2

I have a Sitecore/ADFS integration working with SC 9.3 and ADFS 2019 (on premise). Sign in is working fine. However we can't get the post logout redirect to work. Currently when a user signs out of Sitecore they are taken to an ADFS page that says "You have successfully signed out". We would like the user to be taken back to the Sitecore sign in screen.

I have followed the example found here (https://blog.istern.dk/2019/05/15/sitecore-9-1-identityserver-on-premise-ad-via-adfs/) to create a custom Identity Server plugin. However I cannot figure out how to specify the URL that the user should be directed to after logout is complete. Is that specified somewhere in my custom plugin code? Somewhere in the Identity Server config? Somewhere in ADFS?

The current ADFS configuration information looks like this:

enter image description here

We also noticed an error in the ADFS logs that says this:

enter image description here

I am not really sure I even understand how I am supposed to specify a post logout URL. Does anyone know how I should do that?

Improve this question

2 Answers 2

Reset to default
0

If you use sitecore identity server PostLogoutRedirectUris configuration exists inside [Identity server root\sitecore\Sitecore.Plugin.IdentityServer\Config\identityServer.xml] file, not sure if you've set this since you wrote that the user is taken to the ADFS logout page.

You could try to set a post logout redirect on the ADFS side. If you take a look at the ADFS documentation https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/development/ad-fs-logout-openid-connect, there is a parameter post_logout_redirect_uri to figure out which URI the client should be redirected to after logout.

The ADFS error that you posted might be related to the one described https://github.com/MicrosoftDocs/windowsserverdocs/issues/787, which states that id_token_hint is missing from the logout request.

Improve this answer
2
  • Thanks for the feedback. Yes I saw that article about the "id_token_hint" parameter also. But I have absolutely no idea how to do that. Is that something I am supposed to add to my custom Identity Server plugin? Is that something I configure in ADFS? Is that something I configure in Sitecore or Identity Server?
    – Corey Burnett
    Mar 21, 2021 at 23:58
  • I think you need to specify it in your identity provider, since that is where you are specifying that it should include id_token. Similar to the approach oshyn.com/blog/2019/10/…
    – Cristi Vulturar
    Mar 22, 2021 at 11:57
0

I have actually blogged about this solution extensively. In my case, I have used the WsFederation package Microsoft.AspNetCore.Authentication.WsFederation and below is the code snippet of invoking the middle-ware:

enter image description here

This works fine for me, and I have not had to do any additional configuration within Sitecore side (apart from the plugin configuration settings in the xml file). Signing out automatically directs me back to Sitecore Identity login page.

I am not saying using OpenIdConnect middleware won't work, but I found WsFederation works well with ADFS.

Full blog post link is at sitecore-host-part-four Please give it ago, happy to support further.

I also shared full source code of a working AFDS plugin on my Github repo Look for the *Ids4WsFederation plugin in particular.

Improve this answer
3
  • 1
    Yes I have seen that blog post. In fact I commented on it back in December! We could not get WsFederation to work so we switched to OpenIdConnect. I wanted to follow your blog post but the big mystery to me is how to set up things in ADFS 2019 to work with your blog post. I am not an ADFS expert and I am working with the customer's IT department and they don't know specifically what is needed to work with Sitecore.
    – Corey Burnett
    Mar 25, 2021 at 16:05
  • My guess is that perhaps the customer I am working with has something set up in their ADFS server that redirects users back to their page instead of Sitecore's sign in page. But I have no idea.
    – Corey Burnett
    Mar 25, 2021 at 16:06
  • There is a comprehensive Pluralsight course on setting up ADFS 2019 if this will help too, app.pluralsight.com/library/courses/…
    – Julius A
    Mar 25, 2021 at 18:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.