Class DefaultIdentityServerInteractionService

Namespace

Fdyay.IdentityServer.Services

Assembly

Fdyay.IdentityServer.AspNetCore.dll

Supports all classes in the .NET class hierarchy and provides low-level services to derived classes. This is the ultimate base class of all .NET classes; it is the root of the type hierarchy.

public sealed class DefaultIdentityServerInteractionService : IIdentityServerInteractionService, ILogoutContextFactory, ILogoutNotificationContextFactory

Inheritance

object

DefaultIdentityServerInteractionService

Implements

IIdentityServerInteractionService

ILogoutContextFactory

ILogoutNotificationContextFactory

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

object.ToString()

Constructors

DefaultIdentityServerInteractionService(IClientStore, IConsentService, IHttpContextAccessor, IMessageStore<ErrorMessage>, IMessageStore<ConsentMessage>, IPersistedGrantService, IDataProtectionProvider, IUserSession, IIssuerNameService, ReturnUrlParser, IOptions<IdentityServerOptions>, ISamlLogoutNotificationService?)

The constructor before 0.151.0: no SAML sign-in denial, and the system clock.

public DefaultIdentityServerInteractionService(IClientStore clients, IConsentService consent, IHttpContextAccessor httpContextAccessor, IMessageStore<ErrorMessage> errors, IMessageStore<ConsentMessage> consentMessages, IPersistedGrantService grants, IDataProtectionProvider dataProtectionProvider, IUserSession userSession, IIssuerNameService issuerNameService, ReturnUrlParser returnUrls, IOptions<IdentityServerOptions> options, ISamlLogoutNotificationService? samlLogoutNotifications = null)

Parameters

clients IClientStore

Finds the client a pending request names and the clients a logout notifies.

consent IConsentService

Remembers the consent the user grants.

httpContextAccessor IHttpContextAccessor

Reaches the request in flight and its signed-in user.

errors IMessageStore<ErrorMessage>

Where the error page's messages are read from.

consentMessages IMessageStore<ConsentMessage>

Where the consent page's decisions are written, for the authorize endpoint to read back.

grants IPersistedGrantService

The signed-in user's grants, listed and revoked.

dataProtectionProvider IDataProtectionProvider

Protects the logout id, which carries the session it captures.

userSession IUserSession

The session a logout id captures: its id, clients and SAML sessions.

issuerNameService IIssuerNameService

Names this server as the iss of front-channel logout URLs.

returnUrls ReturnUrlParser

Reads a return URL as the pending request it resumes.

options IOptions<IdentityServerOptions>

The server options; they decide which front-channel logout URLs are allowed.

samlLogoutNotifications ISamlLogoutNotificationService

Builds the SAML service providers' front-channel logout requests; null without the SAML package.

Remarks

The consent page's decisions go through the default IConsentMessageStore over consentMessages.

Exceptions

ArgumentNullException

dataProtectionProvider is null.

DefaultIdentityServerInteractionService(IClientStore, IConsentService, IHttpContextAccessor, IMessageStore<ErrorMessage>, IMessageStore<ConsentMessage>, IPersistedGrantService, IDataProtectionProvider, IUserSession, IIssuerNameService, ReturnUrlParser, IOptions<IdentityServerOptions>, ISamlLogoutNotificationService?, ISamlSignInDenialService?)

The constructor that can deny a SAML sign-in, since 0.151.0.

public DefaultIdentityServerInteractionService(IClientStore clients, IConsentService consent, IHttpContextAccessor httpContextAccessor, IMessageStore<ErrorMessage> errors, IMessageStore<ConsentMessage> consentMessages, IPersistedGrantService grants, IDataProtectionProvider dataProtectionProvider, IUserSession userSession, IIssuerNameService issuerNameService, ReturnUrlParser returnUrls, IOptions<IdentityServerOptions> options, ISamlLogoutNotificationService? samlLogoutNotifications, ISamlSignInDenialService? samlSignInDenials)

Parameters

clients IClientStore

consent IConsentService

httpContextAccessor IHttpContextAccessor

errors IMessageStore<ErrorMessage>

consentMessages IMessageStore<ConsentMessage>

grants IPersistedGrantService

dataProtectionProvider IDataProtectionProvider

userSession IUserSession

issuerNameService IIssuerNameService

returnUrls ReturnUrlParser

options IOptions<IdentityServerOptions>

samlLogoutNotifications ISamlLogoutNotificationService

samlSignInDenials ISamlSignInDenialService

Remarks

An overload rather than a new last parameter, so code compiled against the constructor above still binds to it. Neither SAML service is optional here, so a call with fewer arguments resolves to the one above. Since 0.161.0 it carries the consent page's decisions through the default IConsentMessageStore over consentMessages, as before.

DefaultIdentityServerInteractionService(IClientStore, IConsentService, IHttpContextAccessor, IMessageStore<ErrorMessage>, IConsentMessageStore, IPersistedGrantService, IDataProtectionProvider, IUserSession, IIssuerNameService, ReturnUrlParser, IOptions<IdentityServerOptions>, ISamlLogoutNotificationService?, ISamlSignInDenialService?, TimeProvider)

The constructor that takes Duende's consent message store, since 0.161.0.

public DefaultIdentityServerInteractionService(IClientStore clients, IConsentService consent, IHttpContextAccessor httpContextAccessor, IMessageStore<ErrorMessage> errors, IConsentMessageStore consentMessages, IPersistedGrantService grants, IDataProtectionProvider dataProtectionProvider, IUserSession userSession, IIssuerNameService issuerNameService, ReturnUrlParser returnUrls, IOptions<IdentityServerOptions> options, ISamlLogoutNotificationService? samlLogoutNotifications, ISamlSignInDenialService? samlSignInDenials, TimeProvider time)

Parameters

clients IClientStore

consent IConsentService

httpContextAccessor IHttpContextAccessor

errors IMessageStore<ErrorMessage>

consentMessages IConsentMessageStore

grants IPersistedGrantService

dataProtectionProvider IDataProtectionProvider

userSession IUserSession

issuerNameService IIssuerNameService

returnUrls ReturnUrlParser

options IOptions<IdentityServerOptions>

samlLogoutNotifications ISamlLogoutNotificationService

samlSignInDenials ISamlSignInDenialService

time TimeProvider

Remarks

An overload, as 0.151.0's was, so code compiled against the constructors above still binds to them. The decision a consent page records goes through consentMessages, stamped by time, as Duende's does. AddIdentityServer registers the service by a factory that calls this one with whichever SAML services are registered, rather than leaving the container to choose between the constructors.

Methods

CreateAsync(string?, CancellationToken)

Reads the logout id, or null when it is absent, unreadable, or names no clients.

public Task<LogoutNotificationContext?> CreateAsync(string? logoutId, CancellationToken cancellationToken = default)

Parameters

logoutId string

cancellationToken CancellationToken

Returns

Task<LogoutNotificationContext>

CreateLogoutContextAsync(string?, string?, IReadOnlyDictionary<string, string>?, CancellationToken)

Captures the current session as a logout id, or null when nobody is signed in.

public Task<string?> CreateLogoutContextAsync(string? clientId, string? postLogoutRedirectUri = null, IReadOnlyDictionary<string, string>? parameters = null, CancellationToken cancellationToken = default)

Parameters

clientId string

The client that initiated the signout, when it has been verified.

postLogoutRedirectUri string

The validated post-signout redirect URI, when there is one.

parameters IReadOnlyDictionary<string, string>

The end_session request's parameters, when it started the sign-out; handed to the logout page as Parameters, less those this server acted on. New in 0.129.0.

cancellationToken CancellationToken

Cancels the capture.

Returns

Task<string>

CreateLogoutContextAsync(CancellationToken)

Captures the current signed-in session as a logout id, or null when nobody is signed in.

public Task<string?> CreateLogoutContextAsync(CancellationToken cancellationToken = default)

Parameters

cancellationToken CancellationToken

Returns

Task<string>

DenyAuthenticationAsync(IAuthenticationContext, InteractionError, CancellationToken, string?)

Records a denial of any pending request, to be returned to the client as an error.

public Task DenyAuthenticationAsync(IAuthenticationContext context, InteractionError interactionError, CancellationToken cancellationToken = default, string? errorDescription = null)

Parameters

context IAuthenticationContext

interactionError InteractionError

cancellationToken CancellationToken

errorDescription string

Returns

Task

DenyAuthorizationAsync(AuthorizationRequest, InteractionError, CancellationToken, string?)

Records a denial of a pending authorization request, to be returned to the client as an error.

public Task DenyAuthorizationAsync(AuthorizationRequest request, InteractionError interactionError, CancellationToken cancellationToken = default, string? errorDescription = null)

Parameters

request AuthorizationRequest

interactionError InteractionError

cancellationToken CancellationToken

errorDescription string

Returns

Task

GetAllUserGrantsAsync(CancellationToken)

The consent the signed-in user has given, for an account-management screen.

public Task<IReadOnlyCollection<Grant>> GetAllUserGrantsAsync(CancellationToken cancellationToken = default)

Parameters

cancellationToken CancellationToken

Returns

Task<IReadOnlyCollection<Grant>>

GetAuthenticationContextAsync(string?, CancellationToken)

Gets the pending request described by a return URL, whatever kind it is.

public Task<IAuthenticationContext?> GetAuthenticationContextAsync(string? returnUrl, CancellationToken cancellationToken = default)

Parameters

returnUrl string

cancellationToken CancellationToken

Returns

Task<IAuthenticationContext>

GetAuthorizationContextAsync(string?, CancellationToken)

Gets the authorization request described by a return URL, or null if it is not valid.

public Task<AuthorizationRequest?> GetAuthorizationContextAsync(string? returnUrl, CancellationToken cancellationToken = default)

Parameters

returnUrl string

cancellationToken CancellationToken

Returns

Task<AuthorizationRequest>

GetErrorContextAsync(string?, CancellationToken)

Gets the error context identified by errorId.

public Task<ErrorMessage?> GetErrorContextAsync(string? errorId, CancellationToken cancellationToken = default)

Parameters

errorId string

cancellationToken CancellationToken

Returns

Task<ErrorMessage>

Null when the id is absent, unknown, or has expired.

GetLogoutContextAsync(string?, CancellationToken)

Gets the signout request identified by logoutId.

public Task<LogoutRequest> GetLogoutContextAsync(string? logoutId, CancellationToken cancellationToken = default)

Parameters

logoutId string

cancellationToken CancellationToken

Returns

Task<LogoutRequest>

Remarks

An absent or unreadable id yields a context that prompts the user to confirm.

GrantConsentAsync(AuthorizationRequest, ConsentResponse, CancellationToken, string?)

Records the user's decision on a pending authorization request.

public Task GrantConsentAsync(AuthorizationRequest request, ConsentResponse consent, CancellationToken cancellationToken = default, string? subject = null)

Parameters

request AuthorizationRequest

consent ConsentResponse

cancellationToken CancellationToken

subject string

Returns

Task

IsValidReturnUrl(string?)

Whether the return URL is a valid local authorize URL.

public bool IsValidReturnUrl(string? returnUrl)

Parameters

returnUrl string

Returns

bool

RevokeTokensForCurrentSessionAsync(CancellationToken)

Removes the tokens issued for the signed-in user's current session.

public Task RevokeTokensForCurrentSessionAsync(CancellationToken cancellationToken = default)

Parameters

cancellationToken CancellationToken

Returns

Task

RevokeUserConsentAsync(string?, CancellationToken)

Withdraws the signed-in user's consent for a client.

public Task RevokeUserConsentAsync(string? clientId, CancellationToken cancellationToken = default)

Parameters

clientId string

cancellationToken CancellationToken

Returns

Task

Remarks

Consent alone: the tokens already issued under it are removed too, because leaving them would let a client the user has just disconnected keep acting on their behalf until those tokens expired.