End ADFS session when user logging out

[mavado83]

I have the following setup: Blazor WebAssembly frontend => Api + openiddict backend + a separate login provider using windows ADFS.

In the backend I have configured .AddOpenIdConnect(OpenIdConnectDefaults.AuthenticationScheme, to add the external ADFS provider.
When I login from Blazor I get redirected to the AuthServer where I can choose the login with the external provider. This is working as expected. ( I did override LoginModel to customize some claims).

Now when the user hit's the logout button. (using the default authentication/logout link) The user get's logged off by the OpenIddict session. But the problem is, that the endpoint for the ADFS endpoint (adfs/oauth2/logout) is never called and the user is still logged in there.

What's the recommend way to achieve this ? I tried to override the LogoutModel, but that one is never hit when logging out, so I cannot use that one.

Any suggestions?

[maliming]

Hi,

The logout of a Blazor WASM client doesn't go through the LogoutModel page. It's an RP-initiated logout: the client redirects to OpenIddict's end session endpoint (connect/endsession), which is handled by the LogoutController of the Volo.Abp.OpenIddict.AspNetCore module. That controller only clears the local Identity cookies (application, temporary external and 2FA) and completes the OpenIddict sign-out, it never triggers a sign-out on your external OpenIdConnect scheme. That's why ADFS keeps its session.

You can replace that controller and sign out from ADFS as part of the flow. When SignInManager.ExternalLoginSignInAsync signs the user in, the authentication cookie contains a ClaimTypes.AuthenticationMethod claim holding the scheme name, so you can detect it there:

using System.Security.Claims;
using System.Threading.Tasks;
using Microsoft.AspNetCore.Authentication;
using Microsoft.AspNetCore.Authentication.OpenIdConnect;
using Microsoft.AspNetCore.Http.Extensions;
using Microsoft.AspNetCore.Mvc;
using OpenIddict.Server.AspNetCore;
using Volo.Abp.DependencyInjection;
using Volo.Abp.OpenIddict.Controllers;

namespace MyCompanyName.MyProjectName;

[Route("connect/endsession")]
[ApiExplorerSettings(IgnoreApi = true)]
[ExposeServices(typeof(LogoutController))]
[Dependency(ReplaceServices = true)]
public class MyLogoutController : LogoutController
{
    [HttpGet]
    public override async Task<IActionResult> GetAsync()
    {
        var result = await HttpContext.AuthenticateAsync(SignInManager.AuthenticationScheme);
        var loginProvider = result.Succeeded
            ? result.Principal?.FindFirst(ClaimTypes.AuthenticationMethod)?.Value
            : null;

        await SignInManager.SignOutAsync();

        if (loginProvider == OpenIdConnectDefaults.AuthenticationScheme)
        {
            // Sign out from the external identity provider first, then come back
            // to this endpoint to complete the OpenIddict end session flow.
            return SignOut(
                new AuthenticationProperties
                {
                    RedirectUri = Request.GetEncodedPathAndQuery()
                },
                OpenIdConnectDefaults.AuthenticationScheme);
        }

        return SignOut(authenticationSchemes: OpenIddictServerAspNetCoreDefaults.AuthenticationScheme);
    }
}

The flow becomes: connect/endsession → redirect to the ADFS logout endpoint → ADFS redirects back to /signout-callback-oidc → back to connect/endsession (the cookie is gone now, so the claim check fails) → OpenIddict completes the sign-out and returns to your Blazor client's logout-callback.

Two things to be aware of:

1. The AuthenticationMethod claim is added by ExternalLoginSignInAsync. There is one exception: the very first external login that links the provider to an existing user (matched by email) signs in without it, so that first session falls back to a local-only logout. All following external logins carry the claim.

2. The sign-out request to ADFS is sent without an id_token_hint (the temporary external cookie holding the tokens is already deleted after login). ADFS ends the session anyway, but it relies on the hint to redirect back to the post_logout_redirect_uri. If the sign-out gets stuck on the ADFS page instead of returning to your app: set SaveTokens = true on the OpenIdConnect options, capture the ADFS id_token from loginInfo.AuthenticationTokens in your LoginModel override (you already customize it) and keep it in a session-scoped store, then pass it in the sign-out event:

options.Events.OnRedirectToIdentityProviderForSignOut = context =>
{
    context.ProtocolMessage.IdTokenHint = "<the ADFS id_token you saved at login>";
    return Task.CompletedTask;
};

Note it must be the ID token issued by ADFS, not the one your own auth server issued to the Blazor client. Don't persist it as a user claim.

Thanks

[mavado83]

Thank you for the response. It's working now!