1 First way in ConfigureServices(IServiceCollection services)
.AddWsFederation(options =>
{
options.MetadataAddress = stsConfig.MetadataAddress;
options.RequireHttpsMetadata = true;
options.Events.OnRedirectToIdentityProvider += OnRedirect;
options.Events.OnRemoteSignOut = async context =>
{
await context.HttpContext.SignOutAsync(CookieAuthenticationDefaults.AuthenticationScheme);
context.HandleResponse();
return;
};
});
2 Second way.
ADFS do GET to /signin-wsfed with params to app1 when you signout in app2.
I can't found documentation about it, but see it in debug and logs.
For Asp.net Core 3.1
public void ConfigureServices(IServiceCollection services)
{
...
services.AddScoped<WsFederationAuthCleanupMiddleware>();
...
}
public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
{
...
app.UseMiddleware<WsFederationAuthCleanupMiddleware>();
...
app.UseAuthentication();
...
}
public class WsFederationAuthCleanupMiddleware : IMiddleware
{
private readonly ILogger<WsFederationAuthCleanupMiddleware> _logger;
public WsFederationAuthCleanupMiddleware(ILogger<WsFederationAuthCleanupMiddleware> logger)
{
_logger = logger;
}
public Task InvokeAsync(HttpContext context, RequestDelegate next)
{
var request = context.Request;
// could look for a specific path as well...
if (request.Query.TryGetValue("wa", out var wa) && wa == "wsignoutcleanup1.0")
{
_logger.LogDebug("WsFederationAuthCleanupMiddleware with {@Query}", request.Query);
// Your signin scheme probably cookies
request.HttpContext.SignOutAsync(CookieAuthenticationDefaults.AuthenticationScheme);
return Task.CompletedTask;
}
return next(context);
}
}
