Logout support for external Revocation Endpoint

[bcary]

Is your feature request related to a problem? Please describe.

During the logout process, I am invoking the authorize call (authStateByPresentingAuthorizationRequest in OIDAuthState) with the revocation endpoint. The browser opens, but since I do not receive an authorizationCode in return because its a logout action, the exception thrown on line 204 of OIDAuthorizationResponse crashes my app.

Describe the solution you'd like
I think there should be a configuration check to see if a logout action is being performed, in which case to return nil instead of throwing an uncaught exception.

Describe alternatives you've considered
I am not able to wrap the callback I send in with a try catch because this exception is thrown within the library, prior to the callback being invoked.
I have a fork of this library now that wraps the tokenExchangeRequest made from OIDAuthState in a try catch, and in turn invokes the callback with a nil authState

[WilliamDenniss]

AppAuth does not currently officially support Logout, or any other user-agent endpoints other than authorization (the crash is WAI, as the method suggests it's only for authorization requests).

You can implement something yourself though, as we do have some of the glue already to support generic external user-agent requests. You'd need to create a concrete implementation of OIDExternalUserAgentRequest and OIDExternalUserAgentSession.

Once you have those objects, which describes your logout request, and how you plan to handle any responses, create an instance of OIDExternalUserAgentIOS and call the following method with those two objects:

AppAuth-iOS/Source/OIDExternalUserAgent.h

Lines 33 to 42 in a19bfb6

	/*! @brief Presents the request in the external user-agent.
	@param request The request to be presented in the external user-agent.
	@param session The @c OIDExternalUserAgentSession instance that initiates presenting the UI.
	Concrete implementations of a @c OIDExternalUserAgent may call
	resumeExternalUserAgentFlowWithURL or failExternalUserAgentFlowWithError on session to either
	resume or fail the request.
	@return YES If the request UI was successfully presented to the user.
	*/
	- (BOOL)presentExternalUserAgentRequest:(id<OIDExternalUserAgentRequest> )request
	session:(id<OIDExternalUserAgentSession>)session;

You could also see if there is a fork or PR that solves this for you. This issue tracker is only for merged features of AppAuth, so I am not commenting about that work here.

[bcary]

Got it, thank you for the response and the suggestion! Very helpful!

[WilliamDenniss]

@bcary, this will very soon be in-scope now. You can try a complete Logout implementation in https://github.com/openid/AppAuth-iOS/tree/dev-logout (PR: #259) in fact I'm keen for you to try it and let me know if it works for you before we merge it in.

[bcary]

Awesome, I should be able to try it out before the end of the week!
We're using Azure AD B2C as our Identity/Federation provider, and this was Microsoft's recommended library so I'm very glad to hear about logout coming into scope!

[WilliamDenniss]

Cool! Did you try it out @bcary? I'm keen to learn how it worked out for you.

[danipralea]

I am also interested in logout functionality. Right now, when I try to log back in, it logs me in with the logged out user. Is this going to be a thing?
thanks

[ugenlik]

@WilliamDenniss please correct me if I am wrong, I directed my pod to your dev-logout branch

in ios 11

Previously this is how I did logout:

        let endSessionUrl = issuer.appendingPathComponent("connect/endsession")
        
        let config = OIDServiceConfiguration.init(authorizationEndpoint: endSessionUrl, tokenEndpoint: endSessionUrl)
        
        
        guard let idToken = LoginData.sharedInstance.getIDToken() else {return}
        let additionalParams = [
            "post_logout_redirect_uri":"com.xxx.vnext:/identity_callback",
            "id_token_hint":idToken
        ]
        
        let request = OIDAuthorizationRequest(configuration: config,
                                              clientId: clientID,
                                              clientSecret: Config.sharedInstance.identity_ClientSecret,
                                              scope: "openid offline_access mhdapi",
                                              redirectURL: redirectURI,
                                              responseType: OIDResponseTypeCode,
                                              state: OIDAuthorizationRequest.generateState(),
                                              codeVerifier: OIDAuthorizationRequest.generateCodeVerifier(),
                                              codeChallenge: OIDAuthorizationRequest.generateCodeVerifier(),
                                              codeChallengeMethod: "plain",
                                              additionalParameters: additionalParams)
        
        
        LoginData.sharedInstance.currentAuthorizationFlow = OIDAuthorizationService.present(request, presenting: viewController) { (authState, error) in
            
            LoginData.sharedInstance.removeState()
            completionClosure(true,nil)
        }

with dev-logout branch (I still couldn't completely figure out OIDExternalUserAgentSession protocol, it looks like a lot of effort to implement that, so I just forced downcasted which basially does nothing but ignore warnings)

        let endSessionUrl = issuer.appendingPathComponent("connect/endsession")
        
        let config = OIDServiceConfiguration.init(authorizationEndpoint: endSessionUrl, tokenEndpoint: endSessionUrl, issuer: issuer, registrationEndpoint: nil, endSessionEndpoint: endSessionUrl)
        
        guard let idToken = LoginData.sharedInstance.getIDToken() else {return}

        let url = URL(string: "com.xxxx.vnext:/identity_callback")!
        let endReq = OIDEndSessionRequest.init(configuration: config, idTokenHint: idToken, postLogoutRedirectURL:url, additionalParameters: nil)
        
        
        let agent = OIDExternalUserAgentIOS(presenting: viewController)
        
        LoginData.sharedInstance.externalAuth = OIDAuthorizationService.present(endReq, externalUserAgent: agent!) { (response, error) in

                if let respon = response
                {
                    print(respon)
                }

                if let err = error
                {
                    print(err)
                }

            } as! OIDExternalUserAgentSession

The old way and the new way works out fine, they both do logout fine.

My actual question: Is there a way to logout and delete the cookies without prompting user to a logout page, like every other app/website does?

Because iOS throws this annoying alertview says SIGN IN in the alert view, which is kinda of a big deal for my UX designer.

[danipralea]

@bcary I also tried your implementation, but it doesn't work for me:

- (void)logoutFromViewController:(UIViewController *)controller {
    AppDelegate *appDelegate = (AppDelegate *)[[UIApplication sharedApplication] delegate];
    [appDelegate.authState performActionWithFreshTokens:^(NSString *_Nonnull accessToken,
                                                          NSString *_Nonnull idToken,
                                                          NSError *_Nullable error) {
        if (error) {
            NSLog(@"Error fetching fresh tokens: %@", [error localizedDescription]);
            [[NSNotificationCenter defaultCenter] postNotificationName:REFRESH_TOKEN_EXPIRED_NOTIFICATION object:nil];
        }
        else {
            NSString *logoutURLString = [PayInTechAPIClient logoutEndpoint];
            NSURL *logoutURL = [NSURL URLWithString:logoutURLString];
            
            
            NSURL *redirectURI = [NSURL URLWithString:kRedirectURI];
            OIDServiceConfiguration *config = [[OIDServiceConfiguration alloc] initWithAuthorizationEndpoint:logoutURL tokenEndpoint:logoutURL];
            NSDictionary *additionarParams = @{@"id_token_hint": idToken};
            OIDAuthorizationRequest *request = [[OIDAuthorizationRequest alloc] initWithConfiguration:config
                                                                                             clientId:[PayInTechAPIClient kClientID]
                                                                                         clientSecret:[PayInTechAPIClient kClientSecret]
                                                                                                scope:@"openid offline_access profile"
                                                                                          redirectURL:redirectURI
                                                                                         responseType:OIDResponseTypeCode
                                                                                                state:[OIDAuthorizationRequest generateState]
                                                                                         codeVerifier:[OIDAuthorizationRequest generateCodeVerifier]
                                                                                        codeChallenge:[OIDAuthorizationRequest generateCodeVerifier]
                                                                                  codeChallengeMethod:@"plain"
                                                                                 additionalParameters:additionarParams];
            [OIDAuthorizationService presentAuthorizationRequest:request presentingViewController:controller callback:^(OIDAuthorizationResponse * _Nullable authorizationResponse, NSError * _Nullable error) {
                NSLog(@"authorization response : %@", authorizationResponse);
                NSLog(@"logout error : %@", error);
            }];
        }
    }];
}

Is there something I'm missing out? This is what I'm getting:

What's your issuer in the second implementation @ugenlik ?

[bcary]

We ended up removing our dependency to AppAuth in favor of implementing the ROPC flow from our Identity Provider, which eliminated our need to visit an external Endpoint for any auth actions

[ugenlik]

@danipralea issuer is our endpoint
in our case https://login.mycompany.com/

then in our identity 3 server we have connect/endsession

so my both implementations end session url becomes https://login.mycompany.com/connect/endsession

[Hexfire]

Whenever I try to initiate logout by calling: OIDAuthorizationService.present(request , I see:

Attempting to load the view of a view controller while it is deallocating is not allowed and may result in undefined behavior (<SFAuthenticationViewController: 0x103807800>)

This is weird, as it seems that the viewcontroller which is deallocating is the one of AppAuth which I actually attempt to present.

How to fix it?

[Hexfire]

Figured it out. Result of the call must be persisted. This way it's presented fine.

[petkotodorov]

@WilliamDenniss I see that the library uses different APIs for authentication depending iOS version (SFSafariViewController in iOS 10, SFAuthenticationSession in iOS11 and ASWebAuthenticationSession is iOS 12 or newer). We were using older version of AppAuth and in order to log out we were initializing SFSafariViewController with our "endsession" endpoint, but now this doesn't work since session is not shared between Safari and ASWebAuthenticationSession. Any suggestion how to proceed with it?

[wilmarvh]

@ugenlik Did you manage to resolve this?

Because iOS throws this annoying alertview says SIGN IN in the alert view, which is kinda of a big deal for my UX designer.

[RanjeetStiga]

@WilliamDenniss please correct me if I am wrong, I directed my pod to your dev-logout branch

in ios 11

Previously this is how I did logout:

        let endSessionUrl = issuer.appendingPathComponent("connect/endsession")
        
        let config = OIDServiceConfiguration.init(authorizationEndpoint: endSessionUrl, tokenEndpoint: endSessionUrl)
        
        
        guard let idToken = LoginData.sharedInstance.getIDToken() else {return}
        let additionalParams = [
            "post_logout_redirect_uri":"com.xxx.vnext:/identity_callback",
            "id_token_hint":idToken
        ]
        
        let request = OIDAuthorizationRequest(configuration: config,
                                              clientId: clientID,
                                              clientSecret: Config.sharedInstance.identity_ClientSecret,
                                              scope: "openid offline_access mhdapi",
                                              redirectURL: redirectURI,
                                              responseType: OIDResponseTypeCode,
                                              state: OIDAuthorizationRequest.generateState(),
                                              codeVerifier: OIDAuthorizationRequest.generateCodeVerifier(),
                                              codeChallenge: OIDAuthorizationRequest.generateCodeVerifier(),
                                              codeChallengeMethod: "plain",
                                              additionalParameters: additionalParams)
        
        
        LoginData.sharedInstance.currentAuthorizationFlow = OIDAuthorizationService.present(request, presenting: viewController) { (authState, error) in
            
            LoginData.sharedInstance.removeState()
            completionClosure(true,nil)
        }

with dev-logout branch (I still couldn't completely figure out OIDExternalUserAgentSession protocol, it looks like a lot of effort to implement that, so I just forced downcasted which basially does nothing but ignore warnings)

        let endSessionUrl = issuer.appendingPathComponent("connect/endsession")
        
        let config = OIDServiceConfiguration.init(authorizationEndpoint: endSessionUrl, tokenEndpoint: endSessionUrl, issuer: issuer, registrationEndpoint: nil, endSessionEndpoint: endSessionUrl)
        
        guard let idToken = LoginData.sharedInstance.getIDToken() else {return}

        let url = URL(string: "com.xxxx.vnext:/identity_callback")!
        let endReq = OIDEndSessionRequest.init(configuration: config, idTokenHint: idToken, postLogoutRedirectURL:url, additionalParameters: nil)
        
        
        let agent = OIDExternalUserAgentIOS(presenting: viewController)
        
        LoginData.sharedInstance.externalAuth = OIDAuthorizationService.present(endReq, externalUserAgent: agent!) { (response, error) in

                if let respon = response
                {
                    print(respon)
                }

                if let err = error
                {
                    print(err)
                }

            } as! OIDExternalUserAgentSession

The old way and the new way works out fine, they both do logout fine.

My actual question: Is there a way to logout and delete the cookies without prompting user to a logout page, like every other app/website does?

Because iOS throws this annoying alertview says SIGN IN in the alert view, which is kinda of a big deal for my UX designer.

Have you find any way to logout and delete the cookies without promotion user ?

[arshadsk5]

@WilliamDenniss please correct me if I am wrong, I directed my pod to your dev-logout branch
in ios 11
Previously this is how I did logout:

        let endSessionUrl = issuer.appendingPathComponent("connect/endsession")
        
        let config = OIDServiceConfiguration.init(authorizationEndpoint: endSessionUrl, tokenEndpoint: endSessionUrl)
        
        
        guard let idToken = LoginData.sharedInstance.getIDToken() else {return}
        let additionalParams = [
            "post_logout_redirect_uri":"com.xxx.vnext:/identity_callback",
            "id_token_hint":idToken
        ]
        
        let request = OIDAuthorizationRequest(configuration: config,
                                              clientId: clientID,
                                              clientSecret: Config.sharedInstance.identity_ClientSecret,
                                              scope: "openid offline_access mhdapi",
                                              redirectURL: redirectURI,
                                              responseType: OIDResponseTypeCode,
                                              state: OIDAuthorizationRequest.generateState(),
                                              codeVerifier: OIDAuthorizationRequest.generateCodeVerifier(),
                                              codeChallenge: OIDAuthorizationRequest.generateCodeVerifier(),
                                              codeChallengeMethod: "plain",
                                              additionalParameters: additionalParams)
        
        
        LoginData.sharedInstance.currentAuthorizationFlow = OIDAuthorizationService.present(request, presenting: viewController) { (authState, error) in
            
            LoginData.sharedInstance.removeState()
            completionClosure(true,nil)
        }

with dev-logout branch (I still couldn't completely figure out OIDExternalUserAgentSession protocol, it looks like a lot of effort to implement that, so I just forced downcasted which basially does nothing but ignore warnings)

        let endSessionUrl = issuer.appendingPathComponent("connect/endsession")
        
        let config = OIDServiceConfiguration.init(authorizationEndpoint: endSessionUrl, tokenEndpoint: endSessionUrl, issuer: issuer, registrationEndpoint: nil, endSessionEndpoint: endSessionUrl)
        
        guard let idToken = LoginData.sharedInstance.getIDToken() else {return}

        let url = URL(string: "com.xxxx.vnext:/identity_callback")!
        let endReq = OIDEndSessionRequest.init(configuration: config, idTokenHint: idToken, postLogoutRedirectURL:url, additionalParameters: nil)
        
        
        let agent = OIDExternalUserAgentIOS(presenting: viewController)
        
        LoginData.sharedInstance.externalAuth = OIDAuthorizationService.present(endReq, externalUserAgent: agent!) { (response, error) in

                if let respon = response
                {
                    print(respon)
                }

                if let err = error
                {
                    print(err)
                }

            } as! OIDExternalUserAgentSession

The old way and the new way works out fine, they both do logout fine.
My actual question: Is there a way to logout and delete the cookies without prompting user to a logout page, like every other app/website does?
Because iOS throws this annoying alertview says SIGN IN in the alert view, which is kinda of a big deal for my UX designer.

Have you find any way to logout and delete the cookies without promotion user ?

Even I am getting Sign In alert for logout alert popup, any fixes please

[RanjeetStiga]

Hi ,
I am getting Apple warring .

ITMS-90809: Deprecated API Usage - Apple will stop accepting submissions of apps that use UIWebView APIs . See https://developer.apple.com/documentation/uikit/uiwebview for more information.
After you’ve corrected the issues, you can use Xcode or Application Loader to upload a new binary to App Store Connect.

[razan1994alali]

@WilliamDenniss please correct me if I am wrong, I directed my pod to your dev-logout branch
in ios 11
Previously this is how I did logout:

        let endSessionUrl = issuer.appendingPathComponent("connect/endsession")
        
        let config = OIDServiceConfiguration.init(authorizationEndpoint: endSessionUrl, tokenEndpoint: endSessionUrl)
        
        
        guard let idToken = LoginData.sharedInstance.getIDToken() else {return}
        let additionalParams = [
            "post_logout_redirect_uri":"com.xxx.vnext:/identity_callback",
            "id_token_hint":idToken
        ]
        
        let request = OIDAuthorizationRequest(configuration: config,
                                              clientId: clientID,
                                              clientSecret: Config.sharedInstance.identity_ClientSecret,
                                              scope: "openid offline_access mhdapi",
                                              redirectURL: redirectURI,
                                              responseType: OIDResponseTypeCode,
                                              state: OIDAuthorizationRequest.generateState(),
                                              codeVerifier: OIDAuthorizationRequest.generateCodeVerifier(),
                                              codeChallenge: OIDAuthorizationRequest.generateCodeVerifier(),
                                              codeChallengeMethod: "plain",
                                              additionalParameters: additionalParams)
        
        
        LoginData.sharedInstance.currentAuthorizationFlow = OIDAuthorizationService.present(request, presenting: viewController) { (authState, error) in
            
            LoginData.sharedInstance.removeState()
            completionClosure(true,nil)
        }

with dev-logout branch (I still couldn't completely figure out OIDExternalUserAgentSession protocol, it looks like a lot of effort to implement that, so I just forced downcasted which basially does nothing but ignore warnings)

        let endSessionUrl = issuer.appendingPathComponent("connect/endsession")
        
        let config = OIDServiceConfiguration.init(authorizationEndpoint: endSessionUrl, tokenEndpoint: endSessionUrl, issuer: issuer, registrationEndpoint: nil, endSessionEndpoint: endSessionUrl)
        
        guard let idToken = LoginData.sharedInstance.getIDToken() else {return}

        let url = URL(string: "com.xxxx.vnext:/identity_callback")!
        let endReq = OIDEndSessionRequest.init(configuration: config, idTokenHint: idToken, postLogoutRedirectURL:url, additionalParameters: nil)
        
        
        let agent = OIDExternalUserAgentIOS(presenting: viewController)
        
        LoginData.sharedInstance.externalAuth = OIDAuthorizationService.present(endReq, externalUserAgent: agent!) { (response, error) in

                if let respon = response
                {
                    print(respon)
                }

                if let err = error
                {
                    print(err)
                }

            } as! OIDExternalUserAgentSession

The old way and the new way works out fine, they both do logout fine.
My actual question: Is there a way to logout and delete the cookies without prompting user to a logout page, like every other app/website does?
Because iOS throws this annoying alertview says SIGN IN in the alert view, which is kinda of a big deal for my UX designer.

Have you find any way to logout and delete the cookies without promotion user ?

Even I am getting Sign In alert for logout alert popup, any fixes please

is there any news? thanks in advance

[ugenlik]

@razan1994alali , @RanjeetStiga , @Hexfire

I am not sure if anyone has still issues with log out.

Fo our iOS >10

Here is steps how I log out from our Identity 3 and 4 servers.

*Have this class in your project
https://gist.github.com/ugenlik/2a543f351e9b9425800b48266760dc85

*Our Identity Servers has some modifications such as we have a connect/endsession url as oppose to connect/token and it accepts identity token in

let additionalParams = [
            "post_logout_redirect_uri":"com.xxx.logout:/identity_callback",
            "id_token_hint":idToken
        ]

*Construct a OIDAuthorizationRequest with client id and secret etc.

*Then init let externalUserAgent = OIDExternalUserAgentIOSSafariViewController.init(presentingViewController: viewController)

*Then call

currentAuthorizationFlow = OIDAuthState.authState(byPresenting: request, externalUserAgent: externalUserAgent, callback: { (authState, error) in
      //logged out
        })

Full Function is:

    class func logOut(viewController:UIViewController, clientID: String, clientSecret: String?,
                      completionClosure: @escaping (_ isSuccesfull :Bool , _ error :String?) ->())
    {
        
        guard let redirectURI = URL(string: Config.sharedInstance.identity_RedirectURI) else {
            log.error("Error creating URL for : \(Config.sharedInstance.identity_RedirectURI)")
            return
        }
        
        guard let issuer = URL(string: Config.sharedInstance.identity_Issuer) else {
            log.error("Error creating URL for : \(Config.sharedInstance.identity_Issuer)")
            return
        }
        
        let endSessionUrl = issuer.appendingPathComponent("connect/endsession")
        
        let config = OIDServiceConfiguration.init(authorizationEndpoint: endSessionUrl, tokenEndpoint: endSessionUrl)
        
        
        guard let idToken = LoginData.sharedInstance.getAccessToken() else {return}
        let additionalParams = [
            "post_logout_redirect_uri":"com.myserver.logout:/identity_callback",
            "id_token_hint":idToken
        ]
        
        let request = OIDAuthorizationRequest(configuration: config,
                                              clientId: clientID,
                                              clientSecret:  Config.sharedInstance.identity_ClientSecret,
                                              scope: "openid offline_access mhdapi",
                                              redirectURL: redirectURI,
                                              responseType: OIDResponseTypeCode,
                                              state: OIDAuthorizationRequest.generateState(), nonce: nil, codeVerifier: OIDAuthorizationRequest.generateCodeVerifier(), codeChallenge: OIDAuthorizationRequest.generateCodeVerifier(), codeChallengeMethod: "plain",
                                              additionalParameters: additionalParams)
        
        
        let externalUserAgent = OIDExternalUserAgentIOSSafariViewController.init(presentingViewController: viewController)
        LoginData.sharedInstance.currentAuthorizationFlow = OIDAuthState.authState(byPresenting: request, externalUserAgent: externalUserAgent, callback: { (authState, error) in
            //do whatever after log out
            
        })
        
    }

[agiokas]

@WilliamDenniss please correct me if I am wrong, I directed my pod to your dev-logout branch

in ios 11

Previously this is how I did logout:

        let endSessionUrl = issuer.appendingPathComponent("connect/endsession")
        
        let config = OIDServiceConfiguration.init(authorizationEndpoint: endSessionUrl, tokenEndpoint: endSessionUrl)
        
        
        guard let idToken = LoginData.sharedInstance.getIDToken() else {return}
        let additionalParams = [
            "post_logout_redirect_uri":"com.xxx.vnext:/identity_callback",
            "id_token_hint":idToken
        ]
        
        let request = OIDAuthorizationRequest(configuration: config,
                                              clientId: clientID,
                                              clientSecret: Config.sharedInstance.identity_ClientSecret,
                                              scope: "openid offline_access mhdapi",
                                              redirectURL: redirectURI,
                                              responseType: OIDResponseTypeCode,
                                              state: OIDAuthorizationRequest.generateState(),
                                              codeVerifier: OIDAuthorizationRequest.generateCodeVerifier(),
                                              codeChallenge: OIDAuthorizationRequest.generateCodeVerifier(),
                                              codeChallengeMethod: "plain",
                                              additionalParameters: additionalParams)
        
        
        LoginData.sharedInstance.currentAuthorizationFlow = OIDAuthorizationService.present(request, presenting: viewController) { (authState, error) in
            
            LoginData.sharedInstance.removeState()
            completionClosure(true,nil)
        }

with dev-logout branch (I still couldn't completely figure out OIDExternalUserAgentSession protocol, it looks like a lot of effort to implement that, so I just forced downcasted which basially does nothing but ignore warnings)

        let endSessionUrl = issuer.appendingPathComponent("connect/endsession")
        
        let config = OIDServiceConfiguration.init(authorizationEndpoint: endSessionUrl, tokenEndpoint: endSessionUrl, issuer: issuer, registrationEndpoint: nil, endSessionEndpoint: endSessionUrl)
        
        guard let idToken = LoginData.sharedInstance.getIDToken() else {return}

        let url = URL(string: "com.xxxx.vnext:/identity_callback")!
        let endReq = OIDEndSessionRequest.init(configuration: config, idTokenHint: idToken, postLogoutRedirectURL:url, additionalParameters: nil)
        
        
        let agent = OIDExternalUserAgentIOS(presenting: viewController)
        
        LoginData.sharedInstance.externalAuth = OIDAuthorizationService.present(endReq, externalUserAgent: agent!) { (response, error) in

                if let respon = response
                {
                    print(respon)
                }

                if let err = error
                {
                    print(err)
                }

            } as! OIDExternalUserAgentSession

The old way and the new way works out fine, they both do logout fine.

My actual question: Is there a way to logout and delete the cookies without prompting user to a logout page, like every other app/website does?

Because iOS throws this annoying alertview says SIGN IN in the alert view, which is kinda of a big deal for my UX designer.

Hi @ugenlik , did you manage to get rid of the popup?

[yiyalo]

Hi can i know did you, @ugenlik , managed to done the logout without the pop out alert?

[fukemy]

same problem here i got sign in dialog instead of logout information text when using

OIDAuthorizationService presentEndSessionRequest...

[scinfu]

Same problem

[orschaef]

Concerning the "sign in" alert:

I think there is no real solution since this dialogue is presented by the system. So I guess there is no need to wait for people fixing that in the library - only Apple can do something here. As long as you have to end the session you built up with ASWebAuthenticationSession this is the only way.

If you are just using this logout mechanism to prevent automatic logins with the previous user (resulting in an opening Browser which directly gets closed again) there is a way to prevent this.
Since iOS 13 there is a property in ASWebAuthenticationSession called prefersEphemeralWebBrowserSession. With this you could setup the session in a secure and private environment and you do not share cookies and other data with other safari instances. This means that triggering the login page will always show you the mask - since it has no idea of any previous session.

This would be something that would definitely make sense to be supported by the AppAuth lib. There should be a setting on the OIDAuthorizationRequest or so for activating this on ASWebAuthenticationSession. Could be tricky since the lib must be compatible with older iOS versions.

For any other case I think there is no real solution to this. If anyone can proof me wrong I would be happy.