ILogoutTokenValidator Interface
Validates the Logout Token a provider posts to this receiver to say a session has ended (OpenID Connect Back-Channel Logout 1.0 section 2.6).
public interface ILogoutTokenValidatorDerived
↳ LogoutTokenValidator
Remarks
The request carrying this token is unauthenticated and comes from a caller this receiver never spoke to first, so the token is the only thing vouching for it. Section 4: "The signed Logout Token is required in the logout request to prevent denial of service attacks by enabling the RP to verify that the logout request is coming from a legitimate party." Every check below exists because anyone on the network can make this call.
Methods
ILogoutTokenValidator.ValidateAsync(string, CancellationToken) Method
Validates logoutToken and returns which sessions it says to end.
System.Threading.Tasks.Task<Abblix.SecurityEvents.BackChannelLogout.LogoutNotification> ValidateAsync(string logoutToken, System.Threading.CancellationToken cancellationToken=default(System.Threading.CancellationToken));Parameters
logoutToken System.String
The encoded Logout Token from the logout_token parameter.
cancellationToken System.Threading.CancellationToken
Cancels the key-set and metadata reads this may need.
Returns
System.Threading.Tasks.Task<LogoutNotification>
What the token says to act on.
Exceptions
LogoutTokenValidationException
The token failed a validation step. Section 2.6: "If any of the validation steps fails, reject the
Logout Token and return an HTTP 400 Bad Request error."
Remarks
Steps 8 to 11 of section 2.6 are each introduced with "Optionally", and each needs something only the host has: a record of tokens recently seen, or the ID Token of the session being ended. They are left to the host, which holds the sessions this notification is about, and which section 2.7 makes responsible for locating them anyway.