title: Azure AD B2C logout after session timeout
body: <p><strong>Situation</strong></p>
  
  <p>I have a web application that is using Azure AD B2C as its authentication. We're using OWIN OpenIdConnect to handle this process. The session timeouts are set to 15 minutes (sessionState in web.config and on our AzureADB2C signin policy) and we have SSO enabled in the policy on the policy level. The session is set to be rolling. The OWIN CookieAuthentication is also using a 15m sliding expiry.</p>
  
  <p>The web application is split into multiple parts (virtual folders) but are all sharing the same Azure AD B2C instance. However each has its own application registration in the AD. (These are basically the countries so we have www.site.com/nl and www.site.com/de for example) This to ensure that when you login you are also directed properly back to the country you were operating in. Additionally this enables us to link a country to a different AD instance should this be required.</p>
  
  <p><strong>Problem</strong></p>
  
  <p>When a user logs into the application and then subsequently logs out within his/her session the login process runs properly without issue and upon trying to login again he/she is requested to login again. This is OK and as expected.</p>
  
  <p>However when a user logs in and lets his/her session expire we display a popup that asks whether you'd like to continue (links to the login page) or quit (links to the logout page). Both cases the user does not need to provide his/her credentials and this is not our desired behaviour (as this would mean if someone leaves their account open and timeout occurs anyone can still login to this account without needing to present credentials)</p>
  
  <p><strong>Oservations</strong></p>
  
  <ol>
  <li>If a user hits up the logout page after session timeout the exact same url is called <code>https://login.microsoftonline.com/myazuread.onmicrosoft.com/oauth2/v2.0/logout?p=b2c_1_mypolicyname&amp;post_logout_redirect_uri=https%3a%2f%2fwww.site.com%2fbe&amp;x-client-SKU=ID_NET&amp;x-client-ver=1.0.40306.1554</code> as when a user would logout during his/her session. However I see 2 different behaviours on the Azure side on this call.</li>
  </ol>
  
  <p>A) When the session did not expire this call first calls into <code>https://login.microsoftonline.com/my-azure-ad-guid/oauth2/logout</code> before redirecting to my redirect uri.</p>
  
  <p>B) When the session expired this call directly redirects to my redirect uri without passing over the uri in situation A.</p>
  
  <ol start="2">
  <li><p>There is 1 cookie difference between situation A and B called <code>x-ms-cpim-sso:myazuread.onmicrosoft.com/b2c_1_mypolicyname</code> it only exists in situation A which leads me to believe that this causes the different behaviour. However this is a Microsoft cookie on the login.microsoftonline.com domain so I have no control or influence over this.</p></li>
  <li><p>When the login is initialized after session timeout I see calls pass by containing a clientid that does not match with any of my applications: <code>https://login.microsoftonline.com/myazuread.onmicrosoft.com/oauth2/authorize?client_id=bb2a2e3a-c5e7-4f0a-88e0-8e01fd3fc1f4&amp;redirect_uri=https%3a%2f%2flogin.microsoftonline.com%2fte%2fmyazuread.onmicrosoft.com%2foauth2%2fauthresp&amp;response_type=id_token&amp;scope=email+openid&amp;response_mode=query&amp;nonce=nonce&amp;nux=1&amp;nca=1&amp;domain_hint=myazuread.onmicrosoft.com&amp;mkt=en-US&amp;lc=1033&amp;state=StateProperties</code> this begs the question for me what is this application and why is it being used in my auth flow causing my user not needing to re-authenticate?</p></li>
  </ol>
  
  <p><strong>Question</strong>:
  How do I ensure that users will need to authenticate after each session timeout?</p>