title: Sign out identityserver4 with identityserver3 library in mvc client
body: <p>I have a IdentityServer4 authentication server. I also have an ASP.NET MVC (.Net Framework 4.6) web client. I'm trying to sign out the user, using</p>
  
  <pre><code>Request.GetOwinContext().Authentication.SignOut();
  </code></pre>
  
  <p>It is then redirected to the authentication server account/logout view saying -
   You are now logged out. Click here to return to the client application.</p>
  
  <p>After clicking the logout redirect, I am redirected to my page where I can click sign-in again. After clicking sign-in, i am automatically signed-in. Seems that sign-out does not work. What am I missing? Thank you</p>
  
  <p>updated:
  Identity Server 4 logs below</p>
  
  <blockquote>
    <p>[02:41:07 Debug] IdentityServer4.Services.DefaultClaimsService Getting
    claims for access token for client: dpcdwebclient</p>
    
    <p>[02:41:07 Debug] IdentityServer4.Services.DefaultClaimsService Getting
    claims for access token for client: dpcdwebclient</p>
    
    <p>[02:41:07 Debug] IdentityServer4.Endpoints.TokenEndpoint Token request
    success.</p>
    
    <p>[02:41:07 Debug] IdentityServer4.Endpoints.TokenEndpoint Token request
    success.</p>
    
    <p>[02:41:10 Information]
    Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationHandler
    AuthenticationScheme: Identity.Application was successfully
    authenticated.</p>
    
    <p>[02:41:10 Information]
    Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationHandler
    AuthenticationScheme: Identity.Application was successfully
    authenticated.</p>
    
    <p>[02:41:10 Information]
    Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationHandler
    AuthenticationScheme: Identity.Application was successfully
    authenticated.</p>
    
    <p>[02:41:10 Information]
    Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationHandler
    AuthenticationScheme: Identity.Application was successfully
    authenticated.</p>
    
    <p>[02:41:10 Debug] IdentityServer4.Hosting.EndpointRouter Request path
    /connect/endsession matched to endpoint type Endsession</p>
    
    <p>[02:41:10 Debug] IdentityServer4.Hosting.EndpointRouter Request path
    /connect/endsession matched to endpoint type Endsession</p>
    
    <p>[02:41:10 Debug] IdentityServer4.Hosting.EndpointRouter Endpoint
    enabled: Endsession, successfully created handler:
    IdentityServer4.Endpoints.EndSessionEndpoint</p>
    
    <p>[02:41:10 Debug] IdentityServer4.Hosting.EndpointRouter Endpoint
    enabled: Endsession, successfully created handler:
    IdentityServer4.Endpoints.EndSessionEndpoint</p>
    
    <p>[02:41:10 Information]
    IdentityServer4.Hosting.IdentityServerMiddleware Invoking
    IdentityServer endpoint: IdentityServer4.Endpoints.EndSessionEndpoint
    for /connect/endsession</p>
    
    <p>[02:41:10 Information]
    IdentityServer4.Hosting.IdentityServerMiddleware Invoking
    IdentityServer endpoint: IdentityServer4.Endpoints.EndSessionEndpoint
    for /connect/endsession</p>
    
    <p>[02:41:10 Debug] IdentityServer4.Endpoints.EndSessionEndpoint
    Processing signout request for cc5a2d8c-77d9-477d-8eed-48b8cb7cc8df</p>
    
    <p>[02:41:10 Debug] IdentityServer4.Endpoints.EndSessionEndpoint
    Processing signout request for cc5a2d8c-77d9-477d-8eed-48b8cb7cc8df</p>
    
    <p>[02:41:10 Debug] IdentityServer4.Validation.EndSessionRequestValidator
    Start end session request validation</p>
    
    <p>[02:41:10 Debug] IdentityServer4.Validation.EndSessionRequestValidator
    Start end session request validation</p>
    
    <p>[02:41:10 Debug] IdentityServer4.Validation.TokenValidator Start
    identity token validation</p>
    
    <p>[02:41:10 Debug] IdentityServer4.Validation.TokenValidator Start
    identity token validation</p>
    
    <p>[02:41:10 Debug] IdentityServer4.EntityFramework.Stores.ClientStore
    dpcdwebclient found in database: True</p>
    
    <p>[02:41:10 Debug] IdentityServer4.EntityFramework.Stores.ClientStore
    dpcdwebclient found in database: True</p>
    
    <p>[02:41:10 Debug] IdentityServer4.Validation.TokenValidator Client
    found: dpcdwebclient / DPCD Web Client</p>
    
    <p>[02:41:10 Debug] IdentityServer4.Validation.TokenValidator Client
    found: dpcdwebclient / DPCD Web Client</p>
    
    <p>[02:41:10 Debug] IdentityServer4.Validation.TokenValidator Calling
    into custom token validator:
    IdentityServer4.Validation.DefaultCustomTokenValidator</p>
    
    <p>[02:41:10 Debug] IdentityServer4.Validation.TokenValidator Calling
    into custom token validator:
    IdentityServer4.Validation.DefaultCustomTokenValidator</p>
    
    <p>[02:41:10 Debug] IdentityServer4.Validation.TokenValidator Token
    validation success {   "ClientId": "dpcdwebclient",   "ClientName":
    "DPCD Web Client",   "ValidateLifetime": false,   "Claims": {
        "nbf": 1516560060,
        "exp": 1516560360,
        "iss": "<a href="http://localhost:9000" rel="nofollow noreferrer">http://localhost:9000</a>",
        "aud": "dpcdwebclient",
        "nonce": "636521568596713051.ZGU2MmM3YzMtMjI5Yi00YmFlLThhMzUtOTBjM2U2NWIwZjhjZThmZmNkN2EtNmFlYS00NjZiLWExMWMtNjY3YjEzYmM4YzY5",
        "iat": 1516560060,
        "c_hash": "OOI3bdt6NUGB4bptfc9w_A",
        "sid": "5caef14630a16f452d9b0bfe03906fe5",
        "sub": "cc5a2d8c-77d9-477d-8eed-48b8cb7cc8df",
        "auth_time": 1516559499,
        "idp": "local",
        "amr": "pwd"   } }</p>
    
    <p>[02:41:10 Debug] IdentityServer4.Validation.TokenValidator Token
    validation success {   "ClientId": "dpcdwebclient",   "ClientName":
    "DPCD Web Client",   "ValidateLifetime": false,   "Claims": {
        "nbf": 1516560060,
        "exp": 1516560360,
        "iss": "<a href="http://localhost:9000" rel="nofollow noreferrer">http://localhost:9000</a>",
        "aud": "dpcdwebclient",
        "nonce": "636521568596713051.ZGU2MmM3YzMtMjI5Yi00YmFlLThhMzUtOTBjM2U2NWIwZjhjZThmZmNkN2EtNmFlYS00NjZiLWExMWMtNjY3YjEzYmM4YzY5",
        "iat": 1516560060,
        "c_hash": "OOI3bdt6NUGB4bptfc9w_A",
        "sid": "5caef14630a16f452d9b0bfe03906fe5",
        "sub": "cc5a2d8c-77d9-477d-8eed-48b8cb7cc8df",
        "auth_time": 1516559499,
        "idp": "local",
        "amr": "pwd"   } }</p>
    
    <p>[02:41:10 Information]
    IdentityServer4.Validation.EndSessionRequestValidator End session
    request validation success {   "ClientId": "dpcdwebclient",<br>
    "ClientName": "DPCD Web Client",   "SubjectId":
    "cc5a2d8c-77d9-477d-8eed-48b8cb7cc8df",   "PostLogOutUri":
    "<a href="http://localhost:9002/signout-callback-oidc" rel="nofollow noreferrer">http://localhost:9002/signout-callback-oidc</a>",   "Raw": {
        "id_token_hint": "eyJhbGciOiJSUzI1NiIsImtpZCI6IjdmMjM1MDRjNjc3NzkzM2I0MDU5ODU5ZDA4MTMzOGMyIiwidHlwIjoiSldUIn0.eyJuYmYiOjE1MTY1NjAwNjAsImV4cCI6MTUxNjU2MDM2MCwiaXNzIjoiaHR0cDovL2xvY2FsaG9zdDo5MDAwIiwiYXVkIjoiZHBjZHdlYmNsaWVudCIsIm5vbmNlIjoiNjM2NTIxNTY4NTk2NzEzMDUxLlpHVTJNbU0zWXpNdE1qSTVZaTAwWW1GbExUaGhNelV0T1RCak0yVTJOV0l3WmpoalpUaG1abU5rTjJFdE5tRmxZUzAwTmpaaUxXRXhNV010TmpZM1lqRXpZbU00WXpZNSIsImlhdCI6MTUxNjU2MDA2MCwiY19oYXNoIjoiT09JM2JkdDZOVUdCNGJwdGZjOXdfQSIsInNpZCI6IjVjYWVmMTQ2MzBhMTZmNDUyZDliMGJmZTAzOTA2ZmU1Iiwic3ViIjoiY2M1YTJkOGMtNzdkOS00NzdkLThlZWQtNDhiOGNiN2NjOGRmIiwiYXV0aF90aW1lIjoxNTE2NTU5NDk5LCJpZHAiOiJsb2NhbCIsImFtciI6WyJwd2QiXX0.P7Zn6GVdSuUaFS55DGqjA2PlRYH0CLIHPI7AKtOnNYn24sTagOBlX57Fg_QVmCczLrkdIwh-Deok2bXjf3O5ZrYKWN3OFKqkDx0CfTN3zypxruiumWEdhqtK_13iinh2n1XLiV0OeUozOCMsDVI2hMTcnHQxsIGlQigETeoRaG6NlB5jGB5-3i7DCJycywPyWV-CcMLJkEiAunLbVXGOsdALQxZTYFsXlffQA4vRybAK6d5Ybc5139vjW68jV4Rbjm9ihhFv4edwALcEYPICBWLR0FxGLWd6XOH56rK7HCoiom4v8afgFimS4MhfyEIkuKu0md46XrBF2MYy3xtdOQ",
        "x-client-SKU": "ID_NET",
        "x-client-ver": "1.0.40306.1554"   } }</p>
    
    <p>[02:41:10 Information]
    IdentityServer4.Validation.EndSessionRequestValidator End session
    request validation success {   "ClientId": "dpcdwebclient",<br>
    "ClientName": "DPCD Web Client",   "SubjectId":
    "cc5a2d8c-77d9-477d-8eed-48b8cb7cc8df",   "PostLogOutUri":
    "<a href="http://localhost:9002/signout-callback-oidc" rel="nofollow noreferrer">http://localhost:9002/signout-callback-oidc</a>",   "Raw": {
        "id_token_hint": "eyJhbGciOiJSUzI1NiIsImtpZCI6IjdmMjM1MDRjNjc3NzkzM2I0MDU5ODU5ZDA4MTMzOGMyIiwidHlwIjoiSldUIn0.eyJuYmYiOjE1MTY1NjAwNjAsImV4cCI6MTUxNjU2MDM2MCwiaXNzIjoiaHR0cDovL2xvY2FsaG9zdDo5MDAwIiwiYXVkIjoiZHBjZHdlYmNsaWVudCIsIm5vbmNlIjoiNjM2NTIxNTY4NTk2NzEzMDUxLlpHVTJNbU0zWXpNdE1qSTVZaTAwWW1GbExUaGhNelV0T1RCak0yVTJOV0l3WmpoalpUaG1abU5rTjJFdE5tRmxZUzAwTmpaaUxXRXhNV010TmpZM1lqRXpZbU00WXpZNSIsImlhdCI6MTUxNjU2MDA2MCwiY19oYXNoIjoiT09JM2JkdDZOVUdCNGJwdGZjOXdfQSIsInNpZCI6IjVjYWVmMTQ2MzBhMTZmNDUyZDliMGJmZTAzOTA2ZmU1Iiwic3ViIjoiY2M1YTJkOGMtNzdkOS00NzdkLThlZWQtNDhiOGNiN2NjOGRmIiwiYXV0aF90aW1lIjoxNTE2NTU5NDk5LCJpZHAiOiJsb2NhbCIsImFtciI6WyJwd2QiXX0.P7Zn6GVdSuUaFS55DGqjA2PlRYH0CLIHPI7AKtOnNYn24sTagOBlX57Fg_QVmCczLrkdIwh-Deok2bXjf3O5ZrYKWN3OFKqkDx0CfTN3zypxruiumWEdhqtK_13iinh2n1XLiV0OeUozOCMsDVI2hMTcnHQxsIGlQigETeoRaG6NlB5jGB5-3i7DCJycywPyWV-CcMLJkEiAunLbVXGOsdALQxZTYFsXlffQA4vRybAK6d5Ybc5139vjW68jV4Rbjm9ihhFv4edwALcEYPICBWLR0FxGLWd6XOH56rK7HCoiom4v8afgFimS4MhfyEIkuKu0md46XrBF2MYy3xtdOQ",
        "x-client-SKU": "ID_NET",
        "x-client-ver": "1.0.40306.1554"   } }</p>
    
    <p>[02:41:10 Debug] IdentityServer4.Endpoints.EndSessionEndpoint Success
    validating end session request from dpcdwebclient</p>
    
    <p>[02:41:10 Debug] IdentityServer4.Endpoints.EndSessionEndpoint Success
    validating end session request from dpcdwebclient</p>
    
    <p>[02:41:10 Information]
    Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationHandler
    AuthenticationScheme: Identity.Application was successfully
    authenticated.</p>
    
    <p>[02:41:10 Information]
    Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationHandler
    AuthenticationScheme: Identity.Application was successfully
    authenticated.</p>
    
    <p>[02:41:10 Information]
    Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationHandler
    AuthenticationScheme: Identity.Application was successfully
    authenticated.</p>
    
    <p>[02:41:10 Information]
    Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationHandler
    AuthenticationScheme: Identity.Application was successfully
    authenticated.</p>
    
    <p>[02:41:12 Information]
    Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationHandler
    AuthenticationScheme: Identity.External signed out.</p>
    
    <p>[02:41:12 Information]
    Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationHandler
    AuthenticationScheme: Identity.External signed out.</p>
    
    <p>[02:41:12 Information]
    Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationHandler
    AuthenticationScheme: Identity.Application was successfully
    authenticated.</p>
    
    <p>[02:41:12 Information]
    Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationHandler
    AuthenticationScheme: Identity.Application was successfully
    authenticated.</p>
    
    <p>[02:41:12 Information]
    Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationHandler
    AuthenticationScheme: Identity.Application was successfully
    authenticated.</p>
    
    <p>[02:41:12 Information]
    Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationHandler
    AuthenticationScheme: Identity.Application was successfully
    authenticated.</p>
    
    <p>[02:41:12 Debug] IdentityServer4.Hosting.EndpointRouter Request path
    /connect/endsession/callback matched to endpoint type Endsession</p>
    
    <p>[02:41:12 Debug] IdentityServer4.Hosting.EndpointRouter Request path
    /connect/endsession/callback matched to endpoint type Endsession</p>
    
    <p>[02:41:12 Debug] IdentityServer4.Hosting.EndpointRouter Endpoint
    enabled: Endsession, successfully created handler:
    IdentityServer4.Endpoints.EndSessionCallbackEndpoint</p>
    
    <p>[02:41:12 Debug] IdentityServer4.Hosting.EndpointRouter Endpoint
    enabled: Endsession, successfully created handler:
    IdentityServer4.Endpoints.EndSessionCallbackEndpoint</p>
    
    <p>[02:41:12 Information]
    IdentityServer4.Hosting.IdentityServerMiddleware Invoking
    IdentityServer endpoint:
    IdentityServer4.Endpoints.EndSessionCallbackEndpoint for
    /connect/endsession/callback</p>
    
    <p>[02:41:12 Information]
    IdentityServer4.Hosting.IdentityServerMiddleware Invoking
    IdentityServer endpoint:
    IdentityServer4.Endpoints.EndSessionCallbackEndpoint for
    /connect/endsession/callback</p>
    
    <p>[02:41:12 Debug] IdentityServer4.Endpoints.EndSessionCallbackEndpoint
    Processing signout callback request</p>
    
    <p>[02:41:12 Debug] IdentityServer4.Endpoints.EndSessionCallbackEndpoint
    Processing signout callback request</p>
    
    <p>[02:41:12 Debug] IdentityServer4.EntityFramework.Stores.ClientStore
    dpcdwebclient found in database: True</p>
    
    <p>[02:41:12 Debug] IdentityServer4.EntityFramework.Stores.ClientStore
    dpcdwebclient found in database: True</p>
    
    <p>[02:41:12 Debug] IdentityServer4.Validation.EndSessionRequestValidator
    No client front-channel logout URLs</p>
    
    <p>[02:41:12 Debug] IdentityServer4.Validation.EndSessionRequestValidator
    No client front-channel logout URLs</p>
    
    <p>[02:41:12 Debug] IdentityServer4.Validation.EndSessionRequestValidator
    No client back-channel logout URLs</p>
    
    <p>[02:41:12 Debug] IdentityServer4.Validation.EndSessionRequestValidator
    No client back-channel logout URLs</p>
    
    <p>[02:41:12 Information]
    IdentityServer4.Endpoints.EndSessionCallbackEndpoint Successful
    signout callback.</p>
    
    <p>[02:41:12 Information]
    IdentityServer4.Endpoints.EndSessionCallbackEndpoint Successful
    signout callback.</p>
    
    <p>[02:41:12 Debug] IdentityServer4.Endpoints.EndSessionCallbackEndpoint
    No client front-channel iframe urls</p>
    
    <p>[02:41:12 Debug] IdentityServer4.Endpoints.EndSessionCallbackEndpoint
    No client front-channel iframe urls</p>
    
    <p>[02:41:12 Debug] IdentityServer4.Endpoints.EndSessionCallbackEndpoint
    No client back-channel iframe urls</p>
    
    <p>[02:41:12 Debug] IdentityServer4.Endpoints.EndSessionCallbackEndpoint
    No client back-channel iframe urls</p>
  </blockquote>
  
  <p>ASP.NET MVC 5 (Identity Server 3) Logout code:</p>
  
  <pre><code>[HttpGet]
      public ActionResult SignOut()
      {
          Request.GetOwinContext().Authentication.SignOut();
          return Redirect("/");
      }
  
      //signout-oidc redirect
      [AllowAnonymous]
      public ActionResult LogoutCallback()
      {
          Request.GetOwinContext().Authentication.SignOut("Cookies");
          return RedirectToAction("Index", "Home");
      }
  </code></pre>
  
  <p>IDS4 Logout (from sample codes)</p>
  
  <pre><code>[HttpPost]
      [ValidateAntiForgeryToken]
      public async Task&lt;IActionResult&gt; Logout(LogoutInputModel model)
      {
          // build a model so the logged out page knows what to display
          var vm = await _account.BuildLoggedOutViewModelAsync(model.LogoutId);
  
          var user = HttpContext.User;
          if (user?.Identity.IsAuthenticated == true)
          {
              // delete local authentication cookie
              await HttpContext.SignOutAsync();
  
              // raise the logout event
              await _events.RaiseAsync(new UserLogoutSuccessEvent(user.GetSubjectId(), user.GetDisplayName()));
          }
  
          // check if we need to trigger sign-out at an upstream identity provider
          if (vm.TriggerExternalSignout)
          {
              // build a return URL so the upstream provider will redirect back
              // to us after the user has logged out. this allows us to then
              // complete our single sign-out processing.
              string url = Url.Action("Logout", new { logoutId = vm.LogoutId });
  
              // this triggers a redirect to the external provider for sign-out
              return SignOut(new AuthenticationProperties { RedirectUri = url }, vm.ExternalAuthenticationScheme);
          }
  
          return View("LoggedOut", vm);
      }
  </code></pre>
  
  <p>Client Configuration:</p>
  
  <pre><code>new Client
              {
                  ClientId = "dpcdwebclient",
                  ClientName = "DPCD Web Client",
                  AllowedGrantTypes = GrantTypes.HybridAndClientCredentials,
                  Enabled = true,
  
                  RequireConsent = false,
  
                  ClientSecrets =
                  {
                      new Secret("secret".Sha256())
                  },
  
                  RedirectUris = { "http://localhost:9002/signin-oidc" },
                  PostLogoutRedirectUris = { "http://localhost:9002/signout-callback-oidc" },
  
                  AlwaysIncludeUserClaimsInIdToken = true,
  
                  AllowedScopes =
                  {
                      IdentityServerConstants.StandardScopes.OpenId,
                      IdentityServerConstants.StandardScopes.Profile,
                      IdentityServerConstants.StandardScopes.OfflineAccess,
                      "myapi"
                  },
  
                  AllowOfflineAccess = true
              },
  </code></pre>