Identity Server 4 - Check iframe session issue - oidc client

Question

I'm using OIDC Client in my angular application for authentication against identity server 4. Everything works fine until i hit sign out.

I've enabled monitor session (enabled by default) so that other browser can detect the sign out and i can log the user out in other tab of the same browser. When I sign out from one tab, the other tab makes a request to the identity server for silent refresh token and that get succeed. I'm expecting the other browser to signout as well. If i hit the F5 in the other tab then yes, it gets redirected to login again. but not automatically.

user_4399281 · Answer

Update

to log out from other clients that share the same identity server frontChannel , you can add an Iframe in your identity to notify your clients about the logout (oidc-client.js supports front-channel signout)

Front-channel server-side clients

To signout the user from the server-side client applications via the front-channel spec, the “logged out” page in IdentityServer must render an to notify the clients that the user has signed out. Clients that wish to be notified must have the FrontChannelLogoutUri configuration value set. IdentityServer tracks which clients the user has signed into, and provides an API called GetLogoutContextAsync on the IIdentityServerInteractionService (details). This API returns a LogoutRequest object with a SignOutIFrameUrl property that your logged out page must render into an .

Back-channel server-side clients

To signout the user from the server-side client applications via the back-channel spec, the SignOutIFrameUrl endpoint in IdentityServer will automatically trigger server-to-server invocation passing a signed sign-out request to the client. This means that even if there are no front-channel clients, the “logged out” page in IdentityServer must still render an to the SignOutIFrameUrl as described above. Clients that wish to be notified must have the BackChannelLogoutUri configuration value set.

Browser-based JavaScript clients

Given how the session management specification is designed, there is nothing special in IdentityServer that you need to do to notify these clients that the user has signed out. The clients, though, must perform monitoring on the check_session_iframe, and this is implemented by the oidc-client JavaScript library.

after that you can listen the event addUserSignedOut of oidc-client in all your clients and trigger signoutRedirect to logout your client

this._userManager.events.addUserSignedOut(() => {
    this._userManager
      .signoutRedirect()
       .then(resp => {
         console.log('Success');
       })
       .catch(err => {
         console.log(err);
       });
 });

check this documentation for more details

Identity Server 4 - Check iframe session issue - oidc client

1 Answers