Thinktecture IdentityServer v3 LogOut for Implicit flow -
how id_token implicit token pass in id_token hint logout implicit flow or there way? have end point /connect/endsession? id_token_hint=
not sure how id_token implict flow access_token , expiration. there setting in idsvr?
there's 3 components this.
first ensure you're requesting id_token identity server when you're configuring oidc authentication in startup.cs (as mentioned @leastprivilege above):
app.useopenidconnectauthentication(new openidconnectauthenticationoptions { authority = "https://localhost:44301/", ... responsetype = "id_token token", //(here's request id_token!)
secondly, using oidc notifications & after security token validated add id_token user's claims:
notifications = new openidconnectauthenticationnotifications { securitytokenvalidated = async n => { var nid = new claimsidentity( n.authenticationticket.identity.authenticationtype, constants.claimtypes.givenname, constants.claimtypes.role); // userinfo data var userinfoclient = new userinfoclient( new uri(n.options.authority + "/" + constants.routepaths.oidc.userinfo), n.protocolmessage.accesstoken); var userinfo = await userinfoclient.getasync(); userinfo.claims.tolist().foreach(ui => nid.addclaim(new claim(ui.item1, ui.item2))); // keep id_token logout (**this bit**) nid.addclaim(new claim(constants.tokentypes.identitytoken, n.protocolmessage.idtoken)); n.authenticationticket = new authenticationticket( nid, n.authenticationticket.properties); },
finally, on redirect signout (also notification event) add id_token protocol message:
redirecttoidentityprovider = n => { if (n.protocolmessage.requesttype == openidconnectrequesttype.logoutrequest) { var idtokenhint = n.owincontext.authentication.user.findfirst(constants.tokentypes.identitytoken); if (idtokenhint != null) { n.protocolmessage.idtokenhint = idtokenhint.value; } } return task.fromresult(0); }
you'll need ensure setup postlogoutredirecturis on client within identity server:
new client { enabled = true, clientname = "(mvc) web app", clientid = "mvc", flow = flows.implicit, postlogoutredirecturis = new list<string> { "https://localhost:44300/" //(** client's url**) } }
that ensure give user option return authorised client when log out :)
all of pretty per mvc sample @ https://identityserver.github.io/documentation/docsv2/overview/mvcgettingstarted.html
bit more asked helps else who's trying figure out :)
Comments
Post a Comment