Class Saml2SloResponseGenerator

Namespace

Fdyay.IdentityServer.Saml.Idp

Assembly

Fdyay.IdentityServer.Saml.dll

The default ISaml2SloResponseGenerator. Duende 8.0.1's Saml2SloResponseGenerator, measured.

public class Saml2SloResponseGenerator : ISaml2SloResponseGenerator

Inheritance

object

Saml2SloResponseGenerator

Implements

ISaml2SloResponseGenerator

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.MemberwiseClone()

object.ReferenceEquals(object, object)

object.ToString()

Remarks

CreateSuccessResponse(ValidatedLogoutRequest, CancellationToken) asks Duende's one step, CreateResponseAsync(ValidatedLogoutRequest, string, string?, string?, CancellationToken), for Success, and CreatePartialLogoutResponse(ValidatedLogoutRequest, CancellationToken) for Success with PartialLogout, each with no message, as Duende's do. The response is the one the single logout endpoint built until 0.163.0: from IssuerName, to the provider's single logout endpoint (its HTTP-POST one, else its first), answering the request's ID, signed with the certificate ISamlSigningService answers. A host derives from this, overrides the step and registers its class as ISaml2SloResponseGenerator.

Where ours differs: as for Saml2SSoResponseGenerator, the two methods that run the step are not overridable, as Duende's are not, and hold what Duende's step could change — the response's Issuer, Destination, InResponseTo and its status codes — refusing with an InvalidOperationException, not a response, one whose step changed them; the step returns the response unsigned, and the run method signs it, so no override can send one unsigned. A message (StatusMessage) is the step's to add. The destination is the HTTP-POST endpoint, where Duende takes the provider's first and falls back to the request's issuer; with none, the refusal is Duende's message without that fallback.

Constructors

Saml2SloResponseGenerator(TimeProvider, ISamlSigningService)

Creates the generator.

public Saml2SloResponseGenerator(TimeProvider timeProvider, ISamlSigningService samlSigningService)

Parameters

timeProvider TimeProvider

The clock the response's IssueInstant is read from.

samlSigningService ISamlSigningService

Supplies the certificate each response is signed with, asked at the time it is signed.

Exceptions

ArgumentNullException

Either argument is null.

Methods

CreatePartialLogoutResponse(ValidatedLogoutRequest, CancellationToken)

The signed LogoutResponse saying the session ended here and not everywhere: Success with PartialLogout.

public Task<Saml2FrontChannelResult> CreatePartialLogoutResponse(ValidatedLogoutRequest request, CancellationToken ct)

Parameters

request ValidatedLogoutRequest

ct CancellationToken

Returns

Task<Saml2FrontChannelResult>

Exceptions

ArgumentNullException

request is null.

InvalidOperationException

The request has no IssuerName, the provider has no single logout endpoint, or an overriding CreateResponseAsync(ValidatedLogoutRequest, string, string?, string?, CancellationToken) changed what the run holds.

CreateResponseAsync(ValidatedLogoutRequest, string, string?, string?, CancellationToken)

The LogoutResponse, unsigned: from this server, to the provider, answering the request. Duende's step.

protected virtual Task<SamlLogoutResponse> CreateResponseAsync(ValidatedLogoutRequest request, string statusCode, string? subStatusCode, string? statusMessage, CancellationToken ct)

Parameters

request ValidatedLogoutRequest

statusCode string

subStatusCode string

statusMessage string

ct CancellationToken

Returns

Task<SamlLogoutResponse>

CreateSuccessResponse(ValidatedLogoutRequest, CancellationToken)

The signed LogoutResponse saying the session ended everywhere it reached.

public Task<Saml2FrontChannelResult> CreateSuccessResponse(ValidatedLogoutRequest request, CancellationToken ct)

Parameters

request ValidatedLogoutRequest

ct CancellationToken

Returns

Task<Saml2FrontChannelResult>

Exceptions

ArgumentNullException

request is null.

InvalidOperationException

The request has no IssuerName, the provider has no single logout endpoint, or an overriding CreateResponseAsync(ValidatedLogoutRequest, string, string?, string?, CancellationToken) changed what the run holds.