Ufdjrw

So i set up a brand new mvc dotnet core app. No security. Then i added open id connect security in the start up like so:

 // This method gets called by the runtime. Use this method to add services to the container.
 public void ConfigureServices(IServiceCollection services)
 
 var clientId = Configuration["clientID"];
 var metadataAddress = Configuration["MetadataAddress"]; 

 var Wtrealm = Configuration["Wtrealm"];
 string signedOutCallbackPath = Configuration["SignedOutCallbackPath"];
 string postLogoutUrl = Configuration["postLogoutUrl"];

 services.AddAuthentication(options =>
 
 options.DefaultScheme = "Cookies";
 options.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme;
 )
 .AddCookie("Cookies")
 .AddOpenIdConnect(OpenIdConnectDefaults.AuthenticationScheme, options =>
 
 options.SaveTokens = true;
 options.ClientId = clientId;
 options.Authority = metadataAddress;

 options.SignedOutCallbackPath = signedOutCallbackPath;


 options.Scope.Add("openid");
 options.Scope.Add("profile");
 options.Scope.Add("email");

 options.TokenValidationParameters = new Microsoft.IdentityModel.Tokens.TokenValidationParameters
 
 NameClaimType = "name",
 RoleClaimType = "role",
 ;

 );
 services.AddMvc().SetCompatibilityVersion(CompatibilityVersion.Version_2_2);
 

 // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
 public void Configure(IApplicationBuilder app, IHostingEnvironment env)
 
 if (env.IsDevelopment())
 
 app.UseDeveloperExceptionPage();
 
 else
 
 app.UseExceptionHandler("/Home/Error");
 // The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
 app.UseHsts();
 

 app.UseHttpsRedirection();
 app.UseStaticFiles();
 app.UseCookiePolicy();

 app.UseAuthentication();

 app.UseMvc(routes =>
 
 routes.MapRoute(
 name: "default",
 template: "controller=Home/action=Index/id?");
 );
 

This works for login.
Then I added

 public async Task<IActionResult> Logout(string callBack)
 
 return SignOut("Cookies", OpenIdConnectDefaults.AuthenticationScheme);
 
 public async Task<IActionResult> LogoutComplete()
 
 return View();
 

Logout to initiate logout and logout to handle the clean up after logout is completed. Logout works for my app. Then it redirects to IdP to logout. It works fine then it redirects browser to LogoutComplete. This is where the weirdness starts: LogoutComplete returns a 302 into the home controller but i don't know why. It never hits the debug point in the method. It does not return the view it is designed t return. This method works fine(returns it's own view) when openIdConnect middleware is not enabled.
Why is this happening? How is this even possible? Why would the middle ware hijack LogoutComplete? Is this in the spec? The openIDProvider was set up in ADFS 2016 and another one in ID Server 4. Both cases the application behaved the same. So i am sure this is not a Provider Configuration/IdP Server issue.