Class DefaultUserSession

Namespace

Fdyay.IdentityServer.Services

Assembly

Fdyay.IdentityServer.AspNetCore.dll

Supports all classes in the .NET class hierarchy and provides low-level services to derived classes. This is the ultimate base class of all .NET classes; it is the root of the type hierarchy.

public sealed class DefaultUserSession : IUserSession

Inheritance

object

DefaultUserSession

Implements

IUserSession

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

object.ToString()

Remarks

State lives in the authentication ticket rather than in a server-side store, so it survives exactly as long as the cookie does and needs no storage of its own. The cost is that recording a new client re-issues the cookie.

Registered per request, because the ticket is read once and then mutated in place. Authenticating again after a sign-in returns the ticket the request arrived with — the handler caches its own result — so a second reader would not see the first's change and would overwrite it on the way out.

Constructors

DefaultUserSession(IHttpContextAccessor)

Creates the session over the request in flight.

public DefaultUserSession(IHttpContextAccessor httpContextAccessor)

Parameters

httpContextAccessor IHttpContextAccessor

Reaches the request whose session cookie is read and re-issued.

Methods

AddClientIdAsync(string, CancellationToken)

Records that a client has been authenticated in this session.

public Task AddClientIdAsync(string clientId, CancellationToken cancellationToken = default)

Parameters

clientId string

cancellationToken CancellationToken

Returns

Task

Remarks

Re-issues the cookie only when the client is not already on the list; does nothing when nobody is signed in.

Exceptions

ArgumentException

clientId is null or empty.

AddSamlSessionAsync(SamlSpSessionData, CancellationToken)

Records that this session issued an assertion to a SAML service provider, and what it said.

public Task AddSamlSessionAsync(SamlSpSessionData session, CancellationToken cancellationToken = default)

Parameters

session SamlSpSessionData

cancellationToken CancellationToken

Returns

Task

Remarks

Duende 8.0.1's. Replaces the provider's earlier record, if it has one: a session holds one SAML session per service provider.

Kept apart from the client list rather than folded into it, because the two are different namespaces of identifier. Back-channel logout resolves every entry of the client list with FindClientByIdAsync; an entity id resolves to nothing there and would be skipped in silence, which is the shape this tree keeps finding rather than one to add. Single logout reads this list and resolves each entry against the service provider registry instead.

Breaking in 0.129.0. It was AddSamlServiceProviderAsync(string entityId), and the list GetSamlServiceProviderListAsync; a logout can only name a provider's session if the NameID and session index are kept with it.

Exceptions

ArgumentNullException

session is null.

ArgumentException

The session's EntityId is null or empty.

GetClientListAsync(CancellationToken)

The clients authenticated in this session so far.

public Task<IReadOnlyCollection<string>> GetClientListAsync(CancellationToken cancellationToken = default)

Parameters

cancellationToken CancellationToken

Returns

Task<IReadOnlyCollection<string>>

GetSamlSessionListAsync(CancellationToken)

The SAML service providers this session reached, which a sign-out has to notify.

public Task<IReadOnlyCollection<SamlSpSessionData>> GetSamlSessionListAsync(CancellationToken cancellationToken = default)

Parameters

cancellationToken CancellationToken

Returns

Task<IReadOnlyCollection<SamlSpSessionData>>

GetSessionIdAsync(CancellationToken)

The current session's identifier, creating one if the session does not have it yet.

public Task<string?> GetSessionIdAsync(CancellationToken cancellationToken = default)

Parameters

cancellationToken CancellationToken

Returns

Task<string>

Remarks

The sid claim when the host issues one; otherwise the id kept on the cookie, which a sign-in to the session's scheme is given (0.174.0) — or, for a session that has none, created and the cookie re-issued the first time it is asked for. Null when there is no request or nobody is signed in.

GetUserAsync(CancellationToken)

The user signed in to this session, or null when nobody is.

public Task<ClaimsPrincipal?> GetUserAsync(CancellationToken cancellationToken = default)

Parameters

cancellationToken CancellationToken

Returns

Task<ClaimsPrincipal>

Remarks

Duende 8.0.1's: the principal of the session's own cookie scheme, authenticated, which is not always HttpContext.User — that is whatever the host's default scheme says. Asked by CIBA completion, as Duende's (since 0.160.0); the endpoints read the session as they did before 0.158.0.

A default interface method, so a host's session written before 0.158.0 keeps compiling; one that does not implement it throws NotSupportedException when asked, rather than answering that nobody is signed in. Duende's interface has no default.

RemoveSamlSessionAsync(string, CancellationToken)

Forgets this session's SAML session with one service provider, so a sign-out does not notify it.

public Task RemoveSamlSessionAsync(string entityId, CancellationToken cancellationToken = default)

Parameters

entityId string

cancellationToken CancellationToken

Returns

Task

Remarks

Duende 8.0.1's, measured from DefaultUserSession: every record for the entity id, compared ordinally, and nothing for nobody signed in. Nothing in Duende's assembly or this server calls it; it is for a host that ends one provider's session itself.

A default interface method for the same reason as GetUserAsync(CancellationToken), throwing NotSupportedException for a session that does not implement it.

Exceptions

ArgumentNullException

entityId is null.