Class EndSessionRequestValidator

Namespace

Fdyay.IdentityServer.Validation

Assembly

Fdyay.IdentityServer.AspNetCore.dll

Duende's default end-session request validator.

public class EndSessionRequestValidator : IEndSessionRequestValidator

Inheritance

object

EndSessionRequestValidator

Implements

IEndSessionRequestValidator

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.MemberwiseClone()

object.ReferenceEquals(object, object)

object.ToString()

Remarks

In the ASP.NET Core assembly rather than with its interface, because it reads the signed-in user's session and this server's issuer, which the id_token_hint is validated against.

Constructors

EndSessionRequestValidator(IOptions<IdentityServerOptions>, ITokenValidator, IRedirectUriValidator, IUserSession, IClientStore, IIssuerNameService, IHttpContextAccessor)

Creates the validator, as the container resolves it.

public EndSessionRequestValidator(IOptions<IdentityServerOptions> options, ITokenValidator tokenValidator, IRedirectUriValidator uriValidator, IUserSession userSession, IClientStore clients, IIssuerNameService issuers, IHttpContextAccessor httpContextAccessor)

Parameters

options IOptions<IdentityServerOptions>

The server options: input length limits, whether an anonymous request is refused, and the allowed redirect targets.

tokenValidator ITokenValidator

Validates the id_token_hint as one this server issued.

uriValidator IRedirectUriValidator

Decides whether the post_logout_redirect_uri is registered for the client.

userSession IUserSession

The signed-in session, whose id the hint must name and whose clients are to be told.

clients IClientStore

Finds the client the hint was issued to.

issuers IIssuerNameService

Names this server as the issuer the hint must come from.

httpContextAccessor IHttpContextAccessor

Reaches the request in flight, for its issuer.

Exceptions

ArgumentNullException

options is null.

Properties

Clients

Finds the client the hint was issued to.

protected IClientStore Clients { get; }

Property Value

IClientStore

HttpContextAccessor

Reaches the request in flight, for its issuer.

protected IHttpContextAccessor HttpContextAccessor { get; }

Property Value

IHttpContextAccessor

Issuers

Names this server as the issuer the hint must come from.

protected IIssuerNameService Issuers { get; }

Property Value

IIssuerNameService

Options

The server options, as they stood when the validator was created.

protected IdentityServerOptions Options { get; }

Property Value

IdentityServerOptions

TokenValidator

Validates the id_token_hint as one this server issued.

protected ITokenValidator TokenValidator { get; }

Property Value

ITokenValidator

UriValidator

Decides whether the post_logout_redirect_uri is registered for the client.

protected IRedirectUriValidator UriValidator { get; }

Property Value

IRedirectUriValidator

UserSession

The signed-in session, whose id the hint must name and whose clients are to be told.

protected IUserSession UserSession { get; }

Property Value

IUserSession

Methods

ValidateAsync(IReadOnlyDictionary<string, string>, ClaimsPrincipal?, CancellationToken)

Validates an end-session request as IEndSessionRequestValidator describes; a refusal is a result carrying the error, not an exception.

public virtual Task<EndSessionValidationResult> ValidateAsync(IReadOnlyDictionary<string, string> parameters, ClaimsPrincipal? subject, CancellationToken ct)

Parameters

parameters IReadOnlyDictionary<string, string>

The request's parameters.

subject ClaimsPrincipal

The signed-in user, or null when nobody is signed in.

ct CancellationToken

Cancels the validation.

Returns

Task<EndSessionValidationResult>

The validated request, or the refusal.

Exceptions

ArgumentNullException

parameters is null.

ValidateIdTokenHintAsync(EndSessionHintValidationContext, CancellationToken)

Whether a valid id_token_hint names the signed-in user's session.

protected virtual Task<EndSessionHintValidationResult> ValidateIdTokenHintAsync(EndSessionHintValidationContext context, CancellationToken ct)

Parameters

context EndSessionHintValidationContext

ct CancellationToken

Returns

Task<EndSessionHintValidationResult>

Remarks

Duende's, measured: with a sid in the hint and a session here, the two must match; otherwise the hint's sub must be the signed-in user. A host overrides this to ask for confirmation, or to refuse more.