Logging out doesn't prompt again from password

1

Hello,
I am trying to use keycloak 10.0.1 with an F# .net core 3.1.3 Saturn application.

I am having trouble logging out. Basically I call the .net core logout api that is standard and it should work with OpenIDConnect, and then I do server redirect back to the main URL which requires authorization. The application logs me back in automatically. Is it normal?

I don’t know if any people here use F# but here is the code for logout:

get "/SignOut2" (fun next ctx -> task {
            do! ctx.SignOutAsync(OpenIdConnectDefaults.AuthenticationScheme) 
            do! ctx.SignOutAsync(CookieAuthenticationDefaults.AuthenticationScheme) 
            return! redirectTo false "/" next ctx
        }
    )

It is supposed to work in asp.net core.

I watched this course on pluralsight and he uses IdentityServer4 - the log out calls basically do not log the user back in rather the user is prompted for password again in the IS4 login page.

I enabled the debugging in KC configuration but I don’t see any LOGOUT action.

I tried to call the logout end point manually but it is a pain - the documentation doesn’t say exactly what data has to be passed to it. I will have to read the code.

Any ideas?

Thanks

OK - I figured it out - it was my fault - the problem was the redirect at the end.

The correct all is:

get "/SignOut2" (fun next ctx -> task {
            do! ctx.SignOutAsync(CookieAuthenticationDefaults.AuthenticationScheme)
            do! ctx.SignOutAsync(OpenIdConnectDefaults.AuthenticationScheme) 
            return! earlyReturn ctx // This replaced the redirect - actually the SignOutAsync performs the redirect to the logout endpoint
        }
    )
2

That looks like a wrong logout request. Probably it just “deleted” your app user session, but it needs to destroy also IDP (Keycloak) session. I would recommend to read OIDC standard to see how to perform valid logout: https://openid.net/specs/openid-connect-session-1_0.html#RPLogout