0

I have been successfully reading the logged in OIDC authentication scheme from IAuthenticateResultFeature when using OIDC. I need to know this scheme to perform sign out. This is for a .NET 8 ASP.NET website.

var authProperties = httpContext?.Features.GetRequiredFeature<Microsoft.AspNetCore.Authentication.IAuthenticateResultFeature>();
authScheme = authProperties.AuthenticateResult!.Ticket!.Properties.Items[".AuthScheme"];

I have just introduced a JWT bearer token to the same website and found that I can only get AddJwtBearer and OIDC to work at the same time if I set all possible schemes in AuthorizeFilter, using a AuthorizationPolicyBuilder. When I do this I can successfully log into the website with either OIDC or a JWT bearer token. However, I cannot get logged out of OIDC, because IAuthenticateResultFeature has now dissappeared, so I do not know what scheme to use to sign out with. If I remove the code that sets the schemes to AuthorizeFilter, I cannot get logged in.

I followed the examples at this website:

https://learn.microsoft.com/en-us/aspnet/core/security/authorization/limitingidentitybyscheme?view=aspnetcore-8.0#use-multiple-authentication-schemes

What I have is:

services.AddAuthentication()
                .AddOpenIdConnect()
                .AddCookie()
                .AddJwtBearer();
                
// The below code is only necessary when including AddJwtBearer.
// If I don't do the below, then OIDC login does not work with AddJwtBearer.
// if I do the below, then IAuthenticateResultFeature is missing.
services.AddAuthorization(options =>
{
    var defaultAuthorizationPolicyBuilder = new AuthorizationPolicyBuilder(
        "oidcsheme", "jwtscheme"
        );
    defaultAuthorizationPolicyBuilder =
        defaultAuthorizationPolicyBuilder.RequireAuthenticatedUser();
    options.DefaultPolicy = defaultAuthorizationPolicyBuilder.Build();
});     

Update: After even more extensive digging, I found a report of this issue on github. There is a suggestion that this behavior is by design. Does anyone have a solution that allows signing in and signing out when using AddOpenIdConnect and AddJwtBearer together?

https://github.com/dotnet/aspnetcore/issues/47059

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.