I have a Sitecore/ADFS integration working with SC 9.3 and ADFS 2019 (on premise). Sign in is working fine. However we can't get the post logout redirect to work. Currently when a user signs out of Sitecore they are taken to an ADFS page that says "You have successfully signed out". We would like the user to be taken back to the Sitecore sign in screen.

I have followed the example found here (https://blog.istern.dk/2019/05/15/sitecore-9-1-identityserver-on-premise-ad-via-adfs/) to create a custom Identity Server plugin. However I cannot figure out how to specify the URL that the user should be directed to after logout is complete. Is that specified somewhere in my custom plugin code? Somewhere in the Identity Server config? Somewhere in ADFS?

The current ADFS configuration information looks like this:

enter image description here

We also noticed an error in the ADFS logs that says this:

enter image description here

I am not really sure I even understand how I am supposed to specify a post logout URL. Does anyone know how I should do that?

3 Answers 3


If you use sitecore identity server PostLogoutRedirectUris configuration exists inside [Identity server root\sitecore\Sitecore.Plugin.IdentityServer\Config\identityServer.xml] file, not sure if you've set this since you wrote that the user is taken to the ADFS logout page.

You could try to set a post logout redirect on the ADFS side. If you take a look at the ADFS documentation https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/development/ad-fs-logout-openid-connect, there is a parameter post_logout_redirect_uri to figure out which URI the client should be redirected to after logout.

The ADFS error that you posted might be related to the one described https://github.com/MicrosoftDocs/windowsserverdocs/issues/787, which states that id_token_hint is missing from the logout request.

  • Thanks for the feedback. Yes I saw that article about the "id_token_hint" parameter also. But I have absolutely no idea how to do that. Is that something I am supposed to add to my custom Identity Server plugin? Is that something I configure in ADFS? Is that something I configure in Sitecore or Identity Server? Mar 21, 2021 at 23:58
  • I think you need to specify it in your identity provider, since that is where you are specifying that it should include id_token. Similar to the approach oshyn.com/blog/2019/10/… Mar 22, 2021 at 11:57

I have actually blogged about this solution extensively. In my case, I have used the WsFederation package Microsoft.AspNetCore.Authentication.WsFederation and below is the code snippet of invoking the middle-ware:

enter image description here

This works fine for me, and I have not had to do any additional configuration within Sitecore side (apart from the plugin configuration settings in the xml file). Signing out automatically directs me back to Sitecore Identity login page.

I am not saying using OpenIdConnect middleware won't work, but I found WsFederation works well with ADFS.

Full blog post link is at sitecore-host-part-four Please give it ago, happy to support further.

I also shared full source code of a working AFDS plugin on my Github repo Look for the *Ids4WsFederation plugin in particular.

  • 1
    Yes I have seen that blog post. In fact I commented on it back in December! We could not get WsFederation to work so we switched to OpenIdConnect. I wanted to follow your blog post but the big mystery to me is how to set up things in ADFS 2019 to work with your blog post. I am not an ADFS expert and I am working with the customer's IT department and they don't know specifically what is needed to work with Sitecore. Mar 25, 2021 at 16:05
  • My guess is that perhaps the customer I am working with has something set up in their ADFS server that redirects users back to their page instead of Sitecore's sign in page. But I have no idea. Mar 25, 2021 at 16:06
  • There is a comprehensive Pluralsight course on setting up ADFS 2019 if this will help too, app.pluralsight.com/library/courses/…
    – Julius A
    Mar 25, 2021 at 18:23

I have implemented it previously and it is working fine. Please find below sample code:

public class KeycloakIdentityProvider : IdentityProvidersProcessor  
     protected override string IdentityProviderName => "keycloak";  
     private string ClientId => Settings.GetSetting(KeycloakSettings.ClientId, "");  
     private string ClientSecret => Settings.GetSetting(KeycloakSettings.ClientSecret, "");  
     private string Authority => Settings.GetSetting(KeycloakSettings.Authority, "");  
     private string MetadataAddress => Settings.GetSetting(KeycloakSettings.MetadataAddress, "");  
     private string RedirectURL => Settings.GetSetting(KeycloakSettings.RedirectURL, "");  
     private readonly string OpenIdScope = OpenIdConnectScope.OpenIdProfile + " email";  
     private readonly string idToken = "id_token";  
     private readonly string accessDeniedRelativePath = "/custom/errorpages/Forbidden.aspx";  
     public KeycloakIdentityProvider(FederatedAuthenticationConfiguration federatedAuthenticationConfiguration, Microsoft.Owin.Infrastructure.ICookieManager cookieManager, BaseSettings settings) : base(federatedAuthenticationConfiguration, cookieManager, settings)  
     protected IdentityProvider IdentityProvider { get; set; }  
     protected override void ProcessCore(IdentityProvidersArgs args)  
       IdentityProvider = this.GetIdentityProvider();  
       var httphandler = new HttpClientHandler();  
       httphandler.DefaultProxyCredentials = CredentialCache.DefaultCredentials;  
       httphandler.CheckCertificateRevocationList = true;  
       httphandler.ServerCertificateCustomValidationCallback = (message, cert, chain, sslPolicyErrors) =>  
         return true;  
       var options = new OpenIdConnectAuthenticationOptions  
         BackchannelHttpHandler = httphandler,  
         //Backchannel = httpclient,  
         RequireHttpsMetadata = false,  
         MetadataAddress = MetadataAddress,  
         ClientId = ClientId,  
         ClientSecret = ClientSecret,  
         Authority = Authority,  
         RedirectUri = RedirectURL,  
         ResponseType = OpenIdConnectResponseType.Code,  
         Scope = OpenIdScope,  
         AuthenticationType = IdentityProvider.Name,  
         RedeemCode = true,  
         TokenValidationParameters = new TokenValidationParameters  
           NameClaimType = "name"  
         Notifications = new OpenIdConnectAuthenticationNotifications  
           RedirectToIdentityProvider = notification =>  
             if (notification.ProtocolMessage.RequestType == OpenIdConnectRequestType.Authentication)  
               if (Sitecore.Context.User.IsAuthenticated)  
                 notification.ProtocolMessage.SetParameter("kc_idp_hint", "saml");  
             if (notification.ProtocolMessage.RequestType == OpenIdConnectRequestType.Logout)  
               // If signing out, add the id_token_hint  
               var idTokenClaim = notification.OwinContext.Authentication.User.FindFirst(idToken);  
               if (idTokenClaim != null)  
                 notification.ProtocolMessage.IdTokenHint = idTokenClaim.Value;  
             return System.Threading.Tasks.Task.CompletedTask;  

In the 'RedirectUri' you can set call back URL, so it will redirect back to that URL.

Full blog you can check here https://swatiguptablogs.blogspot.com/2023/06/keycloak-integration-with-sitecore-part.html

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.