Class SamlAssertionRejectedEvent

Namespace

Fdyay.IdentityServer.Events

Assembly

Fdyay.IdentityServer.Core.dll

An assertion an upstream identity provider sent us was refused.

public class SamlAssertionRejectedEvent : Event

Inheritance

object

Event

SamlAssertionRejectedEvent

Inherited Members

Event.Category

Event.Name

Event.EventType

Event.Id

Event.Message

Event.TimeStamp

Event.ActivityId

Event.RemoteIpAddress

Event.LocalIpAddress

Event.ProcessId

Event.PrepareAsync()

Event.ToString()

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.MemberwiseClone()

object.ReferenceEquals(object, object)

Remarks

The mirror of SamlSignOnFailureEvent, and the reason it is a separate type rather than a reuse: that one records this server as an identity provider refusing a service provider's request, and this one records this server as a service provider refusing an identity provider's answer. Different actor, different direction, different thing to go and fix — and the peer it names is an identity provider, so carrying it in a member called ServiceProviderEntityId would be a claim crossing a boundary under the wrong side's name.

0.51.0 said this server speaks two protocols and audited one, then audited SAML sign-on from the identity provider's side. SAML has two roles and two operations; that covered one cell of four. Successes were already recorded in all four — the service provider side reaches UserLoginSuccessEvent through the external login page — while refusals were recorded in exactly one. A refused assertion never reaches that page, so nothing recorded it at all.

The assertion is absent for the reason its counterpart's is: a signed assertion in a log store is a credential, and every question this event answers is answerable without it.

Constructors

SamlAssertionRejectedEvent(string, string?, string)

An assertion from an upstream identity provider that was refused.

public SamlAssertionRejectedEvent(string scheme, string? identityProviderEntityId, string error)

Parameters

scheme string

The authentication scheme it arrived at.

identityProviderEntityId string

The identity provider, or null when the response could not be read far enough to say.

error string

Why it was refused; also carried as Message.

Properties

Error

Why it was refused.

public string Error { get; }

Property Value

string

IdentityProviderEntityId

Null when the response could not be read far enough to say who sent it.

public string? IdentityProviderEntityId { get; }

Property Value

string

Scheme

The authentication scheme the assertion arrived at, so a host with several can tell them apart.

public string Scheme { get; }

Property Value

string