且构网

分享程序员开发的那些事...
且构网 - 分享程序员编程开发的那些事

如何从Windows中的OAuth2.0认证注销的Azure Active Directory身份验证

更新时间:2023-12-03 15:51:58

Clearing cookies you've created will not help you, since the user is still signed-in with the Azure AD. This is howo Web-SSO (Single-Sign-On) works. Regardless of the protocol you use to authenticate with Azure AD, you still need to implement the Sign Out properly - a federated Sign Out! This is the case with any web-sso provider you will find on the internet - Google, Facebook, LinkedIn, Twitter, you name it.

What you do is just signing user out of your Application, not from the identity provider. Once your application redirects the user to the selected identity provider (in your case AAD), if the user has an active session with it, one will not see login screen!

In order to properly implement federated sign-out, you have to read through the Implementing SSO with Azure Active Directory. You can fast forward to the "Implementing Sign Out Controller" step. Which will show a code like this:

public void SignOut()
{
     WsFederationConfiguration fc = 
            FederatedAuthentication.FederationConfiguration.WsFederationConfiguration;

     string request = System.Web.HttpContext.Current.Request.Url.ToString();
     string wreply = request.Substring(0, request.Length - 7);

     SignOutRequestMessage soMessage = 
                     new SignOutRequestMessage(new Uri(fc.Issuer), wreply);
     soMessage.SetParameter("wtrealm", fc.Realm);

     FederatedAuthentication.SessionAuthenticationModule.SignOut();
     Response.Redirect(soMessage.WriteQueryString());
} 

Please read through the entire section (better the entire article) to understand what the code does and why you have to go this way.