LogoutNotification Class
Which sessions a validated Logout Token says to end.
public sealed record LogoutNotification : System.IEquatable<Abblix.SecurityEvents.BackChannelLogout.LogoutNotification>Inheritance System.Object → LogoutNotification
Implements System.IEquatable<LogoutNotification>
Remarks
What OpenID Connect Back-Channel Logout 1.0 Section 2.7 asks the RP to act on: "locate the session(s) identified by the iss and sub Claims and/or the sid Claim", then "clear any state associated with the identified session(s)". Acting is the host's, since only the host knows where its sessions are kept.
Constructors
LogoutNotification(string, string, string, string) Constructor
Which sessions a validated Logout Token says to end.
public LogoutNotification(string Issuer, string? Subject, string? SessionId, string? TokenId);Parameters
Issuer System.String
The provider that sent the notification.
Subject System.String
The end-user whose sessions are ending, when the token named one. Every session this client holds for that user at that issuer is meant, not one of them.
SessionId System.String
The single session that is ending, when the token named one. Narrower than the subject, and the two may arrive together.
TokenId System.String
The jti of the token that carried this notification.
Remarks
What OpenID Connect Back-Channel Logout 1.0 Section 2.7 asks the RP to act on: "locate the session(s) identified by the iss and sub Claims and/or the sid Claim", then "clear any state associated with the identified session(s)". Acting is the host's, since only the host knows where its sessions are kept.
Properties
LogoutNotification.Issuer Property
The provider that sent the notification.
public string Issuer { get; init; }Property Value
LogoutNotification.SessionId Property
The single session that is ending, when the token named one. Narrower than the subject, and the two may arrive together.
public string? SessionId { get; init; }Property Value
LogoutNotification.Subject Property
The end-user whose sessions are ending, when the token named one. Every session this client holds for that user at that issuer is meant, not one of them.
public string? Subject { get; init; }Property Value
LogoutNotification.TokenId Property
The jti of the token that carried this notification.
public string? TokenId { get; init; }Property Value
Methods
LogoutNotification.Matches(JsonWebToken) Method
Reports whether this notification is about the session identityToken belongs to.
public bool Matches(Abblix.Jwt.JsonWebToken identityToken);Parameters
identityToken JsonWebToken
The ID Token of a session this client is holding, as validated when that session was established.
Returns
System.Boolean
true when the notification names that session and nothing contradicts it.
Remarks
Steps 9, 10 and 11 of OpenID Connect Back-Channel Logout 1.0 Section 2.6, which the
specification introduces with "Optionally verify that the iss Logout Token Claim matches the
iss Claim in an ID Token issued for the current session or a recent session", and likewise
of any sub and any sid.
They are offered here rather than performed during validation because they are questions
about a session, and only the host knows which sessions it holds - Section 2.7 already makes
it responsible for finding them. What the library can do is make the comparison one call
rather than three hand-written string comparisons, which is where a case-insensitive or a
null-tolerant one creeps in.
Note what "matches" means for a claim the token did not carry: the notification names a
subject or a session or both, and a claim it did not name places no restriction. A
notification carrying only a subject is about every session this client holds for that user,
which is exactly what a provider means by omitting the session identifier.