How to Sign out of ASP.NET from End Session Endpoint?

[Mike-E-angelo]

IdentityServer version

7.1

.NET version

9.0

Description

We have an Uno application that is authenticating users with Open ID Connect via Duende Identity Server. Everything works great and I wanted to thank you for all your efforts out there. 🙏

The problem we are having is when the user logs out. This calls /connect/endsession endpoint but it apparently does not delete the ASP.NET Cookie as described here.

Is there a way to do this? Thank you for any assistance you can provide.

Reproduction steps

NA

Expected behavior

No response

Logs

No response

Additional context

Thank you again for creating such a great product! 🙏

[RolandGuijt]

Since you're mentioning cookies and ASP.NET Core, are you hosting an Uno WebAssembly app with ASP.NET Core?
Also: can you please post the IdentityServer client configuration for the app?

[Mike-E-angelo]

Thank you for your assistance @RolandGuijt. Please note this is a device-based Uno application, so Android and iOS. No WebAssembly is involved. The Android/iOS device is calling into Duende Identity Server with the Uno OidcAuthenticationProvider (via OidcClient). This then launches the browser on the device (Chrome/Safari) where the cookie is stored.

There are indeed a lot of moving pieces here. 😁 Please let me know if you have any further questions and I will assist you.

Here is my configuration:

[RolandGuijt]

Typically a native app (iOS, Android) relies on the access token/refresh token mechanism of OAuth to do its work. It doesn't need or use the session. So it's OK to set the session lifetime to a short duration since it's only used to authenticate the user.
The meaning of "logging out" in an application like that in many cases just means revoking the refresh token at the revocation endpoint and then let the session die out.
Can this approach be used in your situation?

[Mike-E-angelo]

Thank you very much for your continued assistance @RolandGuijt it is appreciated. To start, I want to be sure we understand this is Open ID Connect and not plain Oauth2. Uno has an Open ID Connect provider as well as an Oauth2 provider. We chose the OIDC provider as that seemed to allow what we were after: basic username/password entry. The Duende templates set this up wonderfully and it works really well for our purposes:

Note the Remember My Login as well, as this appears to be a feature to consider when saving the session. Even with this unchecked the cookie remains and the next time Chrome loads this page on the user's device it simply forwards the user back to the application in an authenticated state.

As I understand your suggestion, we should decrease the session lifetime to a much smaller amount (a couple of seconds?). If we do this, what happens to the Remember My Login feature, I wonder?

in many cases just means revoking the refresh token at the revocation endpoint and then let the session die out.

I am a little confused here as the OIDC provider implemented by Uno does not appear to be doing this but calling the OidcClient.LogoutAsync which seems to be ending the session.

Any clarification would be appreciated. 🙏

[RolandGuijt]

The "Remember my login" feature sets a separate cookie in the browser, so you should be fine.

Regarding the call to LogoutAsync: that is correct behavior. That will call the end session endpoint on Identity Server triggering single logout. If other (web) clients have front- or back-channel logout configured their sessions will end automatically.

[Mike-E-angelo]

That will call the end session endpoint on Identity Server triggering single logout

Correct, but it doesn't delete the cookie as we are discussing, correct? I am trying to understand why Duende is setting cookies it does not delete following the expected workflow. That is, it will log in the user, set cookies, but it will log out (end session) without deleting the cookies it set.

Additionally, as it sounds like there are two cookies with the Remember My Login I want to be sure that this one gets deleted as well.

If other (web) clients have front- or back-channel logout configured their sessions will end automatically.

I would appreciate some further clarity around this. The only web client I am aware of is the one that I am using for Uno. Thank you for your continued assistance.

[Mike-E-angelo]

Thank you very much for that, @RolandGuijt your time and assistance are greatly appreciated and help me assemble the numerous moving pieces to get a working solution here.

It sounds like either the front-channel or back-channel configurations are the way to go. In particular, I found a good answer for Identity Server 4 configuration that seems to allow what I am looking for: https://stackoverflow.com/a/55312218

I will travel down this path and let you know of my findings. 🙏

[Mike-E-angelo]

Alright, @RolandGuijt I took a look at this and I have to say it all seems pretty complicated, especially for someone who is pretty new to this and especially as there (surprisingly) doesn't seem to be any guidance, examples, or documentation for this scenario.

Additionally, the issue as I understand it is that the end session endpoint is being called, and that is the server where the cookie is stored. A back-channel or front-channel seems to call another server/client when the server/client I want to call is the server itself.

All complications aside, I think the better way is to reduce the session lifetime to a small amount as you suggested earlier. I did take a look into this and while I saw a setting that defines the amount of time to clear stale sessions, there doesn't seem to be a setting that defines when a session is considered stale.

If you can help me figure that out it would be greatly appreciated and I can move on to the next fire here. Thank you again for all your effort and patience with me as I learn the ropes (painfully) here.

[RolandGuijt]

You can control the lifetime of IdentityServer's session yourself. Please see here.

Please remember that although in your situation there seems to be just one client (application), an identity provider is designed to serve many. back- and front-channel logout are there to give these other clients the opportunity to end their sessions when the identity provider notifies them to do so.

Hope all is clear now. If not please let me know.

[Mike-E-angelo]

Thank you for your continued patience and kind guidance while I learn all the moving pieces here @RolandGuijt. As I stated earlier there are quite a bit and you mentioned a few more.

I did try your suggestion but unfortunately, it did not address the issue. However, after some searching, I found what worked for me here:
https://stackoverflow.com/a/59705395

I think for now this will be a good solution but if we end up having to need more control over this I will look further into front channel clients and getting that implemented. It's a shame there isn't already an available demonstration of this feature with your documentation. This would save a lot of time and headache of having to create a discussion to bug you over implementation details. 😅 Thank you for any consideration.

[RolandGuijt]

Good that you have it working. We do have docs plus an example available. Did you notice this? If so can you please indicate what was lacking there so we can improve?

[Mike-E-angelo]

Ah, I did see that @RolandGuijt but as far as I can tell that is for clients who also log in using the same UI, correct? What is unclear to me is how to call this page from the HTTP call to the end_session endpoint that is made from the Uno application. 🤔

So I guess what is missing from your documentation is an example that demonstrates how an Uno (or Maui) client can successfully delete their cookies stored on the device's browser when the end_session endpoint is called. This seems like a common scenario and should be covered somehow. Thank you for your consideration in providing this.