Stuck in redirect loop after external signout with Federated Authentication

Question

We use Federated Authentication in Sitecore 9.1 in order to allow a user to login to the extranet domain through an external provider (Azure AD B2C).

When configuring the sign out part, we followed the documentation found on https://doc.sitecore.com/developers/91/sitecore-experience-management/en/understanding-sitecore-authentication-behavior-changes.html#UUID-153eb49e-9b9c-c95e-1e0c-c368778c900d_section-idm45851235771136.

When the user tries to sign out, he/she will end up in a navigation loop.

The logout is initiated by clicking a logout button, which calls AuthenticationManager.Logout();

Sitecore appears to initiate a local logoff and then sets the sc_externalLogout cookie. This will cause a redirect to the signout url of the external provider. The user is signed out on the external provider and redirected back the post logout redirect URI. Sitecore now sends the user again to the signout url of the external provider, causing a navigation loop.

Answer 1

If you don't want to signout of B2C when the user logs out of Sitecore, just set TriggerExternalSignOut to false in your identity provider configuration.

The external redirect feature appears to be undocumented and used internally by Sitecore to logout from IdentityServer. However, you can get it to work with your custom provider if you do a couple things. Here's an example identity provider for Azure B2C using OpenID Connect with working external signout. The first key part is to make sure you have an id_token claim set (lines 32 & 41). And last, the PostLogoutRedirectUri needs to be /identity/postexternallogout with ReturnUrl and nonce query string parameters set (line 50+).

If you're interested in the dirty details, there are two classes in Sitecore.Owin.Authentication.dll where this logic is defined. Sitecore.Owin.Authentication.Pipelines.Initialize.HandlePostLogoutUrl sets up the handler for /identity/postexternallogout. The second class is Sitecore.Owin.Authentication.Security.SignalCookieExternalLogoutManager which is called from the first and does the check for the nonce in IsValidUnRegisterExternalLogoutRequest. It also checks for the id_token in RegisterExternalLogout.