Azure AD B2C does not log out properly in Edge

From the AD B2C sample from Microsoft, I was able to successfully login and log out of my own tenant in all browsers, except Edge, where logout is behaving oddly.

Problem: Upon logout in Edge and then a subsequent attempt at a new login, the browser gets quickly redirected to Azure and then the previous user seems to be auto logged in by Azure without prompt for credentials. This is obviously not what we want.

Effectively, logout doesn't seem to be successful at all in Edge, and we have to wait for the Azure session to timeout to try to login properly again. This is only happening in the deployed dev instance and not when running locally in Edge.

Question: Is there some workaround for getting complete logout to work in Edge? Why might I be experiencing this only in Edge?

public void Login( )

        {

            //Use the default policy (specified in Startup.Auth) to process the sign up / sign in flow

            if (!Request.IsAuthenticated)

            {

                HttpContext.GetOwinContext().Authentication.Challenge();

                return;

            }

            Response.Redirect("/");

        }

Logout Method:

/*

    *  Called when requesting to sign out

    */

    public void SignOut( )

    {

        // To sign out the user, you should issue an OpenIDConnect sign out request.

        if (Request.IsAuthenticated)

        {

            IEnumerable<AuthenticationDescription> authTypes = HttpContext.GetOwinContext().Authentication.GetAuthenticationTypes();

            HttpContext.GetOwinContext().Authentication.SignOut( authTypes.Select(t => t.AuthenticationType).ToArray());

        }

    }

I tried adding Session.RemoveAll(); Session.Abandon(); in the logout but that did not work.

The Startup method is as shown in the sample as well.

app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);



            app.UseCookieAuthentication(new CookieAuthenticationOptions());



            app.UseOpenIdConnectAuthentication(

...);

...

edited Nov 21 '18 at 17:21

asked Nov 21 '18 at 17:16

Anne

add a comment |

From the AD B2C sample from Microsoft, I was able to successfully login and log out of my own tenant in all browsers, except Edge, where logout is behaving oddly.

Question: Is there some workaround for getting complete logout to work in Edge? Why might I be experiencing this only in Edge?

public void Login( )

        {

            //Use the default policy (specified in Startup.Auth) to process the sign up / sign in flow

            if (!Request.IsAuthenticated)

            {

                HttpContext.GetOwinContext().Authentication.Challenge();

                return;

            }

            Response.Redirect("/");

        }

Logout Method:

/*

    *  Called when requesting to sign out

    */

    public void SignOut( )

    {

        // To sign out the user, you should issue an OpenIDConnect sign out request.

        if (Request.IsAuthenticated)

        {

            IEnumerable<AuthenticationDescription> authTypes = HttpContext.GetOwinContext().Authentication.GetAuthenticationTypes();

            HttpContext.GetOwinContext().Authentication.SignOut( authTypes.Select(t => t.AuthenticationType).ToArray());

        }

    }

I tried adding Session.RemoveAll(); Session.Abandon(); in the logout but that did not work.

The Startup method is as shown in the sample as well.

app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);



            app.UseCookieAuthentication(new CookieAuthenticationOptions());



            app.UseOpenIdConnectAuthentication(

...);

...

edited Nov 21 '18 at 17:21

asked Nov 21 '18 at 17:16

Anne

add a comment |

From the AD B2C sample from Microsoft, I was able to successfully login and log out of my own tenant in all browsers, except Edge, where logout is behaving oddly.

Question: Is there some workaround for getting complete logout to work in Edge? Why might I be experiencing this only in Edge?

public void Login( )

        {

            //Use the default policy (specified in Startup.Auth) to process the sign up / sign in flow

            if (!Request.IsAuthenticated)

            {

                HttpContext.GetOwinContext().Authentication.Challenge();

                return;

            }

            Response.Redirect("/");

        }

Logout Method:

/*

    *  Called when requesting to sign out

    */

    public void SignOut( )

    {

        // To sign out the user, you should issue an OpenIDConnect sign out request.

        if (Request.IsAuthenticated)

        {

            IEnumerable<AuthenticationDescription> authTypes = HttpContext.GetOwinContext().Authentication.GetAuthenticationTypes();

            HttpContext.GetOwinContext().Authentication.SignOut( authTypes.Select(t => t.AuthenticationType).ToArray());

        }

    }

I tried adding Session.RemoveAll(); Session.Abandon(); in the logout but that did not work.

The Startup method is as shown in the sample as well.

app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);



            app.UseCookieAuthentication(new CookieAuthenticationOptions());



            app.UseOpenIdConnectAuthentication(

...);

...

edited Nov 21 '18 at 17:21

asked Nov 21 '18 at 17:16

Anne

From the AD B2C sample from Microsoft, I was able to successfully login and log out of my own tenant in all browsers, except Edge, where logout is behaving oddly.

Question: Is there some workaround for getting complete logout to work in Edge? Why might I be experiencing this only in Edge?

public void Login( )

        {

            //Use the default policy (specified in Startup.Auth) to process the sign up / sign in flow

            if (!Request.IsAuthenticated)

            {

                HttpContext.GetOwinContext().Authentication.Challenge();

                return;

            }

            Response.Redirect("/");

        }

Logout Method:

/*

    *  Called when requesting to sign out

    */

    public void SignOut( )

    {

        // To sign out the user, you should issue an OpenIDConnect sign out request.

        if (Request.IsAuthenticated)

        {

            IEnumerable<AuthenticationDescription> authTypes = HttpContext.GetOwinContext().Authentication.GetAuthenticationTypes();

            HttpContext.GetOwinContext().Authentication.SignOut( authTypes.Select(t => t.AuthenticationType).ToArray());

        }

    }

I tried adding Session.RemoveAll(); Session.Abandon(); in the logout but that did not work.

The Startup method is as shown in the sample as well.

app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);



            app.UseCookieAuthentication(new CookieAuthenticationOptions());



            app.UseOpenIdConnectAuthentication(

...);

...

microsoft-edge logout azure-ad-b2c

edited Nov 21 '18 at 17:21

asked Nov 21 '18 at 17:16

Anne

edited Nov 21 '18 at 17:21

asked Nov 21 '18 at 17:16

Anne

edited Nov 21 '18 at 17:21

asked Nov 21 '18 at 17:16

Anne

asked Nov 21 '18 at 17:16

Anne

asked Nov 21 '18 at 17:16

Anne

add a comment |

1 Answer
1

active

oldest

votes

Please refer to the description on Azure Document:

When you want to sign the user out of the app, it is not enough to
clear your app's cookies or otherwise end the session with the user.
You must also redirect the user to Azure AD to sign out. If you fail
to do so, the user might be able to reauthenticate to your app without
entering their credentials again. This is because they will have a
valid single sign-on session with Azure AD.

So, you can simply redirect the user to the end_session endpoint:

GET https://fabrikamb2c.b2clogin.com/fabrikamb2c.onmicrosoft.com/oauth2/v2.0/logout?

p=b2c_1_sign_in

&post_logout_redirect_uri=https%3A%2F%2Faadb2cplayground.azurewebsites.net%2F

More details, please refer to Azure Active Directory B2C: Web sign-in with OpenID Connect

answered Nov 22 '18 at 9:11

Zhi Lv - MSFT

59234

I am doing the redirect to the oauth logout endpoint via HttpContext.GetOwinContext().Authentication.SignOut. I have verified in the network calls we are redirecting to that endpoint

– Anne
Nov 29 '18 at 23:00

add a comment |

Your Answer

StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");

StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});

function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});

}
});

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53417407%2fazure-ad-b2c-does-not-log-out-properly-in-edge%23new-answer', 'question_page');
}
);

Post as a guest

Name

Required, but never shown

1 Answer
1

active

oldest

votes

1 Answer
1

active

oldest

votes

Please refer to the description on Azure Document:

When you want to sign the user out of the app, it is not enough to
clear your app's cookies or otherwise end the session with the user.
You must also redirect the user to Azure AD to sign out. If you fail
to do so, the user might be able to reauthenticate to your app without
entering their credentials again. This is because they will have a
valid single sign-on session with Azure AD.

So, you can simply redirect the user to the end_session endpoint:

GET https://fabrikamb2c.b2clogin.com/fabrikamb2c.onmicrosoft.com/oauth2/v2.0/logout?

p=b2c_1_sign_in

&post_logout_redirect_uri=https%3A%2F%2Faadb2cplayground.azurewebsites.net%2F

More details, please refer to Azure Active Directory B2C: Web sign-in with OpenID Connect

answered Nov 22 '18 at 9:11

Zhi Lv - MSFT

59234

I am doing the redirect to the oauth logout endpoint via HttpContext.GetOwinContext().Authentication.SignOut. I have verified in the network calls we are redirecting to that endpoint

– Anne
Nov 29 '18 at 23:00

add a comment |

Please refer to the description on Azure Document:

When you want to sign the user out of the app, it is not enough to
clear your app's cookies or otherwise end the session with the user.
You must also redirect the user to Azure AD to sign out. If you fail
to do so, the user might be able to reauthenticate to your app without
entering their credentials again. This is because they will have a
valid single sign-on session with Azure AD.

So, you can simply redirect the user to the end_session endpoint:

GET https://fabrikamb2c.b2clogin.com/fabrikamb2c.onmicrosoft.com/oauth2/v2.0/logout?

p=b2c_1_sign_in

&post_logout_redirect_uri=https%3A%2F%2Faadb2cplayground.azurewebsites.net%2F

More details, please refer to Azure Active Directory B2C: Web sign-in with OpenID Connect

answered Nov 22 '18 at 9:11

Zhi Lv - MSFT

59234

I am doing the redirect to the oauth logout endpoint via HttpContext.GetOwinContext().Authentication.SignOut. I have verified in the network calls we are redirecting to that endpoint

– Anne
Nov 29 '18 at 23:00

add a comment |

Please refer to the description on Azure Document:

When you want to sign the user out of the app, it is not enough to
clear your app's cookies or otherwise end the session with the user.
You must also redirect the user to Azure AD to sign out. If you fail
to do so, the user might be able to reauthenticate to your app without
entering their credentials again. This is because they will have a
valid single sign-on session with Azure AD.

So, you can simply redirect the user to the end_session endpoint:

GET https://fabrikamb2c.b2clogin.com/fabrikamb2c.onmicrosoft.com/oauth2/v2.0/logout?

p=b2c_1_sign_in

&post_logout_redirect_uri=https%3A%2F%2Faadb2cplayground.azurewebsites.net%2F

More details, please refer to Azure Active Directory B2C: Web sign-in with OpenID Connect

answered Nov 22 '18 at 9:11

Zhi Lv - MSFT

59234

Please refer to the description on Azure Document:

When you want to sign the user out of the app, it is not enough to
clear your app's cookies or otherwise end the session with the user.
You must also redirect the user to Azure AD to sign out. If you fail
to do so, the user might be able to reauthenticate to your app without
entering their credentials again. This is because they will have a
valid single sign-on session with Azure AD.

So, you can simply redirect the user to the end_session endpoint:

GET https://fabrikamb2c.b2clogin.com/fabrikamb2c.onmicrosoft.com/oauth2/v2.0/logout?

p=b2c_1_sign_in

&post_logout_redirect_uri=https%3A%2F%2Faadb2cplayground.azurewebsites.net%2F

More details, please refer to Azure Active Directory B2C: Web sign-in with OpenID Connect

answered Nov 22 '18 at 9:11

Zhi Lv - MSFT

59234

answered Nov 22 '18 at 9:11

Zhi Lv - MSFT

59234

answered Nov 22 '18 at 9:11

Zhi Lv - MSFT

59234

answered Nov 22 '18 at 9:11

Zhi Lv - MSFT

59234

I am doing the redirect to the oauth logout endpoint via HttpContext.GetOwinContext().Authentication.SignOut. I have verified in the network calls we are redirecting to that endpoint

– Anne
Nov 29 '18 at 23:00

add a comment |

I am doing the redirect to the oauth logout endpoint via HttpContext.GetOwinContext().Authentication.SignOut. I have verified in the network calls we are redirecting to that endpoint

– Anne
Nov 29 '18 at 23:00

I am doing the redirect to the oauth logout endpoint via HttpContext.GetOwinContext().Authentication.SignOut. I have verified in the network calls we are redirecting to that endpoint

– Anne
Nov 29 '18 at 23:00

add a comment |

draft saved

draft discarded

Thanks for contributing an answer to Stack Overflow!

Please be sure to answer the question. Provide details and share your research!

But avoid …

Asking for help, clarification, or responding to other answers.

Making statements based on opinion; back them up with references or personal experience.

To learn more, see our tips on writing great answers.

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Name

Required, but never shown

Name

Required, but never shown

This page is only for reference, If you need detailed information, please check here

Search This Blog

Ufyukyu