WsFederation and local user mixed authentication

Question

I'm trying make my user login with Azure AD credentials (using OWIN WsFederation plugin) or using a local user account with microsoft asp.net identity in a MVC 5.1 Web App.

Login with local users work fine, login using a federated account works only once, and I need to restart my app to make it work again.

I suppose the problem is with the response from Microsoft login page not processed correctly

Infact, using two differente browsers (chrome+ie) in private mode and Fiddler, I can see that my cookie is set on first request but not on a subsequent request made from a different browser

First request

Second request

This is my ConfigureAuth

     public void ConfigureAuth(IAppBuilder app)
    {
        AntiForgeryConfig.UniqueClaimTypeIdentifier = ClaimTypes.NameIdentifier;

        app.CreatePerOwinContext(ApplicationDbContext.Create);
        app.CreatePerOwinContext<ApplicationUserManager>(ApplicationUserManager.Create);

        app.SetDefaultSignInAsAuthenticationType("ExternalCookie");

        app.UseCookieAuthentication(new CookieAuthenticationOptions
        {
            AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
            LoginPath = new PathString("/Account/Login"),
            AuthenticationMode = Microsoft.Owin.Security.AuthenticationMode.Active,
        });


        // these two lines of code are needed if you are using any of the external authentication middleware
        app.UseCookieAuthentication(new CookieAuthenticationOptions
        {
            AuthenticationType = "ExternalCookie",
            AuthenticationMode = Microsoft.Owin.Security.AuthenticationMode.Passive,
        });


        app.UseWsFederationAuthentication(new Microsoft.Owin.Security.WsFederation.WsFederationAuthenticationOptions()
        {
            MetadataAddress = "https://login.windows.net/XXXXXXX.onmicrosoft.com/federationmetadata/2007-06/federationmetadata.xml",
            Wtrealm = "https://MYREALM",

            AuthenticationType = WsFederationAuthenticationDefaults.AuthenticationType,
        });

    }

This is part of the account controller

    //
    // POST: /Account/ExternalLogin
    [HttpPost]
    [AllowAnonymous]
    [ValidateAntiForgeryToken]
    public ActionResult ExternalLogin(string provider, string returnUrl)
    {
        // Request a redirect to the external login provider
        return new ChallengeResult(provider, Url.Action("ExternalLoginCallback", "Account", new { ReturnUrl = returnUrl }));
    }


    // GET: /Account/ExternalLoginCallback
    [AllowAnonymous]
    public ActionResult ExternalLoginCallback(string returnUrl)
    {

        var ctx = Request.GetOwinContext();
        var result = ctx.Authentication.AuthenticateAsync("ExternalCookie").Result;

        if (result != null) //null on request other than the first (!!!)
        {
            ctx.Authentication.SignOut("ExternalCookie");

            var claims = result.Identity.Claims.ToList();
            claims.Add(new Claim(ClaimTypes.AuthenticationMethod, "External Account"));
            var email = claims.Where(x => x.Type == "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name").SingleOrDefault().Value;
            var ci = new ClaimsIdentity(claims, DefaultAuthenticationTypes.ApplicationCookie);
            ctx.Authentication.SignIn(ci);
        }

        return RedirectToLocal(returnUrl);
    }

Hi Nicola, I had the same issue, I changed the AuthenticationMode to Passive. AuthenticationMode = AuthenticationMode.Passive in WsFederationAuthenticationOptions — Haroon, Nov 29 '14 at 22:11

score 3 · Answer 1 · answered Nov 29 '14 at 22:19

In the ConfgureAuth set AuthenticationMode to Passive. It worked in my workflow which seems very similar to yours.

app.UseWsFederationAuthentication(new Microsoft.Owin.Security.WsFederation.WsFederationAuthenticationOptions()
    {
        MetadataAddress = "https://login.windows.net/XXXXXXX.onmicrosoft.com/federationmetadata/2007-06/federationmetadata.xml",
        Wtrealm = "https://MYREALM",

        AuthenticationType = WsFederationAuthenticationDefaults.AuthenticationType,
        AuthenticationMode = AuthenticationMode.Passive
    });

http://msdn.microsoft.com/en-us/library/microsoft.owin.security.authenticationmode%28v=vs.113%29.aspx

WsFederation and local user mixed authentication

1 Answers1