title: Azure ACS custom Identity Provider Single SignOut
body: <p>I'm implementing my own identity provider based on Thinktecture code. Here is a strange behaviour of Azure ACS while using a single sign-out feature, it differ for google/live and for my own identity provider. </p>
  
  <p>URL for sign-out (realm is really same as a site name):      </p>
  
  <blockquote>
    <p>mysite.accesscontrol.windows.net/v2/wsfederation?wa=wsignout1.0&amp;wreply=http%3a%2f%2flocalhost%2fAdministration.Frontend.Web%2f&amp;wtrealm=http%3a%2f%2flocalhost%2fAdministration.Frontend.Web%2f</p>
  </blockquote>
  
  <p>Here is a pseudo-code for logout: </p>
  
  <pre><code>//clear FedAuth cookies
  FormsAuthentication.SignOut();
  FederatedAuthentication.WSFederationAuthenticationModule.SignOut(true);
  
  //call Single SignOut
  var signoutRequestMessage = new SignOutRequestMessage(new Uri(signOutUrl));
  return Redirect(signoutRequestMessage.WriteQueryString());
  </code></pre>
  
  <p>Here is sample flow (i'm using private browsing plus Fiddler to see everything):</p>
  
  <p>1) I'm logging into my application with google account. </p>
  
  <p>2) click a logout, in result i get a page on ACS with a this code:</p>
  
  <pre><code>function on_completion() 
    {window.location = 'http://localhost/Administration.Frontend.Web/';}
  
  &lt;iframe src="https://www.google.com/accounts/Logout" style="visibility: hidden""&gt;/iframe&gt;
  &lt;iframe src="http://localhost/Administration.Frontend.Web/?wa=wsignoutcleanup1.0" style="visibility: hidden"&gt;&lt;/iframe&gt;
  </code></pre>
  
  <p>Result: i'm logged out from my application and google.</p>
  
  <p>3) Log to my identity provider, click logout, redirected to same URL on ACS as on previous step but now i get 302 result with redirecting to </p>
  
  <pre><code>https://localhost/IdentityProvider/issue/wsfed?wa=wsignout1.0&amp;amp;wreply=https%3a%2f%2fmysite.accesscontrol.windows.net%2fv2%2fwsfederation%3fredirectUrl%3dhttp%3a%2f%2flocalhost%2fAdministration.Frontend.Web%2f
  </code></pre>
  
  <p>Result: i'm logged out from my application and my identity provider.</p>
  
  <p>4) try to use google again, sucessfully login by entering credential, but logout if failed. I'm logged out from application but not logged from google. And also i see that i don't get page with iframe but instead ACS again try to redirect me to </p>
  
  <pre><code>https://localhost/IdentityProvider/issue/wsfed?wa=wsignout1.0 
  </code></pre>
  
  <p>(and then back to mysite.accesscontrol.windows.net and finally to my application)</p>
  
  <p><strong>Two main question:</strong> </p>
  
  <ol>
  <li>Why calling ACS logout give me iframe page with additional
  wa=wsignoutcleanup1.0 for google/live but 302 redirect to my
  identity provider, may be i miss something in
  FederationMetadata.xml? </li>
  <li>It looks like ACS after step 3 don't
  understand that i successfully logged out from my identity provider
  and from this moment try to do it again and again, how to tell them
  to stop it?</li>
  </ol>