IdentityServer4 + ASP.Net Core Identity 从客户端注销不会在 ID4 上注销

Question

I have I am using ID4 for OIDC and ASP.Net Core Identity to manage the user membership. Razor with Pagemodel. I have a test client that properly logs in with SSO. On logout , it log outs of the client OK, but does not logout from the ID4 server.

On Logout, the client redirects to my ID4 server using the end session url. It does have hint token. The ID4 server does show the logout page, but it still is logged in. I suspect the problem is that I am using scafolded ASP.Net Identity pages for login/logout.

Manually clicking on the logout button on the ID4 server works as expected. The user is logged on on the server and on the client.

I am able to get it to work by redirecting to the ASP.Net Core Indentity logout page and have the OnGet method call _signInManager.SignOutAsync(). But this seems like a poor solution to me.

Reading the ID4 docs, spec and many github and SO posts, I have the following logout code on my client:

var id_token = (await HttpContext.AuthenticateAsync()).Properties.Items[".Token.id_token"];

await HttpContext.SignOutAsync("Cookies");
await HttpContext.SignOutAsync("oidc");

var redirectUrl = $"{Startup.IdentityServerUrl}/connect/endsession?id_token_hint={id_token}";

return Redirect(redirectUrl);

And here is the startup code for my client:

  // This method gets called by the runtime. Use this method to add services to the container.
    public void ConfigureServices(IServiceCollection services)
    {
        JwtSecurityTokenHandler.DefaultMapInboundClaims = false;

        services.AddAuthentication(options =>
        {
            options.DefaultScheme = "Cookies";
            options.DefaultChallengeScheme = "oidc";
        })
            .AddCookie("Cookies")
            .AddOpenIdConnect("oidc", options =>
            {
                options.Authority = IdentityServerUrl;
                options.RequireHttpsMetadata = false;

                options.ClientId = "testClient1";
                options.ClientSecret = "xxxxxxxxxxxxx";
                options.ResponseType = "code";

                options.SaveTokens = true;
            });


        services.AddRazorPages();


    }

    // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
    public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
    {
        if (env.IsDevelopment())
        {
            app.UseDeveloperExceptionPage();
        }
        else
        {
            app.UseExceptionHandler("/Error");
            // The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
            app.UseHsts();
        }

        app.UseStaticFiles();

        app.UseRouting();
        app.UseAuthentication();
        app.UseAuthorization();

        app.UseEndpoints(endpoints =>
        {
            endpoints.MapRazorPages();
            endpoints.MapDefaultControllerRoute()
                .RequireAuthorization();
        });

    }

Here is the startup code for my ID4 server:

 public void ConfigureServices(IServiceCollection services)
    {
        var connectionString = Configuration.GetConnectionString("DefaultConnection");

        var migrationsAssembly = typeof(Startup).GetTypeInfo().Assembly.GetName().Name;

        services.AddDbContext<ApplicationDbContext>(options =>
            options.UseSqlServer(connectionString));

        services.AddIdentity<ApplicationUser, IdentityRole>(
           config =>
           {
               config.SignIn.RequireConfirmedEmail = true;
               config.SignIn.RequireConfirmedAccount = true;
               config.User.RequireUniqueEmail = true;
               config.Lockout.DefaultLockoutTimeSpan = TimeSpan.FromMinutes(5);
               config.Lockout.MaxFailedAccessAttempts = 5;
               config.Lockout.AllowedForNewUsers = true;
           })
               .AddEntityFrameworkStores<ApplicationDbContext>()
               .AddDefaultTokenProviders();



        // these point ID4 to the correct pages for login, logout, etc.
        services.ConfigureApplicationCookie((options) =>
        {
            options.LoginPath = "/Identity/Account/Login";
            options.LogoutPath = "/Identity/Account/Logout";
            options.AccessDeniedPath = "/Error";
        });


        services.AddIdentityServer()
            .AddOperationalStore(options =>
                options.ConfigureDbContext = builder =>
                    builder.UseSqlServer(connectionString, sqlOptions => sqlOptions.MigrationsAssembly(migrationsAssembly)))
            .AddConfigurationStore(options =>
                options.ConfigureDbContext = builder =>
                    builder.UseSqlServer(connectionString, sqlOptions => sqlOptions.MigrationsAssembly(migrationsAssembly)))
            .AddAspNetIdentity<ApplicationUser>()
            .AddDeveloperSigningCredential();

        ConfigureEmailServices(services);

        services.AddRazorPages();


    }

    // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
    public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
    {
        if (env.IsDevelopment())
        {
            app.UseDeveloperExceptionPage();
            app.UseDatabaseErrorPage();

            InitializeDbTestData(app);

        }
        else
        {
            app.UseExceptionHandler("/Home/Error");
            // The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
            app.UseHsts();
        }

        app.UseHttpsRedirection();
        app.UseStaticFiles();

        app.UseRouting();

        app.UseAuthentication();
        app.UseAuthorization();

        app.UseIdentityServer();

        app.UseEndpoints(endpoints =>
        {
            endpoints.MapControllerRoute(
                name: "default",
                pattern: "{controller=Home}/{action=Index}/{id?}");

            endpoints.MapRazorPages();
        });
    }

Answer 1

For the idp logout you don't need to redirect manually. Simply return a SignOutResult and the redirection will be done by the oidc handler by using discovery endpoint and mounting the request properly. Put this code in your logout method:

 return SignOut(new[] { "Cookies", "oidc" });

Or this other:

return new SignOutResult(new[] { "Cookies", "oidc" });

If you want to be redirected to the client after the idp logout, set up your postLogoutRedirectUri.