Question

Working on project where we use Windows Identity Foundation.
While testing the sign out solution i found that the following call
http://rp/?wa=wsignoutcleanup1.0 does not delete the FedAuth cookie on the RP.
Which in turn make the user stay signed in at the RP.

To remedy the situation I added the following code to the Global.asax:

protected void Application_Start()
{
    FederatedAuthentication.WSFederationAuthenticationModule.SigningOut += new EventHandler<SigningOutEventArgs>(WSFederationAuthenticationModule_SigningOut);
}

void WSFederationAuthenticationModule_SigningOut(object sender, SigningOutEventArgs e)
{
    FederatedAuthentication.SessionAuthenticationModule.DeleteSessionTokenCookie();
}

But shouldn’t WIF take care of this automatically?
Or is this the way to do it?

Answer 1

Make sure all the url casings match, even the application name, website name casing in IIS should match the urls in configs. I had a hard time tracking this down. See here: wasignoutcleanup issue