Add Support to Logout using OpenId

src/OrchardCore.Modules/OrchardCore.OpenId/Handlers/OpenIdExternalLoginEventHandler.cs

@@ -0,0 +1,43 @@
+using System.Security.Claims;
+using Microsoft.AspNetCore.Authentication;
+using Microsoft.AspNetCore.Http;
+using OrchardCore.Users;
+using OrchardCore.Users.Handlers;
+
+namespace OrchardCore.OpenId.Handlers;
+
+public sealed class OpenIdExternalLoginEventHandler : IExternalLoginEventHandler
+{
+    private readonly IHttpContextAccessor _httpContextAccessor;
+
+    public OpenIdExternalLoginEventHandler(IHttpContextAccessor httpContextAccessor)
+    {
+        _httpContextAccessor = httpContextAccessor;
+    }
+
+    public Task<string> GenerateUserName(string provider, IEnumerable<SerializableClaim> claims)
+        => Task.FromResult<string>(null);
+
+    public Task UpdateUserAsync(UpdateUserContext context)
+        => Task.CompletedTask;
+
+    public async Task SetLogoutAsync(string provider, Dictionary<string, string> properties)
+    {
+        if (provider != "OpenIdConnect")
+        {
+            return;
+        }
+
+        var result = await _httpContextAccessor.HttpContext.AuthenticateAsync();
+
+        if (result is not { Principal.Identity: ClaimsIdentity _ })
+        {
+            return;
+        }
+
+        // Some how initiate the logout request at the server.
+
+        properties[".identity_token_hint"] = result.Properties.GetTokenValue("backchannel_id_token");
+        properties[".registration_id"] = provider;
+    }
+}

src/OrchardCore.Modules/OrchardCore.OpenId/Startup.cs

@@ -23,6 +23,7 @@
 using OrchardCore.OpenId.Configuration;
 using OrchardCore.OpenId.Deployment;
 using OrchardCore.OpenId.Drivers;
+using OrchardCore.OpenId.Handlers;
 using OrchardCore.OpenId.Migrations;
 using OrchardCore.OpenId.Recipes;
 using OrchardCore.OpenId.Services;
@@ -33,6 +34,7 @@
 using OrchardCore.Security;
 using OrchardCore.Security.Permissions;
 using OrchardCore.Settings;
+using OrchardCore.Users.Handlers;
 
 namespace OrchardCore.OpenId;
 
@@ -84,6 +86,8 @@ public override void ConfigureServices(IServiceCollection services)
             // Built-in initializers:
             ServiceDescriptor.Singleton<IPostConfigureOptions<OpenIdConnectOptions>, OpenIdConnectPostConfigureOptions>()
         });
+
+        services.AddScoped<IExternalLoginEventHandler, OpenIdExternalLoginEventHandler>();
     }
 }
 

src/OrchardCore.Modules/OrchardCore.Users/Controllers/AccountController.cs

@@ -260,6 +260,32 @@ public async Task<IActionResult> LoginPOST(string returnUrl = null)
     [ValidateAntiForgeryToken]
     public async Task<IActionResult> LogOff(string returnUrl = null)
     {
+        var user = await _signInManager.UserManager.GetUserAsync(User);
+        var userLogins = await _signInManager.UserManager.GetLoginsAsync(user);
+
+        var providerClaim = User.Claims.FirstOrDefault(c => c.Type == ClaimTypes.AuthenticationMethod || c.Type == "LoginProvider");
+
+        if (providerClaim != null && userLogins.Any(userInfo => userInfo.LoginProvider == providerClaim.Value))
+        {
+            // The user logged in using an external provider.
+            var properties = new Dictionary<string, string>();
+
+            await _externalLoginHandlers.InvokeAsync(handler => handler.SetLogoutAsync(providerClaim.Value, properties), _logger);
+
+            if (properties.Count > 0)
+            {
+                var schema = HttpContext.Features.Get<IAuthenticateResultFeature>()
+                    .AuthenticateResult
+                    ?.Ticket
+                    ?.AuthenticationScheme;
+
+                await _signInManager.SignOutAsync();
+                _logger.LogInformation(4, "User logged out.");
+
+                return SignOut(new AuthenticationProperties(properties), schema);
+            }
+        }
+
         await _signInManager.SignOutAsync();
         _logger.LogInformation(4, "User logged out.");
 

src/OrchardCore/OrchardCore.Users.Abstractions/Handlers/IExternalLoginEventHandler.cs

@@ -19,4 +19,12 @@ public interface IExternalLoginEventHandler
     /// <param name="context">The <see cref="UpdateUserContext"/>.</param>
     Task UpdateUserAsync(UpdateUserContext context);
 
+    /// <summary>
+    /// Occurs during the logout. The default implementation will be removed in v3.
+    /// </summary>
+    /// <param name="provider"></param>
+    /// <param name="properties"></param>
+    /// <returns></returns>
+    Task SetLogoutAsync(string provider, Dictionary<string, string> properties)
+        => Task.CompletedTask;
 }