Class SamlLogoutFailureEvent

Namespace

Fdyay.IdentityServer.Events

Assembly

Fdyay.IdentityServer.Core.dll

A SAML logout message was refused.

public class SamlLogoutFailureEvent : Event

Inheritance

object

Event

SamlLogoutFailureEvent

Inherited Members

Event.Category

Event.Name

Event.EventType

Event.Id

Event.Message

Event.TimeStamp

Event.ActivityId

Event.RemoteIpAddress

Event.LocalIpAddress

Event.ProcessId

Event.PrepareAsync()

Event.ToString()

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.MemberwiseClone()

object.ReferenceEquals(object, object)

Remarks

One type for both roles, which is a decision rather than an economy. A rise in these means the same investigation whichever side it came from — a partner's signing key has rotated, a registration is stale, or somebody is putting logout requests at a published endpoint to see whose session they can end — and the peer this names is what says which partner to go and look at.

The argument against, recorded because it is not weak: an operator whose server is both an identity provider and a service provider might reasonably alert differently on the two directions. That is answerable from PeerEntityId and Scheme without a second type, and a single type means a host that takes on its second role later keeps receiving these rather than silently missing them for having subscribed to one of two. 0.57.0 split three session-ending events apart because an operator does something different about each; this is the case where they do the same thing.

What is deliberately not recorded here: a request carrying no SAML message at all. A published endpoint is reached by crawlers and health checks, and an event per drive-by turns the record this exists to be into noise. The line is that this server read enough to know it was being asked something and then refused.

Constructors

SamlLogoutFailureEvent(string?, string, string?)

A refused SAML logout message, in either role.

public SamlLogoutFailureEvent(string? peerEntityId, string error, string? scheme = null)

Parameters

peerEntityId string

The partner the message named, or null when it could not be read far enough to say.

error string

Why it was refused; also carried as Message.

scheme string

The authentication scheme when this server was the service provider; null when it was the identity provider.

Properties

Error

Why it was refused.

public string Error { get; }

Property Value

string

PeerEntityId

The partner the message named, or null when it could not be read far enough to say.

public string? PeerEntityId { get; }

Property Value

string

Scheme

The authentication scheme, when this server was acting as a service provider; null when it was acting as the identity provider, because that path has no scheme.

public string? Scheme { get; }

Property Value

string