SubjectOrSessionStep Class

Requires a sub, a sid, or both - step 5 of OpenID Connect Back-Channel Logout 1.0 Section 2.6.

public sealed class SubjectOrSessionStep : Abblix.SecurityEvents.Validation.ISecurityEventTokenValidator

Inheritance System.Object → SubjectOrSessionStep

Implements ISecurityEventTokenValidator

Remarks

A token carrying neither says a session ended without saying whose, and Section 2.7 leaves nothing to act on: the RP is asked to "locate the session(s) identified by the iss and sub Claims and/or the sid Claim". A receiver that accepted it would either do nothing and answer success to a request it did not honour, or end every session it holds for that issuer.

Read after the signature, unlike the cheap presence checks above: these two are the claims the host acts on, so they must be the issuer's statements rather than the sender's.

Methods

SubjectOrSessionStep.ValidateAsync(SecurityEventTokenValidationContext, CancellationToken) Method

Checks the token in flight.

public System.Threading.Tasks.ValueTask<Abblix.SecurityEvents.Validation.SecurityEventTokenValidationError?> ValidateAsync(Abblix.SecurityEvents.Validation.SecurityEventTokenValidationContext context, System.Threading.CancellationToken cancellationToken);