Class SamlLogoutNotificationFailureEvent

Namespace

Fdyay.IdentityServer.Events

Assembly

Fdyay.IdentityServer.Core.dll

A partner in a logout could not be told, so its session is still live.

public class SamlLogoutNotificationFailureEvent : Event

Inheritance

object

Event

SamlLogoutNotificationFailureEvent

Inherited Members

Event.Category

Event.Name

Event.EventType

Event.Id

Event.Message

Event.TimeStamp

Event.ActivityId

Event.RemoteIpAddress

Event.LocalIpAddress

Event.ProcessId

Event.PrepareAsync()

Event.ToString()

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.MemberwiseClone()

object.ReferenceEquals(object, object)

Remarks

The SAML twin of BackChannelLogoutFailureEvent, and it names the same fact: a session this server believes is over and a partner believes is live. That is the state somebody has to find before a user reports it, and on this protocol it was reached by a continue in a loop.

Distinct from SamlLogoutFailureEvent, which is a message this server refused. Here nothing was wrong with any message: the logout is proceeding correctly and one partner is being left out of it. An operator does something different about the two — a refusal points at a signing key or a forged request, this points at a registration — so folding them together would put the distinction where no alert rule can read it. 0.57.0's reason for splitting three session-ending events apart.

One type with a reason rather than a type per cause, which is the opposite call and the opposite reason: every value of Reason prompts the same investigation — go and look at that partner's registration — so the reason is diagnostic rather than an alerting key. 0.63.0's SenderConstraintViolationEvent made the same call for the same reason. Duende splits the configuration half out as InvalidSamlServiceProviderConfigurationEvent; that name is accurate for two of these three reasons and wrong for the third, and a name that is right for part of what it covers is what §1 keeps finding.

One type for both roles, as SamlLogoutFailureEvent is, and for its reason: this server fails to notify an identity provider through a scheme and a service provider through a registration, and the investigation is the same one. Scheme is what says which it was.

Constructors

SamlLogoutNotificationFailureEvent(string, string, string?)

A partner in a logout that could not be told.

public SamlLogoutNotificationFailureEvent(string peerEntityId, string reason, string? scheme = null)

Parameters

peerEntityId string

The partner that was not told.

reason string

Why — one of SamlLogoutNotificationFailureReasons; also carried as Message.

scheme string

The authentication scheme when this server was the service provider; null when it was the identity provider.

Properties

PeerEntityId

The partner that was not told.

public string PeerEntityId { get; }

Property Value

string

Remarks

Always known, including when the reason is that the registry no longer holds it: the entity id comes from the session's own participant list, not from the registration that has gone. Which is the whole value of the event in that case — the id is what an operator needs to find the session's history.

Reason

Why it could not be told. One of SamlLogoutNotificationFailureReasons.

public string Reason { get; }

Property Value

string

Scheme

The authentication scheme, when this server was acting as a service provider and could not reach its identity provider; null when it was acting as the identity provider.

public string? Scheme { get; }

Property Value

string