azure b2c sign out issue - identity provider

Reddy, Santosh M 1 Reputation point
2021-09-21T16:10:32.247+00:00

When user click on sign-out below code get execute, however this code is not clearing the user session, i.e. user is able to sign-in the application with store credential.

Requirement, is user should be prompted again to enter email id and password in case of identity provider log in

Using the below code in signout action method

HttpContext.SignOutAsync(OpenIdConnectDefaults.AuthenticationScheme);
HttpContext.SignOutAsync(CookieAuthenticationDefaults.AuthenticationScheme);
return Redirect("https://login.microsoftonline.com/AD_Tenant_ID/oauth2/v2.0/logout?post_logout_redirect_uri=https://localhost:5000/MicrosoftIdentity/Account/SignedOut");

Microsoft Security | Microsoft Entra | Microsoft Entra External ID
{count} votes

2 answers

Sort by: Most helpful
  1. Reddy, Santosh M 1 Reputation point
    2021-09-22T09:10:45.493+00:00

    Send a sign-out request
    When you want to sign the user out of the application, it isn't enough to clear the application's cookies or otherwise end the session with the user. Redirect the user to Azure AD B2C to sign out. If you fail to do so, the user might be able to reauthenticate to your application without entering their credentials again. For more information, see Azure AD B2C session.

    To sign out the user, redirect the user to the end_session endpoint that is listed in the OpenID Connect metadata document described earlier:
    https://fabrikamb2c.b2clogin.com/fabrikamb2c.onmicrosoft.com/b2c_1_sign_in/v2.0/.well-known/openid-configuration

    Link - https://learn.microsoft.com/en-us/azure/active-directory-b2c/openid-connect,
    https://learn.microsoft.com/en-us/azure/active-directory-b2c/session-behavior?pivots=b2c-user-flow#sign-out

    0 comments No comments

  2. Reddy, Santosh M 1 Reputation point
    2021-09-24T11:13:45.233+00:00

    Please find the attached image, i am able to sign out from federation account, but on log-in it is getting redirected to https://login.microsoftonline.com instead of b2c login page.

    We want to show the user b2c login page.

    135028-b2c-signin.png

    0 comments No comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.