Class DefaultBackChannelLogoutService

Namespace

Fdyay.IdentityServer.Services

Assembly

Fdyay.IdentityServer.AspNetCore.dll

Supports all classes in the .NET class hierarchy and provides low-level services to derived classes. This is the ultimate base class of all .NET classes; it is the root of the type hierarchy.

public class DefaultBackChannelLogoutService : IBackChannelLogoutService

Inheritance

object

DefaultBackChannelLogoutService

Implements

IBackChannelLogoutService

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.MemberwiseClone()

object.ReferenceEquals(object, object)

object.ToString()

Remarks

Duende 8.0.1's DefaultBackChannelLogoutService, measured: the clients to be told become BackChannelLogoutRequests, sent by protected steps — SendLogoutNotificationsAsync(IEnumerable<BackChannelLogoutRequest>, CancellationToken), then for each CreateFormPostPayloadAsync(BackChannelLogoutRequest, CancellationToken) (with CreateTokenAsync(BackChannelLogoutRequest, CancellationToken) and CreateClaimsForTokenAsync(BackChannelLogoutRequest)) and PostLogoutJwt(BackChannelLogoutRequest, Dictionary<string, string>, CancellationToken) — the virtual ones a host overrides to deliver differently or to add to the token.

Where ours differs: SendLogoutNotificationsAsync(LogoutNotificationContext, CancellationToken), which builds the requests, is not virtual, and puts the session id only on the request of a client that asked for it, so no step is handed one to give away; each client is told concurrently and on its own, a failure raising BackChannelLogoutFailureEvent rather than stopping the others; the token's lifetime is BackChannelLogout.LogoutTokenLifetime, not Duende's fixed 300 seconds.

Constructors

DefaultBackChannelLogoutService(IClientStore, ITokenCreationService, IIssuerNameService, IBackChannelLogoutHttpClient, IOptions<IdentityServerOptions>, IEventService, TimeProvider, ILogger<DefaultBackChannelLogoutService>)

Creates the service, as the container resolves it.

public DefaultBackChannelLogoutService(IClientStore clients, ITokenCreationService tokens, IIssuerNameService issuerNameService, IBackChannelLogoutHttpClient httpClient, IOptions<IdentityServerOptions> options, IEventService events, TimeProvider time, ILogger<DefaultBackChannelLogoutService> logger)

Parameters

clients IClientStore

Finds each client in the session, and its back-channel logout URI.

tokens ITokenCreationService

Signs each logout token.

issuerNameService IIssuerNameService

Names this server as the logout tokens' issuer.

httpClient IBackChannelLogoutHttpClient

Posts each logout token to its client.

options IOptions<IdentityServerOptions>

The server options; BackChannelLogout.LogoutTokenLifetime is each token's lifetime.

events IEventService

Receives a BackChannelLogoutFailureEvent for each client that could not be told.

time TimeProvider

The clock that stamps each logout token's creation time.

logger ILogger<DefaultBackChannelLogoutService>

Receives the service's diagnostics.

Properties

HttpClient

What posts the token to a client. Duende's.

protected IBackChannelLogoutHttpClient HttpClient { get; }

Property Value

IBackChannelLogoutHttpClient

IssuerNameService

Where the issuer comes from when a request names none. Duende's.

protected IIssuerNameService IssuerNameService { get; }

Property Value

IIssuerNameService

TimeProvider

The clock. Duende's.

protected TimeProvider TimeProvider { get; }

Property Value

TimeProvider

Methods

CreateClaimsForTokenAsync(BackChannelLogoutRequest)

The logout token's claims: the event marker, sub, sid and logout_reason. Duende's.

[SuppressMessage("Performance", "CA1822:Mark members as static", Justification = "Duende's shape: an instance member a derived service calls.")]
protected Task<IEnumerable<Claim>> CreateClaimsForTokenAsync(BackChannelLogoutRequest request)

Parameters

request BackChannelLogoutRequest

Returns

Task<IEnumerable<Claim>>

Exceptions

ArgumentException

The client asked for the session id and there is none, or there is neither a subject nor a session to name.

CreateFormPostPayloadAsync(BackChannelLogoutRequest, CancellationToken)

The form to post: the logout token, as logout_token. Duende's.

protected Task<Dictionary<string, string>> CreateFormPostPayloadAsync(BackChannelLogoutRequest request, CancellationToken cancellationToken)

Parameters

request BackChannelLogoutRequest

cancellationToken CancellationToken

Returns

Task<Dictionary<string, string>>

CreateTokenAsync(BackChannelLogoutRequest, CancellationToken)

The logout token for one client, per OpenID Connect Back-Channel Logout 1.0 §2.4. Duende's step.

protected virtual Task<string> CreateTokenAsync(BackChannelLogoutRequest request, CancellationToken cancellationToken)

Parameters

request BackChannelLogoutRequest

cancellationToken CancellationToken

Returns

Task<string>

PostLogoutJwt(BackChannelLogoutRequest, Dictionary<string, string>, CancellationToken)

Posts data to the client's back-channel logout URI. Duende's step.

protected virtual Task PostLogoutJwt(BackChannelLogoutRequest client, Dictionary<string, string> data, CancellationToken cancellationToken)

Parameters

client BackChannelLogoutRequest

data Dictionary<string, string>

cancellationToken CancellationToken

Returns

Task

SendLogoutNotificationsAsync(LogoutNotificationContext, CancellationToken)

Notifies every client in the context that registered a back-channel logout URI.

public Task SendLogoutNotificationsAsync(LogoutNotificationContext context, CancellationToken cancellationToken = default)

Parameters

context LogoutNotificationContext

cancellationToken CancellationToken

Returns

Task

Remarks

Nothing is sent, and the omission is logged, when there is no request and no configured issuer. Only a client that asked for the session id (BackChannelLogoutSessionRequired) is sent it.

Exceptions

ArgumentNullException

context is null.

SendLogoutNotificationsAsync(IEnumerable<BackChannelLogoutRequest>, CancellationToken)

Tells each client in requests. Duende's step.

protected virtual Task SendLogoutNotificationsAsync(IEnumerable<BackChannelLogoutRequest> requests, CancellationToken cancellationToken)

Parameters

requests IEnumerable<BackChannelLogoutRequest>

cancellationToken CancellationToken

Returns

Task

Remarks

Concurrently and each on its own: a failure is logged and raised as BackChannelLogoutFailureEvent.