IdentityServer3注销功能不适用于ASP.NET Core客户端

Question

我正在使用IdentityServer 3进行身份验证。我有2个客户端应用程序，一个是使用经典的ASP.NET MVC 5开发的，另一个是使用ASP.NET Core开发的。这两个应用程序已经退出功能实现如下：

经典ASP.NET MVC 5

应用程序启动

public class Startup 
{ 
    public void Configuration(IAppBuilder app) 
    {   
     var CK = new CookieAuthenticationOptions() 
     { 
      AuthenticationType = "Cookies", 
      CookieName = "MyCookie" 
     }; 

     app.UseCookieAuthentication(CK); 

     app.UseOpenIdConnectAuthentication(new OpenIdConnectAuthenticationOptions 
     { 
      Authority = "https://login.mydomain.com/identity", 
      Scope = "openid profile", 
      ClientId = "myclientid", 
      RedirectUri = "http://localhost:34937/", 
      ResponseType = "id_token", 
      SignInAsAuthenticationType = "Cookies", 

      Notifications = new OpenIdConnectAuthenticationNotifications 
      { 
       SecurityTokenValidated = (context) => 
       { 
        // do claim transformation here 
       }, 

       RedirectToIdentityProvider = (n) => 
       { 
        if (n.ProtocolMessage.RequestType == OpenIdConnectRequestType.LogoutRequest) 
        { 
         var idTokenHint = n.OwinContext.Authentication.User.FindFirst("id_token").Value; 
         n.ProtocolMessage.IdTokenHint = idTokenHint; 
        } 
        return Task.FromResult(0); 
       } 
      } 
    } 
} 

账户控制器具有注销行动

public class AccountController:Controller 
    { 
    [HttpPost] 
    [ValidateAntiForgeryToken] 
    public ActionResult LogOff() 
    { 
     Request.GetOwinContext().Authentication.SignOut(); 
     return Redirect("/"); 
    } 
    } 

ASP。 NET Core

应用程序启动

public static class IApplicationBuilderExtensions 
    { 
     public static void UseIdentityServer(this IApplicationBuilder app, string authority, string clientId) 
     { 
      app.UseCookieAuthentication(new CookieAuthenticationOptions() 
      { 
       AutomaticAuthenticate = true, 
       AutomaticChallenge = true, 
       AuthenticationScheme = CookieAuthenticationDefaults.AuthenticationScheme, 
       LoginPath = "/home", 
       AccessDeniedPath = new PathString(IdentityConstant.AccessDeniedPath), 
       CookieName = "MtAuthCookie", 
       SlidingExpiration = true 
      }); 

      JwtSecurityTokenHandler.DefaultInboundClaimTypeMap = new Dictionary<string, string>();   

      var connectOptions = new OpenIdConnectOptions() 
      {     
       AutomaticChallenge = true, 
       Authority = authority, 
       ClientId = clientId, 
       ResponseType = "id_token", 
       AuthenticationScheme = OpenIdConnectDefaults.AuthenticationScheme, 
       SignInScheme = CookieAuthenticationDefaults.AuthenticationScheme,    
       CallbackPath = "/home", 
       Events = new OpenIdConnectEvents() 
       { 
        OnTokenValidated = async context => 
        { 
         //create new identity to store only required claims here.      
        }, 
        OnRedirectToIdentityProvider = async context => 
        { 
         if (context.ProtocolMessage.RequestType == OpenIdConnectRequestType.Logout) 
         { 
          var idTokenHint = context.HttpContext.User.FindFirst("id_token"); 
          if (idTokenHint != null) 
           context.ProtocolMessage.IdTokenHint = idTokenHint.Value; 
         } 
         await Task.FromResult(0); 
        }      
       } 
      };   


      app.UseOpenIdConnectAuthentication(connectOptions); 
     } 
    } 
} 

账户控制器具有注销行动

public class AccountController:Controller 
    { 
    [HttpPost] 
    [ValidateAntiForgeryToken] 
    public async Task<IActionResult> LogOff() 
    { 
     if (User.Identity.IsAuthenticated) 
     { 
      await HttpContext.Authentication.SignOutAsync(CookieAuthenticationDefaults.AuthenticationScheme); 
     } 
     return Redirect("/"); 
    } 
    } 

问题
在经典的asp.net注销行动工作正常。我看到它执行OnRedirectToIdentityProvider事件，也context.ProtocolMessage.RequestType设置为LogoutRequest之后，它使GET要求：

https://login.mydomain.com/identity/connect/endsession?id_token_hint=XXXXXXXXXXXXXX
https://login.mydomain.com/identity/logout?id=XXXXXX
https://login.mydomain.com/identity/connect/endsessioncallback?sid=XXXXXX

，最终用户landup上https://devlogin.crowdreason.com/identity/logout?id=xxxx页

然而，在注销操作后，ASP.NET核心https://login.mydomain.com/identity/connect/endsession永远不会被调用。我也注意到context.ProtocolMessage.RequestType永远不会设置为Logout。 事实上，注销用户自动获得认证并返回主页？

而且

我在ASP.NET核心的思念？是否有可用的样品使用IdentityServer3和ASP.NET Core客户端？ （注意我没有使用IdentityServer4）

Answer 1

我认为这是一个不同的事件。这适用于我：

OnRedirectToIdentityProviderForSignOut = context => 
       { 
        var idTokenHint = context.HttpContext.User.FindFirst("id_token"); 

        if (idTokenHint != null) 
        { 
         context.ProtocolMessage.IdTokenHint = idTokenHint.Value; 
        } 

        return Task.FromResult(0); 
       }