IdentityServer3 logoff functionality does not work with ASP.NET Core client

Question

I am using IdentityServer 3 for authentication. I have 2 client applications, one is developed using classic ASP.NET MVC 5 and other one using ASP.NET Core. Both the applications have logout functionality implemented as below:

Classic ASP.NET MVC 5

Application startup

public class Startup
{
    public void Configuration(IAppBuilder app)
    {        
        var CK = new CookieAuthenticationOptions()
        {
            AuthenticationType = "Cookies",
            CookieName = "MyCookie"
        };

        app.UseCookieAuthentication(CK);

        app.UseOpenIdConnectAuthentication(new OpenIdConnectAuthenticationOptions
        {
            Authority = "https://login.mydomain.com/identity",
            Scope = "openid profile",
            ClientId = "myclientid",
            RedirectUri = "http://localhost:34937/",
            ResponseType = "id_token",
            SignInAsAuthenticationType = "Cookies",

            Notifications = new OpenIdConnectAuthenticationNotifications
            {
                SecurityTokenValidated = (context) =>
                {
                    // do claim transformation here
                },

                RedirectToIdentityProvider = (n) =>
                {
                    if (n.ProtocolMessage.RequestType == OpenIdConnectRequestType.LogoutRequest)
                    {
                        var idTokenHint = n.OwinContext.Authentication.User.FindFirst("id_token").Value;
                        n.ProtocolMessage.IdTokenHint = idTokenHint;
                    }
                    return Task.FromResult(0);
                }
            }
     }
 }

Account Controller has logoff action

  public class AccountController:Controller
  {
    [HttpPost]
    [ValidateAntiForgeryToken]
    public ActionResult LogOff()
    {
        Request.GetOwinContext().Authentication.SignOut();
        return Redirect("/");
    }
  }

ASP.NET Core

Application Startup

    public static class IApplicationBuilderExtensions
    {
        public static void UseIdentityServer(this IApplicationBuilder app, string authority, string clientId)
        {
            app.UseCookieAuthentication(new CookieAuthenticationOptions()
            {
                AutomaticAuthenticate = true,
                AutomaticChallenge = true,
                AuthenticationScheme = CookieAuthenticationDefaults.AuthenticationScheme,
                LoginPath = "/home",
                AccessDeniedPath = new PathString(IdentityConstant.AccessDeniedPath),
                CookieName = "MtAuthCookie",
                SlidingExpiration = true
            });

            JwtSecurityTokenHandler.DefaultInboundClaimTypeMap = new Dictionary<string, string>();           

            var connectOptions = new OpenIdConnectOptions()
            {                
                AutomaticChallenge = true,
                Authority = authority,
                ClientId = clientId,
                ResponseType = "id_token",
                AuthenticationScheme = OpenIdConnectDefaults.AuthenticationScheme,
                SignInScheme = CookieAuthenticationDefaults.AuthenticationScheme,             
                CallbackPath = "/home",
                Events = new OpenIdConnectEvents()
                {
                    OnTokenValidated = async context =>
                    {
                        //create new identity to store only required claims here.                       
                    },
                    OnRedirectToIdentityProvider = async context =>
                    {
                        if (context.ProtocolMessage.RequestType == OpenIdConnectRequestType.Logout)
                        {
                            var idTokenHint = context.HttpContext.User.FindFirst("id_token");
                            if (idTokenHint != null)
                                context.ProtocolMessage.IdTokenHint = idTokenHint.Value;
                        }
                        await Task.FromResult(0);
                    }                    
                }
            };        


            app.UseOpenIdConnectAuthentication(connectOptions);
        }
    }
}

Account Controller has logoff Action

  public class AccountController:Controller
  {
    [HttpPost]
    [ValidateAntiForgeryToken]
    public async Task<IActionResult> LogOff()
    {
        if (User.Identity.IsAuthenticated)
        {
            await HttpContext.Authentication.SignOutAsync(CookieAuthenticationDefaults.AuthenticationScheme);
        }
        return Redirect("/");
    }
  }

Issue
In classic asp.net logoff action is working fine. I see it executes OnRedirectToIdentityProvider event and also context.ProtocolMessage.RequestType is set to LogoutRequest and after that it makes GET request to:

https://login.mydomain.com/identity/connect/endsession?id_token_hint=XXXXXXXXXXXXXX
https://login.mydomain.com/identity/logout?id=XXXXXX
https://login.mydomain.com/identity/connect/endsessioncallback?sid=XXXXXX

and finally user landup on https://devlogin.crowdreason.com/identity/logout?id=xxxx page

However in ASP.NET Core https://login.mydomain.com/identity/connect/endsession never gets invoked upon logoff action. Also i noticed context.ProtocolMessage.RequestType never get set to Logout. In-fact upon logoff user automatically gets authenticated and goes back to home page?

Also

What i am missing in ASP.NET Core? Is there sample available using IdentityServer3 and ASP.NET Core client? (Note i am not using IdentityServer4)

Answer 1

I think there's a different event for that. This works for me:

OnRedirectToIdentityProviderForSignOut = context =>
                {
                    var idTokenHint = context.HttpContext.User.FindFirst("id_token");

                    if (idTokenHint != null)
                    {
                        context.ProtocolMessage.IdTokenHint = idTokenHint.Value;
                    }

                    return Task.FromResult(0);
                }