How to disable automatic login to thinktecture IdentityServer

Question

I have an MVC application with authentication managed by an identity server. When I first access my website, it is redirected to the registration page of the identification files and after I am redirected to my website again.

My problem is that if I exit the identityserver server, when I again access my network (with authorization of the identifier), I am redirected to the personal server, but the login is automatically performed to access my network without entering the user / password in the server identification.

I believe this is because the cookie is still alive in the client (if I manually delete all cookies in my browser, then a user / password is required).

How to disable automatic login (make user / password always required)?

my launch client configuration is as follows:

 app.UseCookieAuthentication(new CookieAuthenticationOptions
        {
            LoginPath = new PathString("/Home/Logged/"),
            AuthenticationType = "Cookies",
            ExpireTimeSpan = TimeSpan.FromDays(2),
            SlidingExpiration = true,
            CookieName = ".AspNet.MyApp"

        });


        app.UseOpenIdConnectAuthentication(new OpenIdConnectAuthenticationOptions
        {
            ClientId = "MyApp",
            Authority = IS_URL,
            RedirectUri = localHostURL + "/Home/Logged/",
            PostLogoutRedirectUri = localHostURL + "/Account/Login/",
            ResponseType = "code id_token token", 
            Scope = "openid profile read write sampleApi",
            SignInAsAuthenticationType = "Cookies",

            UseTokenLifetime = true,

            Notifications = new OpenIdConnectAuthenticationNotifications
            {
                SecurityTokenValidated = async n =>
                {
                    var nid = new ClaimsIdentity(
                        n.AuthenticationTicket.Identity.AuthenticationType,
                        "given_name",
                        "role");

                    // get userinfo data
                    var userInfoClient = new UserInfoClient(
                        new System.Uri(n.Options.Authority + "/connect/userinfo"),
                        n.ProtocolMessage.AccessToken);

                    var userInfo = await userInfoClient.GetAsync();
                    userInfo.Claims.ToList().ForEach(ui => nid.AddClaim(new Claim(ui.Item1, ui.Item2)));

                    //keep the id_token for logout

                   nid.AddClaim(new Claim("id_token", n.ProtocolMessage.IdToken));

                   // add access token for sample API
                   nid.AddClaim(new Claim("access_token", n.ProtocolMessage.AccessToken));

                    // keep track of access token expiration
                    nid.AddClaim(new Claim("expires_at", TimeSpan.FromDays(2).ToString()));

                    // add some other app specific claim
                    nid.AddClaim(new Claim("app_specific", "some data"));

                    n.AuthenticationTicket = new AuthenticationTicket(
                        nid,
                        n.AuthenticationTicket.Properties);
                },
                RedirectToIdentityProvider = n =>
                {
                    if (n.ProtocolMessage.RequestType == OpenIdConnectRequestType.LogoutRequest)
                    {
                        var idTokenHint = n.OwinContext.Authentication.User.FindFirst("id_token");

                        if (idTokenHint != null)
                        {
                            n.ProtocolMessage.IdTokenHint = idTokenHint.Value;
                        }
                    }

                    return Task.FromResult(0);
                }
            }
        });

Thanks in advance!

Answer 1

To exit the authentication server, you need to redirect the endpoint of the end session.

Usually /connect/endsession. This is the only way to clear the authentication session cookie.

See specification: https://openid.net/specs/openid-connect-session-1_0.html#RPLogout

Answer 2

For idsrv login requests / redirects, set the parameter promptto login.

OnRedirectToIdentityProvider = n =>
{

    if (n.ProtocolMessage.RequestType == OpenIdConnectRequestType.Authentication)
    {    
        n.ProtocolMessage.Prompt = "login";
    }

    return Task.FromResult(0);
}

IdSrv docs (see help)

prompt (optional)

login , .

OpenId Connect spec /authorize

prompt=login

. , , login_required.

Answer 3

. , , cookie 10 . : 10 , .