Logout from dotnetcore app authenticated by onelogin using oauth

Question

I am using below app to connect onelogin through my .Netcore2.2 web app.Onelogin logout from .NetCore 2.2 mvc webapp.

I am using onelogin to authenticate users and logged into the system in dotnetcore2.2. for onelogin i have used OAuth for authentication. user can log in successfully but not able to logout from app as there is no proper documentation provided by onelogin.

what i did is revoke that token successfully then use HttpContext.SignoutAsync() to logout from webapp. but its not working.

Anybody have solution on above problem.

Thanks in advance.

var options = new OAuthOptions
        {
            AuthorizationEndpoint = "https://demo.onelogin.com/oidc/auth",
            UserInformationEndpoint = "https://demo.onelogin.com/oidc/me",
            TokenEndpoint = "https://demo.onelogin.com/oidc/token",
            CallbackPath = new PathString("/callback"),
            ClaimsIssuer = "https://openid-connect.onelogin.com/oidc",
            ClientId = "2fljk230-9456-0975-5hgd-02649b659666158745",
            ClientSecret = "7856f543awer33948968b0fgh5b82d4c21a1e29fec87365c32341ba72e20g89",
            SaveTokens = true,

above is for Onelogin OAuth configuration

var client = new HttpClient();
        var formData = new FormUrlEncodedContent(new[]
            {
          new KeyValuePair<string, string>("token", accessToken),
          new KeyValuePair<string, string>("token_type_hint", "access_token"),
          new KeyValuePair<string, string>("client_id", "2fljk230-9456-0975-5hgd-02649b659666158745"),
          new KeyValuePair<string, string>("client_secret", "7856f543awer33948968b0fgh5b82d4c21a1e29fec87365c32341ba72e20g89")
      });

        var uri = String.Format("https://openid-connect.onelogin.com/oidc/token/revocation");

        var res = await client.PostAsync(uri, formData);

Welcome to Stack Overflow! Could you please edit your question to add more details, including the code that is causing this issue? — jkdev
my first step is to Revoke onleogin token and then signout from the onelogin. Is this Correct? Please help me to get rid from this situation. I can login successfully, get users using apis, but not able to LogOut. I tried other providers like OKTA,PingOne they logged just by redirecting to their logout url by passing idtoken and postLogoutRedirectUri. — suraj kumbhar

niall_atlasidentity niall_atlasidentity · Accepted Answer · 2019-08-06T12:35:12

There are a couple of things you need to consider here. You have the tokens issued by Onelogin, but you also have a session with Onelogin which is what provides your user with SSO.

To be clear, there is no one clean way to log a user out of Onelogin using OIDC. So my recommendation is;

Kill all tokens locally. This will leave the tokens as valid in Onelogin for a period of time, but they only exist in Onelogin so the risk surface is minimal.
Kill the Onelogin session. You could try sending the user to https://login.ourtesco.com/logout but for belt and braces you'll need this API, which should only be available to you if you have a backend to the app to allow you to protected the clientid/secret appropriately. https://developers.onelogin.com/api-docs/1/users/log-user-out

Logout from dotnetcore app authenticated by onelogin using oauth

1 Answers