I am using Sitecore 10.2 and I have set up federated authentication for the end user, below are the steps:
- On the public website www.website.com, there will be a login button
- When the user will click on the login button it will redirect to www.something-sso.com.
- User will enter username and password and after successful validation, it will redirect back to www.website.com.
- On www.website.com website, logout button will visible
- On logout button it will redirect to www.something-sso.com and it will logout and on www.something-sso.com there will be a button "Return to home page".
Now problem is that when user click on "Return to home page" then it is redirecting to "www.website.com" and again coming on to "www.something-sso.com" but when I do logout and after 2 mins I click on "Return to home page" then it correctly redirect to "www.website.com".
Below is my logout code:
[HttpPost]
[ValidateAntiForgeryToken]
public ActionResult LogOut()
{
Session.Abandon();
Sitecore.Security.Authentication.AuthenticationManager.Logout();
return RedirectToAction("/");
}
public class ProjectIdentityProvider : IdentityProvidersProcessor
{
private readonly ICookieManager cookieManager;
readonly string clientId = Sitecore.Configuration.Settings.GetSetting("ClientId");
readonly string redirectUri = Sitecore.Configuration.Settings.GetSetting("RedirectUri");
readonly string clientSecret = Sitecore.Configuration.Settings.GetSetting("ClientSecret");
readonly string authority = Sitecore.Configuration.Settings.GetSetting("Authority");
readonly string postLogoutRedirectUri = Sitecore.Configuration.Settings.GetSetting("PostLogoutRedirectUri");
readonly string errorUri = Sitecore.Configuration.Settings.GetSetting("ErrorMessage");
public ProjectIdentityProvider(
FederatedAuthenticationConfiguration federatedAuthenticationConfiguration,
ICookieManager cookieManager,
BaseSettings settings) : base(federatedAuthenticationConfiguration, cookieManager, settings)
{
this.cookieManager = cookieManager ?? throw new ArgumentNullException(nameof(cookieManager));
}
protected override void ProcessCore(IdentityProvidersArgs args)
{
var authenticationType = this.GetAuthenticationType();
var identityProvider = this.GetIdentityProvider();
var saveSigninToken = identityProvider.TriggerExternalSignOut;
var oidcOptions = this.SetupOidcOptions(authenticationType, saveSigninToken);
args.App.UseOpenIdConnectAuthentication(oidcOptions);
}
public OpenIdConnectAuthenticationOptions SetupOidcOptions(
string authenticationType,
bool saveSigninToken)
{
var oidcOptions = new OpenIdConnectAuthenticationOptions
{
AuthenticationType = authenticationType,
// AuthenticationMode = AuthenticationMode.Passive,
Authority = authority,
ClientId = clientId,
ClientSecret = clientSecret,
// ResponseMode = OpenIdConnectResponseMode.FormPost,
ResponseType = OpenIdConnectResponseType.IdTokenToken,
RedirectUri = redirectUri,
PostLogoutRedirectUri = postLogoutRedirectUri,
//RedeemCode = true,
Scope = OpenIdConnectScope.OpenIdProfile + " " + OpenIdConnectScope.OfflineAccess,
SaveTokens = true,
//RequireHttpsMetadata = true,
Notifications = new OpenIdConnectAuthenticationNotifications
{
RedirectToIdentityProvider = this.RedirectToIdentityProviderAsync,
SecurityTokenValidated = this.SecurityTokenValidatedAsync
},
TokenValidationParameters =
{
SaveSigninToken = saveSigninToken
//ValidateIssuer = false
},
// CookieManager = cookieManager
};
return oidcOptions;
}
protected override string IdentityProviderName => "ProjectIdentityProvider";
protected BaseLog Log { get; }
public Collection<string> Scopes { get; } = new Collection<string>();
private Task RedirectToIdentityProviderAsync(
RedirectToIdentityProviderNotification<OpenIdConnectMessage, OpenIdConnectAuthenticationOptions>
notification)
{
//var domain = urlUtils.GetDomain();
var owinContext = notification.OwinContext;
var protocolMessage = notification.ProtocolMessage;
var user = Sitecore.Context.User;
if (protocolMessage.RequestType == OpenIdConnectRequestType.Authentication)
{
//var redirectUri = postLogoutRedirectUri;// this.configurationRepository.GetSetting(postLogoutRedirectUri);
// Make sure the redirectUri goes to the current domain.
// redirectUri = WebUtil.GetUri(redirectUri, new Uri(domain)).ToString();
protocolMessage.RedirectUri = postLogoutRedirectUri;
}
if (protocolMessage.RequestType == OpenIdConnectRequestType.Logout)
{
// var postLogoutRedirectUri = this.configurationRepository.GetSetting(postLogoutRedirectUri);
// Make sure the postLogoutRedirectUri goes to the current domain.
//postLogoutRedirectUri = WebUtil.GetUri(postLogoutRedirectUri, new Uri(domain)).ToString();
protocolMessage.PostLogoutRedirectUri = postLogoutRedirectUri;
protocolMessage.IdTokenHint = this.GetIdTokenHint(owinContext);
}
return Task.CompletedTask;
}
private Task SecurityTokenValidatedAsync(SecurityTokenValidatedNotification<OpenIdConnectMessage, OpenIdConnectAuthenticationOptions> notification)
{
var identityProvider = this.GetIdentityProvider();
var identity = notification.AuthenticationTicket.Identity;
foreach (var current in identityProvider.Transformations)
{
current.Transform(identity, new TransformationContext(this.FederatedAuthenticationConfiguration, identityProvider));
}
return Task.CompletedTask;
}
}
<federatedAuthentication type="Sitecore.Owin.Authentication.Configuration.FederatedAuthenticationConfiguration, Sitecore.Owin.Authentication">
<identityProvidersPerSites hint="list:AddIdentityProvidersPerSites">
<mapEntry name="sites with extranet domain" type="Sitecore.Owin.Authentication.Collections.IdentityProvidersPerSitesMapEntry, Sitecore.Owin.Authentication" resolve="true" patch:instead="*[@name='sites with extranet domain']">
<sites hint="list">
<site>Test</site>
</sites>
<identityProviders hint="list:AddIdentityProvider">
<identityProvider ref="federatedAuthentication/identityProviders/identityProvider[@id='ProjectIdentityProvider']" />
</identityProviders>
<externalUserBuilder type="Sitecore.Owin.Authentication.Services.DefaultExternalUserBuilder, Sitecore.Owin.Authentication" resolve="true">
<IsPersistentUser>false</IsPersistentUser>
</externalUserBuilder>
</mapEntry>
</identityProvidersPerSites>
<identityProviders>
<identityProvider id="ProjectIdentityProvider" type="Sitecore.Owin.Authentication.Configuration.DefaultIdentityProvider, Sitecore.Owin.Authentication">
<param desc="name">$(id)</param>
<param desc="domainManager" type="Sitecore.Abstractions.BaseDomainManager" resolve="true" />
<caption>Go to login</caption>
<domain>extranet</domain>
<triggerExternalSignOut>true</triggerExternalSignOut>
<!--list of identity transfromations which are applied to the provider when a user signin-->
<transformations hint="list:AddTransformation">
<!--SetIdpClaim transformation-->
<transformation name="Idp Claim" type="Sitecore.Owin.Authentication.Services.SetIdpClaimTransform, Sitecore.Owin.Authentication" />
<!-- If external authentication is configured with "TokenValidationParameters = {SaveSigninToken = true}", this saves the value from "claimsIdentity.BootstrapContext" to the "id_token" claim. -->
<transformation name="set id_token claim" type="Sitecore.Owin.Authentication.Services.SaveIdTokenInClaim, Sitecore.Owin.Authentication" />
</transformations>
</identityProvider>
</identityProviders>
<propertyInitializer type="Sitecore.Owin.Authentication.Services.PropertyInitializer, Sitecore.Owin.Authentication">
<maps hint="list">
<map name="email claim" type="Sitecore.Owin.Authentication.Services.DefaultClaimToPropertyMapper, Sitecore.Owin.Authentication" resolve="true">
<data hint="raw:AddData">
<!--claim name-->
<source name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress" />
<!--property name-->
<target name="Email" />
</data>
</map>
<map name="Given Name" type="Sitecore.Owin.Authentication.Services.DefaultClaimToPropertyMapper, Sitecore.Owin.Authentication" resolve="true">
<data hint="raw:AddData">
<!--<source name="given_name" />-->
<source name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname" />
<target name="Name" />
</data>
</map>
</maps>
</propertyInitializer>
</federatedAuthentication>
