId, proj.PublicId}).Delete(kms.AllocRootKey()).Error)
+				rk := kms.TestRootKey(t, conn, proj.PublicId)
+				kms.TestOidcKey(t, conn, rk.PrivateId)
+				require.NoError(err)
+			}
+			got, err := repo.ListOidcKeys(context.Background(), tt.args.opt...)
+			if tt.wantErr {
+				require.Error(err)
+				return
+			}
+			require.NoError(err)
+			assert.Equal(tt.wantCnt, len(got))
+		})
+	}
+}

internal/kms/repository_oidc_key_version.go

@@ -0,0 +1,173 @@
+package kms
+
+import (
+	"context"
+	"fmt"
+	"strings"
+
+	"github.com/hashicorp/boundary/internal/db"
+	"github.com/hashicorp/boundary/internal/errors"
+	wrapping "github.com/hashicorp/go-kms-wrapping"
+)
+
+// CreateOidcKeyVersion inserts into the repository and returns the new key
+// version with its PrivateId.  There are no valid options at this time.
+func (r *Repository) CreateOidcKeyVersion(ctx context.Context, rkvWrapper wrapping.Wrapper, oidcKeyId string, key []byte, _ ...Option) (*OidcKeyVersion, error) {
+	const op = "kms.(Repository).CreateOidcKeyVersion"
+	if rkvWrapper == nil {
+		return nil, errors.New(errors.InvalidParameter, op, "missing root key version wrapper")
+	}
+	rootKeyVersionId := rkvWrapper.KeyID()
+	switch {
+	case !strings.HasPrefix(rootKeyVersionId, RootKeyVersionPrefix):
+		return nil, errors.New(errors.InvalidParameter, op, fmt.Sprintf("root key version id %s doesn't start with prefix %s", rootKeyVersionId, RootKeyVersionPrefix))
+	case rootKeyVersionId == "":
+		return nil, errors.New(errors.InvalidParameter, op, "missing root key version id")
+	}
+	if oidcKeyId == "" {
+		return nil, errors.New(errors.InvalidParameter, op, "missing oidc key id")
+	}
+	if len(key) == 0 {
+		return nil, errors.New(errors.InvalidParameter, op, "missing key")
+	}
+	kv := AllocOidcKeyVersion()
+	id, err := newOidcKeyVersionId()
+	if err != nil {
+		return nil, errors.Wrap(err, op)
+	}
+	kv.PrivateId = id
+	kv.RootKeyVersionId = rootKeyVersionId
+	kv.Key = key
+	kv.OidcKeyId = oidcKeyId
+	if err := kv.Encrypt(ctx, rkvWrapper); err != nil {
+		return nil, errors.Wrap(err, op)
+	}
+
+	var returnedKey interface{}
+	_, err = r.writer.DoTx(
+		ctx,
+		db.StdRetryCnt,
+		db.ExpBackoff{},
+		func(_ db.Reader, w db.Writer) error {
+			returnedKey = kv.Clone()
+			// no oplog entries for root key version
+			if err := w.Create(ctx, returnedKey); err != nil {
+				return errors.Wrap(err, op)
+			}
+			return nil
+		},
+	)
+	if err != nil {
+		return nil, errors.Wrap(err, op, errors.WithMsg(fmt.Sprintf("failed for %s oidc key id", kv.OidcKeyId)))
+	}
+	return returnedKey.(*OidcKeyVersion), nil
+}
+
+// LookupOidcKeyVersion will look up a key version in the repository.  If
+// the key version is not found, it will return nil, nil.
+func (r *Repository) LookupOidcKeyVersion(ctx context.Context, keyWrapper wrapping.Wrapper, privateId string, _ ...Option) (*OidcKeyVersion, error) {
+	const op = "kms.(Repository).LookupOidcKeyVersion"
+	if privateId == "" {
+		return nil, errors.New(errors.InvalidParameter, op, "missing private id")
+	}
+	if keyWrapper == nil {
+		return nil, errors.New(errors.InvalidParameter, op, "missing key wrapper")
+	}
+	k := AllocOidcKeyVersion()
+	k.PrivateId = privateId
+	if err := r.reader.LookupById(ctx, &k); err != nil {
+		return nil, errors.Wrap(err, op, errors.WithMsg(fmt.Sprintf("failed for %s", privateId)))
+	}
+	if err := k.Decrypt(ctx, keyWrapper); err != nil {
+		return nil, errors.Wrap(err, op)
+	}
+	return &k, nil
+}
+
+// DeleteOidcKeyVersion deletes the key version for the provided id from the
+// repository returning a count of the number of records deleted.  All options
+// are ignored.
+func (r *Repository) DeleteOidcKeyVersion(ctx context.Context, privateId string, _ ...Option) (int, error) {
+	const op = "kms.(Repository).DeleteOidcKeyVersion"
+	if privateId == "" {
+		return db.NoRowsAffected, errors.New(errors.InvalidParameter, op, "missing private id")
+	}
+	k := AllocOidcKeyVersion()
+	k.PrivateId = privateId
+	if err := r.reader.LookupById(ctx, &k); err != nil {
+		return db.NoRowsAffected, errors.Wrap(err, op, errors.WithMsg(fmt.Sprintf("failed for %s", privateId)))
+	}
+
+	var rowsDeleted int
+	_, err := r.writer.DoTx(
+		ctx,
+		db.StdRetryCnt,
+		db.ExpBackoff{},
+		func(_ db.Reader, w db.Writer) (err error) {
+			dk := k.Clone()
+			// no oplog entries for the key version
+			rowsDeleted, err = w.Delete(ctx, dk)
+			if err != nil {
+				return errors.Wrap(err, op)
+			}
+			if rowsDeleted > 1 {
+				return errors.New(errors.MultipleRecords, op, "more than 1 resource would have been deleted")
+			}
+			return nil
+		},
+	)
+	if err != nil {
+		return db.NoRowsAffected, errors.Wrap(err, op, errors.WithMsg(fmt.Sprintf("failed for %s", privateId)))
+	}
+	return rowsDeleted, nil
+}
+
+// LatestOidcKeyVersion searches for the key version with the highest
+// version number.  When no results are found, it returns nil with an
+// errors.RecordNotFound error.
+func (r *Repository) LatestOidcKeyVersion(ctx context.Context, rkvWrapper wrapping.Wrapper, OidcKeyId string, _ ...Option) (*OidcKeyVersion, error) {
+	const op = "kms.(Repository).LatestOidcKeyVersion"
+	if OidcKeyId == "" {
+		return nil, errors.New(errors.InvalidParameter, op, "missing oidc key id")
+	}
+	if rkvWrapper == nil {
+		return nil, errors.New(errors.InvalidParameter, op, "missing root key version wrapper")
+	}
+	var foundKeys []*OidcKeyVersion
+	if err := r.reader.SearchWhere(ctx, &foundKeys, "oidc_key_id = ?", []interface{}{OidcKeyId}, db.WithLimit(1), db.WithOrder("version desc")); err != nil {
+		return nil, errors.Wrap(err, op, errors.WithMsg(fmt.Sprintf("failed for %s", OidcKeyId)))
+	}
+	if len(foundKeys) == 0 {
+		return nil, errors.E(errors.WithCode(errors.RecordNotFound), errors.WithOp(op))
+	}
+	if err := foundKeys[0].Decrypt(ctx, rkvWrapper); err != nil {
+		return nil, errors.Wrap(err, op)
+	}
+	return foundKeys[0], nil
+}
+
+// ListOidcKeyVersions will lists versions of a key.  Supports the WithLimit option.
+func (r *Repository) ListOidcKeyVersions(ctx context.Context, rkvWrapper wrapping.Wrapper, OidcKeyId string, opt ...Option) ([]DekVersion, error) {
+	const op = "kms.(Repository).ListOidcKeyVersions"
+	if OidcKeyId == "" {
+		return nil, errors.New(errors.InvalidParameter, op, "missing oidc key id")
+	}
+	if rkvWrapper == nil {
+		return nil, errors.New(errors.InvalidParameter, op, "missing root key version wrapper")
+	}
+	var versions []*OidcKeyVersion
+	err := r.list(ctx, &versions, "oidc_key_id = ?", []interface{}{OidcKeyId}, opt...)
+	if err != nil {
+		return nil, errors.Wrap(err, op)
+	}
+	for i, k := range versions {
+		if err := k.Decrypt(ctx, rkvWrapper); err != nil {
+			return nil, errors.Wrap(err, op, errors.WithMsg(fmt.Sprintf("error decrypting key num %d", i)))
+		}
+	}
+	dekVersions := make([]DekVersion, 0, len(versions))
+	for _, version := range versions {
+		dekVersions = append(dekVersions, version)
+	}
+	return dekVersions, nil
+}

internal/kms/repository_oidc_key_version_test.go

@@ -0,0 +1,367 @@
+package kms_test
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/hashicorp/boundary/internal/db"
+	"github.com/hashicorp/boundary/internal/errors"
+	"github.com/hashicorp/boundary/internal/iam"
+	"github.com/hashicorp/boundary/internal/kms"
+	"github.com/hashicorp/boundary/internal/oplog"
+	wrapping "github.com/hashicorp/go-kms-wrapping"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/proto"
+)
+
+func TestRepository_CreateOidcKeyVersion(t *testing.T) {
+	t.Parallel()
+	conn, _ := db.TestSetup(t, "postgres")
+	rw := db.New(conn)
+	wrapper := db.TestWrapper(t)
+	repo, err := kms.NewRepository(rw, rw)
+	require.NoError(t, err)
+	org, _ := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper))
+	require.NoError(t, conn.Where("1=1").Delete(kms.AllocRootKey()).Error)
+	rk := kms.TestRootKey(t, conn, org.PublicId)
+	_, rkvWrapper := kms.TestRootKeyVersion(t, conn, wrapper, rk.PrivateId)
+	dk := kms.TestOidcKey(t, conn, rk.PrivateId)
+
+	type args struct {
+		key        []byte
+		OidcKeyId  string
+		keyWrapper wrapping.Wrapper
+		opt        []kms.Option
+	}
+	tests := []struct {
+		name        string
+		args        args
+		wantErr     bool
+		wantIsError errors.Code
+	}{
+		{
+			name: "valid",
+			args: args{
+				key:        []byte("test key"),
+				keyWrapper: rkvWrapper,
+				OidcKeyId:  dk.PrivateId,
+			},
+			wantErr: false,
+		},
+		{
+			name: "invalid-rkv-wrapper",
+			args: args{
+				key:        []byte("test key"),
+				keyWrapper: wrapper,
+				OidcKeyId:  dk.PrivateId,
+			},
+			wantErr: true,
+		},
+		{
+			name: "empty-key",
+			args: args{
+				key:        nil,
+				keyWrapper: wrapper,
+				OidcKeyId:  dk.PrivateId,
+			},
+			wantErr:     true,
+			wantIsError: errors.InvalidParameter,
+		},
+		{
+			name: "nil-wrapper",
+			args: args{
+				key:        []byte("test key"),
+				keyWrapper: nil,
+			},
+			wantErr:     true,
+			wantIsError: errors.InvalidParameter,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert, require := assert.New(t), require.New(t)
+			k, err := repo.CreateOidcKeyVersion(context.Background(), tt.args.keyWrapper, tt.args.OidcKeyId, tt.args.key, tt.args.opt...)
+			if tt.wantErr {
+				assert.Error(err)
+				assert.Nil(k)
+				assert.True(errors.Match(errors.T(tt.wantIsError), err))
+				return
+			}
+			require.NoError(err)
+			assert.NotNil(k.CreateTime)
+			foundKey, err := repo.LookupOidcKeyVersion(context.Background(), tt.args.keyWrapper, k.PrivateId)
+			assert.NoError(err)
+			assert.True(proto.Equal(foundKey, k))
+
+			// make sure there was no oplog written
+			err = db.TestVerifyOplog(t, rw, k.PrivateId, db.WithOperation(oplog.OpType_OP_TYPE_CREATE), db.WithCreateNotBefore(10*time.Second))
+			assert.Error(err)
+			assert.True(errors.IsNotFoundError(err))
+		})
+	}
+}
+
+func TestRepository_DeleteOidcKeyVersion(t *testing.T) {
+	t.Parallel()
+	conn, _ := db.TestSetup(t, "postgres")
+	rw := db.New(conn)
+	wrapper := db.TestWrapper(t)
+	repo, err := kms.NewRepository(rw, rw)
+	require.NoError(t, err)
+	org, _ := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper))
+	require.NoError(t, conn.Where("1=1").Delete(kms.AllocRootKey()).Error)
+	rk := kms.TestRootKey(t, conn, org.PublicId)
+	_, rkvWrapper := kms.TestRootKeyVersion(t, conn, wrapper, rk.PrivateId)
+	dk := kms.TestOidcKey(t, conn, rk.PrivateId)
+
+	type args struct {
+		key *kms.OidcKeyVersion
+		opt []kms.Option
+	}
+	tests := []struct {
+		name            string
+		args            args
+		wantRowsDeleted int
+		wantErr         bool
+		wantIsError     errors.Code
+	}{
+		{
+			name: "valid",
+			args: args{
+				key: kms.TestOidcKeyVersion(t, conn, rkvWrapper, dk.PrivateId, []byte("oidc key")),
+			},
+			wantRowsDeleted: 1,
+			wantErr:         false,
+		},
+		{
+			name: "no-private-id",
+			args: args{
+				key: func() *kms.OidcKeyVersion {
+					k := kms.AllocOidcKeyVersion()
+					return &k
+				}(),
+			},
+			wantRowsDeleted: 0,
+			wantErr:         true,
+			wantIsError:     errors.InvalidParameter,
+		},
+		{
+			name: "not-found",
+			args: args{
+				key: func() *kms.OidcKeyVersion {
+					id, err := db.NewPublicId(kms.OidcKeyPrefix)
+					require.NoError(t, err)
+					k := kms.AllocOidcKeyVersion()
+					k.PrivateId = id
+					require.NoError(t, err)
+					return &k
+				}(),
+			},
+			wantRowsDeleted: 0,
+			wantErr:         true,
+			wantIsError:     errors.RecordNotFound,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert, require := assert.New(t), require.New(t)
+			deletedRows, err := repo.DeleteOidcKeyVersion(context.Background(), tt.args.key.PrivateId, tt.args.opt...)
+			if tt.wantErr {
+				require.Error(err)
+				assert.Equal(0, deletedRows)
+				assert.True(errors.Match(errors.T(tt.wantIsError), err))
+				err = db.TestVerifyOplog(t, rw, tt.args.key.PrivateId, db.WithOperation(oplog.OpType_OP_TYPE_DELETE), db.WithCreateNotBefore(10*time.Second))
+				assert.Error(err)
+				assert.True(errors.IsNotFoundError(err))
+				return
+			}
+			require.NoError(err)
+			assert.Equal(tt.wantRowsDeleted, deletedRows)
+			foundKey, err := repo.LookupOidcKeyVersion(context.Background(), wrapper, tt.args.key.PrivateId)
+			assert.Error(err)
+			assert.Nil(foundKey)
+			assert.True(errors.IsNotFoundError(err))
+
+			// make sure there was no oplog written
+			err = db.TestVerifyOplog(t, rw, tt.args.key.PrivateId, db.WithOperation(oplog.OpType_OP_TYPE_DELETE), db.WithCreateNotBefore(10*time.Second))
+			assert.Error(err)
+			assert.True(errors.IsNotFoundError(err))
+		})
+	}
+}
+
+func TestRepository_LatestOidcKeyVersion(t *testing.T) {
+	t.Parallel()
+	conn, _ := db.TestSetup(t, "postgres")
+	rw := db.New(conn)
+	wrapper := db.TestWrapper(t)
+	repo, err := kms.NewRepository(rw, rw)
+	require.NoError(t, err)
+	org, _ := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper))
+	require.NoError(t, conn.Where("1=1").Delete(kms.AllocRootKey()).Error)
+	rk := kms.TestRootKey(t, conn, org.PublicId)
+	_, rkvWrapper := kms.TestRootKeyVersion(t, conn, wrapper, rk.PrivateId)
+	dk := kms.TestOidcKey(t, conn, rk.PrivateId)
+
+	tests := []struct {
+		name        string
+		createCnt   int
+		keyWrapper  wrapping.Wrapper
+		wantVersion uint32
+		wantErr     bool
+		wantIsError errors.Code
+	}{
+		{
+			name:        "5",
+			createCnt:   5,
+			keyWrapper:  rkvWrapper,
+			wantVersion: 5,
+			wantErr:     false,
+		},
+		{
+			name:        "1",
+			createCnt:   1,
+			keyWrapper:  rkvWrapper,
+			wantVersion: 1,
+			wantErr:     false,
+		},
+		{
+			name:        "0",
+			createCnt:   0,
+			keyWrapper:  rkvWrapper,
+			wantErr:     true,
+			wantIsError: errors.RecordNotFound,
+		},
+		{
+			name:        "nil-wrapper",
+			createCnt:   5,
+			keyWrapper:  nil,
+			wantErr:     true,
+			wantIsError: errors.InvalidParameter,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert, require := assert.New(t), require.New(t)
+			require.NoError(conn.Where("1=1").Delete(kms.AllocOidcKeyVersion()).Error)
+			testKeys := []*kms.OidcKeyVersion{}
+			for i := 0; i < tt.createCnt; i++ {
+				k := kms.TestOidcKeyVersion(t, conn, rkvWrapper, dk.PrivateId, []byte("test oidc key"))
+				testKeys = append(testKeys, k)
+			}
+			assert.Equal(tt.createCnt, len(testKeys))
+			got, err := repo.LatestOidcKeyVersion(context.Background(), tt.keyWrapper, dk.PrivateId)
+			if tt.wantErr {
+				require.Error(err)
+				assert.Nil(got)
+				assert.True(errors.Match(errors.T(tt.wantIsError), err))
+				return
+			}
+			require.NoError(err)
+			require.NotNil(got)
+			assert.Equal(tt.wantVersion, got.Version)
+		})
+	}
+}
+
+func TestRepository_ListOidcKeyVersions(t *testing.T) {
+	t.Parallel()
+	conn, _ := db.TestSetup(t, "postgres")
+	const testLimit = 10
+	rw := db.New(conn)
+	wrapper := db.TestWrapper(t)
+	repo, err := kms.NewRepository(rw, rw, kms.WithLimit(testLimit))
+	require.NoError(t, err)
+	org, _ := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper))
+	require.NoError(t, conn.Where("1=1").Delete(kms.AllocRootKey()).Error)
+	rk := kms.TestRootKey(t, conn, org.PublicId)
+	_, rkvWrapper := kms.TestRootKeyVersion(t, conn, wrapper, rk.PrivateId)
+	dk := kms.TestOidcKey(t, conn, rk.PrivateId)
+
+	type args struct {
+		OidcKeyId  string
+		keyWrapper wrapping.Wrapper
+		opt        []kms.Option
+	}
+	tests := []struct {
+		name      string
+		createCnt int
+		args      args
+		wantCnt   int
+		wantErr   bool
+	}{
+		{
+			name:      "no-limit",
+			createCnt: repo.DefaultLimit() + 1,
+			args: args{
+				OidcKeyId:  dk.PrivateId,
+				keyWrapper: rkvWrapper,
+				opt:        []kms.Option{kms.WithLimit(-1)},
+			},
+			wantCnt: repo.DefaultLimit() + 1,
+			wantErr: false,
+		},
+		{
+			name:      "default-limit",
+			createCnt: repo.DefaultLimit() + 1,
+			args: args{
+				keyWrapper: rkvWrapper,
+				OidcKeyId:  dk.PrivateId,
+			},
+			wantCnt: repo.DefaultLimit(),
+			wantErr: false,
+		},
+		{
+			name:      "custom-limit",
+			createCnt: repo.DefaultLimit() + 1,
+			args: args{
+				keyWrapper: rkvWrapper,
+				OidcKeyId:  dk.PrivateId,
+				opt:        []kms.Option{kms.WithLimit(3)},
+			},
+			wantCnt: 3,
+			wantErr: false,
+		},
+		{
+			name:      "bad-org",
+			createCnt: 1,
+			args: args{
+				keyWrapper: rkvWrapper,
+				OidcKeyId:  "bad-id",
+			},
+			wantCnt: 0,
+			wantErr: false,
+		},
+		{
+			name:      "nil-wrapper",
+			createCnt: 1,
+			args: args{
+				keyWrapper: nil,
+				OidcKeyId:  dk.PrivateId,
+			},
+			wantCnt: 0,
+			wantErr: true,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert, require := assert.New(t), require.New(t)
+			require.NoError(conn.Where("1=1").Delete(kms.AllocOidcKeyVersion()).Error)
+			keyVersions := []*kms.OidcKeyVersion{}
+			for i := 0; i < tt.createCnt; i++ {
+				k := kms.TestOidcKeyVersion(t, conn, rkvWrapper, dk.PrivateId, []byte("oidc key"))
+				keyVersions = append(keyVersions, k)
+			}
+			assert.Equal(tt.createCnt, len(keyVersions))
+			got, err := repo.ListOidcKeyVersions(context.Background(), tt.args.keyWrapper, tt.args.OidcKeyId, tt.args.opt...)
+			if tt.wantErr {
+				require.Error(err)
+				return
+			}
+			require.NoError(err)
+			assert.Equal(tt.wantCnt, len(got))
+		})
+	}
+}

internal/kms/repository_test.go

@@ -244,6 +244,19 @@ func TestCreateKeysTx(t *testing.T) {
 			require.NoError(err)
 			assert.Equal(tk.PrivateId, tkv.TokenKeyId)
 			assert.Equal(rkv.PrivateId, tkv.RootKeyVersionId)
+
+			oidcK := kms.AllocOidcKey()
+			oidcK.PrivateId = keys[kms.KeyTypeOidcKey].GetPrivateId()
+			err = rw.LookupById(context.Background(), &oidcK)
+			require.NoError(err)
+			assert.Equal(rk.PrivateId, oidcK.RootKeyId)
+
+			oidcKv := kms.AllocOidcKeyVersion()
+			oidcKv.PrivateId = keys[kms.KeyTypeOidcKeyVersion].GetPrivateId()
+			err = rw.LookupById(context.Background(), &oidcKv)
+			require.NoError(err)
+			assert.Equal(oidcK.PrivateId, oidcKv.OidcKeyId)
+			assert.Equal(rkv.PrivateId, oidcKv.RootKeyVersionId)
 		})
 	}
 }

internal/kms/store/oidc_key.pb.go

@@ -0,0 +1,329 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.25.0-devel
+// 	protoc        v3.12.4
+// source: controller/storage/kms/store/v1/oidc_key.proto
+
+package store
+
+import (
+	timestamp "github.com/hashicorp/boundary/internal/db/timestamp"
+	_ "github.com/hashicorp/boundary/internal/gen/controller/protooptions"
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type OidcKey struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// private_id is used to access the key via an API
+	// @inject_tag: gorm:"primary_key"
+	PrivateId string `protobuf:"bytes,10,opt,name=private_id,json=privateId,proto3" json:"private_id,omitempty" gorm:"primary_key"`
+	// root key id for the key
+	// @inject_tag: `gorm:"default:null"`
+	RootKeyId string `protobuf:"bytes,20,opt,name=root_key_id,json=rootKeyId,proto3" json:"root_key_id,omitempty" gorm:"default:null"`
+	// create_time from the RDBMS
+	// @inject_tag: `gorm:"default:current_timestamp"`
+	CreateTime *timestamp.Timestamp `protobuf:"bytes,30,opt,name=create_time,json=createTime,proto3" json:"create_time,omitempty" gorm:"default:current_timestamp"`
+}
+
+func (x *OidcKey) Reset() {
+	*x = OidcKey{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_controller_storage_kms_store_v1_oidc_key_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *OidcKey) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*OidcKey) ProtoMessage() {}
+
+func (x *OidcKey) ProtoReflect() protoreflect.Message {
+	mi := &file_controller_storage_kms_store_v1_oidc_key_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use OidcKey.ProtoReflect.Descriptor instead.
+func (*OidcKey) Descriptor() ([]byte, []int) {
+	return file_controller_storage_kms_store_v1_oidc_key_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *OidcKey) GetPrivateId() string {
+	if x != nil {
+		return x.PrivateId
+	}
+	return ""
+}
+
+func (x *OidcKey) GetRootKeyId() string {
+	if x != nil {
+		return x.RootKeyId
+	}
+	return ""
+}
+
+func (x *OidcKey) GetCreateTime() *timestamp.Timestamp {
+	if x != nil {
+		return x.CreateTime
+	}
+	return nil
+}
+
+type OidcKeyVersion struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// private_id is used to access the key version via an API
+	// @inject_tag: gorm:"primary_key"
+	PrivateId string `protobuf:"bytes,10,opt,name=private_id,json=privateId,proto3" json:"private_id,omitempty" gorm:"primary_key"`
+	// id for the key version
+	// @inject_tag: `gorm:"default:null"`
+	OidcKeyId string `protobuf:"bytes,20,opt,name=oidc_key_id,json=oidcKeyId,proto3" json:"oidc_key_id,omitempty" gorm:"default:null"`
+	// root_key_version_id of the version of the root key data.
+	// @inject_tag: `gorm:"default:null"`
+	RootKeyVersionId string `protobuf:"bytes,30,opt,name=root_key_version_id,json=rootKeyVersionId,proto3" json:"root_key_version_id,omitempty" gorm:"default:null"`
+	// plain-text of the key data.  we are NOT storing this plain-text key
+	// in the db.
+	// @inject_tag: `gorm:"-" wrapping:"pt,key_data"`
+	Key []byte `protobuf:"bytes,40,opt,name=key,proto3" json:"key,omitempty" gorm:"-" wrapping:"pt,key_data"`
+	// ciphertext key data stored in the database
+	// @inject_tag: `gorm:"column:key;not_null" wrapping:"ct,key_data"`
+	CtKey []byte `protobuf:"bytes,50,opt,name=ct_key,json=ctKey,proto3" json:"ct_key,omitempty" gorm:"column:key;not_null" wrapping:"ct,key_data"`
+	// version of the key data.  This is not used for optimistic locking, since
+	// key versions are immutable.  It's just the version of the key.
+	// @inject_tag: `gorm:"default:null"`
+	Version uint32 `protobuf:"varint,60,opt,name=version,proto3" json:"version,omitempty" gorm:"default:null"`
+	// create_time from the RDBMS
+	// @inject_tag: `gorm:"default:current_timestamp"`
+	CreateTime *timestamp.Timestamp `protobuf:"bytes,70,opt,name=create_time,json=createTime,proto3" json:"create_time,omitempty" gorm:"default:current_timestamp"`
+}
+
+func (x *OidcKeyVersion) Reset() {
+	*x = OidcKeyVersion{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_controller_storage_kms_store_v1_oidc_key_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *OidcKeyVersion) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*OidcKeyVersion) ProtoMessage() {}
+
+func (x *OidcKeyVersion) ProtoReflect() protoreflect.Message {
+	mi := &file_controller_storage_kms_store_v1_oidc_key_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use OidcKeyVersion.ProtoReflect.Descriptor instead.
+func (*OidcKeyVersion) Descriptor() ([]byte, []int) {
+	return file_controller_storage_kms_store_v1_oidc_key_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *OidcKeyVersion) GetPrivateId() string {
+	if x != nil {
+		return x.PrivateId
+	}
+	return ""
+}
+
+func (x *OidcKeyVersion) GetOidcKeyId() string {
+	if x != nil {
+		return x.OidcKeyId
+	}
+	return ""
+}
+
+func (x *OidcKeyVersion) GetRootKeyVersionId() string {
+	if x != nil {
+		return x.RootKeyVersionId
+	}
+	return ""
+}
+
+func (x *OidcKeyVersion) GetKey() []byte {
+	if x != nil {
+		return x.Key
+	}
+	return nil
+}
+
+func (x *OidcKeyVersion) GetCtKey() []byte {
+	if x != nil {
+		return x.CtKey
+	}
+	return nil
+}
+
+func (x *OidcKeyVersion) GetVersion() uint32 {
+	if x != nil {
+		return x.Version
+	}
+	return 0
+}
+
+func (x *OidcKeyVersion) GetCreateTime() *timestamp.Timestamp {
+	if x != nil {
+		return x.CreateTime
+	}
+	return nil
+}
+
+var File_controller_storage_kms_store_v1_oidc_key_proto protoreflect.FileDescriptor
+
+var file_controller_storage_kms_store_v1_oidc_key_proto_rawDesc = []byte{
+	0x0a, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2f, 0x73, 0x74, 0x6f,
+	0x72, 0x61, 0x67, 0x65, 0x2f, 0x6b, 0x6d, 0x73, 0x2f, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2f, 0x76,
+	0x31, 0x2f, 0x6f, 0x69, 0x64, 0x63, 0x5f, 0x6b, 0x65, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x12, 0x1f, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x74, 0x6f,
+	0x72, 0x61, 0x67, 0x65, 0x2e, 0x6b, 0x6d, 0x73, 0x2e, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x76,
+	0x31, 0x1a, 0x2f, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2f, 0x73, 0x74,
+	0x6f, 0x72, 0x61, 0x67, 0x65, 0x2f, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2f,
+	0x76, 0x31, 0x2f, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x1a, 0x2a, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2f, 0x63,
+	0x75, 0x73, 0x74, 0x6f, 0x6d, 0x5f, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2f, 0x76, 0x31,
+	0x2f, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x95,
+	0x01, 0x0a, 0x07, 0x4f, 0x69, 0x64, 0x63, 0x4b, 0x65, 0x79, 0x12, 0x1d, 0x0a, 0x0a, 0x70, 0x72,
+	0x69, 0x76, 0x61, 0x74, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09,
+	0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x49, 0x64, 0x12, 0x1e, 0x0a, 0x0b, 0x72, 0x6f, 0x6f,
+	0x74, 0x5f, 0x6b, 0x65, 0x79, 0x5f, 0x69, 0x64, 0x18, 0x14, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09,
+	0x72, 0x6f, 0x6f, 0x74, 0x4b, 0x65, 0x79, 0x49, 0x64, 0x12, 0x4b, 0x0a, 0x0b, 0x63, 0x72, 0x65,
+	0x61, 0x74, 0x65, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x1e, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2a,
+	0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x74, 0x6f, 0x72,
+	0x61, 0x67, 0x65, 0x2e, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x76, 0x31,
+	0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0a, 0x63, 0x72, 0x65, 0x61,
+	0x74, 0x65, 0x54, 0x69, 0x6d, 0x65, 0x22, 0x8e, 0x02, 0x0a, 0x0e, 0x4f, 0x69, 0x64, 0x63, 0x4b,
+	0x65, 0x79, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x1d, 0x0a, 0x0a, 0x70, 0x72, 0x69,
+	0x76, 0x61, 0x74, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x70,
+	0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x49, 0x64, 0x12, 0x1e, 0x0a, 0x0b, 0x6f, 0x69, 0x64, 0x63,
+	0x5f, 0x6b, 0x65, 0x79, 0x5f, 0x69, 0x64, 0x18, 0x14, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x6f,
+	0x69, 0x64, 0x63, 0x4b, 0x65, 0x79, 0x49, 0x64, 0x12, 0x2d, 0x0a, 0x13, 0x72, 0x6f, 0x6f, 0x74,
+	0x5f, 0x6b, 0x65, 0x79, 0x5f, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x69, 0x64, 0x18,
+	0x1e, 0x20, 0x01, 0x28, 0x09, 0x52, 0x10, 0x72, 0x6f, 0x6f, 0x74, 0x4b, 0x65, 0x79, 0x56, 0x65,
+	0x72, 0x73, 0x69, 0x6f, 0x6e, 0x49, 0x64, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x28,
+	0x20, 0x01, 0x28, 0x0c, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x15, 0x0a, 0x06, 0x63, 0x74, 0x5f,
+	0x6b, 0x65, 0x79, 0x18, 0x32, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x05, 0x63, 0x74, 0x4b, 0x65, 0x79,
+	0x12, 0x18, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x3c, 0x20, 0x01, 0x28,
+	0x0d, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x4b, 0x0a, 0x0b, 0x63, 0x72,
+	0x65, 0x61, 0x74, 0x65, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x46, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x2a, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x74, 0x6f,
+	0x72, 0x61, 0x67, 0x65, 0x2e, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x76,
+	0x31, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0a, 0x63, 0x72, 0x65,
+	0x61, 0x74, 0x65, 0x54, 0x69, 0x6d, 0x65, 0x42, 0x38, 0x5a, 0x36, 0x67, 0x69, 0x74, 0x68, 0x75,
+	0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f,
+	0x62, 0x6f, 0x75, 0x6e, 0x64, 0x61, 0x72, 0x79, 0x2f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61,
+	0x6c, 0x2f, 0x6b, 0x6d, 0x73, 0x2f, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x3b, 0x73, 0x74, 0x6f, 0x72,
+	0x65, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_controller_storage_kms_store_v1_oidc_key_proto_rawDescOnce sync.Once
+	file_controller_storage_kms_store_v1_oidc_key_proto_rawDescData = file_controller_storage_kms_store_v1_oidc_key_proto_rawDesc
+)
+
+func file_controller_storage_kms_store_v1_oidc_key_proto_rawDescGZIP() []byte {
+	file_controller_storage_kms_store_v1_oidc_key_proto_rawDescOnce.Do(func() {
+		file_controller_storage_kms_store_v1_oidc_key_proto_rawDescData = protoimpl.X.CompressGZIP(file_controller_storage_kms_store_v1_oidc_key_proto_rawDescData)
+	})
+	return file_controller_storage_kms_store_v1_oidc_key_proto_rawDescData
+}
+
+var file_controller_storage_kms_store_v1_oidc_key_proto_msgTypes = make([]protoimpl.MessageInfo, 2)
+var file_controller_storage_kms_store_v1_oidc_key_proto_goTypes = []interface{}{
+	(*OidcKey)(nil),             // 0: controller.storage.kms.store.v1.OidcKey
+	(*OidcKeyVersion)(nil),      // 1: controller.storage.kms.store.v1.OidcKeyVersion
+	(*timestamp.Timestamp)(nil), // 2: controller.storage.timestamp.v1.Timestamp
+}
+var file_controller_storage_kms_store_v1_oidc_key_proto_depIdxs = []int32{
+	2, // 0: controller.storage.kms.store.v1.OidcKey.create_time:type_name -> controller.storage.timestamp.v1.Timestamp
+	2, // 1: controller.storage.kms.store.v1.OidcKeyVersion.create_time:type_name -> controller.storage.timestamp.v1.Timestamp
+	2, // [2:2] is the sub-list for method output_type
+	2, // [2:2] is the sub-list for method input_type
+	2, // [2:2] is the sub-list for extension type_name
+	2, // [2:2] is the sub-list for extension extendee
+	0, // [0:2] is the sub-list for field type_name
+}
+
+func init() { file_controller_storage_kms_store_v1_oidc_key_proto_init() }
+func file_controller_storage_kms_store_v1_oidc_key_proto_init() {
+	if File_controller_storage_kms_store_v1_oidc_key_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_controller_storage_kms_store_v1_oidc_key_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*OidcKey); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_controller_storage_kms_store_v1_oidc_key_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*OidcKeyVersion); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_controller_storage_kms_store_v1_oidc_key_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   2,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_controller_storage_kms_store_v1_oidc_key_proto_goTypes,
+		DependencyIndexes: file_controller_storage_kms_store_v1_oidc_key_proto_depIdxs,
+		MessageInfos:      file_controller_storage_kms_store_v1_oidc_key_proto_msgTypes,
+	}.Build()
+	File_controller_storage_kms_store_v1_oidc_key_proto = out.File
+	file_controller_storage_kms_store_v1_oidc_key_proto_rawDesc = nil
+	file_controller_storage_kms_store_v1_oidc_key_proto_goTypes = nil
+	file_controller_storage_kms_store_v1_oidc_key_proto_depIdxs = nil
+}

internal/kms/testing.go

@@ -196,3 +196,37 @@ func TestSessionKeyVersion(t *testing.T, conn *gorm.DB, rootKeyVersionWrapper wr
 	require.NoError(err)
 	return k
 }
+
+func TestOidcKey(t *testing.T, conn *gorm.DB, rootKeyId string) *OidcKey {
+	t.Helper()
+	require := require.New(t)
+	rw := db.New(conn)
+	require.NoError(conn.Where("root_key_id = ?", rootKeyId).Delete(AllocOidcKey()).Error)
+	k, err := NewOidcKey(rootKeyId)
+	require.NoError(err)
+	id, err := newOidcKeyId()
+	require.NoError(err)
+	k.PrivateId = id
+	k.RootKeyId = rootKeyId
+	err = rw.Create(context.Background(), k)
+	require.NoError(err)
+	return k
+}
+
+func TestOidcKeyVersion(t *testing.T, conn *gorm.DB, rootKeyVersionWrapper wrapping.Wrapper, oidcKeyId string, key []byte) *OidcKeyVersion {
+	t.Helper()
+	require := require.New(t)
+	rw := db.New(conn)
+	rootKeyVersionId := rootKeyVersionWrapper.KeyID()
+	require.NotEmpty(rootKeyVersionId)
+	k, err := NewOidcKeyVersion(oidcKeyId, key, rootKeyVersionId)
+	require.NoError(err)
+	id, err := newDatabaseKeyVersionId()
+	require.NoError(err)
+	k.PrivateId = id
+	err = k.Encrypt(context.Background(), rootKeyVersionWrapper)
+	require.NoError(err)
+	err = rw.Create(context.Background(), k)
+	require.NoError(err)
+	return k
+}

internal/proto/local/controller/storage/kms/store/v1/oidc_key.proto

@@ -0,0 +1,53 @@
+syntax = "proto3";
+
+package controller.storage.kms.store.v1;
+option go_package = "github.com/hashicorp/boundary/internal/kms/store;store";
+
+import "controller/storage/timestamp/v1/timestamp.proto";
+import "controller/custom_options/v1/options.proto";
+
+message OidcKey {
+  // private_id is used to access the key via an API
+  // @inject_tag: gorm:"primary_key"
+  string private_id = 10;
+
+  // root key id for the key
+  // @inject_tag: `gorm:"default:null"`
+  string root_key_id = 20;
+
+  // create_time from the RDBMS
+  // @inject_tag: `gorm:"default:current_timestamp"`
+  timestamp.v1.Timestamp create_time = 30;
+}
+
+message OidcKeyVersion {
+  // private_id is used to access the key version via an API
+  // @inject_tag: gorm:"primary_key"
+  string private_id = 10;
+
+  // id for the key version
+  // @inject_tag: `gorm:"default:null"`
+  string oidc_key_id = 20;
+
+  // root_key_version_id of the version of the root key data.
+  // @inject_tag: `gorm:"default:null"`
+  string root_key_version_id = 30;
+
+  // plain-text of the key data.  we are NOT storing this plain-text key
+  // in the db.
+  // @inject_tag: `gorm:"-" wrapping:"pt,key_data"`
+  bytes key = 40;
+
+  // ciphertext key data stored in the database
+  // @inject_tag: `gorm:"column:key;not_null" wrapping:"ct,key_data"`
+  bytes ct_key = 50;
+
+  // version of the key data.  This is not used for optimistic locking, since
+  // key versions are immutable.  It's just the version of the key.
+  // @inject_tag: `gorm:"default:null"`
+  uint32 version = 60;
+
+  // create_time from the RDBMS
+  // @inject_tag: `gorm:"default:current_timestamp"`
+  timestamp.v1.Timestamp create_time = 70;
+}