title: Append client ID to logout URL with OWIN middleware for OIDC
body: <p>I am working on a web application for a customer. For authentication the customer is using his own (custom) OIDC identity provider. I was able to implement sign-in, signup, password reset. Now the task is to implement signout.</p>
  
  <p>When the user signs out he will be redirected to <code>https://customoidc.example.com/ciam/logout?post_logout_redirect_uri=https%3a%2f%2flocalhost%3a4200%2faccount%2fsignout-callback</code>. This is not a valid logout URL for the custom OIDC provider. It needs the client ID as well. I was not able to configure the middleware to send the client ID as a query string parameter. How can I achieve this?</p>
  
  <p>Appending the client ID in the configuration <code>EndSessionEndpoint = ciamUrl + $"ciam/logout?client_id={clientId}"</code> results in the malformed URL <code>https://customoidc.exemple.com/ciam/logout?client_id={clientId}?post_logout_redirect_uri=https%3a%2f%2flocalhost%3a4200%2faccount%2fsignout-callback</code> (double question marks).</p>
  
  <p>This is how the authentication middleware looks like:</p>
  
  <pre><code>public void ConfigureAuth(IAppBuilder app)
  {
      var cookieAT = CookieAuthenticationDefaults.AuthenticationType;
      app.SetDefaultSignInAsAuthenticationType(cookieAT);
  
      app.UseCookieAuthentication(new CookieAuthenticationOptions
      {
          AuthenticationType = "Cookie",
          AuthenticationMode = AuthenticationMode.Active
      });
  
      app.UseOpenIdConnectAuthentication(new OpenIdConnectAuthenticationOptions
      {
          ClientId = clientId,
          RedirectUri = redirectUri,
          Configuration = new Microsoft.IdentityModel.Protocols.OpenIdConnectConfiguration
          {
              AuthorizationEndpoint = ciamUrl + "oidc10/auth/oauth/v2/authorize",
              TokenEndpoint = ciamUrl + "oidc10/auth/oauth/v2/token",
              UserInfoEndpoint = ciamUrl + "oidc10/openid/connect/v1/userinfo",
              EndSessionEndpoint = ciamUrl + "ciam/logout"
          },
          ResponseType = "code",
          Scope = "openid ciam-uid email profile"
      });
  }
  </code></pre>
  
  <p>Sign out is triggered through this code:</p>
  
  <pre><code>[RoutePrefix("account")]
  public class AccountController : Controller
  {
      [Route("signout")]
      public void SignOut()
      {
          string callbackUrl = Url.Action(
              actionName: "SignOutCallback",
              controllerName: "Account",
              routeValues: null,
              protocol: Request.Url.Scheme);
          var authnProperties = new AuthenticationProperties { RedirectUri = callbackUrl };
          var oidcAT = OpenIdConnectAuthenticationDefaults.AuthenticationType;
          var cookieAT = CookieAuthenticationDefaults.AuthenticationType;
          var owinCtx = HttpContext.GetOwinContext();
          owinCtx.Authentication.SignOut(authnProperties, oidcAT, cookieAT);
      }
  
      ...
  }
  </code></pre>