CODEWITHSUNDEEP
oauth-2.0identityserver4openid-connect
Kman
Kman

Reputation: 4991

Identity Server 4 and auto redirect on sign out

Playing around with a demo project from PluralSight, I am trying to have the IDP redirect back to the server app on sign out.

The PostLogOutRedirectUris is defined in the config for the Client at the IDP level, but it doesn't seem to have any effect.

public static IEnumerable<Client> Clients =>
    new Client[]
    { 
        new Client
        {
            ClientId = "bethanyspieshophr",
            ClientName = "Bethany's Pie Shop HRM",
            AllowOfflineAccess = true,
            AccessTokenLifetime = 120,
            RequireConsent = false,
            RequirePkce = true,
            AllowedGrantTypes = GrantTypes.Code,
            ClientSecrets = { 
                new Secret("108B7B4F-BEFC-4DD2-82E1-7F025F0F75D0".Sha256()) },
            RedirectUris = { "https://localhost:44301/signin-oidc" },
            PostLogoutRedirectUris = { "https://localhost:44301/signout-oidc" },
            AllowedScopes = { "openid", "profile", "email", "bethanyspieshophrapi" }
        }             
    };

If I manually at runtime set the LoggedOutViewModel it works as expected.

Upvotes: 1

Views: 541

Answers (2)

Kman
Kman

Reputation: 4991

The issue was simply due to a typo, which sent me on a wild goose chase.

  PostLogoutRedirectUris = { "https://localhost:44301/signout-oidc" },

Should be

  PostLogoutRedirectUris = { "https://localhost:44301/signout-callback-oidc" },

And then, it worked.

Upvotes: 1

Michal Trojanowski
Michal Trojanowski

Reputation: 12322

How are you performing the logout request? Remember that the value in the client settings is just the registered value which is verified during logout request. The user is not redirected automatically to the postLogoutRedirectUri. You have to pass a post_logout_redirect_uri parameter to the end session endpoint and this parameter must match on of the values in the PostLogoutRedirectUris setting. To use this feature you should also post a valid ID token in the id_token_hint parameter, so that the server knows which client is requesting the logout.

You can have a look at the end session enpoint docs for details.

Upvotes: 2

Related Questions