Class FederatedSignOutHandlerProvider

Namespace

Fdyay.IdentityServer.Hosting

Assembly

Fdyay.IdentityServer.AspNetCore.dll

Hands out the identity server's cookie handler wrapped, so that a sign-out performed by somebody else runs the same sequence as one performed here.

public sealed class FederatedSignOutHandlerProvider : IAuthenticationHandlerProvider

Inheritance

object

FederatedSignOutHandlerProvider

Implements

IAuthenticationHandlerProvider

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

object.ToString()

Remarks

This is the path that is not ours to call. An upstream provider's handler, notified at its own remote endpoint that the session ended there, signs out the scheme named by its SignOutScheme — this server's cookie — and returns. No code of this server's is on that path, so ISignOutService never runs and the relying parties that authenticated the session are told nothing.

Wrapping the sign-out rather than the request is what makes the detection exact. A wrapper around the request handler would have to work out afterwards whether the session had ended, and it cannot: the cookie handler caches its authenticate result for the request, so asking again after the fact still reports the ticket that has just been deleted.

It also closes the shape structurally rather than one path at a time. Three releases running found a place that ended a session without telling anyone — the end-session endpoint, then the SAML logout endpoint, then this. Anything that drops this cookie now runs the sequence, whether or not whoever wrote it knew the sequence existed.

Constructors

FederatedSignOutHandlerProvider(IAuthenticationHandlerProvider)

Decorates the handler provider registered before this one.

public FederatedSignOutHandlerProvider(IAuthenticationHandlerProvider inner)

Parameters

inner IAuthenticationHandlerProvider

The provider whose handlers are handed out.

Methods

GetHandlerAsync(HttpContext, string)

The handler for authenticationScheme, wrapped so its sign-out runs the federated sign-out sequence when it is this server's own session cookie; any other scheme's handler untouched.

public Task<IAuthenticationHandler?> GetHandlerAsync(HttpContext context, string authenticationScheme)

Parameters

context HttpContext

The request.

authenticationScheme string

The scheme whose handler is asked for.

Returns

Task<IAuthenticationHandler>

The handler, or null when the scheme has none.