WsFederationOptions WsFederationOptions WsFederationOptions Class

Definition

Configuration options for WsFederationHandler

public class WsFederationOptions : Microsoft.AspNetCore.Authentication.RemoteAuthenticationOptions
type WsFederationOptions = class
    inherit RemoteAuthenticationOptions
Public Class WsFederationOptions
Inherits RemoteAuthenticationOptions
Inheritance

Constructors

WsFederationOptions() WsFederationOptions() WsFederationOptions()

Initializes a new WsFederationOptions

Properties

AllowUnsolicitedLogins AllowUnsolicitedLogins AllowUnsolicitedLogins

The Ws-Federation protocol allows the user to initiate logins without contacting the application for a Challenge first. However, that flow is susceptible to XSRF and other attacks so it is disabled here by default.

Backchannel Backchannel Backchannel

Used to communicate with the remote identity provider.

(Inherited from RemoteAuthenticationOptions)
BackchannelHttpHandler BackchannelHttpHandler BackchannelHttpHandler

The HttpMessageHandler used to communicate with remote identity provider. This cannot be set at the same time as BackchannelCertificateValidator unless the value can be downcast to a WebRequestHandler.

(Inherited from RemoteAuthenticationOptions)
BackchannelTimeout BackchannelTimeout BackchannelTimeout

Gets or sets timeout value in milliseconds for back channel communications with the remote identity provider.

(Inherited from RemoteAuthenticationOptions)
CallbackPath CallbackPath CallbackPath

The request path within the application's base path where the user-agent will be returned. The middleware will process this request when it arrives.

(Inherited from RemoteAuthenticationOptions)
ClaimsIssuer ClaimsIssuer ClaimsIssuer

Gets or sets the issuer that should be used for any claims that are created

(Inherited from AuthenticationSchemeOptions)
Configuration Configuration Configuration

Configuration provided directly by the developer. If provided, then MetadataAddress and the Backchannel properties will not be used. This information should not be updated during request processing.

ConfigurationManager ConfigurationManager ConfigurationManager

Responsible for retrieving, caching, and refreshing the configuration from metadata. If not provided, then one will be created using the MetadataAddress and Backchannel properties.

CorrelationCookie CorrelationCookie CorrelationCookie

Determines the settings used to create the correlation cookie before the cookie gets added to the response.

(Inherited from RemoteAuthenticationOptions)
DataProtectionProvider DataProtectionProvider DataProtectionProvider

Gets or sets the type used to secure data.

(Inherited from RemoteAuthenticationOptions)
Events Events Events

Gets or sets the WsFederationEvents to call when processing WsFederation messages.

EventsType EventsType EventsType

If set, will be used as the service type to get the Events instance instead of the property.

(Inherited from AuthenticationSchemeOptions)
ForwardAuthenticate ForwardAuthenticate ForwardAuthenticate

If set, this specifies the target scheme that this scheme should forward AuthenticateAsync calls to. For example Context.AuthenticateAsync("ThisScheme") => Context.AuthenticateAsync("ForwardAuthenticateValue"); Set the target to the current scheme to disable forwarding and allow normal processing.

(Inherited from AuthenticationSchemeOptions)
ForwardChallenge ForwardChallenge ForwardChallenge

If set, this specifies the target scheme that this scheme should forward ChallengeAsync calls to. For example Context.ChallengeAsync("ThisScheme") => Context.ChallengeAsync("ForwardChallengeValue"); Set the target to the current scheme to disable forwarding and allow normal processing.

(Inherited from AuthenticationSchemeOptions)
ForwardDefault ForwardDefault ForwardDefault

If set, this specifies a default scheme that authentication handlers should forward all authentication operations to by default. The default forwarding logic will check the most specific ForwardAuthenticate/Challenge/Forbid/SignIn/SignOut setting first, followed by checking the ForwardDefaultSelector, followed by ForwardDefault. The first non null result will be used as the target scheme to forward to.

(Inherited from AuthenticationSchemeOptions)
ForwardDefaultSelector ForwardDefaultSelector ForwardDefaultSelector

Used to select a default scheme for the current request that authentication handlers should forward all authentication operations to by default. The default forwarding logic will check the most specific ForwardAuthenticate/Challenge/Forbid/SignIn/SignOut setting first, followed by checking the ForwardDefaultSelector, followed by ForwardDefault. The first non null result will be used as the target scheme to forward to.

(Inherited from AuthenticationSchemeOptions)
ForwardForbid ForwardForbid ForwardForbid

If set, this specifies the target scheme that this scheme should forward ForbidAsync calls to. For example Context.ForbidAsync("ThisScheme") => Context.ForbidAsync("ForwardForbidValue"); Set the target to the current scheme to disable forwarding and allow normal processing.

(Inherited from AuthenticationSchemeOptions)
ForwardSignIn ForwardSignIn ForwardSignIn

If set, this specifies the target scheme that this scheme should forward SignInAsync calls to. For example Context.SignInAsync("ThisScheme") => Context.SignInAsync("ForwardSignInValue"); Set the target to the current scheme to disable forwarding and allow normal processing.

(Inherited from AuthenticationSchemeOptions)
ForwardSignOut ForwardSignOut ForwardSignOut

If set, this specifies the target scheme that this scheme should forward SignOutAsync calls to. For example Context.SignOutAsync("ThisScheme") => Context.SignInAsync("ForwardSignOutValue"); Set the target to the current scheme to disable forwarding and allow normal processing.

(Inherited from AuthenticationSchemeOptions)
MetadataAddress MetadataAddress MetadataAddress

Gets or sets the address to retrieve the wsFederation metadata

RefreshOnIssuerKeyNotFound RefreshOnIssuerKeyNotFound RefreshOnIssuerKeyNotFound

Gets or sets if a metadata refresh should be attempted after a SecurityTokenSignatureKeyNotFoundException. This allows for automatic recovery in the event of a signature key rollover. This is enabled by default.

RemoteAuthenticationTimeout RemoteAuthenticationTimeout RemoteAuthenticationTimeout

Gets or sets the time limit for completing the authentication flow (15 minutes by default).

(Inherited from RemoteAuthenticationOptions)
RemoteSignOutPath RemoteSignOutPath RemoteSignOutPath

Requests received on this path will cause the handler to invoke SignOut using the SignOutScheme.

RequireHttpsMetadata RequireHttpsMetadata RequireHttpsMetadata

Gets or sets if HTTPS is required for the metadata address or authority. The default is true. This should be disabled only in development environments.

SaveTokens SaveTokens SaveTokens

Defines whether access and refresh tokens should be stored in the AuthenticationProperties after a successful authorization. This property is set to false by default to reduce the size of the final authentication cookie.

(Inherited from RemoteAuthenticationOptions)
SecurityTokenHandlers SecurityTokenHandlers SecurityTokenHandlers

Gets or sets the collection of ISecurityTokenValidator used to read and validate the SecurityTokens.

SignInScheme SignInScheme SignInScheme

Gets or sets the authentication scheme corresponding to the middleware responsible of persisting user's identity after a successful authentication. This value typically corresponds to a cookie middleware registered in the Startup class. When omitted, DefaultSignInScheme is used as a fallback value.

(Inherited from RemoteAuthenticationOptions)
SignOutScheme SignOutScheme SignOutScheme

The Authentication Scheme to use with SignOutAsync from RemoteSignOutPath. SignInScheme will be used if this is not set.

SignOutWreply SignOutWreply SignOutWreply

Gets or sets the 'wreply' value used during sign-out. If none is specified then the value from the Wreply field is used.

SkipUnrecognizedRequests SkipUnrecognizedRequests SkipUnrecognizedRequests

Indicates if requests to the CallbackPath may also be for other components. If enabled the handler will pass requests through that do not contain WsFederation authentication responses. Disabling this and setting the CallbackPath to a dedicated endpoint may provide better error handling. This is disabled by default.

StateDataFormat StateDataFormat StateDataFormat

Gets or sets the type used to secure data handled by the middleware.

TokenValidationParameters TokenValidationParameters TokenValidationParameters

Gets or sets the TokenValidationParameters

UseTokenLifetime UseTokenLifetime UseTokenLifetime

Indicates that the authentication session lifetime (e.g. cookies) should match that of the authentication token. If the token does not provide lifetime information then normal session lifetimes will be used. This is enabled by default.

Wreply Wreply Wreply

Gets or sets the 'wreply'. CallbackPath must be set to match or cleared so it can be generated dynamically. This field is optional. If not set then it will be generated from the current request and the CallbackPath.

Wtrealm Wtrealm Wtrealm

Gets or sets the 'wtrealm'.

Methods

Validate() Validate() Validate()

Check that the options are valid. Should throw an exception if things are not ok.

Validate(String) Validate(String) Validate(String)

Checks that the options are valid for a specific scheme

(Inherited from RemoteAuthenticationOptions)

Applies to