Class SamlLogoutSession

Namespace

Fdyay.IdentityServer.Saml.Stores

Assembly

Fdyay.IdentityServer.Saml.dll

A single logout in flight: who asked, and who has not been told yet.

public sealed class SamlLogoutSession

Inheritance

object

SamlLogoutSession

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

object.ToString()

Remarks

SAML single logout is a sequence rather than a message. The identity provider has to ask every other service provider the session reached to end its own session, each over a browser hop, and only answer the one that asked once the rest have finished. Nothing about that fits in a local: between hops the only thing this server has is what the browser brings back, so what is in flight lives here and the browser carries an opaque reference to it.

The same shape as SamlSignInState, for the same reason, and with the same one-time consume: a reference left in history must not replay somebody else's logout.

Properties

Created

When it started, so a store can drop a sequence nobody finished.

public required DateTimeOffset Created { get; init; }

Property Value

DateTimeOffset

ExpiresAt

When the sequence stops being resumable: Created plus SamlOptions.LogoutSessionLifetime.

public DateTimeOffset? ExpiresAt { get; init; }

Property Value

DateTimeOffset?

Remarks

Null for a sequence written without one, which the in-memory store keeps for its own Lifetime.

OutstandingRequestId

The request this server last sent, so the answer coming back can be matched to it.

public string? OutstandingRequestId { get; init; }

Property Value

string

Pending

The service providers still to be asked, as the session recorded them. Empty means the requester can be answered.

public required IReadOnlyList<SamlSpSessionData> Pending { get; init; }

Property Value

IReadOnlyList<SamlSpSessionData>

Remarks

Breaking in 0.129.0: the session's records rather than entity ids, so each provider is asked about its own session — the NameID and SessionIndex its assertion carried — rather than the requester's.

RequesterEntityId

The service provider that asked for the logout, and is owed an answer.

public required string RequesterEntityId { get; init; }

Property Value

string

RequesterRelayState

The RelayState it sent, handed back to it with the answer.

public string? RequesterRelayState { get; init; }

Property Value

string

RequesterRequestId

The ID of its LogoutRequest, which the answer must name.

public required string RequesterRequestId { get; init; }

Property Value

string

SkippedSpCount

Participants passed over so far — unregistered, unreachable, or answering with anything but success — whose sessions may still be live. Any at all, and the requester is told PartialLogout. Duende's name.

public int SkippedSpCount { get; init; }

Property Value

int

SubjectNameId

The subject whose session is ending, named in every request this server sends on.

public required string SubjectNameId { get; init; }

Property Value

string

Remarks

Carried rather than re-read, because by the second hop the session is already gone: the sign-out happened on the first pass, which is the point — the user is signed out here whether or not the partners ever answer.