Class SamlLogoutNotificationService

Namespace

Fdyay.IdentityServer.Saml.Idp

Assembly

Fdyay.IdentityServer.Saml.dll

Signed, redirect-bound logout requests for a session's SAML service providers. Duende's.

public sealed class SamlLogoutNotificationService : ISamlLogoutNotificationService

Inheritance

object

SamlLogoutNotificationService

Implements

ISamlLogoutNotificationService

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

object.ToString()

Remarks

Duende 8.0.1's Saml2LogoutNotificationService and Saml2FrontChannelLogoutRequestBuilder, measured: for each provider the session reached, a LogoutRequest to its single logout URL naming the NameID and SessionIndex its assertion carried, signed over the query string (HTTP-Redirect binding) with the certificate ISamlSigningService answers. No Reason, no RelayState — nothing waits on the answer.

Duende sends only to a provider that registered an HTTP-Redirect logout endpoint; a provider here has one single logout URL and no binding (re-measure release 18), so the request goes there. A provider that cannot be told — unregistered, no single logout URL, one this server will not navigate a browser to — is counted as skipped and recorded with SamlLogoutNotificationFailureEvent, as at /saml/slo; Duende only logs it.

Constructors

SamlLogoutNotificationService(ISamlServiceProviderStore, IOptions<SamlOptions>, IOptions<IdentityServerOptions>, IIssuerNameService, IHttpContextAccessor, IEventService, ISamlSigningService, TimeProvider)

Creates the service.

public SamlLogoutNotificationService(ISamlServiceProviderStore serviceProviders, IOptions<SamlOptions> options, IOptions<IdentityServerOptions> identityServerOptions, IIssuerNameService issuerNameService, IHttpContextAccessor httpContextAccessor, IEventService events, ISamlSigningService signing, TimeProvider time)

Parameters

serviceProviders ISamlServiceProviderStore

Finds the registration of each provider the session reached.

options IOptions<SamlOptions>

The SAML options, whose EntityId names the issuer.

identityServerOptions IOptions<IdentityServerOptions>

The server's options, whose rules decide whether a provider's logout URL is one a browser is sent to.

issuerNameService IIssuerNameService

Supplies the issuer when EntityId names none.

httpContextAccessor IHttpContextAccessor

Supplies the current request, for the issuer.

events IEventService

Where SamlLogoutNotificationFailureEvent is raised for a provider that cannot be told.

signing ISamlSigningService

Supplies the certificate each logout request is signed with.

time TimeProvider

The clock each request's IssueInstant is read from.

Methods

GetSamlFrontChannelLogoutsAsync(LogoutNotificationContext, CancellationToken)

A logout request for each of the context's SAML sessions that can be told.

public Task<SamlLogoutNotificationResult> GetSamlFrontChannelLogoutsAsync(LogoutNotificationContext context, CancellationToken cancellationToken = default)

Parameters

context LogoutNotificationContext

cancellationToken CancellationToken

Returns

Task<SamlLogoutNotificationResult>

Remarks

With no SAML sessions, nothing to send and nothing skipped. With no issuer — no EntityId and no current request — every session is counted as skipped.

Exceptions

ArgumentNullException

context is null.