无法重定向到结束会话端点，配置可能丢失或无效 OpenIdConnect SignOutAsync

Question

我收到一个错误

无法重定向到结束会话端点，退出时配置可能丢失或无效。

当我处理退出时

public async Task LogOut()
{
    await HttpContext.SignOutAsync(CookieAuthenticationDefaults.AuthenticationScheme);            
    await HttpContext.SignOutAsync("oidc");
}

模式

services.AddAuthentication(sharedOptions =>
    {
        sharedOptions.DefaultAuthenticateScheme = CookieAuthenticationDefaults.AuthenticationScheme;
        sharedOptions.DefaultSignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;
        sharedOptions.DefaultSignOutScheme = "oidc";
        sharedOptions.DefaultChallengeScheme = "oidc";
    })
    .AddCookie(options =>
    {
        options.AccessDeniedPath = new PathString("/Access/Unauthorised");
        options.Cookie.Name = "MyCookie";
    })
    .AddOpenIdConnect("oidc", options =>
    {
        options.ClientId = Configuration["oidc:ClientId"];
        options.ClientSecret = Configuration["oidc:ClientSecret"]; // for code flow
        options.SignedOutRedirectUri = Configuration["oidc:SignedOutRedirectUri"];
        options.Authority = Configuration["oidc:Authority"];
        options.ResponseType = OpenIdConnectResponseType.Code;
        options.GetClaimsFromUserInfoEndpoint = true;
        options.CallbackPath = new PathString("/oidc");
        options.Events = new OpenIdConnectEvents()
        {
            OnRedirectToIdentityProvider = context =>
            {
                context.ProtocolMessage.SetParameter("pfidpadapterid", Configuration["oidc:PingProtocolMessage"]);
                return Task.FromResult(0);
            }
        };
    });

Answer 1

您的授权服务器似乎不支持会话管理和动态注册。当它被支持时，发现响应包含end_session_endpoint. 这与SignedOutRedirectUri 不同，后者用作用户在授权服务器上注销时的最终重定向目标。

OnRedirectToIdentityProviderForSignOut event 提供了一个选项来设置发行者地址，在这种情况下是注销 URI：

options.Events = new OpenIdConnectEvents()
{
    options.Events.OnRedirectToIdentityProviderForSignOut = context =>
    {
        context.ProtocolMessage.IssuerAddress =
            GetAbsoluteUri(Configuration["oidc:EndSessionEndpoint"], Configuration["oidc:Authority"]);
        return Task.CompletedTask;
    };
}

helper 方法用于在配置中同时支持相对路径和绝对路径：

private string GetAbsoluteUri(string signoutUri, string authority)
{
    var signOutUri = new Uri(signoutUri, UriKind.RelativeOrAbsolute);
    var authorityUri = new Uri(authority, UriKind.Absolute);

    var uri = signOutUri.IsAbsoluteUri ? signOutUri : new Uri(authorityUri, signOutUri);
    return uri.AbsoluteUri;
}   

这样授权服务器将在查询字符串中获得额外的参数，它可以使用例如重定向回您的应用程序。

Answer 2

要修复此问题，请处理OnRedirectToIdentityProviderForSignOut事件并手动指定注销端点：

options.Events = new OpenIdConnectEvents()
{
    OnRedirectToIdentityProvider = context =>
    {
        context.ProtocolMessage.SetParameter("pfidpadapterid", Configuration["oidc:PingProtocolMessage"]);
        return Task.FromResult(0);
    },
    // handle the logout redirection 
    OnRedirectToIdentityProviderForSignOut = context =>
    {
        var logoutUri = Configuration["oidc:SignedOutRedirectUri"];
        context.Response.Redirect(logoutUri);
        context.HandleResponse();

        return Task.CompletedTask;
    }
};