Skip to content

Commit c333d77

Browse files
authored
Fix capitalization, add closing braces, and some formatting
1 parent fec1888 commit c333d77

File tree

1 file changed

+32
-29
lines changed

1 file changed

+32
-29
lines changed

src/content/docs/bff/extensibility/management/back-channel-logout.md

Lines changed: 32 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -12,65 +12,68 @@ redirect_from:
1212
- /identityserver/v7/bff/extensibility/management/back-channel-logout/
1313
---
1414

15-
The back-channel logout endpoint has several extensibility points organized into two interfaces and their default implementations. The *IBackchannelLogoutService* is the top level abstraction that processes requests to the endpoint. This service can be used to add custom request processing logic or to change how it validates incoming requests. When the back-channel logout endpoint receives a valid request, it revokes sessions using the *ISessionRevocationService*.
15+
The back-channel logout endpoint has several extensibility points organized into two interfaces and their default implementations. The *IBackChannelLogoutService* is the top level abstraction that processes requests to the endpoint. This service can be used to add custom request processing logic or to change how it validates incoming requests. When the back-channel logout endpoint receives a valid request, it revokes sessions using the *ISessionRevocationService*.
1616

1717
## Request Processing
18-
You can add custom logic to the endpoint by implementing the *IBackchannelLogoutService* or by extending its default implementation (*Duende.Bff.DefaultBackchannelLogoutService*). In most cases, extending the default implementation is preferred, as it has several virtual methods that can be overridden to customize particular aspects of how the request is processed.
18+
You can add custom logic to the endpoint by implementing the *IBackChannelLogoutService* or by extending its default implementation (*Duende.Bff.DefaultBackChannelLogoutService*). In most cases, extending the default implementation is preferred, as it has several virtual methods that can be overridden to customize particular aspects of how the request is processed.
1919

2020
*ProcessRequestAsync* is the top level function called in the endpoint service and can be used to add arbitrary logic to the endpoint.
2121

2222
```csharp
23-
public class CustomizedBackchannelLogoutService : DefaultBackchannelLogoutService
23+
public class CustomizedBackChannelLogoutService : DefaultBackChannelLogoutService
2424
{
2525
public override Task ProcessRequestAsync(HttpContext context)
2626
{
2727
// Custom logic here
2828
2929
return base.ProcessRequestAsync(context);
3030
}
31+
}
3132
```
3233

3334
## Validation
3435

35-
Validation of the incoming request can be customized by overriding one of several virtual methods in the *DefaultBackchannelLogoutService*. *GetTokenValidationParameters* allows you to specify the *[TokenValidationParameters](https://learn.microsoft.com/en-us/dotnet/API/microsoft.identitymodel.tokens.tokenvalidationparameters?view=azure-dotnet)* used to validate the incoming logout token. The default implementation creates token validation parameters based on the authentication scheme's configuration. Your override could begin by calling the base method and then make changes to those parameters or completely customize how token validation parameters are created. For example:
36+
Validation of the incoming request can be customized by overriding one of several virtual methods in the *DefaultBackChannelLogoutService*. *GetTokenValidationParameters* allows you to specify the *[TokenValidationParameters](https://learn.microsoft.com/en-us/dotnet/API/microsoft.identitymodel.tokens.tokenvalidationparameters?view=azure-dotnet)* used to validate the incoming logout token. The default implementation creates token validation parameters based on the authentication scheme's configuration. Your override could begin by calling the base method and then make changes to those parameters or completely customize how token validation parameters are created. For example:
3637

3738
```csharp
38-
public class CustomizedBackchannelLogoutService : DefaultBackchannelLogoutService
39+
public class CustomizedBackChannelLogoutService : DefaultBackChannelLogoutService
3940
{
40-
protected override async Task<TokenValidationParameters> GetTokenValidationParameters()
41-
{
42-
var tokenValidationParams = await base.GetTokenValidationParameters();
43-
44-
// Set custom parameters here
45-
// For example, make clock skew more permissive than it is by default:
46-
tokenValidationParams.ClockSkew = TimeSpan.FromMinutes(15);
41+
protected override async Task<TokenValidationParameters> GetTokenValidationParameters()
42+
{
43+
var tokenValidationParams = await base.GetTokenValidationParameters();
44+
45+
// Set custom parameters here
46+
// For example, make clock skew more permissive than it is by default:
47+
tokenValidationParams.ClockSkew = TimeSpan.FromMinutes(15);
4748

48-
return tokenValidationParams;
49-
}
49+
return tokenValidationParams;
50+
}
51+
}
5052
```
5153
If you need more control over the validation of the logout token, you can override *ValidateJwt*. The default implementation of *ValidateJwt* validates the token and produces a *ClaimsIdentity* using a *[JsonWebTokenHandler](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/wiki/ValidatingTokens)* and the token validation parameters returned from *GetTokenValidationParameters*. Your override could call the base method and then manipulate this *ClaimsIdentity* or add a completely custom method for producing the *ClaimsIdentity* from the logout token.
5254

5355
*ValidateLogoutTokenAsync* is the coarsest-grained validation method. It is responsible for validating the incoming logout token and determining if logout should proceed, based on claims in the token. It returns a *ClaimsIdentity* if logout should proceed or null if it should not. Your override could prevent logout in certain circumstances by returning null. For example:
5456

5557
```csharp
56-
public class CustomizedBackchannelLogoutService : DefaultBackchannelLogoutService
58+
public class CustomizedBackChannelLogoutService : DefaultBackChannelLogoutService
5759
{
58-
protected override async Task<ClaimsIdentity?> ValidateLogoutTokenAsync(string logoutToken)
59-
{
60-
var identity = await base.ValidateLogoutTokenAsync(logoutToken);
61-
62-
// Perform custom logic here
63-
// For example, prevent logout based on certain conditions
64-
if(identity?.FindFirst("sub")?.Value == "12345")
65-
{
66-
return null;
67-
}
68-
else
60+
protected override async Task<ClaimsIdentity?> ValidateLogoutTokenAsync(string logoutToken)
6961
{
70-
return identity;
62+
var identity = await base.ValidateLogoutTokenAsync(logoutToken);
63+
64+
// Perform custom logic here
65+
// For example, prevent logout based on certain conditions
66+
if(identity?.FindFirst("sub")?.Value == "12345")
67+
{
68+
return null;
69+
}
70+
else
71+
{
72+
return identity;
73+
}
7174
}
72-
}
75+
}
7376
```
7477

7578
## Session Revocation
76-
The back-channel logout service will call the registered session revocation service to revoke the user session when it receives a valid logout token. To customize the revocation process, implement the *ISessionRevocationService*.
79+
The back-channel logout service will call the registered session revocation service to revoke the user session when it receives a valid logout token. To customize the revocation process, implement the *ISessionRevocationService*.

0 commit comments

Comments
 (0)