Table of Contents

Class DefaultSessionCoordinationService

Namespace
Fdyay.IdentityServer.Services
Assembly
Fdyay.IdentityServer.AspNetCore.dll

Supports all classes in the .NET class hierarchy and provides low-level services to derived classes. This is the ultimate base class of all .NET classes; it is the root of the type hierarchy.

public class DefaultSessionCoordinationService : ISessionCoordinationService
Inheritance
DefaultSessionCoordinationService
Implements
Inherited Members

Constructors

DefaultSessionCoordinationService(IPersistedGrantStore, IBackChannelLogoutService, IEventService, IServerSideSessionStore?, IOptions<IdentityServerOptions>?, TimeProvider?, IServerSideTicketStore?)

Creates the service, as the container resolves it.

public DefaultSessionCoordinationService(IPersistedGrantStore grants, IBackChannelLogoutService backChannelLogout, IEventService events, IServerSideSessionStore? sessions = null, IOptions<IdentityServerOptions>? options = null, TimeProvider? time = null, IServerSideTicketStore? tickets = null)

Parameters

grants IPersistedGrantStore

The grants a session's clients are read from, and removed from when it ends.

backChannelLogout IBackChannelLogoutService

Tells the session's clients that it ended.

events IEventService

Receives a GrantsRevokedEvent when an ended session's grants are removed.

sessions IServerSideSessionStore

The server-side sessions a coordinating client's token is checked and slid against; null checks nothing.

options IOptions<IdentityServerOptions>

The server options: whether every client coordinates with the session, and whether the cookie slides.

time TimeProvider

The clock a session's expiry is read against. Defaults to the system clock.

tickets IServerSideTicketStore

The tickets renewed with a sliding cookie; null slides only the rows.

Methods

ProcessExpirationAsync(ServerSideSession, CancellationToken)

Cleans up after a session that has expired. Duende's.

public Task ProcessExpirationAsync(ServerSideSession session, CancellationToken cancellationToken = default)

Parameters

session ServerSideSession
cancellationToken CancellationToken

Returns

Task

Remarks

The clients are told the session expired rather than that it was ended. Calls ProcessLogoutAsync(ServerSideSession, CancellationToken) unless implemented, so an implementation written before 0.129.0 keeps compiling and keeps cleaning up after expired sessions as it did.

ProcessLogoutAsync(ServerSideSession, CancellationToken)

Cleans up after a session that has been ended from outside the browser holding it.

public Task ProcessLogoutAsync(ServerSideSession session, CancellationToken cancellationToken = default)

Parameters

session ServerSideSession
cancellationToken CancellationToken

Returns

Task

Remarks

Its caller here is ISessionManagementService.RemoveSessionsAsync, so the clients are told the session was terminated. Duende's of the same name is called at a browser's own sign-out instead; this server's sign-out notifies the clients itself and does not come through here.

ValidateSessionAsync(SessionValidationRequest, CancellationToken)

Whether a client's token may still be used, given the user's session here; and, while it may, the session slid forward by the use.

public Task<bool> ValidateSessionAsync(SessionValidationRequest request, CancellationToken cancellationToken = default)

Parameters

request SessionValidationRequest
cancellationToken CancellationToken

Returns

Task<bool>

Remarks

Only a client that coordinates its lifetime with the session is asked about it — Client.CoordinateLifetimeWithUserSession, or the server-wide default — and for one that does, a token whose subject and session id match no unexpired session is refused. Duende 8.0.1's, measured.

Answers valid unless implemented, so an implementation written before 0.99.0 keeps compiling and keeps its meaning — it coordinated nothing then, and still does.