title: Identity Server 4 (ASP.NET Core 2.2) signin-oidc and signout-callback-oidc
body: <p>To start, I'm very new to Identity Server/OIDC/OAuth2. I've hunted around to an answer to my question/our issue, but nothing seems to quite address it or responses are already based on a presumed solid foundation of Identity Server/OIDC.</p>
  
  <p>We've recently ran into an issue of sorts where our users are sometimes hitting/landing and staying on <code>https://ourapp.domain.com/signin-oidc</code>. And naturally are getting a 404 error.</p>
  
  <p>All of my Client configs' <code>RedirectUris</code> and <code>PostLogoutRedirectUris</code> are <code>https://ourapp.domain.com/signin-oidc</code> and <code>https://ourapp.domain.com/signout-callback-oidc</code> respectively.</p>
  
  <p>At first I thought that's where our users were getting this and getting stuck, so I removed <code>/signin-oidc</code> from the uri, and then everything broke essentially. None of my client applications worked. So I replaced <code>/signin-oidc</code> and immediately they all worked again.</p>
  
  <p>Our users will log in on our Identity Server, then they will be sent along to another (separate) application. And this all works when <code>/signin-oidc</code> is specific in the Client config</p>
  
  <p>So where I am confused is how some users are actually landing on <code>/signin-oidc</code> and staying there. Most of the time this doesn't seem to happen.</p>
  
  <p>From my understanding, <code>/signin-oidc</code> is recognized and handled by Middleware and any redirection in the process should all happen automatically.</p>
  
  <p>So is there some property in <code>startup.cs</code> on the Identity Server app or the client config that I'm missing that would help this issue?</p>
  
  <p>Or is there something in the client applications to configure so users don't "get stuck" on <code>https://ourapp.domain.com/signin-oidc</code> ?</p>
  
  <p><strong>Example of one of my Client configs (and they all follow this same basic format)</strong></p>
  
  <pre><code>    clients.Add(new Client
      {
  
          ClientId = "demo-client",
          ClientName = "Demo Client",
          AllowedGrantTypes = GrantTypes.ImplicitAndClientCredentials,
          AlwaysSendClientClaims = true,
  
          RequireConsent = false,
  
          ClientSecrets =
              {
                  new Secret("democlientsecret".Sha256())
              },
  
          // where to redirect to after login
          RedirectUris = { "https://localhost:5003/signin-oidc" },
  
          // where to redirect to after logout
          PostLogoutRedirectUris = { "https://localhost:5003/signout-callback-oidc" },
  
          AllowedScopes = new List&lt;string&gt;
              {
                  IdentityServerConstants.StandardScopes.OpenId,
                  //IdentityServerConstants.StandardScopes.Profile,
                  IdentityServerConstants.StandardScopes.Email,
                  IdentityServerConstants.StandardScopes.OfflineAccess,
                  "role",
                  "name",
                  "idsrv-api-admin.read_only",
                  "idsrv-api-admin.full_access"
  
              },
          AllowOfflineAccess = true,
          AlwaysIncludeUserClaimsInIdToken = true,
          AllowAccessTokensViaBrowser = true
      });
  </code></pre>
  
  <p><strong><code>startup.cs</code> on Identity Server (<code>AddAuthentication</code> and <code>AddIdentityServerAuthentication</code>)</strong></p>
  
  <pre><code>        services.AddAuthentication(IdentityServerAuthenticationDefaults.AuthenticationScheme)
              .AddIdentityServerAuthentication(options =&gt;
              {
                  options.Authority = settings.IDServAppUrl;
                  options.ApiName = settings.ApiResourceName;
                  options.ApiSecret = settings.ApiResourceSecret;
                  options.NameClaimType = "name";
                  options.RoleClaimType = "role";
              });
  </code></pre>
  
  <p><strong><code>startup.cs</code> in a client application (<code>AddAuthentication</code> and <code>AddOpenIdConnect</code>)</strong></p>
  
  <pre><code>        services.AddAuthentication(options =&gt;
          {
  
              options.DefaultScheme = "Cookies";
              options.DefaultChallengeScheme = "oidc";
          })
              .AddCookie("Cookies")
              .AddOpenIdConnect("oidc", options =&gt;
              {
                  options.Authority = config.IDServUrl;
                  options.ClientId = config.IDServClientId;
                  options.ClientSecret = config.IDServClientSecret;
                  options.SaveTokens = true;
                  options.Scope.Clear();
                  options.Scope.Add("openid");
                  options.Scope.Add("email");
                  options.Scope.Add("role");
                  options.Scope.Add("name");
              });
  </code></pre>
  
  <hr>
  
  <p><strong>UPDATE 1</strong></p>
  
  <p>The specific example is</p>
  
  <ol>
  <li>User goes to client application URL</li>
  <li>User is redirected to Identity Server's app to log in </li>
  <li>User logs in </li>
  <li>User goes through simple Two Factor Auth process</li>
  <li>User is sent back to the sending client application based on information in the ReturnUrl query param (contains client_id, client_secret, redirect_uri, etc)</li>
  </ol>
  
  <p>It is at step 5 where users would just end up on, and stay on <code>https://clientapp.domain.com/signin-oidc</code></p>
  
  <p>After I removed <code>/signin-oidc</code> from all of my Client confgurations, trying to navigate to <code>https://clientapp.domain.com</code> would straight up fail. </p>