LogoutTokenValidator Class
Validates Logout Tokens arriving at this receiver's back-channel logout endpoint.
public sealed class LogoutTokenValidator : Abblix.SecurityEvents.BackChannelLogout.ILogoutTokenValidatorInheritance System.Object → LogoutTokenValidator
Implements ILogoutTokenValidator
Remarks
Steps 1 to 7 of OpenID Connect Back-Channel Logout 1.0 Section 2.6 are the profile's, which is why this class is short: the signature, the algorithm and the iss, aud, iat and exp claims are the steps the specification defines by reference to ID Token validation, and the profile carries them along with the logout event, the absent nonce and the subject or session. What is left here is step 8 and the notification the host acts on.
Step 1, decryption, does not arise: this receiver registers no encryption algorithm for the endpoint, so an encrypted token is one it never asked for and the JOSE layer refuses.
Constructors
LogoutTokenValidator(ISecurityEventTokenValidator, BackChannelLogoutValidationOptions, IReplayCache) Constructor
Validates Logout Tokens arriving at this receiver's back-channel logout endpoint.
public LogoutTokenValidator(Abblix.SecurityEvents.Validation.ISecurityEventTokenValidator validator, Abblix.SecurityEvents.BackChannelLogout.BackChannelLogoutValidationOptions options, Abblix.Jwt.ReplayPrevention.IReplayCache replayCache);Parameters
validator ISecurityEventTokenValidator
The validation pipeline, resolved from this receiver's own named profile (LogoutToken) - never the host's plain family, which another consumer of security event tokens may have shaped to refuse every Logout Token.
options BackChannelLogoutValidationOptions
What this receiver expects of every Logout Token.
replayCache IReplayCache
Remembers tokens already acted on, which is step 8.
Remarks
Steps 1 to 7 of OpenID Connect Back-Channel Logout 1.0 Section 2.6 are the profile's, which is why this class is short: the signature, the algorithm and the iss, aud, iat and exp claims are the steps the specification defines by reference to ID Token validation, and the profile carries them along with the logout event, the absent nonce and the subject or session. What is left here is step 8 and the notification the host acts on.
Step 1, decryption, does not arise: this receiver registers no encryption algorithm for the endpoint, so an encrypted token is one it never asked for and the JOSE layer refuses.
Methods
LogoutTokenValidator.ValidateAsync(string, CancellationToken) Method
Validates logoutToken and returns which sessions it says to end.
public System.Threading.Tasks.Task<Abblix.SecurityEvents.BackChannelLogout.LogoutNotification> ValidateAsync(string logoutToken, System.Threading.CancellationToken cancellationToken=default(System.Threading.CancellationToken));Parameters
logoutToken System.String
The encoded Logout Token from the logout_token parameter.
cancellationToken System.Threading.CancellationToken
Cancels the key-set and metadata reads this may need.
Implements ValidateAsync(string, CancellationToken)
Returns
System.Threading.Tasks.Task<LogoutNotification>
What the token says to act on.
Exceptions
LogoutTokenValidationException
The token failed a validation step. Section 2.6: "If any of the validation steps fails, reject the
Logout Token and return an HTTP 400 Bad Request error."
Remarks
Steps 8 to 11 of section 2.6 are each introduced with "Optionally", and each needs something only the host has: a record of tokens recently seen, or the ID Token of the session being ended. They are left to the host, which holds the sessions this notification is about, and which section 2.7 makes responsible for locating them anyway.