Class SamlServiceProvider
- Namespace
- Fdyay.IdentityServer.Saml.Idp
- Assembly
- Fdyay.IdentityServer.Saml.dll
A relying party (SAML service provider) registered with this identity provider.
public sealed class SamlServiceProvider : IConnectedApplication- Inheritance
-
SamlServiceProvider
- Implements
- Inherited Members
Properties
AllowIdpInitiated
Whether this server may start a sign-on to this provider that it did not ask for. Defaults to false. Duende's.
public bool AllowIdpInitiated { get; init; }Property Value
AllowedScopes
The identity scopes whose user claims this provider may be issued as attributes. At least one is required. Duende's.
public ICollection<string> AllowedScopes { get; init; }Property Value
Remarks
The ceiling on what an assertion to this provider can say: each must name an enabled identity resource, and the resources' user claims are what the profile service is asked for. A registration with none is refused where it is read, and one naming a scope that is not an enabled identity resource is refused at sign-on, as Duende refuses both.
AllowedSignatureAlgorithms
The signature and digest methods this SP's signatures may use; empty takes every one this server accepts. Duende's.
public ICollection<string> AllowedSignatureAlgorithms { get; init; }Property Value
Remarks
Algorithm URIs, such as http://www.w3.org/2001/04/xmldsig-more#rsa-sha256, read wherever the provider's signature
is checked — its AuthnRequests, LogoutRequests and LogoutResponses. Duende's single list: an enveloped signature's
signature method and its digest method must each be named (so a list naming no digest method refuses every
enveloped signature, as Duende's does), and a redirect-bound signature's SigAlg.
Ours: it only narrows. A method must also be one of AcceptedSignatureMethods and AcceptedDigestMethods, which are pinned; Duende's replaces its defaults, so there a provider's list can admit SHA-1, and here naming it admits nothing.
AssertionConsumerServiceUrl
The default assertion consumer service's URL, where a response to a request that names none is delivered.
public string AssertionConsumerServiceUrl { get; init; }Property Value
Remarks
This server's shorthand over AssertionConsumerServiceUrls, which Duende does not have: reading it gives the endpoint marked IsDefault, else the first, else empty; setting it registers an HTTP-POST endpoint, so a provider with one reply address is registered as it was before 0.143.0. Set this or the collection's contents, not a new collection after it, which would replace what it registered.
AssertionConsumerServiceUrls
The provider's assertion consumer services, each with a binding and an index; at least one, each HTTP-POST. Duende's.
public ICollection<IndexedEndpoint> AssertionConsumerServiceUrls { get; init; }Property Value
Remarks
A request names one by URL or by index, or names none and is answered at the default. Until 0.143.0 a provider had one, and a request naming any other was refused.
AssertionLifetime
How long an assertion issued to this provider is valid; null takes AssertionLifetime. Duende's.
public TimeSpan? AssertionLifetime { get; init; }Property Value
AuthnContextMappings
This provider's acr/amr values and the AuthnContextClassRef each is issued as. Empty by default. Duende's.
public IDictionary<string, string> AuthnContextMappings { get; init; }Property Value
Remarks
Any entry replaces DefaultAuthnContextMappings for this provider: the two are not merged, as Duende does not merge them.
Certificates
The provider's certificates, each with what it is for. Duende's.
public ICollection<ServiceProviderCertificate> Certificates { get; init; }Property Value
Remarks
Every certificate for Signing verifies what the provider signs, so a provider rolling its key over registers the new one beside the old. The first for Encryption is the one assertions are encrypted to, which is this server's: Duende reads no encryption certificate.
ClaimMappings
This provider's claim types and the attribute name each is issued as. Empty by default. Duende's.
public IDictionary<string, string> ClaimMappings { get; init; }Property Value
Remarks
Any entry replaces DefaultClaimMappings for this provider: the two are not merged, as Duende does not merge them. A claim type in neither is issued under its own name.
ClockSkew
The clock skew allowed this SP's requests; null takes ClockSkew. Duende's.
public TimeSpan? ClockSkew { get; init; }Property Value
DefaultNameIdFormat
The NameID format issued when the request names none; null is unspecified. Duende's DefaultNameIdFormat.
public string? DefaultNameIdFormat { get; init; }Property Value
Remarks
Until 0.134.0 this was NameIdFormat and the only format the provider could be issued; a request may now ask for
any of SupportedNameIdFormats, and this answers the request that does not ask.
It must itself be one of them, or the provider's requests are refused.
Description
A description of the provider, for a host's own use. Read by nothing here, as by nothing in Duende.
public string? Description { get; init; }Property Value
DisplayName
A name for this service provider to show a user on the login page. Optional.
public string? DisplayName { get; init; }Property Value
Remarks
The entity id is a URI and reads as one. A registration that supplies a name gets it shown instead; one that does not is not named, rather than named badly.
EmailNameIdClaimType
The claim an emailAddress NameID is read from; null takes EmailNameIdClaimType. Duende's.
public string? EmailNameIdClaimType { get; init; }Property Value
Enabled
Whether the provider is served. Defaults to true. Duende's.
public bool Enabled { get; init; }Property Value
EncryptionCertificate
When set, assertions issued to this SP are encrypted to this certificate.
public X509Certificate2? EncryptionCertificate { get; init; }Property Value
Remarks
The SP's public key, learned from its metadata. Optional because encryption is the partner's requirement rather than this server's: a registration without one is sent a plain assertion, which is what every partner integrated before this existed still expects.
This server's shorthand over Certificates: reading it gives the first encryption certificate, setting it registers one for Encryption.
EntityId
The SP's entity ID (matched against the Issuer of its AuthnRequest).
public required string EntityId { get; init; }Property Value
MatchLogoutRequestToSession
Whether this SP's LogoutRequests must name a SAML session this browser holds with it; null takes MatchLogoutRequestToSession. New in 0.159.0.
public bool? MatchLogoutRequestToSession { get; init; }Property Value
- bool?
Remarks
Ours: Duende runs its session checks for every provider; here they are opt-in, by the option or per provider (decided 2026-10-14).
RequestMaxAge
How old this SP's AuthnRequests may be; null takes DefaultRequestMaxAge. Duende's.
public TimeSpan? RequestMaxAge { get; init; }Property Value
RequestSigningCertificate
When set, requests from this SP must carry a signature made by this certificate — enveloped, or detached under the HTTP-Redirect binding.
public X509Certificate2? RequestSigningCertificate { get; init; }Property Value
Remarks
This server's shorthand over Certificates: reading it gives the first signing certificate, setting it registers one for Signing. A signature any signing certificate verifies is accepted.
RequestedClaimTypes
The claim types to ask for, narrower than AllowedScopes allows; empty asks for all of them. Duende's.
public ICollection<string> RequestedClaimTypes { get; init; }Property Value
Remarks
Each must be a user claim of one of the allowed scopes' identity resources, or sign-on is refused.
RequireSignedAuthnRequests
Whether this SP's AuthnRequests must be signed; null takes WantAuthnRequestsSigned. Duende's.
public bool? RequireSignedAuthnRequests { get; init; }Property Value
- bool?
Remarks
False is the way a provider that cannot sign — one with no RequestSigningCertificate — is still served.
RequireSignedLogoutResponses
Whether this SP's LogoutResponses must be signed; null takes RequireSignedLogoutResponses. Duende's.
public bool? RequireSignedLogoutResponses { get; init; }Property Value
- bool?
Remarks
False is the way a provider that does not sign its answers — one answering inside the signed-out page's iframe, say — is still heard. Only an unsigned answer is let through: one carrying a signature must verify against Certificates, as before.
SigningBehavior
What is signed in a response to this provider; null takes DefaultSigningBehavior. Duende's.
public SamlSigningBehavior? SigningBehavior { get; init; }Property Value
SingleLogoutServiceUrl
The SP's Single Logout Service URL, where LogoutResponses are delivered.
public string? SingleLogoutServiceUrl { get; init; }Property Value
Remarks
This server's shorthand over SingleLogoutServiceUrls: reading it gives the HTTP-Redirect endpoint, else the first; setting it registers an HTTP-Redirect endpoint, Duende's one supported logout binding. Where this server answers on HTTP-POST it takes the POST endpoint when there is one, and this location when there is not, as before 0.143.0.
SingleLogoutServiceUrls
The provider's single logout services, each with a binding. Duende's, which delivers on HTTP-Redirect only.
public ICollection<SamlEndpointType> SingleLogoutServiceUrls { get; init; }Property Value
Remarks
This server delivers a logout begun from another sign-out on HTTP-Redirect, and answers one begun at /saml/slo
on HTTP-POST; each takes the endpoint on its binding, else the first registered.
Methods
GetSingleLogoutServiceEndpoint(SamlBinding)
The single logout service on binding, or null when none is registered. Duende's.
public SamlEndpointType? GetSingleLogoutServiceEndpoint(SamlBinding binding)Parameters
bindingSamlBinding