155Options = OptionsMonitor.Get(Scheme.Name);

25if (!Options.RequiredConnectionTypes.Any(connectionTypeFeature.ConnectionTypes.Contains)) 27return Task.FromResult(AuthenticateResult.Fail($"Connection types '{string.Join(", ", Options.RequiredConnectionTypes)}' are not enabled on this connection."));

99protected virtual string ClaimsIssuer => Options.ClaimsIssuer ?? Scheme.Name; 157TimeProvider = Options.TimeProvider ?? TimeProvider.System; 171Events = Options.Events; 172if (Options.EventsType != null) 174Events = Context.RequestServices.GetRequiredService(Options.EventsType); 206var target = scheme ?? Options.ForwardDefaultSelector?.Invoke(Context) ?? Options.ForwardDefault; 217var target = ResolveTarget(Options.ForwardAuthenticate); 308var target = ResolveTarget(Options.ForwardChallenge); 323var target = ResolveTarget(Options.ForwardForbid);

29protected string? SignInScheme => Options.SignInScheme; 70=> Task.FromResult(Options.CallbackPath == Request.Path); 122var errorContext = new RemoteFailureContext(Context, Scheme, Options, exception) 152var ticketContext = new TicketReceivedContext(Context, Scheme, Options, ticket) 240var cookieOptions = Options.CorrelationCookie.Build(Context, TimeProvider.GetUtcNow()); 244var cookieName = Options.CorrelationCookie.Name + correlationId; 261Logger.CorrelationPropertyNotFound(Options.CorrelationCookie.Name!); 267var cookieName = Options.CorrelationCookie.Name + correlationId; 276var cookieOptions = Options.CorrelationCookie.Build(Context, TimeProvider.GetUtcNow()); 297var context = new AccessDeniedContext(Context, Scheme, Options) 299AccessDeniedPath = Options.AccessDeniedPath, 302ReturnUrlParameter = Options.ReturnUrlParameter

40var target = ResolveTarget(Options.ForwardSignIn);

39var target = ResolveTarget(Options.ForwardSignOut);

27var messageReceivedContext = new MessageReceivedContext(Context, Scheme, Options); 43var ticket = Options.BearerTokenProtector.Unprotect(token); 69properties.ExpiresUtc = utcNow + Options.BearerTokenExpiration; 73AccessToken = Options.BearerTokenProtector.Protect(CreateBearerTicket(user, properties)), 74ExpiresIn = (long)Options.BearerTokenExpiration.TotalSeconds, 75RefreshToken = Options.RefreshTokenProtector.Protect(CreateRefreshTicket(user, utcNow)), 110ExpiresUtc = utcNow + Options.RefreshTokenExpiration

109var authenticationFailedContext = new CertificateAuthenticationFailedContext(Context, Scheme, Options) 125!Options.AllowedCertificateTypes.HasFlag(CertificateTypes.SelfSigned)) 134!Options.AllowedCertificateTypes.HasFlag(CertificateTypes.Chained)) 172var certificateValidatedContext = new CertificateValidatedContext(Context, Scheme, Options) 191var authenticationChallengedContext = new CertificateChallengeContext(Context, Scheme, Options, properties); 207X509RevocationFlag revocationFlag = Options.RevocationFlag; 208X509RevocationMode revocationMode = Options.RevocationMode; 223if (Options.ValidateCertificateUse) 236if (Options.CustomTrustStore != null) 238chainPolicy.CustomTrustStore.AddRange(Options.CustomTrustStore); 241chainPolicy.TrustMode = Options.ChainTrustValidationMode; 244chainPolicy.ExtraStore.AddRange(Options.AdditionalChainCertificates); 246if (!Options.ValidateValidityPeriod) 259claims.Add(new Claim("issuer", issuer, ClaimValueTypes.String, Options.ClaimsIssuer)); 262claims.Add(new Claim(ClaimTypes.Thumbprint, thumbprint, ClaimValueTypes.Base64Binary, Options.ClaimsIssuer)); 267claims.Add(new Claim(ClaimTypes.X500DistinguishedName, value, ClaimValueTypes.String, Options.ClaimsIssuer)); 273claims.Add(new Claim(ClaimTypes.SerialNumber, value, ClaimValueTypes.String, Options.ClaimsIssuer)); 279claims.Add(new Claim(ClaimTypes.Dns, value, ClaimValueTypes.String, Options.ClaimsIssuer)); 285claims.Add(new Claim(ClaimTypes.Name, value, ClaimValueTypes.String, Options.ClaimsIssuer)); 291claims.Add(new Claim(ClaimTypes.Email, value, ClaimValueTypes.String, Options.ClaimsIssuer)); 297claims.Add(new Claim(ClaimTypes.Upn, value, ClaimValueTypes.String, Options.ClaimsIssuer)); 303claims.Add(new Claim(ClaimTypes.Uri, value, ClaimValueTypes.String, Options.ClaimsIssuer));

99if (issuedUtc != null && expiresUtc != null && Options.SlidingExpiration && allowRefresh) 104var eventContext = new CookieSlidingExpirationContext(Context, Scheme, Options, ticket, timeElapsed, timeRemaining) 153var cookie = Options.CookieManager.GetRequestCookie(Context, Options.Cookie.Name!); 159var ticket = Options.TicketDataFormat.Unprotect(cookie, GetTlsTokenBinding()); 165if (Options.SessionStore != null) 173ticket = await Options.SessionStore.RetrieveAsync(claim.Value, Context, Context.RequestAborted); 186if (Options.SessionStore != null) 188await Options.SessionStore.RemoveAsync(_sessionKey!, Context, Context.RequestAborted); 214var context = new CookieValidatePrincipalContext(Context, Scheme, Options, result.Ticket); 232var cookieOptions = Options.Cookie.Build(Context); 263if (Options.SessionStore != null && _sessionKey != null) 265await Options.SessionStore.RenewAsync(_sessionKey, ticket, Context, Context.RequestAborted); 268new[] { new Claim(SessionIdClaim, _sessionKey, ClaimValueTypes.String, Options.ClaimsIssuer) }, 273var cookieValue = Options.TicketDataFormat.Protect(ticket, GetTlsTokenBinding()); 281Options.CookieManager.AppendResponseCookie( 283Options.Cookie.Name!, 307Options, 325signInContext.Properties.ExpiresUtc = issuedUtc.Add(Options.ExpireTimeSpan); 332var expiresUtc = signInContext.Properties.ExpiresUtc ?? issuedUtc.Add(Options.ExpireTimeSpan); 338if (Options.SessionStore != null) 343await Options.SessionStore.RenewAsync(_sessionKey, ticket, Context, Context.RequestAborted); 347_sessionKey = await Options.SessionStore.StoreAsync(ticket, Context, Context.RequestAborted); 352new[] { new Claim(SessionIdClaim, _sessionKey, ClaimValueTypes.String, Options.ClaimsIssuer) }, 353Options.ClaimsIssuer)); 357var cookieValue = Options.TicketDataFormat.Protect(ticket, GetTlsTokenBinding()); 359Options.CookieManager.AppendResponseCookie( 361Options.Cookie.Name!, 370Options); 375var shouldHonorReturnUrlParameter = Options.LoginPath.HasValue && OriginalPath == Options.LoginPath; 391if (Options.SessionStore != null && _sessionKey != null) 393await Options.SessionStore.RemoveAsync(_sessionKey, Context, Context.RequestAborted); 404Options, 410Options.CookieManager.DeleteCookie( 412Options.Cookie.Name!, 416var shouldHonorReturnUrlParameter = Options.LogoutPath.HasValue && OriginalPath == Options.LogoutPath; 439redirectUri = Request.Query[Options.ReturnUrlParameter]; 449new RedirectContext<CookieAuthenticationOptions>(Context, Scheme, Options, properties, redirectUri)); 467var accessDeniedUri = Options.AccessDeniedPath + QueryString.Create(Options.ReturnUrlParameter, returnUrl); 468var redirectContext = new RedirectContext<CookieAuthenticationOptions>(Context, Scheme, Options, properties, BuildRedirectUri(accessDeniedUri)); 481var loginUri = Options.LoginPath + QueryString.Create(Options.ReturnUrlParameter, redirectUri); 482var redirectContext = new RedirectContext<CookieAuthenticationOptions>(Context, Scheme, Options, properties, BuildRedirectUri(loginUri));

71if (Request.Path.Equals(Options.RegistrationPath)) 77if (Request.Path.Equals(Options.RefreshPath)) 109var authResult = await Context.AuthenticateAsync(Options.RegistrationSourceScheme); 147await Context.SignInAsync(Options.RefreshScheme, principal, refreshProperties); 154ExpiresUtc = now.Add(Options.ShortLivedCookieExpiration), 157await Context.SignInAsync(Options.SessionScheme, principal, sessionProperties); 163await Context.SignOutAsync(Options.RegistrationSourceScheme); 187var authResult = await Context.AuthenticateAsync(Options.RefreshScheme); 259ExpiresUtc = now.Add(Options.ShortLivedCookieExpiration), 262await Context.SignInAsync(Options.SessionScheme, authResult.Principal, sessionProperties); 282var scopeRules = Options.ScopeSpecifications.Select(r => new SessionScopeRule 296$"The session cookie scheme '{Options.SessionScheme}' has no configured cookie name; cannot build a valid DBSC session instruction."); 301RefreshUrl = Request.PathBase.Add(Options.RefreshPath).ToUriComponent(), 305IncludeSite = Options.IncludeSite, 316AllowedRefreshInitiators = [.. Options.AllowedRefreshInitiators], 322if (Options.SessionScheme is null) 328return _cookieOptionsMonitor.Get(Options.SessionScheme); 355=> _challengeProtector.GenerateRegistrationChallenge(principal, Options.ChallengeMaxAge); 361=> _challengeProtector.GenerateRefreshChallenge(principal, sessionId, Options.ChallengeMaxAge);

42var endpoint = QueryHelpers.AddQueryString(Options.UserInformationEndpoint, "access_token", tokens.AccessToken!); 43if (Options.SendAppSecretProof) 47if (Options.Fields.Count > 0) 49endpoint = QueryHelpers.AddQueryString(endpoint, "fields", string.Join(",", Options.Fields)); 60var context = new OAuthCreatingTicketContext(new ClaimsPrincipal(identity), properties, Context, Scheme, Options, Backchannel, tokens, payload.RootElement); 69var key = Encoding.ASCII.GetBytes(Options.AppSecret);

47var request = new HttpRequestMessage(HttpMethod.Get, Options.UserInformationEndpoint); 58var context = new OAuthCreatingTicketContext(new ClaimsPrincipal(identity), properties, Context, Scheme, Options, Backchannel, tokens, payload.RootElement); 74SetQueryParam(queryStrings, properties, GoogleChallengeProperties.ScopeKey, FormatScope, Options.Scope); 75SetQueryParam(queryStrings, properties, GoogleChallengeProperties.AccessTypeKey, Options.AccessType); 82queryStrings["state"] = Options.StateDataFormat.Protect(properties); 84return QueryHelpers.AddQueryString(Options.AuthorizationEndpoint, queryStrings);

62var messageReceivedContext = new MessageReceivedContext(Context, Scheme, Options); 101if (!Options.UseSecurityTokenValidators) 103foreach (var tokenHandler in Options.TokenHandlers) 130foreach (var validator in Options.SecurityTokenValidators) 153var tokenValidatedContext = new TokenValidatedContext(Context, Scheme, Options) 168if (Options.SaveToken) 182var authenticationFailedContext = new AuthenticationFailedContext(Context, Scheme, Options) 196if (!Options.UseSecurityTokenValidators) 207var authenticationFailedContext = new AuthenticationFailedContext(Context, Scheme, Options) 232if (Options.RefreshOnIssuerKeyNotFound && Options.ConfigurationManager != null 235Options.ConfigurationManager.RequestRefresh(); 242var tokenValidationParameters = Options.TokenValidationParameters.Clone(); 244if (Options.ConfigurationManager is BaseConfigurationManager baseConfigurationManager) 250if (Options.ConfigurationManager != null) 253var configuration = await Options.ConfigurationManager.GetConfigurationAsync(Context.RequestAborted); 278var eventContext = new JwtBearerChallengeContext(Context, Scheme, Options, properties) 284if (Options.IncludeErrorDetails && eventContext.AuthenticateFailure != null) 302Response.Headers.Append(HeaderNames.WWWAuthenticate, Options.Challenge); 308var builder = new StringBuilder(Options.Challenge); 309if (Options.Challenge.IndexOf(' ') > 0) 351var forbiddenContext = new ForbiddenContext(Context, Scheme, Options);

43var request = new HttpRequestMessage(HttpMethod.Get, Options.UserInformationEndpoint); 54var context = new OAuthCreatingTicketContext(new ClaimsPrincipal(identity), properties, Context, Scheme, Options, Backchannel, tokens, payload.RootElement); 66{ "client_id", Options.ClientId }, 71AddQueryString(queryStrings, properties, MicrosoftChallengeProperties.ScopeKey, FormatScope, Options.Scope); 79if (Options.UsePkce) 95var state = Options.StateDataFormat.Protect(properties); 98return QueryHelpers.AddQueryString(Options.AuthorizationEndpoint, queryStrings!);

77if (_requestProcessed || Options.DeferToServer) 134_negotiateState ??= Options.StateFactory.CreateInstance(GetChannelBindingToken()); 204if (_negotiateState.Protocol == "NTLM" && !Options.PersistNtlmCredentials) 217if (Options.PersistKerberosCredentials) 268var errorContext = new AuthenticationFailedContext(Context, Scheme, Options) { Exception = ex }; 337if (Options.LdapSettings.EnableLdapClaimResolution) 339var ldapContext = new LdapContext(Context, Scheme, Options, Options.LdapSettings) 353authenticatedContext = new AuthenticatedContext(Context, Scheme, Options) 360authenticatedContext = new AuthenticatedContext(Context, Scheme, Options) 386var eventContext = new ChallengeContext(Context, Scheme, Options, properties);

28protected HttpClient Backchannel => Options.Backchannel; 69var properties = Options.StateDataFormat.Unprotect(state); 133var codeExchangeContext = new OAuthCodeExchangeContext(properties, code.ToString(), BuildRedirectUri(Options.CallbackPath)); 148if (Options.SaveTokens) 202{ "client_id", Options.ClientId }, 204{ "client_secret", Options.ClientSecret }, 218var requestMessage = new HttpRequestMessage(HttpMethod.Post, Options.TokenEndpoint); 256var context = new OAuthCreatingTicketContext(new ClaimsPrincipal(identity), properties, Context, Scheme, Options, Backchannel, tokens, user.RootElement); 273var authorizationEndpoint = BuildChallengeUrl(properties, BuildRedirectUri(Options.CallbackPath)); 275Context, Scheme, Options, 307{ "client_id", Options.ClientId }, 313if (Options.UsePkce) 329parameters["state"] = Options.StateDataFormat.Protect(properties); 331foreach (var additionalParameter in Options.AdditionalAuthorizationParameters) 336return QueryHelpers.AddQueryString(Options.AuthorizationEndpoint, parameters!); 353=> FormatScope(Options.Scope);

41protected HttpClient Backchannel => Options.Backchannel; 95if (Options.RemoteSignOutPath.HasValue && Options.RemoteSignOutPath == Request.Path) 99else if (Options.SignedOutCallbackPath.HasValue && Options.SignedOutCallbackPath == Request.Path) 140var remoteSignOutContext = new RemoteSignOutContext(Context, Scheme, Options, message); 170var principal = (await Context.AuthenticateAsync(Options.SignOutScheme))?.Principal; 209await Context.SignOutAsync(Options.SignOutScheme); 219var target = ResolveTarget(Options.ForwardSignOut); 230if (_configuration == null && Options.ConfigurationManager != null) 232_configuration = await Options.ConfigurationManager.GetConfigurationAsync(Context.RequestAborted); 237EnableTelemetryParameters = !Options.DisableTelemetry, 241PostLogoutRedirectUri = BuildRedirectUriIfRelative(Options.SignedOutCallbackPath) 247properties.RedirectUri = BuildRedirectUriIfRelative(Options.SignedOutRedirectUri); 256message.IdTokenHint = await Context.GetTokenAsync(Options.SignOutScheme, OpenIdConnectParameterNames.IdToken); 258var redirectContext = new RedirectContext(Context, Scheme, Options, properties) 277message.State = Options.StateDataFormat.Protect(properties); 284if (Options.AuthenticationMethod == OpenIdConnectRedirectBehavior.RedirectGet) 294else if (Options.AuthenticationMethod == OpenIdConnectRedirectBehavior.FormPost) 311throw new NotImplementedException($"An unsupported authentication method has been configured: {Options.AuthenticationMethod}"); 331properties = Options.StateDataFormat.Unprotect(message.State); 334var signOut = new RemoteSignOutContext(Context, Scheme, Options, message) 402if (_configuration == null && Options.ConfigurationManager != null) 404_configuration = await Options.ConfigurationManager.GetConfigurationAsync(Context.RequestAborted); 409ClientId = Options.ClientId, 410EnableTelemetryParameters = !Options.DisableTelemetry, 412RedirectUri = BuildRedirectUri(Options.CallbackPath), 413Resource = Options.Resource, 414ResponseType = Options.ResponseType, 415Prompt = properties.GetParameter<string>(OpenIdConnectParameterNames.Prompt) ?? Options.Prompt, 416Scope = string.Join(" ", properties.GetParameter<ICollection<string>>(OpenIdConnectParameterNames.Scope) ?? Options.Scope), 420if (Options.UsePkce && Options.ResponseType == OpenIdConnectResponseType.Code) 438var maxAge = properties.GetParameter<TimeSpan?>(OpenIdConnectParameterNames.MaxAge) ?? Options.MaxAge; 448if (!string.Equals(Options.ResponseType, OpenIdConnectResponseType.Code, StringComparison.Ordinal) || 449!string.Equals(Options.ResponseMode, OpenIdConnectResponseMode.Query, StringComparison.Ordinal)) 451message.ResponseMode = Options.ResponseMode; 454if (Options.ProtocolValidator.RequireNonce) 456message.Nonce = Options.ProtocolValidator.GenerateNonce(); 462foreach (var additionalParameter in Options.AdditionalAuthorizationParameters) 467var redirectContext = new RedirectContext(Context, Scheme, Options, properties) 489message.State = Options.StateDataFormat.Protect(properties); 499switch (Options.PushedAuthorizationBehavior) 530if (Options.AuthenticationMethod == OpenIdConnectRedirectBehavior.RedirectGet) 541else if (Options.AuthenticationMethod == OpenIdConnectRedirectBehavior.FormPost) 558throw new NotImplementedException($"An unsupported authentication method has been configured: {Options.AuthenticationMethod}"); 567var context = new PushedAuthorizationContext(Context, Scheme, Options, parRequest, properties); 578if (!string.IsNullOrEmpty(Options.ClientSecret)) 580parRequest.Parameters.Add(OpenIdConnectParameterNames.ClientSecret, Options.ClientSecret); 609authorizeRequest.Parameters.Add("client_id", Options.ClientId); 656if (Options.SkipUnrecognizedRequests) 681if (Options.SkipUnrecognizedRequests) 709if (Options.SkipUnrecognizedRequests) 722if (Options.SkipUnrecognizedRequests) 757if (_configuration == null && Options.ConfigurationManager != null) 760_configuration = await Options.ConfigurationManager.GetConfigurationAsync(Context.RequestAborted); 768var validationParameters = Options.TokenValidationParameters.Clone(); 775if (!Options.UseSecurityTokenValidator) 804Options.ProtocolValidator.ValidateAuthenticationResponse(new OpenIdConnectProtocolValidationContext() 806ClientId = Options.ClientId, 856if (!Options.UseSecurityTokenValidator) 901Options.ProtocolValidator.ValidateTokenResponse(new OpenIdConnectProtocolValidationContext() 903ClientId = Options.ClientId, 911if (Options.SaveTokens) 916if (Options.GetClaimsFromUserInfoEndpoint) 925foreach (var action in Options.ClaimActions) 939if (Options.RefreshOnIssuerKeyNotFound && exception is SecurityTokenSignatureKeyNotFoundException) 941if (Options.ConfigurationManager != null) 944Options.ConfigurationManager.RequestRefresh(); 963properties = Options.StateDataFormat.Unprotect(message.State); 1097Options.ProtocolValidator.ValidateUserInfoResponse(new OpenIdConnectProtocolValidationContext() 1105foreach (var action in Options.ClaimActions) 1168var cookieOptions = Options.NonceCookie.Build(Context, TimeProvider.GetUtcNow()); 1172Options.NonceCookie.Name + Options.StringDataFormat.Protect(nonce), 1193if (Options.NonceCookie.Name is string name && nonceKey.StartsWith(name, StringComparison.Ordinal)) 1197var nonceDecodedValue = Options.StringDataFormat.Unprotect(nonceKey.Substring(Options.NonceCookie.Name.Length, nonceKey.Length - Options.NonceCookie.Name.Length)); 1200var cookieOptions = Options.NonceCookie.Build(Context, TimeProvider.GetUtcNow()); 1218var context = new MessageReceivedContext(Context, Scheme, Options, properties) 1241var context = new TokenValidatedContext(Context, Scheme, Options, user, properties) 1271ClientId = Options.ClientId, 1272ClientSecret = Options.ClientSecret, 1275EnableTelemetryParameters = !Options.DisableTelemetry, 1286var context = new AuthorizationCodeReceivedContext(Context, Scheme, Options, properties) 1318var context = new TokenResponseReceivedContext(Context, Scheme, Options, user, properties) 1344var context = new UserInformationReceivedContext(Context, Scheme, Options, principal, properties) 1368var context = new AuthenticationFailedContext(Context, Scheme, Options) 1394if (!Options.SecurityTokenValidator.CanReadToken(idToken)) 1411var principal = Options.SecurityTokenValidator.ValidateToken(idToken, validationParameters, out SecurityToken validatedToken); 1429if (Options.UseTokenLifetime) 1450if (Options.ConfigurationManager is BaseConfigurationManager baseConfigurationManager) 1463var validationResult = await Options.TokenHandler.ValidateTokenAsync(idToken, validationParameters); 1484if (Options.UseTokenLifetime)

25private HttpClient Backchannel => Options.Backchannel; 61var protectedRequestToken = Request.Cookies[Options.StateCookie.Name!]; 63var requestToken = Options.StateDataFormat.Unprotect(protectedRequestToken); 101var cookieOptions = Options.StateCookie.Build(Context, TimeProvider.GetUtcNow()); 103Response.Cookies.Delete(Options.StateCookie.Name!, cookieOptions); 117if (Options.RetrieveUserDetails) 128if (Options.SaveTokens) 152foreach (var action in Options.ClaimActions) 157var context = new TwitterCreatingTicketContext(Context, Scheme, Options, new ClaimsPrincipal(identity), properties, token.UserId, token.ScreenName, token.Token, token.TokenSecret, user); 172var requestToken = await ObtainRequestTokenAsync(BuildRedirectUri(Options.CallbackPath), properties); 175var cookieOptions = Options.StateCookie.Build(Context, TimeProvider.GetUtcNow()); 178Response.Cookies.Append(Options.StateCookie.Name!, Options.StateDataFormat.Protect(requestToken), cookieOptions); 180var redirectContext = new RedirectContext<TwitterOptions>(Context, Scheme, Options, properties, twitterAuthenticationEndpoint); 188{ "oauth_consumer_key", Options.ConsumerKey! }, 231var signature = ComputeSignature(Options.ConsumerSecret!, accessToken?.TokenSecret, stringBuilder.ToString());

70if (Options.RemoteSignOutPath.HasValue && Options.RemoteSignOutPath == Request.Path && HttpMethods.IsGet(Request.Method) 89_configuration = await Options.ConfigurationManager.GetConfigurationAsync(Context.RequestAborted); 101Wtrealm = Options.Wtrealm, 105if (!string.IsNullOrEmpty(Options.Wreply)) 107wsFederationMessage.Wreply = Options.Wreply; 111wsFederationMessage.Wreply = BuildRedirectUri(Options.CallbackPath); 116var redirectContext = new RedirectContext(Context, Scheme, Options, properties) 134wsFederationMessage.Wctx = Uri.EscapeDataString(Options.StateDataFormat.Protect(properties)); 170if (Options.SkipUnrecognizedRequests) 185properties = Options.StateDataFormat.Unprotect(state); 189if (!Options.AllowUnsolicitedLogins) 201var messageReceivedContext = new MessageReceivedContext(Context, Scheme, Options, properties) 233var securityTokenReceivedContext = new SecurityTokenReceivedContext(Context, Scheme, Options, properties) 248if (!Options.UseSecurityTokenHandlers) 250foreach (var tokenHandler in Options.TokenHandlers) 281foreach (var validator in Options.SecurityTokenHandlers) 317if (Options.UseTokenLifetime && validatedToken != null) 333var securityTokenValidatedContext = new SecurityTokenValidatedContext(Context, Scheme, Options, principal, properties) 356var authenticationFailedContext = new AuthenticationFailedContext(Context, Scheme, Options) 375var tokenValidationParameters = Options.TokenValidationParameters.Clone(); 377if (Options.ConfigurationManager is BaseConfigurationManager baseConfigurationManager) 383if (Options.ConfigurationManager != null) 386_configuration = await Options.ConfigurationManager.GetConfigurationAsync(Context.RequestAborted); 401if (Options.RefreshOnIssuerKeyNotFound && exception is SecurityTokenSignatureKeyNotFoundException) 403Options.ConfigurationManager.RequestRefresh(); 413var target = ResolveTarget(Options.ForwardSignOut); 422_configuration = await Options.ConfigurationManager.GetConfigurationAsync(Context.RequestAborted); 428Wtrealm = Options.Wtrealm, 440else if (!string.IsNullOrEmpty(Options.SignOutWreply)) 442wsFederationMessage.Wreply = BuildRedirectUriIfRelative(Options.SignOutWreply); 444else if (!string.IsNullOrEmpty(Options.Wreply)) 446wsFederationMessage.Wreply = BuildRedirectUriIfRelative(Options.Wreply); 449var redirectContext = new RedirectContext(Context, Scheme, Options, properties) 477var remoteSignOutContext = new RemoteSignOutContext(Context, Scheme, Options, message); 496await Context.SignOutAsync(Options.SignOutScheme);