I'm using the Okta as External Identity Provider in Identity Server 4 by OpenID Connect. And I've stucked with the Logout. After I initiate logout process in Identity Server 4, IS4 makes logout request to Okta to the next endpoint:
https://dev-7142444.okta.com/oauth2/v1/logout?....
on this step I got error:
{"errorCode":"invalid_client","errorSummary":"A client_id must be provided in the request.","errorLink":"invalid_client","errorId":"oaeUc84t4IKTFuB-x_6LGtsKA","errorCauses":[]}
To resolve this error, the id-token must be passed as id_token_hint parameter and the following query should be generated:
https://dev-7142444.okta.com/oauth2/v1/logout?id_token_hint=########
This means that it is up to me to manage user tokens. Something like saving at the user login stage, so that later you can use it to exit. We also use Azure AD as another External Identity Provider, and this is not used there, only the logout-url that comes with the metadata is enough. This all makes me want to abandon the implementation of the specific logout that Okta requires for the time being. Instead, I'd like to just have a Url that can be passed in metadata that will use IdentityServer4 out of the box.
I also found the logout url that works without id-token in Okta:
https://dev-7142444.okta.com/login/signout?fromURI=https://localhost:44309/&post_logout_redirect_uri=https://localhost:44309/
And here is my main question.
- How to use this URL to have Identity Server 4 redirect to this URL during External Provider logout?
As I understand correctly Identity Server 4 get Okta LogoutUrl from ".well-known/openid-configuration" metadata from end_session_endpoint field.
{
...
"end_session_endpoint":"https://dev-7142444.okta.com/oauth2/v1/logout",
...
}
- So can I change end_session_endpoint from Okta Administrator Portal? or
- Can I initialize this LogoutUrl on Identity Server 4 side? How todo this? :)
Thanks everyone!