[oleks9o6]

Description

Back-channel logout notifications sent by the expired session cleanup now get their issuer from the session, so they no longer need an HttpContext.

SessionCleanupService runs without a request. DefaultBackChannelLogoutService read the issuer from HttpContext, threw, and the cleanup caught and logged the exception, so the clients in that batch were never notified. The issuer is already stored with the session, so it now travels through EndUserSessionEventContext, LogoutNotificationContext and BackChannelLogoutRequest (the Issuer names match Duende). The token uses request.Issuer when it is set and falls back to the current request otherwise, so end session is unchanged. DefaultSessionManagementService.RemoveSessionsAsync passes the session issuer too, since it can also run outside a request.

Closes #134

Type of change

• Bug fix
• Feature
• Refactoring
• Documentation
• Other

Does this PR introduce a breaking change?

Does the change cause a breaking change to any of the following?

• Changes to existing public APIs or DB schema
• Changes which could cause existing behaviour to fail (eg. feature restrictions, changes to default values, stricter validation, etc)

Adds an Issuer property to LogoutNotificationContext, BackChannelLogoutRequest and EndUserSessionEventContext.

Testing

Unit tests cover each step the issuer passes through. A new integration test runs the expired session cleanup outside a request and checks the iss of the posted logout token; without the fix no token is posted. The existing end session tests cover the fallback. The full unit and integration suites pass.

LLM Usage

The src/ changes are written by me. The tests were drafted with Claude and reviewed by me.

Other context

Based on main, so it can go into a patch release without #140. #140 changes the same lines at the end of DefaultBackChannelLogoutService.CreateTokenAsync, so I'll update #140 once this is merged.

RemoveSessionsAsync called inside a request now uses the session's issuer rather than the current request's. They differ only when the session was created on another host or before IssuerUri changed, and then the session's issuer is the one the client knows.

🤖 Generated with Claude Code

[patchandthat]

@oleks9o6 The PR is marked as draft, is that accidental?

[oleks9o6]

@oleks9o6 The PR is marked as draft, is that accidental?

@patchandthat Not accidental: it builds on #140 and includes its three commits, so I kept it as a draft until #140 is merged. It’s ready otherwise.

[patchandthat]

As this is a bugfix and non-breaking, I'd like to do a patch release soon with this in (& other bugfixes) but not #140. Is it possible to reorder them?

[oleks9o6]

As this is a bugfix and non-breaking, I'd like to do a patch release soon with this in (& other bugfixes) but not #140. Is it possible to reorder them?

Sure, I'll do that.

[patchandthat]

Great, thank you.