Table of Contents

Class SamlSpHandler

Namespace
Fdyay.IdentityServer.Saml.Sp
Assembly
Fdyay.IdentityServer.Saml.dll

A native SAML 2.0 service-provider handler: SP-initiated SSO to an upstream IdP, consuming its assertion.

public sealed class SamlSpHandler : RemoteAuthenticationHandler<SamlSpOptions>, IAuthenticationRequestHandler, IAuthenticationSignOutHandler, IAuthenticationHandler
Inheritance
SamlSpHandler
Implements
Inherited Members

Constructors

SamlSpHandler(IOptionsMonitor<SamlSpOptions>, ILoggerFactory, UrlEncoder)

Creates the handler; the framework constructs one per request.

public SamlSpHandler(IOptionsMonitor<SamlSpOptions> options, ILoggerFactory logger, UrlEncoder encoder)

Parameters

options IOptionsMonitor<SamlSpOptions>

The handler options, per scheme.

logger ILoggerFactory

Creates the handler's logger.

encoder UrlEncoder

Encodes URLs the handler builds.

Methods

HandleChallengeAsync(AuthenticationProperties)

Sends the browser to the identity provider with an AuthnRequest, over HTTP-Redirect or HTTP-POST as IdpSingleSignOnBinding says.

protected override Task HandleChallengeAsync(AuthenticationProperties properties)

Parameters

properties AuthenticationProperties

The sign-in's properties, protected into the RelayState with the request's ID; the redirect URI defaults to the current URL.

Returns

Task

A task that completes once the redirect or the form has been written.

Remarks

The request is signed when SigningCertificate is set: over the query on HTTP-Redirect, inside the XML on HTTP-POST.

HandleRemoteAuthenticateAsync()

Consumes the identity provider's posted SAMLResponse at the callback path and signs the user in from its assertion.

protected override Task<HandleRequestResult> HandleRemoteAuthenticateAsync()

Returns

Task<HandleRequestResult>

A ticket whose identity carries the NameID as NameIdentifier (and as NameIdClaimType when that differs) and each attribute value as a claim; or a failure naming why the response was refused.

Remarks

The response must answer the request this browser's RelayState carries, from the browser holding that request's correlation cookie, unless AllowIdpInitiatedSignOn admits an unsolicited one, which returns to IdpInitiatedReturnPath recorded against this scheme. Everything else about the response is SamlResponseValidator's to check; then its assertion is accepted once, and attributes named for a protocol or identity claim (sub, idp, amr, auth_time, acr, sid, NameIdentifier, AuthenticationMethod, AuthenticationInstant, Actor and NameIdClaimType) are dropped. The correlation cookie, the single use and the dropped attributes are since 0.178.0.

Exceptions

InvalidOperationException

The identity provider's signing certificate has no RSA or EC public key.

HandleRequestAsync()

Also intercepts the signed-out callback where the IdP returns its LogoutResponse, and the path this service provider publishes its metadata at.

public override Task<bool> HandleRequestAsync()

Returns

Task<bool>

SignOutAsync(AuthenticationProperties?)

Initiates SP logout: sends a LogoutRequest to the upstream IdP after ending the local session.

public Task SignOutAsync(AuthenticationProperties? properties)

Parameters

properties AuthenticationProperties

Returns

Task

Remarks

Reached by an ordinary sign-out, not only by a host that asks for one: since 0.42.0 the sign-out sequence propagates to whichever provider authenticated the session, and that is any IAuthenticationSignOutHandler, which this always is. So the things that can be missing here are ordinary too, and are reported rather than thrown for — a sign-out that ends in a 500 leaves the local session standing, because the response carrying the deleted cookie is never sent.