identityserver4 local login cause clients logout-CodePudding

User can login to identity server using local account. But this is cause of user sign out from MVC client that uses open id connect for external login and I don't know why exactly!

I checked IdentityServer4 connect/authorize endpoint for any sign out code but I can't find anything.

IdentityServer config:

new Client
    {
        ClientId = "mvc",
        ClientSecrets = { new Secret("secret".Sha256()) },

        AllowedGrantTypes = GrantTypes.Code,
        AllowOfflineAccess = true,
        RequireConsent = true,

        // where to redirect to after login
        RedirectUris = { "https://localhost:5002/signin-oidc" },

        // where to redirect to after logout
        PostLogoutRedirectUris = { "https://localhost:5002/signout-callback-oidc" },

        AllowedScopes = new List<string>
        {
            IdentityServerConstants.StandardScopes.OpenId,
            IdentityServerConstants.StandardScopes.Profile
        }
    }

Client config:

builder.Services.AddDefaultIdentity<IdentityUser>()
.AddEntityFrameworkStores<ApplicationDbContext>();

builder.Services.AddAuthentication()
.AddOpenIdConnect("oidc", "Demo IdentityServer4", options =>
{
    options.Authority = "https://localhost:5001";

    options.ClientId = "mvc";
    options.ClientSecret = "secret";
    options.ResponseType = "code";

    options.GetClaimsFromUserInfoEndpoint = true;

    options.Scope.Add("profile");

    options.SaveTokens = true;
});

CodePudding user response：

Aren't you by any chance using the same name for the cookies of your MVC client and your identity server?

As you are working in localhost for both MVC client and identity server, the cookie of single sign on could be overwriting the MVC cookie.

Have you checked this behavior with different domains?

And, what if you go back to the MVC Client and login from there, do you lose the single sign on? If I'm right, this time the MVC Cookie would be overwriting the identity server Cookie.

CodePudding user response：

Did you check #IdentiyServer4 logs? I think those errors would help you to find the exact problem.