Class SamlAuthenticationContext

Namespace

Fdyay.IdentityServer.Saml.Hosting

Assembly

Fdyay.IdentityServer.Saml.dll

A SAML single sign-on request waiting on the user, as the interactive pages see it.

public sealed class SamlAuthenticationContext : IAuthenticationContext

Inheritance

object

SamlAuthenticationContext

Implements

IAuthenticationContext

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

object.ToString()

Remarks

The members SAML has no answer for are left empty rather than mapped onto their nearest OpenID Connect equivalent. ForceAuthn and IsPassive are the tempting pair — they are what prompt=login and prompt=none ask for — but the single sign-on endpoint acts on both before the browser is sent to the login page, so re-expressing them here would offer a page a decision that has already been taken, and a page that acted on it would take it twice. Duende sets them; this is recorded as a difference.

What the request asked for about the sign-in itself is answered: RequestedAuthnContext, and the Tenant a tenant: class reference in it names, as Duende answers both. Until 0.134.0 neither was read. As of 0.145.0 so are who and where: LoginHint from the request's Subject, IdP from an IDPList of one, and the RelayState and IsIdpInitiated Duende's context carries.

Properties

IdP

The identity provider the request would accept, when its Scoping/IDPList names exactly one; null when it names none or several. Duende's rule, measured.

public string? IdP { get; init; }

Property Value

string

Remarks

The bundled login page acts on it as on OpenID Connect's idp: hint: straight to the external scheme of that name when one is registered, and the page as it is otherwise. A list of several is a choice for the user, not a destination.

IsIdpInitiated

Whether the sign-on began at this server's IdP-initiated door, with no request to answer. Duende's.

public bool IsIdpInitiated { get; init; }

Property Value

bool

LoginHint

The user the request named in its Subject/NameID, or null when it named nobody. Duende's.

public string? LoginHint { get; init; }

Property Value

string

PromptModes

Always empty: SAML has no prompt parameter, and ForceAuthn and IsPassive are acted on before the login page is reached.

public IReadOnlyCollection<string> PromptModes { get; }

Property Value

IReadOnlyCollection<string>

RelayState

The RelayState the service provider sent, or the one the IdP-initiated link carried. Duende's.

public string? RelayState { get; init; }

Property Value

string

RequestedAuthnContext

The authentication context the service provider asked for, or null when it asked for none or the sign-on was IdP-initiated. Duende's SamlAuthenticationContext.RequestedAuthnContext.

public SamlRequestedAuthnContext? RequestedAuthnContext { get; init; }

Property Value

SamlRequestedAuthnContext

Remarks

For the login page to act on — a page that offers a second factor can offer it when asked — and not enforced by this server, as Duende does not enforce it.

ServiceProvider

The registration of the service provider waiting on the sign-in. Also this context's Application.

public required SamlServiceProvider ServiceProvider { get; init; }

Property Value

SamlServiceProvider

StateId

The reference the stored sign-in is kept under — the return URL's StateIdParameterName value — which a denial is recorded against. Duende's StateId.

public string? StateId { get; init; }

Property Value

string

Remarks

A string, as this server's references are handles, where Duende's is a Guid; null on a context built without one, which no denial can be recorded against.

Tenant

The tenant a tenant: class reference in RequestedAuthnContext names, without the prefix; null when none does. Duende's convention, measured.

public string? Tenant { get; }

Property Value

string