从IdentityServer注销后重定向回ASP.NET Mvc客户端

Question

我想从本地注销，然后再从IS4重定向到我的客户端；我的AspNetCore Mvc客户端可以正常工作，并在注销后重定向回该客户端，但是AspNet Mvc（（非核心）却不能。

这是我的Startup.Configuration方法：

    public void Configuration(IAppBuilder app)
    {           
        JwtSecurityTokenHandler.DefaultInboundClaimTypeMap.Clear();

        app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);
        app.UseCookieAuthentication(new CookieAuthenticationOptions
        {
            AuthenticationType = "Cookies",
        });

        app.UseOpenIdConnectAuthentication(new OpenIdConnectAuthenticationOptions
        {
            SignInAsAuthenticationType = "Cookies",

            Authority = "https://localhost:5000",

            UseTokenLifetime = false,              
            // RedeemCode = true,

            ClientId = "aspNet_client",               
            ClientSecret = "secret",                
            RedirectUri = "https://localhost:44343/sigin-oidc",              
            PostLogoutRedirectUri = "https://localhost:44343/signout-callback-oidc",               
            SaveTokens = true,            
            ResponseType = "code id_token",

            Scope = "openid profile offline_access",

            TokenValidationParameters = new TokenValidationParameters()
            {
                NameClaimType = JwtClaimTypes.PreferredUserName,
                RoleClaimType = JwtClaimTypes.Role,
            },

            Notifications = new OpenIdConnectAuthenticationNotifications
            {
                AuthenticationFailed = onAuthenticationFailed,
                MessageReceived = onMessageReceived,

               // AuthorizationCodeReceived = onAuthorizationCodeReceived
            }
        });
    }

我使用此方法注销：

public ActionResult SignOut()
{
    Request.GetOwinContext().Authentication.SignOut();
    return Redirect("/");
}

我也使用过这种方法：

    public ActionResult SignOut()
    {
         System.Web.HttpContext.Current.GetOwinContext().Authentication.SignOut(
                    new AuthenticationProperties
                    {
                        RedirectUri = "https://localhost:44343"
                    },
                        CookieAuthenticationDefaults.AuthenticationType,
                        OpenIdConnectAuthenticationDefaults.AuthenticationType
                    );

          //"Cookies", "OpenIdConnect"
    }

但是没有用。所以我的问题是：注销后如何自动重定向回我的AspNetMvc客户端？

Answer 1

这是很久以前在IdentityServer3上报告的error。通过在注销时设置here，可以固定为IdTokenHint。在这种情况下，由于我们使用IdentityServer4，因此可以在ASP.NET MVC应用程序上手动实施类似的修复程序。这是需要进行的更改：

1. 在IdentityServer项目上为客户端设置PostLogoutRedirectUris：

new Client
{
   ClientId = "aspNet_client",

   //All other settings ...

   PostLogoutRedirectUris = { "http://localhost:44343" },
},

2. 在ASP.NET mvc应用程序上，将OpenIdConnectAuthenticationOptions-PostLogoutRedirectUri设置为与步骤1相同的值

3. 更改Notifications-SecurityTokenValidated和RedirectToIdentityProvider以在注销时设置IdTokenHint

app.UseOpenIdConnectAuthentication(new OpenIdConnectAuthenticationOptions
            {
                // other settings...

                PostLogoutRedirectUri = "http://localhost:44343",
                Notifications = new OpenIdConnectAuthenticationNotifications
                {
                    SecurityTokenValidated = n =>
                    {
                        n.AuthenticationTicket.Identity.AddClaim(new Claim("id_token", n.ProtocolMessage.IdToken));
                        return Task.FromResult(0);
                    },
                    RedirectToIdentityProvider = n =>
                    {
                        if (n.ProtocolMessage.RequestType == OpenIdConnectRequestType.Logout)
                        {
                            var id_token_claim = n.OwinContext.Authentication.User.Claims.FirstOrDefault(x => x.Type == "id_token");
                            if (id_token_claim != null)
                            {
                                n.ProtocolMessage.IdTokenHint = id_token_claim.Value;
                            }
                        }
                        return Task.FromResult(0);
                    }
                }
            });

4. 如果要自动重定向，请在IdentityServer上将AccountOptions-AutomaticRedirectAfterSignOut设置为false。

我自己实施here