{"action":"closed","issue":{"url":"https://api.github.com/repos/aspnet/Security/issues/1917","repository_url":"https://api.github.com/repos/aspnet/Security","labels_url":"https://api.github.com/repos/aspnet/Security/issues/1917/labels{/name}","comments_url":"https://api.github.com/repos/aspnet/Security/issues/1917/comments","events_url":"https://api.github.com/repos/aspnet/Security/issues/1917/events","html_url":"https://github.com/aspnet/Security/issues/1917","id":382266269,"node_id":"MDU6SXNzdWUzODIyNjYyNjk=","number":1917,"title":"Handling incomplete remote signouts","user":{"login":"karthik25","id":1248984,"node_id":"MDQ6VXNlcjEyNDg5ODQ=","avatar_url":"https://avatars1.githubusercontent.com/u/1248984?v=4","gravatar_id":"","url":"https://api.github.com/users/karthik25","html_url":"https://github.com/karthik25","followers_url":"https://api.github.com/users/karthik25/followers","following_url":"https://api.github.com/users/karthik25/following{/other_user}","gists_url":"https://api.github.com/users/karthik25/gists{/gist_id}","starred_url":"https://api.github.com/users/karthik25/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/karthik25/subscriptions","organizations_url":"https://api.github.com/users/karthik25/orgs","repos_url":"https://api.github.com/users/karthik25/repos","events_url":"https://api.github.com/users/karthik25/events{/privacy}","received_events_url":"https://api.github.com/users/karthik25/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":15,"created_at":"2018-11-19T15:28:38Z","updated_at":"2018-11-20T21:19:11Z","closed_at":"2018-11-20T21:19:10Z","author_association":"NONE","body":"I have an identity server which supports multiple open id providers one of which is B2C. After I upgraded the application from .net core 1.1 to .net core 2.1, the signout redirects have stopped working. The application reaches the `signout-callback-oidc` handler and stops there with an empty page with no information about what went wrong.\r\n\r\nThe production instance that uses .Net 1.1 instance still works. I tried setting the signout url in the list of reply urls for the B2C application as suggested in one of the Q & A sites, but that did not help either. Can you please offer some pointers on how I could identify whats going on? Tried looking up for ways to hook up logging for `AddOpenIdConnect`, but did not find anything for that either. \r\n\r\n## Sequence of urls traversed\r\n\r\n***.Net core 2.1 (Stops at signout-callback-oidc?state=&lt;state&gt; w/ a blank page)***\r\n\r\n* https://login.microsoftonline.com/our-tenant-id/our-policy/oauth2/v2.0/logout?post_logout_redirect_uri=https%3A%2F%2Four-identity-server%2Fsignout-callback-oidc&state=&lt;state&gt;&x-client-SKU=ID_NETSTANDARD1_4&x-client-ver=5.2.0.0\r\n* https://&lt;identity-server&gt;/signout-callback-oidc?state=&lt;state&gt;\r\n\r\n***.Net core 1.1 (Successful)***\r\n\r\n* https://login.microsoftonline.com/te/our-tenant-id/our-policy/oauth2/v2.0/logout?post_logout_redirect_uri=https%3A%2F%2Four-dentity-server%2Fsignout-callback-oidc&state=<state&gt;\r\n* https://&lt;identity-server&gt;/signout-callback-oidc?state=&lt;state&gt;\r\n* https://&lt;identity-server&gt;/account/logout\r\n\r\n## Open ID Setup for B2C\r\n\r\n```csharp\r\n   services.AddOpenIdConnect(adSettingsB2c.SchemeName, adSettingsB2c.DisplayName, options =>\r\n    {\r\n\toptions.SignInScheme = IdentityServerConstants.ExternalCookieAuthenticationScheme;\r\n\toptions.SignOutScheme = IdentityServerConstants.SignoutScheme;\r\n\toptions.Authority = $\"{adSettingsB2c.AADInstance}/{adSettingsB2c.Tenant}/B2C_1_{adSettingsB2c.SignInPolicyId}/v2.0\";\r\n\toptions.CallbackPath = adSettingsB2c.CallbackPath;\r\n\toptions.ClientId = adSettingsB2c.ClientId;\r\n\toptions.ResponseType = OpenIdConnectResponseType.IdToken;\r\n\toptions.SaveTokens = true;\r\n\toptions.TokenValidationParameters = new TokenValidationParameters\r\n\t{\r\n\t    ValidateIssuer = true\r\n\t};\r\n\toptions.Events = new OpenIdConnectEvents\r\n\t{\r\n\t    OnRedirectToIdentityProvider = r =>\r\n\t    {\r\n\t\tvar defaultPolicy = adSettingsB2c.SignInPolicyId;\r\n\t\tif (r.Properties.Items.TryGetValue(\"Policy\", out var policy) &&\r\n\t\t    !policy.Equals(defaultPolicy))\r\n\t\t{\r\n\t\t    r.ProtocolMessage.Scope = OpenIdConnectScope.OpenIdProfile;\r\n\t\t    r.ProtocolMessage.ResponseType = OpenIdConnectResponseType.IdToken;\r\n\t\t    r.ProtocolMessage.IssuerAddress = r.ProtocolMessage.IssuerAddress.ToLower().Replace(defaultPolicy.ToLower(), policy.ToLower());\r\n\t\t    r.Properties.Items.Remove(\"Policy\");\r\n\t\t}\r\n\t\tif (r.Properties.Items.ContainsKey(\"email_address\"))\r\n\t\t{\r\n\t\t    r.ProtocolMessage.SetParameter(\"login_hint\", r.Properties.Items[\"email_address\"]);\r\n\t\t}\r\n\t\treturn Task.FromResult(0);\r\n\t    },\r\n\t    OnRemoteFailure = r => { // ... }\r\n\t};\r\n    })\r\n```\r\n"}}
{"actor":{"display_login":"karthik25"}}