IdentityServer4 and .netcore WebApp/WebAPI cookie authentication/authorization

Question

I have Three application viz(IdentityServer4 App, .Net Core2.0 WebApp, .NetCore2.0 WebAPI)

When I open the webapp if its un-authenticated, It gets navigated to identity server where I supply the credentials. After successful authentication it navigates back to webapp with the required cookies in place. Things are fine till here.

Now within webapp I am making calls to webapi (with cookies set by identity server in webapp) but each time it returns as 401 unauthorized.

Code sample in webapp:

services.AddAuthentication(options =>
   {
      options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
      options.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme;
  })
  .AddCookie(CookieAuthenticationDefaults.AuthenticationScheme, o =>
        {
            o.Cookie.Name = Config.CookieName;
            o.Cookie.SameSite = SameSiteMode.None;
        })
  .AddOpenIdConnect(OpenIdConnectDefaults.AuthenticationScheme, options =>
        {
            options.SignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;

            options.Authority = Config.IdentityUrl;
            options.RequireHttpsMetadata = false;
            options.ClientId = Config.ClientId;
            options.SaveTokens = true;
        });

And Code sample used in WebAPI in configure service method ConfigureServices:

services.AddAuthentication(options =>
{
    options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
    options.DefaultChallengeScheme = CookieAuthenticationDefaults.AuthenticationScheme;
})
.AddCookie(CookieAuthenticationDefaults.AuthenticationScheme, o => {
    o.Cookie.Name = Config.CookieName;
    o.Cookie.SameSite = SameSiteMode.None;
    o.Events = new CookieAuthenticationEvents()
    {
        OnRedirectToLogin = redirectContext =>
        {
            redirectContext.HttpContext.Response.StatusCode = StatusCodes.Status401Unauthorized;
            return Task.CompletedTask;
        }
    };
})
.AddIdentityServerAuthentication(options =>
{
    options.Authority = Config.IdentityUrl;
    options.RequireHttpsMetadata = false;
    options.ApiName = Config.ApiName;
});

also I have app.UseAuthentication() method in Configure method

What I get a feeling of it has to do with something session-id may be. If so it the case please help if not then what you could make out as not doing right please help.

I traced log it shows just following thing in there:

Cookie was not authenticated. Failure Message: Unprotect ticket failed.

Authentication Cookie was chanllenged.

Any help would be appreciated.

Answer 1

Here is the magical line of code.Added in

ConfigureServices

method before

services.AddAuthentication

This was reason because of which cookie was not getting validated.

services.AddDataProtection().PersistKeysToFileSystem(PersistKeysLocation.GetKeyRingDirInfo()) .SetApplicationName(Config.ApplicationName);