Question

我无法弄清楚我在这里做错了什么。我几乎所有的东西都在身份服务器3中运行，我不认为自己是那里的新手，但是在使用生成的链接注销后，我真的很难从javascript应用程序自动重定向到我选择的重定向URL。为简洁起见，省略了一些内容（例如完整的jwt令牌）。

这是我的要求：

https://identity.mysite.com/id/connect/endsession?id_token_hint=jwt-id-token&post_logout_redirect_uri=http://localhost:3000/

这是客户端配置：

new Client
            {
                ClientName = "Website User",
                ClientId = "webuser",
                Flow = Flows.AuthorizationCode,
                RequireConsent = false,
                AllowedCorsOrigins = new List<string>()
                {
                    CloudConfigurationManager.GetSetting("Auth:CorsOriginPrimary"),
                    CloudConfigurationManager.GetSetting("Auth:CorsOriginSecondary"),
                },
                RedirectUris = new List<string>
                {
                    CloudConfigurationManager.GetSetting("Auth:RedirectUri"),
                    CloudConfigurationManager.GetSetting("Auth:SecondaryRedirectUri"),
                    CloudConfigurationManager.GetSetting("Auth:TertiaryRedirectUri")
                },
                ClientSecrets = new List<Secret>
                {
                    new Secret(CloudConfigurationManager.GetSetting("WebUser:Secret").Sha256())
                },
                PostLogoutRedirectUris = new List<string>
                {
                    CloudConfigurationManager.GetSetting("Auth:WebPostLogoutUri"),
                    CloudConfigurationManager.GetSetting("Auth:WebPostLogoutUri:Local")
                },
                AllowAccessToAllScopes = true
            },

这是工厂配置（CORS）的东西：

var corsPolicy = new DefaultCorsPolicyService
            {
                AllowedOrigins = new[]
                {
                    "https://storageurl.blob.core.windows.net",
                    CloudConfigurationManager.GetSetting("Auth:CorsOriginPrimary"),
                    CloudConfigurationManager.GetSetting("Auth:CorsOriginSecondary")
                },
                AllowAll = true
            };

当然，AllowAll = true真的只是我努力让它发挥作用。

以下是相关的配置条目：

    <add key="Auth:RedirectUri" value="http://localhost:3000/_oauth/oidc/" />
    <add key="Auth:SecondaryRedirectUri" value="http://mysiteloc.com:3000/_oauth/oidc" />
    <add key="Auth:TertiaryRedirectUri" value="http://localhost:3000/_oauth/oidc"  />
    <add key="Auth:CorsOriginPrimary" value="http://localhost:3000" />
    <add key="Auth:CorsOriginSecondary" value="http://mysiteloc.com:3000" />
    <add key="Auth:WebPostLogoutUri" value="http://localhost:3000/" />
    <add key="Auth:WebPostLogoutUri:Local" value="http://mysiteloc:3000/" />

然后是日志。看起来CORS可能有问题，但我不确定。我原以为允许工厂配置和客户端配置的起源就够了，但我仍然遇到问题。

2017-01-30 16:52:14.2034 INFO: Redirecting to logout page
2017-01-30 16:52:14.2465 INFO: Logout prompt for subject: 2054e687-777b-4ca3-bb20-ee59d8a1dc28
2017-01-30 16:52:14.2465 INFO: EnableSignOutPrompt set to false, performing logout
2017-01-30 16:52:14.2465 INFO: Logout endpoint submitted
2017-01-30 16:52:14.2465 INFO: Logout requested for subject: 2054e687-777b-4ca3-bb20-ee59d8a1dc28
2017-01-30 16:52:14.2465 INFO: Clearing cookies
2017-01-30 16:52:14.2580 INFO: rendering logged out page
2017-01-30 16:52:14.5831 INFO: CSP Report endpoint requested
2017-01-30 16:52:14.5831 INFO: CSP Report data: {"csp-report":{"document-uri":"https://identity.mysite.com/id/logout","referrer":"http://localhost:3000/reservations/purchase","violated-directive":"script-src 'self' ","effective-directive":"script-src","original-policy":"default-src 'self'; script-src 'self' ; style-src 'self' 'unsafe-inline' ; img-src *; font-src 'self' https://storageurl.blob.core.windows.net/; report-uri https://identity.mysite.com/id/csp/report","blocked-uri":"eval","line-number":174,"column-number":361,"source-file":"https://identity.mysite.com/id/assets/scripts.2.5.0.js","status-code":0}}
2017-01-30 16:52:14.5831 INFO: Rendering 204
2017-01-30 16:52:14.7738 INFO: End session callback requested
2017-01-30 16:52:14.7738 DEBUG: No client end session iframe URLs

你可以帮助我的任何东西都会很棒。我想也许我需要在这里传递授权码而不是实际的ID令牌，但我已经看到了其他例子，他们传递了ID令牌，它工作正常。我错过了什么？

编辑：在查看Chrome中的网络标签时，它看起来也像原始的endsession端点将我重定向到endsessioncallback？sid = [some-sort-of-id]。这是正常行为吗？

Answer 1

https://identityserver.github.io/Documentation/docsv2/configuration/authenticationOptions.html

EnablePostSignOutAutoRedirect（默认值：false）？

如果您未在选项中触及此属性，可能就是这样。

IdentityServer3注销端点上没有自动重定向

1 个答案: