Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

IdentityServer4 PostLogoutRedirectUri

I am confused about how this is used.

Most examples I've seen have it given as "/signout-callback-oidc". That seems to indicate that it uses OIDC middleware in the process. What if I want to return to a specific client page?

The automatic redirect isn't working when I set IdentityServer's AccountOptions.cs property of AutomaticRedirectAfterSignOut to true. Further, during logout, I do not receive the client's PostLogoutRedirectUri.

So, is that link supposed to go to the OIDC middleware, or is it available for use to redirect to the client?

like image 566
JakeJ Avatar asked Mar 05 '18 18:03

JakeJ


People also ask

What is PostLogoutRedirectUri?

If there is a PostLogoutRedirectUri value, then it's important how this URL is used to redirect the user. The logout page typically should not directly redirect the user to this URL. Doing so would skip the necessary front-channel notifications to clients.

What is the use of IdentityServer4?

IdentityServer is an authentication server that implements OpenID Connect (OIDC) and OAuth 2.0 standards for ASP.NET Core. It's designed to provide a common way to authenticate requests to all of your applications, whether they're web, native, mobile, or API endpoints.

Is IdentityServer4 open source?

About IdentityServer4IdentityServer is a free, open source OpenID Connect and OAuth 2.0 framework for ASP.NET Core.

What is client in IdentityServer4?

Clients represent applications that can request tokens from your identityserver. The details vary, but you typically define the following common settings for a client: a unique client ID. a secret if needed. the allowed interactions with the token service (called a grant type)

What is postlogoutredirecturis in identityserver?

When setting up IdentityServer (assuming it's a separate application), there are two parameters in the configuration for an accessing client: RedirectUris and PostLogoutRedirectUris. These correspond to what happens after a login or logout of a user against the IdentityServer system.

Does post logout redirect Uri work with older versions of identityserver4?

I knew that my Post Logout Redirect Uri was set to http://localhost:3308/ which worked in older version of IdentityServer4. You mean older versions of the ASP.NET Core OpenID Connect middleware. Sorry, something went wrong. Was my fix the correct approach or is it a fudge and I am missing a more correct approach. Sorry, something went wrong.

Is postlogoutredirecturi always returning null?

However, logout.PostLogoutRedirectUri is always returning null. clients. Add ( new Client () { ClientId = client. IDP_ClientId , ClientName = client.

How do I get the client ID of an identityserver4 user?

The GetSubjectId method is an IdentityServer4 extension method for the Identity. The HttpContext.User can be used to get this. The client id must match the client from the configuration.


2 Answers

Your client has to be configured to request the callback to one of those URIs as part of the client-initiated sign-out flow.

IS4 clients can be configured with lists of allowable redirect URIs for both sign-in and sign-out, which I'm guessing is where you see /signout-callback-oidc -- if I remember right, either the docs or maybe the Quickstart code uses that, but there's nothing special about that particular URI name. (It isn't some OIDC standard, or a "well-known" name, or anything of that nature, as far as I know.)

The missing piece of the puzzle is to configure OIDC in the client application. You didn't mention what kind of application is on the client side, but in ASP.NET Core it's an option named SignedOutCallbackPath on the AddOpenIdConnect service:

services.AddOpenIdConnect("oidc", options =>
{
    options.SignInScheme = "Cookies";
    options.Authority = appConfig["OidcAuthority"];
    options.ClientId = appConfig["OidcClientId"];
    options.ClientSecret = appConfig["OidcClientSecret"];
    // etc

    options.SignedOutCallbackPath = "/jake-says-goodbye";
});

This causes the OIDC implementation to add a property to the sign-out request identifying that redirect URI. As long as your application properly identifies itself, as briefly mentioned in the docs here, and as long as /jake-says-goodbye is one of the approved post-logout redirect URIs on the IS4 side, you should get the callback you're expecting.

(I specifically mention "proper" identification because, based on github questions I've seen, it sounds like it might be more difficult to manage for a JS-based SPA client app versus whatever helpful things MVC does behind the scenes to manage server-to-server OIDC interaction. I can't speak to that as I've not had a need to implement any SPA clients with IS4 yet.)

like image 141
McGuireV10 Avatar answered Oct 18 '22 12:10

McGuireV10


The problem is that you have to set a very specific parameter in order for the PostLogoutRedirectUri to not show up as null on IdentityServer's side, and testing any of the options results in having to step through a ton of ways to set it, most of them still resulting in null. Since I'm using an older client with IdentityServer4 (in order to enable .NET 4.x webapps to authenticate through IdentityServer4, cannot easily use .NET Core with those projects - luckily IdentityServer4 is still compatible with the older client code), the action that triggers signout has two relevant things (and you'll find a TON of examples of code for that will not work for you with MVC in .NET 4.x):

Use the signout() method in this sample github repo (the IdentityServer3 MVC Owin sample client): https://github.com/IdentityServer/IdentityServer3.Samples/blob/master/source/Clients/MVC%20OWIN%20Client/Controllers/HomeController.cs You can trigger that action from a button in a view.

That will get intercepted by the client's Owin middleware if you do this: https://github.com/IdentityServer/IdentityServer3/issues/2687#issuecomment-194739035 I didn't use the stored message bit, and I added the PostLogoutRedirectUri parameter in a way that IdentityServer4's LogoutRequest model wouldn't remove with this line in the same segment:

n.ProtocolMessage.PostLogoutRedirectUri = "http://myredirectaddress/ActionToDoOnceReturned"; 

You have to make sure that the above matches the client's PostLogoutRedirectUri on the IdentityServer side's client config or it'll be null again, and you would have missed it among all the other parameters. For instance, these methods of setting PostLogoutRedirectUri DO NOT work:

n.ProtocolMessage.SetParameter("PostLogoutRedirectURI", "some URL");
n.ProtocolMessage.SetParameter("PostLogoutUri", "another URL");
n.ProtocolMessage.SetParameter("PostLogoutRedirectUri", "yet another URL that's going to be ignored by IdentityServer4");

From there, you're off to the races because PostLogoutRedirectUri is no longer null. There are a few more considerations: check out AccountOptions in the IdentityServer controller folder. I set AutomaticRedirectAfterSignout to true there (this is used by Javascript in IdSrv's final logout page - if set, the script uses PostLogoutRedirectUri to forward the user back to the client). There's also an option to show a logout confirmation prompt, which if you want to actually display, make sure to NOT set the id token hint in the Owin (it's right next to where we set the PostLogoutRedirectUri / the part that gets triggered by signout requests). If you do those two things, AccountServices.BuildLogoutViewModel will return the prompt to the user when it's called by the AccountController.logout() method. Thank you aaronR for the answer to my other question concerning that part:
IdentityServer4 logout (id token hint tells IdentityServer that the signout request was authorized and not a malicious person trying to harass your system / sign out users, IdSrv will ask the user for confirmation if it's not provided).

Finally, if you are confused by what's happening on the IdentityServer side in logout, and why it's repeatedly triggering the same method:

First time it gets called from the client's Owin middleware (the bit of code above that gets triggered after the Signout() action).

It uses AccountService to build a view model to return to the user for logout confirmation.

It gets triggered again by the user clicking yes on that page.

It goes through the Account service method again, which this time sets the bool to show the logout confirmation to false.

It calls the second logout method, the one with the view model that gets passed in.

This one triggers the external identity provider signout.

The external identity provider returns control back to logout, resulting in it getting called again, calling the second logout method again.

Finally, it will return the user to IdentityServer's logout page. If PostLogoutRedirectUri is set & AutomaticRedirectAfterSignOut is true, there's javascript on that page which automatically forwards the user's browser to it.

Due to having two projects to debug through at once and all of these possible ways of setting the redirect (which also have to match client/server side config in order not to be null) it can be easy to get confused.

like image 31
JakeJ Avatar answered Oct 18 '22 13:10

JakeJ