Post Logout Redirect Is Not Working with Sitecore 9.3 and ADFS 2019

Question

I have a Sitecore/ADFS integration working with SC 9.3 and ADFS 2019 (on premise). Sign in is working fine. However we can't get the post logout redirect to work. Currently when a user signs out of Sitecore they are taken to an ADFS page that says "You have successfully signed out". We would like the user to be taken back to the Sitecore sign in screen.

I have followed the example found here (https://blog.istern.dk/2019/05/15/sitecore-9-1-identityserver-on-premise-ad-via-adfs/) to create a custom Identity Server plugin. However I cannot figure out how to specify the URL that the user should be directed to after logout is complete. Is that specified somewhere in my custom plugin code? Somewhere in the Identity Server config? Somewhere in ADFS?

The current ADFS configuration information looks like this:

We also noticed an error in the ADFS logs that says this:

I am not really sure I even understand how I am supposed to specify a post logout URL. Does anyone know how I should do that?

Answer 1

If you use sitecore identity server PostLogoutRedirectUris configuration exists inside [Identity server root\sitecore\Sitecore.Plugin.IdentityServer\Config\identityServer.xml] file, not sure if you've set this since you wrote that the user is taken to the ADFS logout page.

You could try to set a post logout redirect on the ADFS side. If you take a look at the ADFS documentation https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/development/ad-fs-logout-openid-connect, there is a parameter post_logout_redirect_uri to figure out which URI the client should be redirected to after logout.

The ADFS error that you posted might be related to the one described https://github.com/MicrosoftDocs/windowsserverdocs/issues/787, which states that id_token_hint is missing from the logout request.

Answer 2

I have actually blogged about this solution extensively. In my case, I have used the WsFederation package Microsoft.AspNetCore.Authentication.WsFederation and below is the code snippet of invoking the middle-ware:

This works fine for me, and I have not had to do any additional configuration within Sitecore side (apart from the plugin configuration settings in the xml file). Signing out automatically directs me back to Sitecore Identity login page.

I am not saying using OpenIdConnect middleware won't work, but I found WsFederation works well with ADFS.

Full blog post link is at sitecore-host-part-four Please give it ago, happy to support further.

I also shared full source code of a working AFDS plugin on my Github repo Look for the *Ids4WsFederation plugin in particular.

Answer 3

I have implemented it previously and it is working fine. Please find below sample code:

public class KeycloakIdentityProvider : IdentityProvidersProcessor  
   {  
     protected override string IdentityProviderName => "keycloak";  
     private string ClientId => Settings.GetSetting(KeycloakSettings.ClientId, "");  
     private string ClientSecret => Settings.GetSetting(KeycloakSettings.ClientSecret, "");  
     private string Authority => Settings.GetSetting(KeycloakSettings.Authority, "");  
     private string MetadataAddress => Settings.GetSetting(KeycloakSettings.MetadataAddress, "");  
     private string RedirectURL => Settings.GetSetting(KeycloakSettings.RedirectURL, "");  
     private readonly string OpenIdScope = OpenIdConnectScope.OpenIdProfile + " email";  
     private readonly string idToken = "id_token";  
     private readonly string accessDeniedRelativePath = "/custom/errorpages/Forbidden.aspx";  
     public KeycloakIdentityProvider(FederatedAuthenticationConfiguration federatedAuthenticationConfiguration, Microsoft.Owin.Infrastructure.ICookieManager cookieManager, BaseSettings settings) : base(federatedAuthenticationConfiguration, cookieManager, settings)  
     {  
     }  
     protected IdentityProvider IdentityProvider { get; set; }  
     protected override void ProcessCore(IdentityProvidersArgs args)  
     {  
       IdentityProvider = this.GetIdentityProvider();  
       var httphandler = new HttpClientHandler();  
       httphandler.DefaultProxyCredentials = CredentialCache.DefaultCredentials;  
       httphandler.CheckCertificateRevocationList = true;  
       httphandler.ServerCertificateCustomValidationCallback = (message, cert, chain, sslPolicyErrors) =>  
       {  
         return true;  
       };  
       var options = new OpenIdConnectAuthenticationOptions  
       {  
         BackchannelHttpHandler = httphandler,  
         //Backchannel = httpclient,  
         RequireHttpsMetadata = false,  
         MetadataAddress = MetadataAddress,  
         ClientId = ClientId,  
         ClientSecret = ClientSecret,  
         Authority = Authority,  
         RedirectUri = RedirectURL,  
         ResponseType = OpenIdConnectResponseType.Code,  
         Scope = OpenIdScope,  
         AuthenticationType = IdentityProvider.Name,  
         RedeemCode = true,  
         TokenValidationParameters = new TokenValidationParameters  
         {  
           NameClaimType = "name"  
         },  
         Notifications = new OpenIdConnectAuthenticationNotifications  
         {  
           RedirectToIdentityProvider = notification =>  
           {  
             if (notification.ProtocolMessage.RequestType == OpenIdConnectRequestType.Authentication)  
             {  
               if (Sitecore.Context.User.IsAuthenticated)  
               {  
                 notification.HandleResponse();  
                 notification.Response.Redirect(Settings.GetSetting("Identity.sso.launchpad"));  
               }  
               else  
               {  
                 notification.ProtocolMessage.SetParameter("kc_idp_hint", "saml");  
               }  
             }  
             if (notification.ProtocolMessage.RequestType == OpenIdConnectRequestType.Logout)  
             {  
               // If signing out, add the id_token_hint  
               var idTokenClaim = notification.OwinContext.Authentication.User.FindFirst(idToken);  
               if (idTokenClaim != null)  
                 notification.ProtocolMessage.IdTokenHint = idTokenClaim.Value;  
             }  
             return System.Threading.Tasks.Task.CompletedTask;  
           }  
         }  
       };  
       args.App.UseKentorOwinCookieSaver();  
       args.App.UseOpenIdConnectAuthentication(options);  
     }  
   }  

In the 'RedirectUri' you can set call back URL, so it will redirect back to that URL.

Full blog you can check here https://swatiguptablogs.blogspot.com/2023/06/keycloak-integration-with-sitecore-part.html