Skip to content

Commit aab04d7

Browse files
maartenbamaartenba
committed
Refactor options tables in IdentityServer documentation for improved readability and consistency.
1 parent 1ca46d3 commit aab04d7

3 files changed

Lines changed: 140 additions & 54 deletions

File tree

‎astro/src/content/docs/identityserver/diagnostics/conformance-report.md‎

Lines changed: 23 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -59,16 +59,29 @@ The endpoint requires an authenticated user by default (see [Authorization](#aut
5959

6060
`ConformanceReportOptions` controls the conformance report feature:
6161

62-
| Property | Type | Default | Description |
63-
| ------------------------------- | ------------------------------------- | --------------------------- | ---------------------------------------------------------------- |
64-
| `Enabled` | `bool` | `false` | Enable or disable the conformance report endpoint. |
65-
| `EnableOAuth21Assessment` | `bool` | `true` | Include OAuth 2.1 profile assessment in the report. |
66-
| `EnableFapi2SecurityAssessment` | `bool` | `true` | Include FAPI 2.0 Security Profile assessment in the report. |
67-
| `PathPrefix` | `string` | `"_duende"` | URL path prefix for the conformance endpoint (no leading slash). |
68-
| `ConfigureAuthorization` | `Action<AuthorizationPolicyBuilder>?` | Requires authenticated user | Authorization policy for the HTML report endpoint. |
69-
| `AuthorizationPolicyName` | `string` | `"ConformanceReport"` | ASP.NET Core authorization policy name used internally. |
70-
| `HostCompanyName` | `string?` | `null` | Optional company name shown in the report header. |
71-
| `HostCompanyLogoUrl` | `Uri?` | `null` | Optional company logo URL shown in the report header. |
62+
* **`Enabled`**
63+
Enable or disable the conformance report endpoint. Defaults to `false`.
64+
65+
* **`EnableOAuth21Assessment`**
66+
Include OAuth 2.1 profile assessment in the report. Defaults to `true`.
67+
68+
* **`EnableFapi2SecurityAssessment`**
69+
Include FAPI 2.0 Security Profile assessment in the report. Defaults to `true`.
70+
71+
* **`PathPrefix`**
72+
URL path prefix for the conformance endpoint (no leading slash). Defaults to `"_duende"`.
73+
74+
* **`ConfigureAuthorization`**
75+
Authorization policy for the HTML report endpoint. Defaults to require an authenticated user.
76+
77+
* **`AuthorizationPolicyName`**
78+
ASP.NET Core authorization policy name used internally. Defaults to `"ConformanceReport"`.
79+
80+
* **`HostCompanyName`**
81+
Optional company name shown in the report header. Defaults to `null`.
82+
83+
* **`HostCompanyLogoUrl`**
84+
Optional company logo URL shown in the report header. Defaults to `null`.
7285

7386
## Authorization
7487

‎astro/src/content/docs/identityserver/saml/configuration.md‎

Lines changed: 112 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -40,19 +40,40 @@ builder.Services.AddIdentityServer(options =>
4040
});
4141
```
4242

43-
| Property | Type | Default | Description |
44-
| ------------------------------------------ | ------------------------------------ | ----------------------------------------- | -------------------------------------------------------------------- |
45-
| `MetadataValidityDuration` | `TimeSpan?` | 7 days | If set, the metadata document includes a `validUntil` attribute. |
46-
| `WantAuthnRequestsSigned` | `bool` | `false` | When `true`, the IdP requires all AuthnRequests to be signed. |
47-
| `DefaultAttributeNameFormat` | `string` | `uri` | Default SAML attribute name format URI for attributes in assertions. |
48-
| `DefaultPersistentNameIdentifierClaimType` | `string` | `ClaimTypes.NameIdentifier` | Claim type used to resolve a persistent NameID value. |
49-
| `DefaultClaimMappings` | `ReadOnlyDictionary<string, string>` | (see below) | Maps OIDC claim types to SAML attribute names. |
50-
| `SupportedNameIdFormats` | `Collection<string>` | Email, Persistent, Transient, Unspecified | NameID formats advertised in metadata. |
51-
| `DefaultClockSkew` | `TimeSpan` | 5 minutes | Clock skew tolerance for validating SAML message timestamps. |
52-
| `DefaultRequestMaxAge` | `TimeSpan` | 5 minutes | Maximum age for SAML AuthnRequests. |
53-
| `DefaultSigningBehavior` | `SamlSigningBehavior` | `SignAssertion` | Default signing behavior for SAML responses. |
54-
| `MaxRelayStateLength` | `int` | 80 | Maximum length (in UTF-8 bytes) of the RelayState parameter. |
55-
| `UserInteraction` | `SamlUserInteractionOptions` | (see below) | Configures SAML endpoint paths. |
43+
Available options:
44+
45+
* **`MetadataValidityDuration`**
46+
If set, the metadata document includes a `validUntil` attribute. Defaults to 7 days.
47+
48+
* **`WantAuthnRequestsSigned`**
49+
When `true`, the IdP requires all AuthnRequests to be signed. Defaults to `false`.
50+
51+
* **`DefaultAttributeNameFormat`**
52+
Default SAML attribute name format URI for attributes in assertions. Defaults to `uri`.
53+
54+
* **`DefaultPersistentNameIdentifierClaimType`**
55+
Claim type used to resolve a persistent NameID value. Defaults to `ClaimTypes.NameIdentifier`.
56+
57+
* **`DefaultClaimMappings`**
58+
Maps OIDC claim types to SAML attribute names. See below.
59+
60+
* **`SupportedNameIdFormats`**
61+
Supported NameID formats for the IdP. Defaults to `[ Email, Persistent, Transient, Unspecified ]`.
62+
63+
* **`DefaultClockSkew`**
64+
Clock skew tolerance for validating SAML message timestamps. Defaults to 5 minutes.
65+
66+
* **`DefaultRequestMaxAge`**
67+
Maximum age for SAML AuthnRequests. Defaults to 5 minutes.
68+
69+
* **`DefaultSigningBehavior`**
70+
Default signing behavior for SAML responses. Defaults to `SignAssertion`.
71+
72+
* **`MaxRelayStateLength`**
73+
Maximum length (in UTF-8 bytes) of the RelayState parameter. Defaults to 80.
74+
75+
* **`UserInteraction`**
76+
Configures SAML endpoint paths. See below.
5677

5778
### Default Claim Mappings
5879

@@ -74,15 +95,26 @@ via `SamlOptions.DefaultClaimMappings` or per Service Provider via
7495
`SamlUserInteractionOptions` configures the URL paths for all SAML endpoints. All paths are
7596
relative to the application root.
7697

77-
| Property | Default | Description |
78-
| -------------------------- | ------------------ | -------------------------------------------------- |
79-
| `Route` | `/saml` | Base route prefix for all SAML endpoints. |
80-
| `Metadata` | `/metadata` | Path suffix for the metadata endpoint. |
81-
| `SignInPath` | `/signin` | Path suffix for the SP-initiated sign-in endpoint. |
82-
| `SignInCallbackPath` | `/signin_callback` | Path suffix for the sign-in callback endpoint. |
83-
| `IdpInitiatedPath` | `/idp-initiated` | Path suffix for the IdP-initiated SSO endpoint. |
84-
| `SingleLogoutPath` | `/logout` | Path suffix for the single logout endpoint. |
85-
| `SingleLogoutCallbackPath` | `/logout_callback` | Path suffix for the logout callback endpoint. |
98+
* **`Route`**
99+
Base route prefix for all SAML endpoints. Defaults to `/saml`.
100+
101+
* **`Metadata`**
102+
Path suffix for the metadata endpoint. Defaults to `/metadata`.
103+
104+
* **`SignInPath`**
105+
Path suffix for the SP-initiated sign-in endpoint. Defaults to `/signin`.
106+
107+
* **`SignInCallbackPath`**
108+
Path suffix for the sign-in callback endpoint. Defaults to `/signin_callback`.
109+
110+
* **`IdpInitiatedPath`**
111+
Path suffix for the IdP-initiated SSO endpoint. Defaults to `/idp-initiated`.
112+
113+
* **`SingleLogoutPath`**
114+
Path suffix for the single logout endpoint. Defaults to `/logout`.
115+
116+
* **`SingleLogoutCallbackPath`**
117+
Path suffix for the logout callback endpoint. Defaults to `/logout_callback`.
86118

87119
The full URL for each endpoint is formed by combining the base URL of the IdentityServer host with
88120
the `Route` prefix and the individual path suffix. For example, the metadata endpoint is available
@@ -92,27 +124,64 @@ at `https://your-idp.example.com/saml/metadata` by default.
92124

93125
`SamlServiceProvider` represents a registered SAML 2.0 Service Provider configuration.
94126

95-
| Property | Type | Default | Description |
96-
| ------------------------------------------ | -------------------------------- | -------------------- | ------------------------------------------------------------------------------------ |
97-
| `EntityId` | `string` | (required) | The SP's entity identifier URI, as declared in its SAML metadata. |
98-
| `DisplayName` | `string` | (required) | Human-readable name shown in logs and consent screens. |
99-
| `Description` | `string?` | `null` | Optional description. |
100-
| `Enabled` | `bool` | `true` | When `false`, all SAML requests from this SP are rejected. |
101-
| `ClockSkew` | `TimeSpan?` | `null` | Per-SP clock skew override. Uses `SamlOptions.DefaultClockSkew` when `null`. |
102-
| `RequestMaxAge` | `TimeSpan?` | `null` | Per-SP request maximum age. Uses `SamlOptions.DefaultRequestMaxAge` when `null`. |
103-
| `AssertionConsumerServiceUrls` | `ICollection<Uri>` | (required) | ACS URLs where SAML responses will be delivered. At least one is required. |
104-
| `AssertionConsumerServiceBinding` | `SamlBinding` | — | SAML binding for the ACS (`HttpPost` or `HttpRedirect`). |
105-
| `SingleLogoutServiceUrl` | `SamlEndpointType?` | `null` | SP's Single Logout Service endpoint. Required for SLO support. |
106-
| `RequireSignedAuthnRequests` | `bool` | `false` | When `true`, unsigned AuthnRequests from this SP are rejected. |
107-
| `SigningCertificates` | `ICollection<X509Certificate2>?` | `null` | Certificates used to verify SP-signed messages. |
108-
| `EncryptionCertificates` | `ICollection<X509Certificate2>?` | `null` | Certificates used to encrypt assertions for this SP. |
109-
| `EncryptAssertions` | `bool` | `false` | When `true`, assertions are encrypted using `EncryptionCertificates`. |
110-
| `RequireConsent` | `bool` | `false` | When `true`, the user is always shown a consent screen. |
111-
| `AllowIdpInitiated` | `bool` | `false` | When `true`, IdP-initiated SSO is allowed for this SP. |
112-
| `ClaimMappings` | `IDictionary<string, string>` | `{}` | Per-SP claim-to-attribute mappings that override `SamlOptions.DefaultClaimMappings`. |
113-
| `DefaultNameIdFormat` | `string?` | `urn:...unspecified` | Default NameID format to use when the SP does not specify one. |
114-
| `DefaultPersistentNameIdentifierClaimType` | `string?` | `null` | Per-SP override for the claim type used to resolve a persistent NameID. |
115-
| `SigningBehavior` | `SamlSigningBehavior?` | `null` | Per-SP signing behavior. Uses `SamlOptions.DefaultSigningBehavior` when `null`. |
127+
Available options:
128+
129+
* **`EntityId`**
130+
The SP's entity identifier URI, as declared in its SAML metadata. Required.
131+
132+
* **`DisplayName`**
133+
Human-readable name shown in logs and consent screens. Required.
134+
135+
* **`Description`**
136+
Optional description. Defaults to `null`.
137+
138+
* **`Enabled`**
139+
When `false`, all SAML requests from this SP are rejected. Defaults to `true`.
140+
141+
* **`ClockSkew`**
142+
Per-SP clock skew override. Uses `SamlOptions.DefaultClockSkew` when `null`. Defaults to `null`.
143+
144+
* **`RequestMaxAge`**
145+
Per-SP request maximum age. Uses `SamlOptions.DefaultRequestMaxAge` when `null`. Defaults to `null`.
146+
147+
* **`AssertionConsumerServiceUrls`**
148+
ACS URLs where SAML responses will be delivered. At least one is required.
149+
150+
* **`AssertionConsumerServiceBinding`**
151+
SAML binding for the ACS (`HttpPost` or `HttpRedirect`).
152+
153+
* **`SingleLogoutServiceUrl`**
154+
SP's Single Logout Service endpoint. Required for SLO support. Defaults to `null`.
155+
156+
* **`RequireSignedAuthnRequests`**
157+
When `true`, unsigned AuthnRequests from this SP are rejected. Defaults to `false`.
158+
159+
* **`SigningCertificates`**
160+
Certificates used to verify SP-signed messages. Defaults to `null`.
161+
162+
* **`EncryptionCertificates`**
163+
Certificates used to encrypt assertions for this SP. Defaults to `null`.
164+
165+
* **`EncryptAssertions`**
166+
When `true`, assertions are encrypted using `EncryptionCertificates`. Defaults to `false`.
167+
168+
* **`RequireConsent`**
169+
When `true`, the user is always shown a consent screen. Defaults to `false`.
170+
171+
* **`AllowIdpInitiated`**
172+
When `true`, IdP-initiated SSO is allowed for this SP. Defaults to `false`.
173+
174+
* **`ClaimMappings`**
175+
Per-SP claim-to-attribute mappings that override `SamlOptions.DefaultClaimMappings`. Defaults to `{}`.
176+
177+
* **`DefaultNameIdFormat`**
178+
Default NameID format to use when the SP does not specify one. Defaults to `urn:...unspecified`.
179+
180+
* **`DefaultPersistentNameIdentifierClaimType`**
181+
Per-SP override for the claim type used to resolve a persistent NameID. Defaults to `null`.
182+
183+
* **`SigningBehavior`**
184+
Per-SP signing behavior. Uses `SamlOptions.DefaultSigningBehavior` when `null`. Defaults to `null`.
116185

117186
## Enums
118187

‎astro/src/content/docs/identityserver/saml/extensibility.md‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,9 @@ date: 2026-03-02
55
sidebar:
66
label: Extensibility
77
order: 40
8+
tableOfContents:
9+
minHeadingLevel: 2
10+
maxHeadingLevel: 2
811
---
912

1013
<span data-shb-badge data-shb-badge-variant="default">Added in 8.0 (prerelease)</span>
@@ -77,7 +80,8 @@ flows.
7780
```csharp
7881
public interface ISamlInteractionService
7982
{
80-
Task<SamlAuthenticationRequest?> GetAuthenticationRequestContextAsync(CancellationToken ct = default);
83+
Task<SamlAuthenticationRequest?> GetAuthenticationRequestContextAsync(
84+
CancellationToken ct = default);
8185

8286
Task StoreRequestedAuthnContextResultAsync(
8387
bool requestedAuthnContextRequirementsWereMet,

0 commit comments

Comments
 (0)