PostLogoutRedirectUri with Owin and Azure ADb2C

Question

Can anyone confirm if the Sitecore.Security.Authentication.AuthenticationManager.Logout(); handles the logout from AdB2c IDP as well, as per documentation from at:

https://doc.sitecore.com/developers/92/sitecore-experience-manager/en/understanding-sitecore-authentication-behavior-changes.html#UUID-47f9f57c-ca3b-bd39-fde8-98a167d37a24_section-idm45851235771136_body

Sitecore automatically handles this. But I don't see the cookies getting cleared.

Code from processor in which PostLogoutRedirectUri is set-

private OpenIdConnectAuthenticationOptions CreateOptionsFromPolicy(string policy)
        {
            var identityProvider = GetIdentityProvider();
            return new OpenIdConnectAuthenticationOptions
            {
                // For each policy, give OWIN the policy-specific metadata address, and
                // set the authentication type to the id of the policy
                MetadataAddress = String.Format(WellKnownMetadata, Tenant, policy),
                //AuthenticationType = GetAuthenticationType(),
                AuthenticationType = policy,
                AuthenticationMode = AuthenticationMode.Passive,
                RequireHttpsMetadata = RequireHttps,

                // These are standard OpenID Connect parameters, with values pulled from settings
                ClientId = ClientId,
                // Scope = "openid profile offline_access",
                Scope = $"openid profile offline_access { _defaultScope }",
                //ResponseType = "id_token",
                RedirectUri = RedirectUri, //SK RedirectIframeUri
                PostLogoutRedirectUri = RedirectUri,                

                Notifications = new OpenIdConnectAuthenticationNotifications
                {
                    RedirectToIdentityProvider = OnRedirectToIdentityProvider,                    
                    AuthenticationFailed = OnAuthenticationFailed,
                    SecurityTokenValidated = OnSecurityTokenValidated,                   
                    AuthorizationCodeReceived = OnAuthorizationCodeReceived,
                },
                // This piece is optional - it is used for displaying the user's name in the navigation bar.
                TokenValidationParameters = new TokenValidationParameters
                {
                    NameClaimType = "name",                    
                    ValidateIssuer = false,
                    SaveSigninToken = identityProvider.TriggerExternalSignOut
                },
            };
        }

IdentityProcider config

<identityProvider id="AzureAdB2C" type="Sitecore.Owin.Authentication.Configuration.DefaultIdentityProvider, Sitecore.Owin.Authentication">
          <param desc="name">$(id)</param>
          <param desc="domainManager" type="Sitecore.Abstractions.BaseDomainManager" resolve="true" />
          <caption>AzureAdB2C</caption>
          <domain>extranet</domain>
          <enabled>true</enabled>
          <triggerExternalSignOut>true</triggerExternalSignOut>
          <transformations hint="list:AddTransformation">
            <transformation name="Name Identifier Claim" type="Sitecore.Owin.Authentication.Services.DefaultTransformation, Sitecore.Owin.Authentication">
              <sources hint="raw:AddSource">
                <claim name="http://schemas.microsoft.com/identity/claims/objectidentifier" />
              </sources>
              <targets hint="raw:AddTarget">
                <claim name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier" />
              </targets>
              <keepSource>true</keepSource>
            </transformation>

Answer 1

Probably might help someone. I managed to figure this out as the issue was on the Controller Action for SignOut.

Sitecore handles the Owin Middleware integration little differently from Asp.NET. Below is the code for my Signout Action. Here please note, we need to pass the IDP Name "AzureADB2C" explicitly for Sitecore to know which provider is being logged out. After this , Sitecore will send a request to AdB2C post logout redirect Uri

// To sign out the user, you should issue an OpenIDConnect sign out request.
            if (Sitecore.Context.User.IsAuthenticated)
            {
                HttpContext.GetOwinContext().Authentication.SignOut(new AuthenticationProperties { }, new string[] { "AzureAdB2C", Startup.SignInPolicyId });
                AuthenticationManager.Logout();
            }

https://$tenant/$client/$policy/oauth2/v2.0/logout?post_logout_redirect_uri=http://localhost:7032/myaccount&x-client-SKU=ID_NET451&x-client-ver=5.2.2.0