Cannot separate user cancel from Logout done in oidcclient logout async

[Gaburiere-Remira]

i've implemented a net maui 8 mobile application for iOS and Android with IdentityModel.OidcClient v5.0.2. i've an issue logging out in iOS due to the native display alert prompt asking the user if really want to log out

if user tap on "Annulla" button (orange circle), the IBrowser implementation used to open browser in app throws TaskCanceledException.

Here i can intercept the exception and return as result error with detail "UserCancel" as you can see from the code below:

internal class WebAuthenticatorBrowser : IBrowser
    {
        private readonly IWebAuthenticator _webAuthenticator;

        public WebAuthenticatorBrowser(IWebAuthenticator webAuthenticator)
        {
            _webAuthenticator = webAuthenticator;
        }
        
        public async Task<BrowserResult> InvokeAsync(BrowserOptions options, CancellationToken cancellationToken = default)
        {
            try
            {
                var authResult =
                    await _webAuthenticator.AuthenticateAsync(new Uri(options.StartUrl), new Uri(options.EndUrl));
                var authorizeResponse = ToRawIdentityUrl(options.EndUrl, authResult);

                return new BrowserResult
                {
                    Response = authorizeResponse
                };
            }
            catch (TaskCanceledException e)
            {
                return new BrowserResult()
                {
                    ResultType = BrowserResultType.UserCancel,
                    Error = e.ToString()
                };
            }
            catch (Exception ex)
            {
                return new BrowserResult()
                {
                    ResultType = BrowserResultType.UnknownError,
                    Error = ex.ToString()
                };
            }
        }

        public string ToRawIdentityUrl(string redirectUrl, CustomWebAuthenticatorResult result)
        {
            IEnumerable<string> parameters = result.Properties.Select(pair => $"{pair.Key}={pair.Value}");
            var values = string.Join("&", parameters);

            return $"{redirectUrl}#{values}";
        }
    }

then below the service using oidcclient:

public async Task<bool> LogoutAsync()
{
    var oidcClient = _oidcService.BuildOidcClient();
    var logoutResult = await oidcClient.LogoutAsync();
    if (logoutResult.Error.ToLower() == BrowserResultType.UserCancel.ToString().ToLower() && string.IsNullOrEmpty(logoutResult.Response))
        return false;
    DeleteTokens();
    return true;
}

The issue is when user tap on "Continua" in the prompt: the WebAuthenticationBrowser opens the logout page on our identity server 4 identity provider as shown below:

the page performs logout and remains there, so the user must tap on "annulla" button inside the browser. here is the trouble: tapping on cancel in web browser and on cancel on initial prompt performs the same result namely TaskCanceledException.

So in this case i am not able to discriminate between actual user cancellation or login done and user closing web page.

Have you any idea on how to solve this?

[jaredgreen]

Same issue. Cannot differentiate between a "Cancel" on the initial system prompt and the "Cancel" to close the browser after a successful logout. Both yield a LogoutResult with error of UserCancel.

[Gaburiere-Remira]

Changing to the new supported duende nuget https://github.com/DuendeSoftware/foss/tree/main/identity-model/ the issue remains. Any idea on this topic?

[Gaburiere-Remira]

The only way that i found to prevent the native form to appear is to declare the browsing session as ephimeral.

var res = await  WebAuthenticator.AuthenticateAsync(new WebAuthenticatorOptions()
{
    PrefersEphemeralWebBrowserSession = true,
    CallbackUrl = callbackUrl,
    Url = url
});

the ephimeral session, if i have understood well, prevents to save cache and cookies across the browsing sessions and prevents the appearing of the native form.
this affect only iOS.