Class Saml2SSoResponseGenerator

Namespace

Fdyay.IdentityServer.Saml.Idp

Assembly

Fdyay.IdentityServer.Saml.dll

The default ISaml2SsoResponseGenerator. Duende 8.0.1's Saml2SSoResponseGenerator, measured.

public class Saml2SSoResponseGenerator : ISaml2SsoResponseGenerator

Inheritance

object

Saml2SSoResponseGenerator

Implements

ISaml2SsoResponseGenerator

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.MemberwiseClone()

object.ReferenceEquals(object, object)

object.ToString()

Remarks

A response is made in Duende's protected virtual steps, in Duende's order: CreateSubjectNameIdAsync(ValidatedAuthnRequest, CancellationToken), then CreateSaml2ResponseAsync(ValidatedAuthnRequest, SamlNameId, CancellationToken), which asks CreateAssertionAsync(ValidatedAuthnRequest, SamlNameId, string, string, DateTimeOffset, CancellationToken), which asks CreateSubject(ValidatedAuthnRequest, SamlNameId, string, DateTimeOffset, TimeSpan), CreateConditions(ValidatedAuthnRequest, DateTimeOffset, TimeSpan), CreateAuthnStatement(ClaimsPrincipal, DateTimeOffset, SamlServiceProvider, string?) and CreateAttributesAsync(ValidatedAuthnRequest, CancellationToken) (with MapClaimsToAttributes(IEnumerable<Claim>, SamlServiceProvider)). A failure is a response carrying the status codes alone, sent when IsSafeError(ValidatedAuthnRequest, Saml2InteractionResponse) says so — every error, by default, as Duende's. A host derives from this, overrides one step and registers its class as ISaml2SsoResponseGenerator.

Where ours differs: CreateResponse(ValidatedAuthnRequest, CancellationToken) and CreateErrorResponse(ValidatedAuthnRequest, Saml2InteractionResponse, CancellationToken) run the steps and are not overridable, as Duende's are not; but where Duende's let a step change what follows, the run method here holds it, read before the first step and checked after the last — an InvalidOperationException, not a response, when a step changed it: the response's Issuer, Destination, InResponseTo and success status; the assertion's Issuer, its subject's NameID (the one CreateSubjectNameIdAsync(ValidatedAuthnRequest, CancellationToken) generated, which single logout records), its Recipient and InResponseTo, its audience (the provider alone) and its SessionIndex (the one single logout records); and its lifetime, which a step may shorten and never lengthen. What is signed and what is encrypted are the run method's alone, as in Duende.

Constructors

Saml2SSoResponseGenerator(TimeProvider, IProfileService, ISamlSigningService, IOptions<SamlOptions>, ISamlNameIdGenerator)

Creates the generator.

public Saml2SSoResponseGenerator(TimeProvider timeProvider, IProfileService profileService, ISamlSigningService samlSigningService, IOptions<SamlOptions> samlOptions, ISamlNameIdGenerator nameIdGenerator)

Parameters

timeProvider TimeProvider

The clock the response's instants and the assertion's lifetime are read from.

profileService IProfileService

Asked for the claims the assertion's attributes are made from.

samlSigningService ISamlSigningService

Supplies the certificate each response is signed with, asked at the time it is signed.

samlOptions IOptions<SamlOptions>

The SAML options: default signing behaviour, assertion lifetime and attribute mapping.

nameIdGenerator ISamlNameIdGenerator

Chooses the NameID the assertion names its subject by.

Exceptions

ArgumentNullException

Any argument is null.

Methods

CreateAssertionAsync(ValidatedAuthnRequest, SamlNameId, string, string, DateTimeOffset, CancellationToken)

The assertion, lasting the provider's lifetime else the server's. Duende's step.

protected virtual Task<SamlAssertion> CreateAssertionAsync(ValidatedAuthnRequest validatedAuthnRequest, SamlNameId nameId, string issuer, string destination, DateTimeOffset now, CancellationToken ct)

Parameters

validatedAuthnRequest ValidatedAuthnRequest

nameId SamlNameId

issuer string

destination string

now DateTimeOffset

ct CancellationToken

Returns

Task<SamlAssertion>

CreateAttributesAsync(ValidatedAuthnRequest, CancellationToken)

What the profile service says about the user, as attributes. Duende's step, measured.

protected virtual Task<IList<SamlAttribute>> CreateAttributesAsync(ValidatedAuthnRequest validatedAuthnRequest, CancellationToken ct)

Parameters

validatedAuthnRequest ValidatedAuthnRequest

ct CancellationToken

Returns

Task<IList<SamlAttribute>>

Remarks

Asked as Saml2SsoResponseGenerator, with the sign-on as its protocol request and the resolved claim types as what it is asked for; RequestedResources is left unset, as Duende leaves it. The attributes it adds itself come first, as they are; each issued claim is then named by MapClaimsToAttributes(IEnumerable<Claim>, SamlServiceProvider) and joins an attribute of that name, or follows as a new one.

CreateAuthnStatement(ClaimsPrincipal, DateTimeOffset, SamlServiceProvider, string?)

How and when the user signed in. Duende's step.

protected virtual SamlAuthnStatement CreateAuthnStatement(ClaimsPrincipal subject, DateTimeOffset now, SamlServiceProvider saml2Sp, string? sessionIndex)

Parameters

subject ClaimsPrincipal

now DateTimeOffset

saml2Sp SamlServiceProvider

sessionIndex string

Returns

SamlAuthnStatement

Remarks

The class reference is the user's acr, else the first amr, through the provider's mappings else the server's; unspecified when none maps. The instant is now, as Duende's.

CreateConditions(ValidatedAuthnRequest, DateTimeOffset, TimeSpan)

Valid from now for lifetime, for the provider alone. Duende's step.

protected virtual SamlConditions CreateConditions(ValidatedAuthnRequest validatedAuthnRequest, DateTimeOffset now, TimeSpan lifetime)

Parameters

validatedAuthnRequest ValidatedAuthnRequest

now DateTimeOffset

lifetime TimeSpan

Returns

SamlConditions

CreateErrorResponse(ValidatedAuthnRequest, Saml2InteractionResponse, CancellationToken)

The signed response carrying interactionResponse's status and no assertion, when the error is safe to send to the service provider; otherwise a result naming the error for the error page.

public Task<Saml2FrontChannelResult> CreateErrorResponse(ValidatedAuthnRequest validatedAuthnRequest, Saml2InteractionResponse interactionResponse, CancellationToken ct)

Parameters

validatedAuthnRequest ValidatedAuthnRequest

interactionResponse Saml2InteractionResponse

ct CancellationToken

Returns

Task<Saml2FrontChannelResult>

Exceptions

ArgumentNullException

validatedAuthnRequest or interactionResponse is null.

ArgumentException

interactionResponse is not an error, or its status code is not Requester, Responder or VersionMismatch.

CreateResponse(ValidatedAuthnRequest, CancellationToken)

The signed response carrying an assertion about Subject, or why there is none.

public Task<Saml2FrontChannelResult> CreateResponse(ValidatedAuthnRequest validatedAuthnRequest, CancellationToken ct)

Parameters

validatedAuthnRequest ValidatedAuthnRequest

ct CancellationToken

Returns

Task<Saml2FrontChannelResult>

Exceptions

ArgumentNullException

validatedAuthnRequest is null.

InvalidOperationException

An overriding step changed something the run method holds.

CreateSaml2ResponseAsync(ValidatedAuthnRequest, SamlNameId, CancellationToken)

The response: from this server, to the chosen endpoint, answering the request, successful. Duende's step.

protected virtual Task<SamlResponse> CreateSaml2ResponseAsync(ValidatedAuthnRequest validatedAuthnRequest, SamlNameId nameId, CancellationToken ct)

Parameters

validatedAuthnRequest ValidatedAuthnRequest

nameId SamlNameId

ct CancellationToken

Returns

Task<SamlResponse>

CreateSubject(ValidatedAuthnRequest, SamlNameId, string, DateTimeOffset, TimeSpan)

The subject, confirmed as bearer to destination for the request. Duende's step.

protected virtual SamlSubject CreateSubject(ValidatedAuthnRequest validatedAuthnRequest, SamlNameId nameId, string destination, DateTimeOffset now, TimeSpan lifetime)

Parameters

validatedAuthnRequest ValidatedAuthnRequest

nameId SamlNameId

destination string

now DateTimeOffset

lifetime TimeSpan

Returns

SamlSubject

CreateSubjectNameIdAsync(ValidatedAuthnRequest, CancellationToken)

The NameID, from ISamlNameIdGenerator, in the request's format, else the provider's default, else unspecified. Duende's step.

protected virtual Task<NameIdGenerationResult> CreateSubjectNameIdAsync(ValidatedAuthnRequest validatedAuthnRequest, CancellationToken ct)

Parameters

validatedAuthnRequest ValidatedAuthnRequest

ct CancellationToken

Returns

Task<NameIdGenerationResult>

IsSafeError(ValidatedAuthnRequest, Saml2InteractionResponse)

Whether an error is sent to the service provider (true) or left for the error page. Duende's step.

protected virtual bool IsSafeError(ValidatedAuthnRequest validatedAuthnRequest, Saml2InteractionResponse interactionResponse)

Parameters

validatedAuthnRequest ValidatedAuthnRequest

interactionResponse Saml2InteractionResponse

Returns

bool

Remarks

Every error, by default — Duende's, measured: its interaction errors come after the request and its reply address were validated, and its error response carries the status codes and nothing else, so no message is sent whatever is safe.

MapClaimsToAttributes(IEnumerable<Claim>, SamlServiceProvider)

Claims as attributes, one per name in the order first seen. Duende's step, measured.

protected virtual IList<SamlAttribute> MapClaimsToAttributes(IEnumerable<Claim> claims, SamlServiceProvider saml2Sp)

Parameters

claims IEnumerable<Claim>

saml2Sp SamlServiceProvider

Returns

IList<SamlAttribute>

Remarks

The provider's ClaimMappings when it has any, else the server's DefaultClaimMappings — not merged; a claim type in neither is its own attribute name.