IdentityServer3, can't update cookie when apps are on another machine?

Question

I set up some test sites for SSO using IdentityServer3, pretty much sample applications for cookie cutters with small turns. They work well, except for one thing: when trying to parse a subscription and / or renew a claim through a cookie, it only works if all applications are on the same machine.

For example, these two applications may log out.

http://localhost:81 http://localhost:82 

Claims updated in one application using the following also appear in another.

  var authenticationManager = HttpContext.Current.GetOwinContext().Authentication; authenticationManager.AuthenticationResponseGrant = new AuthenticationResponseGrant(new ClaimsPrincipal(identity), new AuthenticationProperties { IsPersistent = false }); 

It also works if I configure such applications as follows:

 http://mymachine/app1 http://mymachine/app2 

But if I mix two

 http://localhost:81 http://mymachine/app2 

Then it will not work. Tried SignOut / SignIn too, same result. They are still signing up, but cannot go out together. Changing requirements will not appear in another. Of course, if I deploy the application on different servers. It is as if the cookie update occurred on the local computer, and not on IdSvr.

Any hints on what I missed? Thank.

Answer 1

Single Sign Off is not available from the box, unfortunately, the behavior that you saw in the same domain was a little red herring.

Out of the box, when you exit IdentityServer, your client applications will only recognize and log out on their own as soon as they make a new request to IdentityServer (their own application cookie may have expired and they will go into the system, or maybe they tried to request a token).

To implement Single Sign Off, each of your client applications must have a way of telling IdentityServer that they need to log out. This can be done using the front channel of the HTTP request or session management .

Check out the IdentityServer Signout Support for more details on how to do this, or check out the Brock Allen post on the topic.