{"action":"created","issue":{"url":"https://api.github.com/repos/IdentityServer/IdentityServer4/issues/474","repository_url":"https://api.github.com/repos/IdentityServer/IdentityServer4","labels_url":"https://api.github.com/repos/IdentityServer/IdentityServer4/issues/474/labels{/name}","comments_url":"https://api.github.com/repos/IdentityServer/IdentityServer4/issues/474/comments","events_url":"https://api.github.com/repos/IdentityServer/IdentityServer4/issues/474/events","html_url":"https://github.com/IdentityServer/IdentityServer4/issues/474","id":188459104,"number":474,"title":"Issue with Single Log-out (SLO)","user":{"login":"JonasAxelsson","id":1220561,"avatar_url":"https://avatars.githubusercontent.com/u/1220561?v=3","gravatar_id":"","url":"https://api.github.com/users/JonasAxelsson","html_url":"https://github.com/JonasAxelsson","followers_url":"https://api.github.com/users/JonasAxelsson/followers","following_url":"https://api.github.com/users/JonasAxelsson/following{/other_user}","gists_url":"https://api.github.com/users/JonasAxelsson/gists{/gist_id}","starred_url":"https://api.github.com/users/JonasAxelsson/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/JonasAxelsson/subscriptions","organizations_url":"https://api.github.com/users/JonasAxelsson/orgs","repos_url":"https://api.github.com/users/JonasAxelsson/repos","events_url":"https://api.github.com/users/JonasAxelsson/events{/privacy}","received_events_url":"https://api.github.com/users/JonasAxelsson/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2016-11-10T09:30:36Z","updated_at":"2016-11-10T09:37:59Z","closed_at":null,"body":"Hi,\r\n\r\nI'm having a issue when performing single log-out  in IdentityServer4.\r\n\r\nI have two MVC clients configured to use the hybrid flow.\r\n\r\nThe cookie middleware in each client is using different CookieName in the CookieAuthenticationOptions. \r\n\r\nShould different clients share same cookie name or do they need to have separate session cookies?\r\n\r\nI have a **HomeController.cs** with a **Logout** action method i each client\r\n```\r\n        public IActionResult Logout()\r\n        {\r\n            return new SignOutResult(new List<string>() { \"cookie\", \"oidc\" });\r\n        }\r\n```\r\n\r\nTheses steps describes my issue:\r\n1. Visit a controller action with the [authorize] filter in mvcclienta.\r\n2. User gets redirected to IdentityServer4 login page.\r\n3. User is now authenticated and gets a session in both IdentityServer4 and mvcclienta.\r\n4. User then browses a controller action with the [authorize] filter in mvcclientb.\r\n5. Since the user already have a session in IdentityServer4 he don't get prompted to login in IdentityServer4 login page.\r\n6.  User is now authenticated and gets a session in mvcclientb.\r\n7. Currently the user have the following cookies stored in the browser:\r\nidsvr\r\nidsvr.session\r\ncompanyname.auth.mvcclienta\r\ncompanyname.auth.mvcclientaC1\r\ncompanyname.auth.mvcclientaC2\r\ncompanyname.auth.mvcclientb\r\ncompanyname.auth.mvcclientbC1\r\ncompanyname.auth.mvcclientbC2\r\n.AspNetCore.Antiforgery.xxxxxxxx\r\n8. User then push button to invoke HomeController Logout action method.\r\n9. User gets prompted in IdentityServer4 \r\n> Logout\r\n> Would you like to logout of IdentityServer?\r\n10. User press Yes button and a page displays the following\r\n> Logout You are now logged out\r\n> Click here to return to the MVC Client A application.\r\n\r\nThe results of the 10 above steps is that the user session in IdentityServer4 is gone and also the session in mvcclienta. But the user is still authenticated and has a session in mvcclientb. The user have the following cookies stored in the browser:\r\ncompanyname.auth.mvcclientb\r\ncompanyname.auth.mvcclientbC1\r\ncompanyname.auth.mvcclientbC2\r\n.AspNetCore.Antiforgery.xxxxxxxx\r\n\r\nI can see a failure in the kestrel log of mvcclientb \r\n> fail: Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectMiddleware[48]\r\n>       The remote signout request was ignored because the 'sid' parameter didn't match the expected value, which may indicate an unsolicited logout.\r\n\r\nHere is the logs from the above 10 steps:\r\n[kestrel logs - mvcclienta.txt](https://github.com/IdentityServer/IdentityServer4/files/582940/kestrel.logs.-.mvcclienta.txt)\r\n[kestrel logs - mvcclientb.txt](https://github.com/IdentityServer/IdentityServer4/files/582941/kestrel.logs.-.mvcclientb.txt)\r\n[kestrel logs - identityserver4.txt](https://github.com/IdentityServer/IdentityServer4/files/582942/kestrel.logs.-.identityserver4.txt)\r\n\r\n**Clients.cs** in IdentityServer4 configuration\r\n```\r\n    public class Clients\r\n    {\r\n        public static IEnumerable<Client> Get()\r\n        {\r\n            return new List<Client>\r\n            {\r\n                new Client\r\n                {\r\n                    ClientId = \"mvcclienta\",\r\n                    ClientName = \"MVC Client A\",\r\n                    Enabled = true,\r\n                    RequireConsent = false,\r\n                    ClientSecrets = new List<Secret>\r\n                    {\r\n                        new Secret(\"secretmvcclienta\".Sha256())\r\n                    },\r\n                    AllowedGrantTypes = GrantTypes.Hybrid,\r\n                    AllowAccessTokensViaBrowser = false,\r\n                    RedirectUris = new List<string>\r\n                    {\r\n                        \"http://localhost:5003/signin-oidc\"\r\n                    },\r\n                    LogoutUri = \"http://localhost:5003/signout-oidc\",\r\n                    PostLogoutRedirectUris = new List<string>\r\n                    {\r\n                        \"http://localhost:5003/\"\r\n                    },\r\n                    AllowedScopes = new List<string>\r\n                    {\r\n                        StandardScopes.OpenId.Name,\r\n                        StandardScopes.Profile.Name,\r\n                        StandardScopes.Email.Name,\r\n                        StandardScopes.Roles.Name\r\n                    }\r\n                },\r\n                new Client\r\n                {\r\n                    ClientId = \"mvcclientb\",\r\n                    ClientName = \"MVC Client B\",\r\n                    Enabled = true,\r\n                    RequireConsent = false,\r\n                    ClientSecrets = new List<Secret>\r\n                    {\r\n                        new Secret(\"secrectmvcclientb\".Sha256())\r\n                    },\r\n                    AllowedGrantTypes = GrantTypes.Hybrid,\r\n                    AllowAccessTokensViaBrowser = false,\r\n                    RedirectUris = new List<string>\r\n                    {\r\n                        \"http://localhost:5004/signin-oidc\"\r\n                    },\r\n                    LogoutUri = \"http://localhost:5004/signout-oidc\",\r\n                    PostLogoutRedirectUris = new List<string>\r\n                    {\r\n                        \"http://localhost:5004/\"\r\n                    },\r\n                    AllowedScopes = new List<string>\r\n                    {\r\n                        StandardScopes.OpenId.Name,\r\n                        StandardScopes.Profile.Name,\r\n                        StandardScopes.Email.Name,\r\n                        StandardScopes.Roles.Name\r\n                    }\r\n                }\r\n            };\r\n        }\r\n    }\r\n```\r\n\r\n**Startup.cs** of MVC client \"mvcclienta\"\r\n```\r\npublic void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerFactory loggerFactory)\r\n        {\r\n            if (_hostingEnvironment.IsDevelopment())\r\n            {\r\n                loggerFactory.AddConsole();\r\n                app.UseDeveloperExceptionPage();\r\n            }\r\n            else\r\n            {\r\n                app.UseExceptionHandler(\"/Home/Error\");\r\n            }\r\n            app.UseStaticFiles();\r\n            app.UseCookieAuthentication(new CookieAuthenticationOptions\r\n            {\r\n                AuthenticationScheme = \"cookie\",\r\n                CookieName = \"companyname.auth.mvcclienta\",\r\n                CookieHttpOnly = true,\r\n                CookieSecure = _hostingEnvironment.IsDevelopment() ? CookieSecurePolicy.SameAsRequest : CookieSecurePolicy.Always,\r\n                AutomaticAuthenticate = true,\r\n                AutomaticChallenge = false,\r\n                ExpireTimeSpan = TimeSpan.FromMinutes(60)\r\n            });\r\n            JwtSecurityTokenHandler.DefaultInboundClaimTypeMap.Clear();\r\n            var oidcOptions = new OpenIdConnectOptions\r\n            {\r\n                AuthenticationScheme = \"oidc\",\r\n                SignInScheme = \"cookie\",\r\n                Authority = \"http://localhost:5001/\",\r\n                RequireHttpsMetadata = _hostingEnvironment.IsDevelopment() ? false : true,\r\n                PostLogoutRedirectUri = \"http://localhost:5003/\",\r\n                ClientId = \"mvcclienta\",\r\n                ClientSecret = \"secretmvcclienta\",\r\n                ResponseType = \"code id_token\",\r\n                SaveTokens = true,\r\n                GetClaimsFromUserInfoEndpoint = true,  \r\n                TokenValidationParameters = new TokenValidationParameters\r\n                {\r\n                    NameClaimType = \"name\",\r\n                    RoleClaimType = \"role\"\r\n                }\r\n            };\r\n            oidcOptions.Scope.Clear();\r\n            oidcOptions.Scope.Add(\"openid\");\r\n            oidcOptions.Scope.Add(\"profile\");\r\n            oidcOptions.Scope.Add(\"email\");\r\n            oidcOptions.Scope.Add(\"roles\");\r\n            app.UseOpenIdConnectAuthentication(oidcOptions);\r\n            app.UseMvcWithDefaultRoute();\r\n        }\r\n```\r\n**Startup.cs** of MVC client \"mvcclientb\" (equal to mvcclienta beside different ports and replaced the string mvcclienta with mvcclientb for different property settings)\r\n```\r\npublic void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerFactory loggerFactory)\r\n        {\r\n            if (_hostingEnvironment.IsDevelopment())\r\n            {\r\n                loggerFactory.AddConsole();\r\n                app.UseDeveloperExceptionPage();\r\n            }\r\n            else\r\n            {\r\n                app.UseExceptionHandler(\"/Home/Error\");\r\n            }\r\n            app.UseStaticFiles();\r\n            app.UseCookieAuthentication(new CookieAuthenticationOptions\r\n            {\r\n                AuthenticationScheme = \"cookie\",\r\n                CookieName = \"companyname.auth.mvcclientb\",\r\n                CookieHttpOnly = true,\r\n                CookieSecure = _hostingEnvironment.IsDevelopment() ? CookieSecurePolicy.SameAsRequest : CookieSecurePolicy.Always,\r\n                AutomaticAuthenticate = true,\r\n                AutomaticChallenge = false,\r\n                ExpireTimeSpan = TimeSpan.FromMinutes(60)\r\n            });\r\n            JwtSecurityTokenHandler.DefaultInboundClaimTypeMap.Clear();\r\n            var oidcOptions = new OpenIdConnectOptions\r\n            {\r\n                AuthenticationScheme = \"oidc\",\r\n                SignInScheme = \"cookie\",\r\n                Authority = \"http://localhost:5001/\",\r\n                RequireHttpsMetadata = _hostingEnvironment.IsDevelopment() ? false : true,\r\n                PostLogoutRedirectUri = \"http://localhost:5004/\",\r\n                ClientId = \"mvcclientb\",\r\n                ClientSecret = \"secretmvcclientb\",\r\n                ResponseType = \"code id_token\",\r\n                SaveTokens = true,\r\n                GetClaimsFromUserInfoEndpoint = true,  \r\n                TokenValidationParameters = new TokenValidationParameters\r\n                {\r\n                    NameClaimType = \"name\",\r\n                    RoleClaimType = \"role\"\r\n                }\r\n            };\r\n            oidcOptions.Scope.Clear();\r\n            oidcOptions.Scope.Add(\"openid\");\r\n            oidcOptions.Scope.Add(\"profile\");\r\n            oidcOptions.Scope.Add(\"email\");\r\n            oidcOptions.Scope.Add(\"roles\");\r\n            app.UseOpenIdConnectAuthentication(oidcOptions);\r\n            app.UseMvcWithDefaultRoute();\r\n        }\r\n```"},"comment":{"url":"https://api.github.com/repos/IdentityServer/IdentityServer4/issues/comments/259644089","html_url":"https://github.com/IdentityServer/IdentityServer4/issues/474#issuecomment-259644089","issue_url":"https://api.github.com/repos/IdentityServer/IdentityServer4/issues/474","id":259644089,"user":{"login":"JonasAxelsson","id":1220561,"avatar_url":"https://avatars.githubusercontent.com/u/1220561?v=3","gravatar_id":"","url":"https://api.github.com/users/JonasAxelsson","html_url":"https://github.com/JonasAxelsson","followers_url":"https://api.github.com/users/JonasAxelsson/followers","following_url":"https://api.github.com/users/JonasAxelsson/following{/other_user}","gists_url":"https://api.github.com/users/JonasAxelsson/gists{/gist_id}","starred_url":"https://api.github.com/users/JonasAxelsson/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/JonasAxelsson/subscriptions","organizations_url":"https://api.github.com/users/JonasAxelsson/orgs","repos_url":"https://api.github.com/users/JonasAxelsson/repos","events_url":"https://api.github.com/users/JonasAxelsson/events{/privacy}","received_events_url":"https://api.github.com/users/JonasAxelsson/received_events","type":"User","site_admin":false},"created_at":"2016-11-10T09:37:59Z","updated_at":"2016-11-10T09:37:59Z","body":"### JWT Header & Payload\r\n{\r\n  \"alg\": \"RS256\",\r\n  \"kid\": \"09c773bd7ccb4ccdeb8398ee9fedf5a4a4b099f2a559338acbe991fd9272683b\",\r\n  \"typ\": \"JWT\"\r\n}\r\n{\r\n  \"nbf\": 1478765478,\r\n  \"exp\": 1478765778,\r\n  \"iss\": \"http://localhost:5001\",\r\n  \"aud\": \"mvcclienta\",\r\n  \"nonce\": \"636143622713626008.N2Q3NWNkYjAtNmVmOC00NjJjLTkzNzYtYWRjNmM5NmQ2ZDg2ZTdjOTkyNTEtYjc0Ny00NzA5LTgxY2YtNWNiN2RjYzNlMDNk\",\r\n  \"iat\": 1478765478,\r\n  \"sid\": \"1b938e630078d1e1d74c734d8b7637750ec4506a3efa25aea4081a1d9d26ea56\",\r\n  \"sub\": \"JohnDoe GUID\",\r\n  \"auth_time\": 1478765477,\r\n  \"idp\": \"local\",\r\n  \"amr\": [\r\n    \"pwd\"\r\n  ]\r\n}"}}
{"actor":{"display_login":"JonasAxelsson"}}