Class DefaultSamlServiceProviderConfigurationValidator

Namespace

Fdyay.IdentityServer.Saml.Idp

Assembly

Fdyay.IdentityServer.Saml.dll

Refuses a service provider registration this server cannot serve.

public class DefaultSamlServiceProviderConfigurationValidator : ISamlServiceProviderConfigurationValidator

Inheritance

object

DefaultSamlServiceProviderConfigurationValidator

Implements

ISamlServiceProviderConfigurationValidator

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.MemberwiseClone()

object.ReferenceEquals(object, object)

object.ToString()

Remarks

Duende 8.0.1's default: an entity id that is not blank, and at least one assertion consumer service, each with the HTTP-POST binding (since 0.143.0, when a registration gained several). And this server's own rules since 0.71.0: every assertion consumer and single logout URL absolute and http(s), and HTTPS when RequireHttpsServiceProviderUrls says so. Since 0.141.0 Duende's check of allowed scopes too, after the URLs and before the lifetimes, with Duende's message. Each check a virtual method, stopping at the first that refuses; the URL checks' messages are the SamlServiceProviderProblems codes, as the log has always carried them.

Constructors

DefaultSamlServiceProviderConfigurationValidator(IOptions<SamlOptions>)

Creates the validator.

public DefaultSamlServiceProviderConfigurationValidator(IOptions<SamlOptions> options)

Parameters

options IOptions<SamlOptions>

The SAML options, read once here; see Options.

Exceptions

ArgumentNullException

options is null.

Properties

Options

The SAML options, whose RequireHttpsServiceProviderUrls the URL checks read.

protected SamlOptions Options { get; }

Property Value

SamlOptions

Methods

ValidateAllowedScopesAsync(SamlServiceProviderConfigurationValidationContext)

At least one allowed scope is required. Duende's ValidateAllowedScopesAsync, measured.

protected virtual Task ValidateAllowedScopesAsync(SamlServiceProviderConfigurationValidationContext context)

Parameters

context SamlServiceProviderConfigurationValidationContext

Returns

Task

Remarks

Until 0.141.0 a registration had no scopes, and every one was issued the session's name and email.

ValidateAssertionConsumerServiceUrlsAsync(SamlServiceProviderConfigurationValidationContext)

At least one assertion consumer service, each HTTP-POST, absolute, and of an allowed scheme. Duende's, measured, with this server's URL rules.

protected virtual Task ValidateAssertionConsumerServiceUrlsAsync(SamlServiceProviderConfigurationValidationContext context)

Parameters

context SamlServiceProviderConfigurationValidationContext

Returns

Task

Remarks

Duende's count, then each endpoint's binding with Duende's message; then each URL, as this server has checked them since 0.71.0. Duende checks no URL.

ValidateAsync(SamlServiceProviderConfigurationValidationContext, CancellationToken)

Checks the registration in context, calling SetError(string) when it cannot be served.

public virtual Task ValidateAsync(SamlServiceProviderConfigurationValidationContext context, CancellationToken ct)

Parameters

context SamlServiceProviderConfigurationValidationContext

The registration, and where the outcome is recorded.

ct CancellationToken

Cancels the check.

Returns

Task

A task that completes when the check has run.

Remarks

Runs ValidateEntityIdAsync(SamlServiceProviderConfigurationValidationContext), ValidateAssertionConsumerServiceUrlsAsync(SamlServiceProviderConfigurationValidationContext), ValidateSingleLogoutServiceUrlAsync(SamlServiceProviderConfigurationValidationContext), ValidateAllowedScopesAsync(SamlServiceProviderConfigurationValidationContext) and the lifetime check in that order, stopping at the first that refuses.

Exceptions

ArgumentNullException

context is null.

ValidateEntityIdAsync(SamlServiceProviderConfigurationValidationContext)

The entity id must not be blank.

protected virtual Task ValidateEntityIdAsync(SamlServiceProviderConfigurationValidationContext context)

Parameters

context SamlServiceProviderConfigurationValidationContext

Returns

Task

ValidateLifetimesAsync(SamlServiceProviderConfigurationValidationContext)

A provider's own lifetimes and clock settings, when it has them, must make sense. Duende's, measured.

protected virtual Task ValidateLifetimesAsync(SamlServiceProviderConfigurationValidationContext context)

Parameters

context SamlServiceProviderConfigurationValidationContext

Returns

Task

Remarks

Duende's order: the assertion lifetime (since 0.143.0), the clock skew, the request age.

ValidateSingleLogoutServiceUrlAsync(SamlServiceProviderConfigurationValidationContext)

Each single logout service URL must be absolute and of an allowed scheme. This server's.

protected virtual Task ValidateSingleLogoutServiceUrlAsync(SamlServiceProviderConfigurationValidationContext context)

Parameters

context SamlServiceProviderConfigurationValidationContext

Returns

Task