OpenID Connect - Force user to sign in every time

[devdigital]

Hi,

What identity server options do I need to set to force the user to sign in on every session? I'm hosting an Angular app using the OpenID Connect implicit client flow.

I've set CookieOptions to new CookieOptions { IsPersistent = false }, however I'm testing on IIS Express, and so the identity server and Angular app are both on localhost, with different ports, so I think this isn't helping either (as the idsrv cookie is shared between both applications).

I haven't tried to sign out of the IdP through the end_session_endpoint URI exposed at the discovery endpoint (connect/endsession), is this handled? However, presumably I should never need to do this if the idsrv cookie is not written in the first place (is this correct?).

Thanks

[brockallen]

In the OIDC spec there is a prompt param that the RP can pass to the STS to indicate this.

http://openid.net/specs/openid-connect-core-1_0.html#AuthRequest

[devdigital]

Thanks, setting prompt=login in the implicit flow request seems to give the desired behaviour

[tugberkugurlu]

Is this still the case with idsvr4?

[brockallen]

The OIDC prompt parameter is supported in IdSvr4, yes.

[asfyra]

Is there a way to force login prompt and not let the client decide about that through the "prompt" param?

Thanks