[WS-Federation] Implement signout cleanup

[leastprivilege]

http://docs.oasis-open.org/wsfed/federation/v1.2/os/ws-federation-1.2-spec-os.html#_Toc223175005

When a sign-out clean-up GET is received at a realm, the realm SHOULD clean-up any cached information and delete any associated artifacts/cookies. If requested, on completion the requestor is redirected back to requestor's IP/STS.

It is very similar to OIDC front-channel signout (/signout-oidc) - when the IdP receives a sign-out, it notifies all RPs in the current session by sending them a signout cleanup message. The RPs then delete their own local state (e.g. authentication cookie).

[Eilon]

Seems important to have this per @vibronet.

[leastprivilege]

I am so happy that Vittorio agrees with me...

[Tratcher]

AAD appears to support this, you can define a Logout Url in the portal. However I cannot find the right IDP endpoint to trigger the single signout.

[KoalaBear84]

I have really no idea how to call this feature. Does anybody have an example of how this works / is called? Thanks!

I do checked out this and called await context.SignOutAsync(WsFederationDefaults.AuthenticationScheme);:
https://github.com/aspnet/Security/blob/rel/2.0.0-ws-preview2/samples/WsFedSample/Startup.cs

But it does not logout the external STS 'session'. I do not have to login again, it is still logged in externally.

[Tratcher]

Which STS are you using?

[Tratcher]

See #1581

[KoalaBear84]

At least it is ADFS, and probably version 4. I'm not into those details of STS myself. Then I will wait for the next preview / final version. For now I'll redirect to a self created STS logout link (it is not yet in production).

Thanks for your answer @Tratcher!