Blazor Server集成KeyCloak登出报错：缺少id_token_hint参数

基于.NET 9的Blazor Server Web应用集成KeyCloak V26实现认证，登录流程正常，但登出时跳转至KeyCloak页面后出现「Missing parameters: id_token_hint」错误。预期登出流程为：跳转KeyCloak完成登出后自动返回Blazor主页，当前手动添加Client ID需手动点击登出，不符合需求。

当前登出代码如下：

@page "/logout"
@using Microsoft.AspNetCore.Authentication
@using Microsoft.AspNetCore.Authentication.Cookies
@using Microsoft.AspNetCore.Authentication.OpenIdConnect
@using Microsoft.AspNetCore.Identity
@inject IConfiguration Configuration

<PageTitle>Log Out</PageTitle>

@code {
    [CascadingParameter]
    private HttpContext HttpContext { get; set; } = default!;

    protected override async Task OnInitializedAsync()
    {
        if (HttpMethods.IsGet(HttpContext.Request.Method))
        {
            // sign-out from the default authentication scheme
            await HttpContext.SignOutAsync(OpenIdConnectDefaults.AuthenticationScheme, new AuthenticationProperties
                {                    
                   RedirectUri = "/"
                });

            // sign-out from the cookie authentication scheme
            await HttpContext.SignOutAsync(CookieAuthenticationDefaults.AuthenticationScheme);
        }
    }
}

1. 确保OpenIdConnect配置保存登录令牌 #

在Program.cs中配置OpenIdConnect时，开启SaveTokens选项，确保登录后id_token被保存到认证票据中：

builder.Services.AddAuthentication(options =>
{
    options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
    options.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme;
})
.AddCookie()
.AddOpenIdConnect(options =>
{
    options.Authority = builder.Configuration["KeyCloak:Authority"];
    options.ClientId = builder.Configuration["KeyCloak:ClientId"];
    options.ClientSecret = builder.Configuration["KeyCloak:ClientSecret"];
    options.ResponseType = "code";
    options.SaveTokens = true; // 必须开启，保存id_token、access_token到认证票据
    options.Scope.Add("openid");
    options.Scope.Add("profile");
});

2. 改进登出代码，传递id_token_hint参数 #

修改/logout页面的代码，从认证票据中获取id_token，并将其作为id_token_hint参数附加到登出请求中：

@page "/logout"
@using Microsoft.AspNetCore.Authentication
@using Microsoft.AspNetCore.Authentication.Cookies
@using Microsoft.AspNetCore.Authentication.OpenIdConnect
@inject IConfiguration Configuration

<PageTitle>Log Out</PageTitle>

@code {
    [CascadingParameter]
    private HttpContext HttpContext { get; set; } = default!;

    protected override async Task OnInitializedAsync()
    {
        if (HttpMethods.IsGet(HttpContext.Request.Method))
        {
            // 从认证票据中获取id_token
            var idToken = await HttpContext.GetTokenAsync(OpenIdConnectDefaults.AuthenticationScheme, "id_token");

            var authProperties = new AuthenticationProperties
            {
                RedirectUri = "/"
            };

            // 添加id_token_hint参数，KeyCloak会自动识别并完成自动登出
            if (!string.IsNullOrEmpty(idToken))
            {
                authProperties.Items["id_token_hint"] = idToken;
            }

            // 先触发OpenIdConnect登出（跳转KeyCloak）
            await HttpContext.SignOutAsync(OpenIdConnectDefaults.AuthenticationScheme, authProperties);
            
            // 清除本地Cookie认证
            await HttpContext.SignOutAsync(CookieAuthenticationDefaults.AuthenticationScheme);
        }
    }
}

3. 验证KeyCloak客户端配置 #

确保KeyCloak客户端的以下配置正确：

• Post Logout Redirect URIs：添加Blazor主页地址（如http://localhost:5000/*），确保登出后能正确跳转回应用
• Frontchannel Logout：设置为On（可选，优化登出体验）
• Valid Redirect URIs：包含应用的所有合法跳转地址

• SaveTokens = true会将登录时获取的id_token、access_token等保存到认证票据的Tokens集合中，方便后续获取
• 向AuthenticationProperties.Items添加id_token_hint参数后，OpenIdConnect认证处理程序会自动将该参数附加到KeyCloak的登出URL上，满足KeyCloak的自动登出要求
• 先执行OpenIdConnect登出再清除本地Cookie，确保KeyCloak端登出完成后再清除本地会话，避免状态不一致

内容的提问来源于stack exchange，提问作者Ganu