I have an asp.net core web application that uses keycloak openidconnect for authentication. I have configured a client in keycloak for standard and implicit flow and have specified valid redirect uris. When the app is tun, it prompts me with a keycloak login page which is correct and then redirects me to my application page. Logout button logs the user out(I can see the cookie being cleared). But when I click on the login button again, instead of prompting me with a keycloak login page, it directly takes me back to my application's home page. In fiddler, I can see it hitting the keycloak server; a new token is issued. I think I'm missing some configuration in keycloak server. Any help is appreciated.

Startup.cs:

public void ConfigureServices(IServiceCollection services)
{
services.AddAuthentication(options =>
                {
                    // Store the session to cookies
                    options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
                    // OpenId authentication
                    options.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme;
                })
                .AddCookie(cookie =>
                {
                    cookie.Cookie.Name = "keycloak.cookie";
                    cookie.Cookie.MaxAge = TimeSpan.FromMinutes(60);
                    cookie.Cookie.SecurePolicy = CookieSecurePolicy.SameAsRequest;
                    cookie.SlidingExpiration = true;
                })
                .AddOpenIdConnect(options =>
                {
                    
                    options.Authority = Configuration.GetSection("Keycloak")["Authority"];
                    //Keycloak client ID
                    options.ClientId = Configuration.GetSection("Keycloak")["ClientId"];
                    //Keycloak client secret
                    options.ClientSecret = Configuration.GetSection("Keycloak")["ClientSecret"];
                    
                    // For testing we disable https (should be true for production)
                    options.RequireHttpsMetadata = false;
                    options.SaveTokens = true;
                    options.GetClaimsFromUserInfoEndpoint = true;
                    // OpenID flow to use
                    options.ResponseType = OpenIdConnectResponseType.CodeIdToken;

                });

}

index.cshtml:

@if(User.Identity.IsAuthenticated)
{
<form  asp-page="/Index" asp-page-handler="Logout">
                                    <button type="submit" >Sign out</button>
                                </form>
} else{
<a  asp-page="/Index">Sign in</a>
}

Index.cshtml.cs:

public void OnGet(){...}
public async Task<IActionResult> OpPostLogout(){
  Console.WriteLine("Logging out...");
  await HttpContext.SignOutAsync(CookieAuthenticationDefaults.AuthenticationScheme);
  Console.WriteLine("Signed out of Cookie Authentication!");
            
  await HttpContext.SignOutAsync(OpenIdConnectDefaults.AuthenticationScheme);            
            
  Console.WriteLine("Signed out of OpenIDConnect!");
  return RedirectToPage("./Logout");
}

CodePudding user response：

1. I modified my Logout method to the following:

    public IActionResult OnPostLogout()
        {
   
            return new SignOutResult(
                new[] {
                OpenIdConnectDefaults.AuthenticationScheme,
                CookieAuthenticationDefaults.AuthenticationScheme
                });
   

   }

2. In my keycloak server, I modified the redirecturi and postlogout redirect uri to my application uri(for example: https://localhost:5001/*)

3. My StartUp.cs:

   services.AddAuthentication(options =>
                {
                    // Store the session to cookies
                    options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;                    
                    // OpenId authentication
                    options.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme;
   
   
                })
                    .AddCookie()                   
                .AddOpenIdConnect(options =>                
                {
   
                    options.Authority = Configuration.GetSection("Keycloak")["Authority"];
                    //Keycloak client ID
                    options.ClientId = Configuration.GetSection("Keycloak")["ClientId"];
                    //Keycloak client secret
                    //options.ClientSecret = Configuration.GetSection("Keycloak")["ClientSecret"];
   
                    // For testing we disable https (should be true for production)
                    options.RequireHttpsMetadata = false;
                    options.SaveTokens = true;                    
                    options.GetClaimsFromUserInfoEndpoint = true;
                    // OpenID flow to use                    
                    options.ResponseType = OpenIdConnectResponseType.CodeIdToken;
   
   
   
   
                });