Azure ADB2C Single Sign Out W/ Azure AD as Identity Provider

user_14183155 0
Viewed 404

I have a React SPA which uses msal. I have configured Azure AD as Identity Provider for my AADB2C. I can signIn/signOut and other operations.

If my user signs out off my application, I want to also sign out of my Identity Provider. I looked a bit into this matter 1, 2, 3, 4, 5.

At this moment, I use msal's logoutRedirect method.

const url = new URL(AadEndSessionEndpoint);
url.searchParams.append('post_logout_redirect_uri', SPAUrl);
instance.logoutRedirect({
  postLogoutRedirectUri: url.toString()
});

What happens, after my user signs out of my AADB2C, he gets redirected to the AAD end_session_endpoint. I can sign out there as well, but my user gets stuck there. Even though I'm passing the post_logout_redirect_uri query parameter to go back to my app, it ignores it.

How could I make this work?

msal.js azure-ad-b2c azure-active-directory openid-connect azure
1 Answers

You are doing an RP Initiated Logout in OpenID Connect terms, meaning you need to also send the id_token_hint query parameter.

I can also confirm that sending both query string parameters logs out successfully for my Azure developer account:

url.searchParams.append('post_logout_redirect_uri', SPAUrl);
url.searchParams.append('id_token_hint', myIdToken);

I think the MSAL library requires you to use getAccount instead:

const account = msalInstance.getAccount();
await msalInstance.logoutRedirect({
    account,
    postLogoutRedirectUri: "https://contoso.com/loggedOut"
});

UPDATE

Your code above is not right - the post logout redirect URI should be that of your own app - I expect the library already knows the end session endpoint location - so just do this:

instance.logoutRedirect({
  postLogoutRedirectUri: SPAUrl
});

At the same time it is worth being aware that the full standards based GET URL should look like this. With the knowledge of the expected URL you can check that you are sending the right request via browser tools:

https://[AadEndSessionEndpoint]?id_token_hint=[myIdToken]&post_logout_redirect_uri=[SPAUrl]

The end session endpoint should be a value such as this by the way:

user_90198850
Related