Table of Contents

Class SamlIdpInitiatedSignOnEndpoint

Namespace
Fdyay.IdentityServer.Saml.Endpoints
Assembly
Fdyay.IdentityServer.Saml.dll

The unsolicited half of SAML Web SSO (§4.1.5): a sign-on this server starts itself.

public sealed class SamlIdpInitiatedSignOnEndpoint : IEndpointHandler
Inheritance
SamlIdpInitiatedSignOnEndpoint
Implements
Inherited Members

Remarks

A link in the identity provider's own portal, naming a registered service provider, which posts an assertion the service provider never asked for. There is no AuthnRequest and so nothing to authenticate about the request itself — the entity id in the query is a selector, not a credential — which is why the capability is switched on by a host rather than served by default, and why everything this endpoint will name comes from the registration rather than from the request.

What it shares with the solicited endpoint, deliberately. The reply address is checked against the host's refusal list before any form is built, because the POST binding's form executes in this server's own origin; a refusal leaves by the error page rather than through the address being refused; the detour through the login page carries an opaque reference rather than anything the browser could edit; and the assertion issued is recorded. Each of those is a rule the other door already obeys, and a second door that skipped one would be the half-a-rule shape this programme keeps paying for.

What differs. The response names no request, at either of the two places InResponseTo can appear — §4.1.5 requires the attribute absent rather than empty, and a receiver that accepts a correlated response where it expected an uncorrelated one is accepting somebody else's answer. RelayState is carried through untouched and is never a destination this server navigates to: it belongs to the service provider's site, and following it here would make this an open redirector for anyone who can write a link.

Constructors

SamlIdpInitiatedSignOnEndpoint(ISamlServiceProviderStore, ISaml2SsoResponseGenerator, IOptions<SamlOptions>, IOptions<IdentityServerOptions>, IIssuerNameService, IMessageStore<ErrorMessage>, ISamlSigninStateStore, IHandleGenerationService, IEventService, IUserSession, TimeProvider, IProfileService, ISamlResourceResolver?)

Answers through responseGenerator, the host's ISaml2SsoResponseGenerator. Since 0.152.0.

public SamlIdpInitiatedSignOnEndpoint(ISamlServiceProviderStore serviceProviders, ISaml2SsoResponseGenerator responseGenerator, IOptions<SamlOptions> samlOptions, IOptions<IdentityServerOptions> options, IIssuerNameService issuerNameService, IMessageStore<ErrorMessage> errorMessages, ISamlSigninStateStore signInStates, IHandleGenerationService handles, IEventService events, IUserSession userSession, TimeProvider time, IProfileService profile, ISamlResourceResolver? resources)

Parameters

serviceProviders ISamlServiceProviderStore

Finds the registration of the service provider the query or the resumed sign-in names.

responseGenerator ISaml2SsoResponseGenerator

Builds the signed response, or the error response for a sign-in declined at the login page.

samlOptions IOptions<SamlOptions>

Whether the endpoint is switched on, the entity id to issue under, the RelayState limit and the endpoint paths.

options IOptions<IdentityServerOptions>

The interaction URLs, and the refusal list the provider's reply address is checked against.

issuerNameService IIssuerNameService

Supplies the issuer when EntityId names none.

errorMessages IMessageStore<ErrorMessage>

Holds the error the error page is sent to show.

signInStates ISamlSigninStateStore

Keeps the sign-on across the detour through the login page, behind an opaque key.

handles IHandleGenerationService

Generates the opaque key the detour through the login page carries.

events IEventService

Raises the sign-on success and failure events.

userSession IUserSession

The user's session: its id and session index go into the response, and the provider is recorded on it for single logout.

time TimeProvider

Stamps and expires the stored sign-in state, and dates the error message.

profile IProfileService

Asked whether the signed-in user is still active before an assertion is issued for them.

resources ISamlResourceResolver

Resolves what the provider may be issued; null asks the profile service for nothing.

SamlIdpInitiatedSignOnEndpoint(ISamlServiceProviderStore, SamlResponseGenerator, IOptions<SamlOptions>, IOptions<IdentityServerOptions>, IIssuerNameService, IMessageStore<ErrorMessage>, ISamlSigninStateStore, IHandleGenerationService, IEventService, IUserSession, TimeProvider, IProfileService?, ISamlNameIdGenerator?, ISamlResourceResolver?)

The 0.151.0 constructor, kept: it answers through Saml2SSoResponseGenerator's steps over responseGenerator.

public SamlIdpInitiatedSignOnEndpoint(ISamlServiceProviderStore serviceProviders, SamlResponseGenerator responseGenerator, IOptions<SamlOptions> samlOptions, IOptions<IdentityServerOptions> options, IIssuerNameService issuerNameService, IMessageStore<ErrorMessage> errorMessages, ISamlSigninStateStore signInStates, IHandleGenerationService handles, IEventService events, IUserSession userSession, TimeProvider time, IProfileService? profile = null, ISamlNameIdGenerator? nameIds = null, ISamlResourceResolver? resources = null)

Parameters

serviceProviders ISamlServiceProviderStore
responseGenerator SamlResponseGenerator
samlOptions IOptions<SamlOptions>
options IOptions<IdentityServerOptions>
issuerNameService IIssuerNameService
errorMessages IMessageStore<ErrorMessage>
signInStates ISamlSigninStateStore
handles IHandleGenerationService
events IEventService
userSession IUserSession
time TimeProvider
profile IProfileService
nameIds ISamlNameIdGenerator
resources ISamlResourceResolver

Methods

ProcessAsync(HttpContext)

Processes the request, or returns null to pass the request through.

public Task<IEndpointResult?> ProcessAsync(HttpContext context)

Parameters

context HttpContext

Returns

Task<IEndpointResult>

Remarks

Null — the request passes through — unless EnableIdpInitiatedSignOn is set. Otherwise the service provider is taken from the query's sp parameter, or from the sign-in being resumed after the login page, and the user is sent to sign in or the response is posted; every refusal goes to the error page.

Exceptions

ArgumentNullException

context is null.