Abblix.SecurityEvents.CAEP 2.4.0

Prefix Reserved
.NET 8.0 This package targets .NET 8.0. The package is compatible with this framework or higher. 
dotnet add package Abblix.SecurityEvents.CAEP --version 2.4.0
                    


                    

                
NuGet\Install-Package Abblix.SecurityEvents.CAEP -Version 2.4.0
This command is intended to be used within the Package Manager Console in Visual Studio, as it uses the NuGet module's version of Install-Package. 
<PackageReference Include="Abblix.SecurityEvents.CAEP" Version="2.4.0" />
For projects that support PackageReference, copy this XML node into the project file to reference the package. 
<PackageVersion Include="Abblix.SecurityEvents.CAEP" Version="2.4.0" />
                    


                            Directory.Packages.props
                        

                    

                
<PackageReference Include="Abblix.SecurityEvents.CAEP" />
                    


                            Project file
For projects that support Central Package Management (CPM), copy this XML node into the solution Directory.Packages.props file to version the package. 
paket add Abblix.SecurityEvents.CAEP --version 2.4.0
                    


                    

                
#r "nuget: Abblix.SecurityEvents.CAEP, 2.4.0"
#r directive can be used in F# Interactive and Polyglot Notebooks. Copy this into the interactive tool or source code of the script to reference the package. 
#:package Abblix.SecurityEvents.CAEP@2.4.0
#:package directive can be used in C# file-based apps starting in .NET 10 preview 4. Copy this into a .cs file before any lines of code to reference the package. 
#addin nuget:?package=Abblix.SecurityEvents.CAEP&version=2.4.0
                    


                            Install as a Cake Addin
                        

                    

                
#tool nuget:?package=Abblix.SecurityEvents.CAEP&version=2.4.0
                    


                            Install as a Cake Tool

Abblix.SecurityEvents.CAEP

The OpenID Continuous Access Evaluation Profile (CAEP) 1.0 event dictionary for Abblix.SecurityEvents: typed payload models and event type identifiers for the CAEP events, registered over the Security Events core in one call. CAEP is how cooperating services keep reacting to each other AFTER login - one provider revokes a session or sees a risk level shift, and every subscribed service learns of it without waiting for the next authentication.

Shared Signals in .NET: SSF, CAEP, RISC and Back-Channel Logout places this vocabulary in the stack: the envelope underneath it, the streams that carry it, and what a receiver does with a session event once it arrives.

Install

dotnet add package Abblix.SecurityEvents.CAEP

Events

Event Payload
session-revoked SessionRevokedPayload
token-claims-change TokenClaimsChangePayload
credential-change CredentialChangePayload
assurance-level-change AssuranceLevelChangePayload
device-compliance-change DeviceComplianceChangePayload
session-established SessionEstablishedPayload
session-presented SessionPresentedPayload
risk-level-change RiskLevelChangePayload

Every payload carries the common CAEP claims - the event timestamp, the initiating entity, and the localizable administrative and end-user reasons - on the shared CaepEventPayload base.

Receiving

services.AddSecurityEvents(options => options.Events.RegisterCaepEvents());

One call teaches the registry the whole dictionary; a validated SET's payloads then arrive as the typed models, and the sink pattern-matches:

if (token.EventPayloads?.GetValueOrDefault(CaepEventTypes.SessionRevoked) is SessionRevokedPayload revoked)
{
    // terminate the local session; revoked.ReasonUser carries the sentence to show
}

Transmitting

await dispatcher.DispatchAsync(new SecurityEventDescriptor
{
    EventType = CaepEventTypes.SessionRevoked,
    Subject = new ComplexSubject { Session = new OpaqueSubject(sessionId), User = userSubject },
    Payload = new SessionRevokedPayload
    {
        InitiatingEntity = CaepEventPayload.InitiatingEntities.Policy,
        ReasonAdmin = new Dictionary<string, string> { ["en"] = "Landspeed Policy Violation" },
        EventTimestamp = revokedAt,
    },
});

Claiming the interoperability profile

reason_admin is optional in CAEP 1.0 and required of a transmitter by the CAEP Interoperability Profile 1.0: each of the use cases in its Section 3 demands a non-empty object. The type cannot carry that rule, because the base specification permits the member's absence - Section 2 makes the common claims optional, Section 3.1.1 defines none of its own for session-revoked - so an empty payload is well-formed and a receiver has to be able to hold one.

So the rule is a policy a deployment registers, and registering it is how the deployment claims the profile:

services.AddSingleton<IEventPayloadPolicy, CaepInteropProfilePolicy>();

The dispatcher then refuses those events unless the member is populated, before anything is minted, and says which event and what is missing. A host that registers nothing emits CAEP 1.0 events, which is a smaller claim and a valid one.

The profile lets you claim fewer than three: "Support for all use cases listed herein is not required in order to be considered compliant with this profile. An implementation can choose specific use cases to support." Name the ones you claim and the others go out as plain CAEP 1.0 events:

services.AddSingleton<IEventPayloadPolicy>(
    new CaepInteropProfilePolicy(CaepEventTypes.CredentialChange));

One rule the policy applies is the base specification's rather than the profile's: reason_admin, once present, "MUST contain one or more key/value pairs" (CAEP 1.0 Section 2). It applies it only inside the use cases you claim, though - an unclaimed event carrying an empty object still goes out, because the policy is a statement about the profile and not a validator for CAEP 1.0.

Two things the policy does not reach. Naming a use case the profile does not define is refused when the policy is built, because a value it does not recognise would otherwise leave it registered, consulted and refusing nothing. And DispatchToStreamAsync is not judged at all: it carries the framework's own verification and stream-updated signals, and its callers write state before dispatching, so a refusal there would fault mid-operation.

Part of the Abblix product family

The events themselves travel over the Abblix.SharedSignals transmitter and receiver; the sibling dictionary for account risk incidents is Abblix.SecurityEvents.RISC, and both compose on one registry.

License

Abblix.SecurityEvents.CAEP is licensed under the Apache License 2.0.

Contacts

Product Compatible and additional computed target framework versions.
.NET net8.0 is compatible.  net8.0-android was computed.  net8.0-browser was computed.  net8.0-ios was computed.  net8.0-maccatalyst was computed.  net8.0-macos was computed.  net8.0-tvos was computed.  net8.0-windows was computed.  net9.0 is compatible.  net9.0-android was computed.  net9.0-browser was computed.  net9.0-ios was computed.  net9.0-maccatalyst was computed.  net9.0-macos was computed.  net9.0-tvos was computed.  net9.0-windows was computed.  net10.0 is compatible.  net10.0-android was computed.  net10.0-browser was computed.  net10.0-ios was computed.  net10.0-maccatalyst was computed.  net10.0-macos was computed.  net10.0-tvos was computed.  net10.0-windows was computed. 
Compatible target framework(s)
Included target framework(s) (in package)
Learn more about Target Frameworks and .NET Standard.

NuGet packages (1)

Showing the top 1 NuGet packages that depend on Abblix.SecurityEvents.CAEP:

Package Downloads
Abblix.SecurityEvents.RISC

OpenID RISC 1.0 (Risk Incident Sharing and Coordination) event dictionary for .NET: typed models for credential compromise, account disabled, enabled and purged, identifier changed and recycled, opt-out and recovery events, over Abblix Security Events.

GitHub repositories

This package is not used by any popular GitHub repositories.

Version Downloads Last Updated
2.4.0 66 9/5/2026

The events of the Continuous Access Evaluation Profile as typed payloads with their registered event type identifiers, so a transmitter emits and a receiver handles a session revocation or a credential change without hand-writing claim names. Registered over the Security Events core in one call; the same models serve a Shared Signals transmitter and receiver. Full details: https://github.com/Abblix/Oidc.Server/releases/tag/v2.4