Class SamlReturnUrlParser

Namespace

Fdyay.IdentityServer.Saml.Hosting

Assembly

Fdyay.IdentityServer.Saml.dll

The return URLs of the SAML single sign-on endpoint.

public sealed class SamlReturnUrlParser : IReturnUrlParser

Inheritance

object

SamlReturnUrlParser

Implements

IReturnUrlParser

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

object.ToString()

Remarks

Registered by AddSaml, and the reason the parsers are a collection. The single sign-on endpoint sends an unauthenticated browser to the login page with a return URL naming itself; until this existed the login page recognised the OpenID Connect authorize endpoint and nothing else, so it refused that return URL and sent the freshly authenticated user to the site root instead. The service provider that started the flow was never answered, and SAML sign-on worked only for a user who already had a session.

What the return URL carries is a reference, resolved here against the sign-in state store rather than decoded from the URL. Until 0.22.0 it carried the request itself, re-encoded as a redirect-binding query whatever binding it had arrived on, which cost a posted request the signature it was sent with.

Constructors

SamlReturnUrlParser(ISamlSigninStateStore, ISamlServiceProviderStore, IHttpContextAccessor, IOptions<SamlOptions>?)

Creates a parser that leaves UserInteraction.AllowOriginInReturnUrl unhonoured.

public SamlReturnUrlParser(ISamlSigninStateStore signInStates, ISamlServiceProviderStore serviceProviders, IHttpContextAccessor httpContextAccessor, IOptions<SamlOptions>? options = null)

Parameters

signInStates ISamlSigninStateStore

Holds the stored sign-ins a return URL refers to; read without being consumed.

serviceProviders ISamlServiceProviderStore

Finds the registration of the service provider a stored sign-in names.

httpContextAccessor IHttpContextAccessor

Supplies the current request, against whose path base a return URL is judged.

options IOptions<SamlOptions>

The SAML options, whose endpoint paths and state parameter name are recognised. Defaults to a new SamlOptions when null.

SamlReturnUrlParser(ISamlSigninStateStore, ISamlServiceProviderStore, IHttpContextAccessor, IOptions<SamlOptions>, IOptions<IdentityServerOptions>?)

With the server's options, so UserInteraction.AllowOriginInReturnUrl is honoured (0.149.0).

public SamlReturnUrlParser(ISamlSigninStateStore signInStates, ISamlServiceProviderStore serviceProviders, IHttpContextAccessor httpContextAccessor, IOptions<SamlOptions> options, IOptions<IdentityServerOptions>? identityServerOptions)

Parameters

signInStates ISamlSigninStateStore

serviceProviders ISamlServiceProviderStore

httpContextAccessor IHttpContextAccessor

options IOptions<SamlOptions>

identityServerOptions IOptions<IdentityServerOptions>

Methods

IsValidReturnUrl(string?)

Both sign-on doors, because the login page only honours a return URL it recognises.

public bool IsValidReturnUrl(string? returnUrl)

Parameters

returnUrl string

Returns

bool

Remarks

The unsolicited endpoint sends a browser to the login page exactly as the solicited one does, and a path this parser does not know is a path the page refuses — which sends the freshly authenticated user to the site root with the service provider still waiting. That is 0.19.0's defect, and adding a second door reproduced it: the same rule, applied to one of its halves. Only an end-to-end test of the return leg says so, which is why this release has one.

At the configured paths since 0.145.0, and the callback among them: the solicited door's return URL names the callback, Duende's SingleSignOnCallbackPath. The sign-on service itself stays recognised, as a URL carrying a request.

Under AllowOriginInReturnUrl, an absolute URL on this server's origin is judged without it, as Duende's is.

ParseAsync(string?, CancellationToken)

The pending request the return URL names, or null when this parser does not own it.

public Task<IAuthenticationContext?> ParseAsync(string? returnUrl, CancellationToken cancellationToken = default)

Parameters

returnUrl string

cancellationToken CancellationToken

Returns

Task<IAuthenticationContext>

Remarks

A SamlAuthenticationContext when the URL is one IsValidReturnUrl(string?) recognises and its state parameter names a stored sign-in whose service provider is still registered; otherwise null. The stored sign-in is peeked at, not consumed.