I need to ensure that the post_logout_redirect_uri can only direct users to a whitelisted URI, so based on the answer in Azure AD B2C vulnerable to Open Redirect? I added
SingleSignOn Scope="Tenant" EnforceIdTokenHintOnLogout="false"
to the ReplyingParty's UserJourneyBehaviors section in our signin_signup custom policy. However, when go to login I get an error
AADB2C90272: the id_token_hint parameter has not been specified in the request. Please provide token and try again.
When I read Microsoft's documentation it states
pass a previously issued ID token to the logout endpoint as a hint about the end user's current authenticated session with the client
However, the user hasn't logged in yet, so they don't have an ID token issued yet to pass and they aren't allowed to login after receiving this error.
I tried enabling the "ID tokens (used for implicit and hybrid flows)" option in the Application's Authentication tab but that was to no avail since the first redirect to Azure AD B2C adds a post_logout_redirect_uri parameter.
I also tried setting PostLogoutRedirectUri to an empty string, null, and a JWT token from a prior login in OpenIdConnectAuthenticationOptions since it seemed to be where post_logout_redirect_uri was being generated in the redirect to signin_signup also to no avail.
Is the id_token_hint supposed to be the JWTToken returned from Azure AD B2C or is it another ID Token? And does anyone have any C# code showing how the pass it in?