User errors when signing out on the dev environment

Add string replacement for the sign out redirect to ensure that it it is https. The headers will be forwarded correctly within this ticket https://dfedigital.atlassian.net/browse/SAB-345.

Author: andycunningham-airelogic

src/SchoolAccount.Web.Mvc/Authentication/Extensions/ServiceCollectionExtensions.cs

@@ -1,4 +1,3 @@
-using Microsoft.AspNetCore.Authentication;
 using Microsoft.AspNetCore.Authentication.Cookies;
 using Microsoft.AspNetCore.Authentication.OpenIdConnect;
 using Microsoft.IdentityModel.Protocols.OpenIdConnect;
@@ -50,25 +49,26 @@ IConfigurationManager configuration
 
                 options.Events = new OpenIdConnectEvents
                 {
-                    OnRedirectToIdentityProviderForSignOut = async context =>
-                    {
-                        context.HttpContext.Session.Clear();
-                        await Task.CompletedTask;
-                    },
-
-                    OnTicketReceived = OpenIdConnectEventHandlers.OnTicketReceived,
-
                     // within ACA a container runs on http, though available as https publicly
                     // this causes the OIDC redirect_url to have the http protocol, rather than https
                     // DSI does not allow http redirect URLS. The following corrects the URL
-                    OnRedirectToIdentityProvider = async n =>
+                    OnRedirectToIdentityProvider = async context =>
                     {
-                        n.ProtocolMessage.RedirectUri = n.ProtocolMessage.RedirectUri.Replace(
-                            "http://",
-                            "https://"
-                        );
+                        context.ProtocolMessage.RedirectUri =
+                            context.ProtocolMessage.RedirectUri.Replace("http://", "https://");
                         await Task.CompletedTask;
                     },
+                    OnRedirectToIdentityProviderForSignOut = async context =>
+                    {
+                        context.HttpContext.Session.Clear();
+                        context.ProtocolMessage.PostLogoutRedirectUri =
+                            context.ProtocolMessage.PostLogoutRedirectUri.Replace(
+                                "http://",
+                                "https://"
+                            );
+                        await Task.CompletedTask;
+                    },
+                    OnTicketReceived = OpenIdConnectEventHandlers.OnTicketReceived,
                 };
             });
 

tests/SchoolAccount.Web.Mvc.UnitTests/Extensions/ServiceCollection/ServiceCollectionAddDsiAuthenticationExtensionTests.cs

@@ -105,12 +105,100 @@ public async Task Ensure_that_OnRedirectToIdentityProviderForSignOut_clears_sess
             scheme,
             oidcOptions,
             new AuthenticationProperties()
+        )
+        {
+            ProtocolMessage = new OpenIdConnectMessage
+            {
+                PostLogoutRedirectUri = "https://test-oidc.signin",
+            },
+        };
+
+        // Act
+        await oidcOptions.Events.OnRedirectToIdentityProviderForSignOut(redirectContext);
+
+        // Assert
+        mockSession.Received(1).Clear();
+    }
+
+    [Fact]
+    public async Task Ensure_that_OnRedirectToIdentityProviderForSignOut_logout_redirect_uri_is_https()
+    {
+        // Arrange
+        var services = new Microsoft.Extensions.DependencyInjection.ServiceCollection();
+        using var configuration = BuildConfiguration();
+        services.AddDsiAuthentication(configuration);
+        var provider = services.BuildServiceProvider();
+
+        var oidcOptions = provider
+            .GetRequiredService<IOptionsMonitor<OpenIdConnectOptions>>()
+            .Get(OpenIdConnectDefaults.AuthenticationScheme);
+
+        var mockSession = Substitute.For<ISession>();
+        var httpContext = new DefaultHttpContext { Session = mockSession };
+
+        var scheme = new AuthenticationScheme(
+            OpenIdConnectDefaults.AuthenticationScheme,
+            OpenIdConnectDefaults.AuthenticationScheme,
+            typeof(OpenIdConnectHandler)
         );
 
+        var redirectContext = new RedirectContext(
+            httpContext,
+            scheme,
+            oidcOptions,
+            new AuthenticationProperties()
+        )
+        {
+            ProtocolMessage = new OpenIdConnectMessage
+            {
+                PostLogoutRedirectUri = "http://test-oidc.signin",
+            },
+        };
+
         // Act
         await oidcOptions.Events.OnRedirectToIdentityProviderForSignOut(redirectContext);
 
         // Assert
         mockSession.Received(1).Clear();
+        redirectContext.ProtocolMessage.PostLogoutRedirectUri.ShouldBe("https://test-oidc.signin");
+    }
+
+    [Fact]
+    public async Task Ensure_that_OnRedirectToIdentityProvider_redirect_uri_is_https()
+    {
+        // Arrange
+        var services = new Microsoft.Extensions.DependencyInjection.ServiceCollection();
+        using var configuration = BuildConfiguration();
+        services.AddDsiAuthentication(configuration);
+        var provider = services.BuildServiceProvider();
+
+        var oidcOptions = provider
+            .GetRequiredService<IOptionsMonitor<OpenIdConnectOptions>>()
+            .Get(OpenIdConnectDefaults.AuthenticationScheme);
+
+        var mockSession = Substitute.For<ISession>();
+        var httpContext = new DefaultHttpContext { Session = mockSession };
+
+        var scheme = new AuthenticationScheme(
+            OpenIdConnectDefaults.AuthenticationScheme,
+            OpenIdConnectDefaults.AuthenticationScheme,
+            typeof(OpenIdConnectHandler)
+        );
+
+        var redirectContext = new RedirectContext(
+            httpContext,
+            scheme,
+            oidcOptions,
+            new AuthenticationProperties()
+        )
+        {
+            ProtocolMessage = new OpenIdConnectMessage { RedirectUri = "http://test-oidc.signin" },
+        };
+
+        // Act
+        await oidcOptions.Events.OnRedirectToIdentityProvider(redirectContext);
+
+        // Assert
+        redirectContext.ProtocolMessage.RedirectUri.ShouldBe("https://test-oidc.signin");
     }
 }