Class DistributedCacheStateDataFormatter

Namespace

Fdyay.IdentityServer.Federation

Assembly

Fdyay.IdentityServer.Federation.dll

Keeps an OpenID Connect sign-in's state in IDistributedCache and sends the provider only a protected key to it. Duende's.

public sealed class DistributedCacheStateDataFormatter : ISecureDataFormat<AuthenticationProperties>

Inheritance

object

DistributedCacheStateDataFormatter

Implements

ISecureDataFormat<AuthenticationProperties>

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

object.ToString()

Remarks

Duende 8.0.1's DistributedCacheStateDataFormatter, measured. The handler's own state formatter writes the whole of the sign-in's properties into the state parameter, which grows with every item a host adds and can outgrow what a provider or a proxy accepts in a URL. This keeps them in the cache under DistributedCacheStateDataFormatter-{scheme}-{purpose}-{guid} — until the properties' own expiry, else for an hour sliding — and sends the key, protected under the purposes DistributedCacheStateDataFormatter and the scheme. Behind a load balancer the cache must be one every instance shares, since the provider may answer on any of them. Registered with AddOidcStateDataFormatterCache. The key's last part, a GUID, is what is protected and sent.

Where ours differs: the properties' items are what is kept, as the framework's own state formatter keeps them, where Duende's serializes the whole AuthenticationProperties object.

Constructors

DistributedCacheStateDataFormatter(IServiceProvider, string)

public DistributedCacheStateDataFormatter(IServiceProvider provider, string name)

Parameters

provider IServiceProvider

Where the cache and the data protection are resolved from, when first used.

name string

The OpenID Connect scheme whose state this keeps.

Methods

Protect(AuthenticationProperties)

Keeps data's items in the cache under no purpose, and returns the protected key to send as state.

public string Protect(AuthenticationProperties data)

Parameters

data AuthenticationProperties

The sign-in's authentication properties.

Returns

string

The protected key.

Exceptions

ArgumentNullException

data is null.

Protect(AuthenticationProperties, string?)

Keeps data's items in the cache — until the properties' expiry, else for an hour sliding — and returns the protected key to send as state.

public string Protect(AuthenticationProperties data, string? purpose)

Parameters

data AuthenticationProperties

The sign-in's authentication properties.

purpose string

The purpose the state is kept under, part of its cache key; null for none.

Returns

string

The protected key.

Exceptions

ArgumentNullException

data is null.

Unprotect(string?)

The properties kept under the protected key with no purpose, or null when there is no key or nothing is kept under it.

public AuthenticationProperties? Unprotect(string? protectedText)

Parameters

protectedText string

The state the provider sent back.

Returns

AuthenticationProperties

The authentication properties, or null.

Exceptions

CryptographicException

protectedText does not unprotect.

Unprotect(string?, string?)

public AuthenticationProperties? Unprotect(string? protectedText, string? purpose)

Parameters

protectedText string

purpose string

Returns

AuthenticationProperties

Remarks

A value that does not unprotect throws, as Duende's and the handler's own formatter do; the handler answers the callback as a failure. State written under another purpose names another key, and reads as none.