IdentityServer3 注销功能不适用于 ASP.NET Core 客户端

Question

我正在使用 IdentityServer 3 进行身份验证。我有 2 个客户端应用程序，一个是使用经典的 ASP.NET MVC 5 开发的，另一个是使用 ASP.NET Core 开发的。这两个应用程序都实现了如下注销功能：

经典 ASP.NET MVC 5

应用启动

public class Startup
{
    public void Configuration(IAppBuilder app)
    {        
        var CK = new CookieAuthenticationOptions()
        {
            AuthenticationType = "Cookies",
            CookieName = "MyCookie"
        };

        app.UseCookieAuthentication(CK);

        app.UseOpenIdConnectAuthentication(new OpenIdConnectAuthenticationOptions
        {
            Authority = "https://login.mydomain.com/identity",
            Scope = "openid profile",
            ClientId = "myclientid",
            RedirectUri = "http://localhost:34937/",
            ResponseType = "id_token",
            SignInAsAuthenticationType = "Cookies",

            Notifications = new OpenIdConnectAuthenticationNotifications
            {
                SecurityTokenValidated = (context) =>
                {
                    // do claim transformation here
                },

                RedirectToIdentityProvider = (n) =>
                {
                    if (n.ProtocolMessage.RequestType == OpenIdConnectRequestType.LogoutRequest)
                    {
                        var idTokenHint = n.OwinContext.Authentication.User.FindFirst("id_token").Value;
                        n.ProtocolMessage.IdTokenHint = idTokenHint;
                    }
                    return Task.FromResult(0);
                }
            }
     }
 }

帐户控制器具有注销操作

  public class AccountController:Controller
  {
    [HttpPost]
    [ValidateAntiForgeryToken]
    public ActionResult LogOff()
    {
        Request.GetOwinContext().Authentication.SignOut();
        return Redirect("/");
    }
  }

ASP.NET Core

应用程序启动

    public static class IApplicationBuilderExtensions
    {
        public static void UseIdentityServer(this IApplicationBuilder app, string authority, string clientId)
        {
            app.UseCookieAuthentication(new CookieAuthenticationOptions()
            {
                AutomaticAuthenticate = true,
                AutomaticChallenge = true,
                AuthenticationScheme = CookieAuthenticationDefaults.AuthenticationScheme,
                LoginPath = "/home",
                AccessDeniedPath = new PathString(IdentityConstant.AccessDeniedPath),
                CookieName = "MtAuthCookie",
                SlidingExpiration = true
            });

            JwtSecurityTokenHandler.DefaultInboundClaimTypeMap = new Dictionary<string, string>();           

            var connectOptions = new OpenIdConnectOptions()
            {                
                AutomaticChallenge = true,
                Authority = authority,
                ClientId = clientId,
                ResponseType = "id_token",
                AuthenticationScheme = OpenIdConnectDefaults.AuthenticationScheme,
                SignInScheme = CookieAuthenticationDefaults.AuthenticationScheme,             
                CallbackPath = "/home",
                Events = new OpenIdConnectEvents()
                {
                    OnTokenValidated = async context =>
                    {
                        //create new identity to store only required claims here.                       
                    },
                    OnRedirectToIdentityProvider = async context =>
                    {
                        if (context.ProtocolMessage.RequestType == OpenIdConnectRequestType.Logout)
                        {
                            var idTokenHint = context.HttpContext.User.FindFirst("id_token");
                            if (idTokenHint != null)
                                context.ProtocolMessage.IdTokenHint = idTokenHint.Value;
                        }
                        await Task.FromResult(0);
                    }                    
                }
            };        


            app.UseOpenIdConnectAuthentication(connectOptions);
        }
    }
}

Account Controller 有注销操作

  public class AccountController:Controller
  {
    [HttpPost]
    [ValidateAntiForgeryToken]
    public async Task<IActionResult> LogOff()
    {
        if (User.Identity.IsAuthenticated)
        {
            await HttpContext.Authentication.SignOutAsync(CookieAuthenticationDefaults.AuthenticationScheme);
        }
        return Redirect("/");
    }
  }

问题
在经典的 asp.net 注销操作中运行良好。我看到它执行OnRedirectToIdentityProvider 事件，并且context.ProtocolMessage.RequestType 设置为LogoutRequest，之后它发出GET 请求：

https://login.mydomain.com/identity/connect/endsession?id_token_hint=XXXXXXXXXXXXXX
https://login.mydomain.com/identity/logout?id=XXXXXX
https://login.mydomain.com/identity/connect/endsessioncallback?sid=XXXXXX

最后用户登陆https://devlogin.crowdreason.com/identity/logout?id=xxxx页面

但是在 ASP.NET Core https://login.mydomain.com/identity/connect/endsession 中永远不会在注销操作时被调用。我还注意到context.ProtocolMessage.RequestType 永远不会设置为Logout。 事实上，注销用户会自动获得身份验证并返回主页？

还有

我在 ASP.NET Core 中缺少什么？是否有使用IdentityServer3 和ASP.NET Core 客户端的示例？ （注意我没有使用 IdentityServer4）

Answer 1

我认为有一个不同的事件。这对我有用：

OnRedirectToIdentityProviderForSignOut = context =>
                {
                    var idTokenHint = context.HttpContext.User.FindFirst("id_token");

                    if (idTokenHint != null)
                    {
                        context.ProtocolMessage.IdTokenHint = idTokenHint.Value;
                    }

                    return Task.FromResult(0);
                }