title: How to sign out user from Blazor server-side app that uses Negotiate
body: <p>I have a Blazor server-side application that uses .NET core 3.1. It uses <code>Microsoft.AspNetCore.Authentication.Negotiate</code> to authenticate user through Windows Credentials/Active Directory.</p>
  
  <p>The issue I have is how to sign out user. After various research I found out that certain external authentication methods do not support sign out. For example Windows/AD does not need to be explicitly signed out. The only thing you need to do is clean identity and Claims principles locally in application. That is what I am having trouble with. The user also signs out automatically when you close browser.</p>
  
  <p>I am using this middle ware to authenticate using Negotiate and am trying to clean claims of user during sign out. But it doesn't work. </p>
  
  <pre><code>using System;
  using System.Collections.Generic;
  using System.Linq;
  using System.Threading.Tasks;
  using Microsoft.AspNetCore.Builder;
  using Microsoft.AspNetCore.Http;
  using Microsoft.AspNetCore.Authentication;
  
  namespace Test.Middleware
  {
      internal class ValidateAuthentication : IMiddleware
      {
          public async Task InvokeAsync(HttpContext context, RequestDelegate next)
          {
              try
              {
                  if (context.User.Identity.IsAuthenticated)
                  {
                      await next(context);
                  }
                  else
                  {
                      await context.ChallengeAsync("Negotiate");
                  }
              }
              catch(InvalidOperationException) // this is for Windows/Negotiate sign out
              {
                  context.User = new System.Security.Claims.ClaimsPrincipal();
              }
          }
      }
  }
  </code></pre>
  
  <p>Here is my configuration of services</p>
  
  <pre><code>public void ConfigureServices(IServiceCollection services)
  {
        services.AddRazorPages();
        services.AddServerSideBlazor();
        services.AddElasticsearch(Configuration);
        services.AddHttpContextAccessor();
        services.AddScoped&lt;ValidateAuthentication&gt;();
        services.AddAuthentication(NegotiateDefaults.AuthenticationScheme).AddNegotiate();
  }
  </code></pre>
  
  <p>Expected result is for user to be signed out. But the actual result is user remains signed in.</p>