dotnet / dotnet/aspnetcore

MSAL PostLogoutRedirectUri refused by ADFS due to missing id_token_hint

Open
#50,771 2 comments 0 reactions 0 assignees View on GitHub
area-blazor enhancement
Dominant language
C#
Stars
38.4k
Forks
10.9k
Avg merge
2d 6h
Merged PRs (30d)
290

Description

### Is there an existing issue for this?

- [X] I have searched the existing issues

### Describe the bug

Unable to redirect to specified postLogoutRedirectUri when logging out from ADFS.

Using MSAL in blazor like so:

services.AddMsalAuthentication(options =>
{
configuration.Bind("oidc:ADFS", options.ProviderOptions.Authentication);
options.ProviderOptions.LoginMode = "redirect";
options.ProviderOptions.Authentication.PostLogoutRedirectUri = "https://myapp.com/authentication/login";
});

No redirect occurs and ADFS create event log refusing the redirect url. I can manually resolve this by appending id_token_hint to the logout url, but there is no mechanism to do this within .NET

### Expected Behavior

Expected:
User's browser is redirected to specified post logout redirect uri

Actual:
User's browser remains on the ADFS hosted logout confirmation screen

### Steps To Reproduce

Configure MSAL:

Using MSAL in blazor like so:

services.AddMsalAuthentication(options =>
{
configuration.Bind("oidc:ADFS", options.ProviderOptions.Authentication);
options.ProviderOptions.LoginMode = "redirect";
options.ProviderOptions.Authentication.PostLogoutRedirectUri = "https://myapp.com/authentication/login";
});

Corresponding appsettings:

"oidc": {
"Provider": "ADFS",
"ADFS": {
"Authority": "https://myadfsserver.com/adfs",
"ClientId": "faa53074-19d5-4dd6-b824-c047a14cda50",
"LogoutUrl": "https://myadfsserver.com/adfs/oauth2/logout",
"postLogoutRedirectUri": "https://myapp.com/authentication/login"
}
}

In ADFS the post logout redirect uri has been added to the list of accepted redirects for this application.

Now in the app logout the user. Everything works fine except redirect back to an address in my app of my choosing (the post logout redirect uri)

It appears the under msal javascript library supports id_hint_token but there appears to be no way in C# to set this implicitly or explicitly

### Exceptions (if any)

_No response_

### .NET Version

6

### Anything else?

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.