How can I keep my identity server session in sync with an external identity provider?

user_6346904 0
Viewed 683

I am using IdentityServer4 to provide SSO and SLO to several web apps. The user may sign in to the identity server through an external OIDC provider such as Azure AD. The external provider, identity server, and web apps are all configured to use persistent sessions that last for weeks or months at a time.

This setup works fine and the user can sign in as expected. The issue is I have a requirement for all sessions to stay in sync, so when the external provider session expires, the expiration propagates to my identity server and then to my web apps.

This requirement is to ensure that none of the sessions further down the chain outlive their provider's session which would break SLO functionality. For example if my identity server session outlives the Azure AD session it depends on, the user can sign into Azure AD again, but will not be able to SLO from my identity server and web apps through Azure AD since the Azure AD session has changed, and my identity server depends on the now-expired Azure AD session.

I am able to enforce this requirement between my identity server and web apps using a check_session iframe and passive authentication requests with prompt=none. But I cannot figure out how to enforce a similar type of requirement between an external provider and my identity server in a way that will both end my identity server session and notify my web apps.

How can I keep my identity server session in sync with an external identity provider? If this is not possible, what is a correct approach to ensuring SSO and SLO sessions do not get out of sync between the external provider, identity server, and web apps?

identityserver4 asp.net-core openid-connect
1 Answers

The solution for this is federated signout

Federated sign-out is the situation where a user has used an external identity provider to log into IdentityServer, and then the user logs out of that external identity provider via a workflow unknown to IdentityServer. When the user signs out, it will be useful for IdentityServer to be notified so that it can sign the user out of IdentityServer and all of the applications that use IdentityServer.

To implement you need to set RemoteSignOutPath when adding AzureAD as external IDP.

services.AddAuthentication()
        .AddOpenIdConnect("aad", "Azure AD", options =>
        {
            options.ClientId = "<Your Application (client) ID>";
            options.Authority = "https://login.windows.net/<Directory (tenant) ID>";
            options.CallbackPath = "/signin-aad";
            options.SignedOutCallbackPath = "/signout-callback-aad";
            options.RemoteSignOutPath = "/signout-aad";
        });

here is a nice blog explaining it with IdentityServer4 (reference blogs on the bottom are very useful too)

user_34865670
Related