0

我使用 IdentityServer4 和 .Net Core Signin Manager 创建了一个 OAuth 服务器。登录效果很好并返回到我的应用程序。注销似乎不知道谁在注销。Logout Razor Page 代码如下：

   public async Task<IActionResult> OnGet(string logoutId)
    {

        var logout = await _interaction.GetLogoutContextAsync(logoutId);

        PostLogoutRedirectUri = logout?.PostLogoutRedirectUri;
        AutomaticRedirectAfterSignOut = (PostLogoutRedirectUri != null);
        ClientName = string.IsNullOrEmpty(logout?.ClientName) ? logout?.ClientId : logout?.ClientName;
        SignOutIframeUrl = logout?.SignOutIFrameUrl;
        LogoutId = logoutId;

        if (User?.Identity.IsAuthenticated == true)
        {
            var idp = User.FindFirst(JwtClaimTypes.IdentityProvider)?.Value;
            if (idp != null && idp != IdentityServer4.IdentityServerConstants.LocalIdentityProvider)
            {
                var providerSupportsSignout = await HttpContext.GetSchemeSupportsSignOutAsync(idp);
                if (providerSupportsSignout)
                {
                    if (LogoutId == null)
                    {
                        // if there's no current logout context, we need to create one
                        // this captures necessary info from the current logged in user
                        // before we signout and redirect away to the external IdP for signout
                        LogoutId = await _interaction.CreateLogoutContextAsync();
                    }

                    ExternalAuthenticationScheme = idp;
                }
            }

            // delete local authentication cookie
            await _signInManager.SignOutAsync();

            // raise the logout event
            await _events.RaiseAsync(new UserLogoutSuccessEvent(User.GetSubjectId(), User.GetDisplayName()));
        }

        // check if we need to trigger sign-out at an upstream identity provider
        if (TriggerExternalSignout)
        {
            // build a return URL so the upstream provider will redirect back
            // to us after the user has logged out. this allows us to then
            // complete our single sign-out processing.
            string url = Url.Action("Logout", new { logoutId = LogoutId });

            // this triggers a redirect to the external provider for sign-out
            return SignOut(new AuthenticationProperties { RedirectUri = url }, ExternalAuthenticationScheme);
        }

        if (AutomaticRedirectAfterSignOut)
            return Redirect(PostLogoutRedirectUri);
        else
            return Page();
    }

当它被调用时，会有一个 logoutId。它获取上下文，但 PostLogoutRedirectUri 为空白。ClientId 和 ClientName 也是空白的，但上下文有一个名为 ClientIds 的字段，第一个条目是我的应用程序的正确 ClientId。日志显示如下：

IdentityServer4.Validation.EndSessionRequestValidator: Information: End session request validation success
{
  "SubjectId": "6841dc6c-0bd7-4f72-8f1c-f7czzzzzzzzz",
  "Raw": {
    "post_logout_redirect_uri": "mps.mobile.app://callback"
  }
}
IdentityServer4.Hosting.IdentityServerMiddleware: Information: Invoking IdentityServer endpoint: IdentityServer4.Endpoints.EndSessionCallbackEndpoint for /connect/endsession/callback
IdentityServer4.Endpoints.EndSessionCallbackEndpoint: Information: Successful signout callback.

我正在为客户端应用程序使用 IdentityModel。我的注销编码如下：

        _options = new OidcClientOptions
        {
            Authority = MPSOidc.Authority,
            ClientId = MPSOidc.ClientID,
            Scope = "openid profile myapi offline_access email",
            RedirectUri = MPSOidc.RedirectUri,
            PostLogoutRedirectUri = MPSOidc.RedirectUri,
            ResponseMode = OidcClientOptions.AuthorizeResponseMode.Redirect,
            Browser = new ChromeCustomTabsBrowser(this)
        };

        var oidcClient = new OidcClient(_options);

        var r = new LogoutRequest();

        await oidcClient.LogoutAsync(r);

似乎 PostLogoutRedirectUri 应该出现在这里。有谁知道实现这一点的方法？如果没有，是否可以使用ClientId获取Client信息以找到那里的PostLogoutRedirectUri？

谢谢，吉姆

4

1 回答 1

1

这就是它的样子。当我在 OidcClient 上注销时，我没有传递 ID 令牌。在我的客户端 Android 应用程序上，我必须将 ID 令牌添加到注销请求中：

          var r = new LogoutRequest()
            {
                IdTokenHint = MPSOidc.Tokens.IdentityToken
            };

这就是全部。干杯。

于 2021-02-11T18:27:38.267 回答