I have two mvc 5 applications setup using OWIN-MixedAuth deployed to the same server. Each application is inside a separate folder and configured with its own app pool as follows:
xyz.domain.com/MySiteA
xyz.domain.com/MySiteB
Web config for each is as follows
MySiteA:
<system.web>
<customErrors mode="Off"/>
<authentication mode="None" />
<compilation debug="true" targetFramework="4.5.2" />
<httpRuntime targetFramework="4.5.2" />
</system.web>
<!-- Enable Mixed Auth -->
<location path="MySiteA/MixedAuth">
<system.webServer>
<security>
<authentication>
<windowsAuthentication enabled="true" />
</authentication>
</security>
</system.webServer>
</location>
<system.webServer>
<modules>
<remove name="FormsAuthentication" />
</modules>
<handlers>
<remove name="ExtensionlessUrlHandler-Integrated-4.0" />
<remove name="OPTIONSVerbHandler" />
<remove name="TRACEVerbHandler" />
<add name="ExtensionlessUrlHandler-Integrated-4.0" path="*." verb="*" type="System.Web.Handlers.TransferRequestHandler" preCondition="integratedMode,runtimeVersionv4.0" />
</handlers>
</system.webServer>`
MySiteB:
<system.web>
<customErrors mode="Off"/>
<authentication mode="None" />
<compilation debug="true" targetFramework="4.5.2" />
<httpRuntime targetFramework="4.5.2" />
</system.web>
<!-- Enable Mixed Auth -->
<location path="MySiteB/MixedAuth">
<system.webServer>
<security>
<authentication>
<windowsAuthentication enabled="true" />
</authentication>
</security>
</system.webServer>
</location>
<system.webServer>
<modules>
<remove name="FormsAuthentication" />
</modules>
<handlers>
<remove name="ExtensionlessUrlHandler-Integrated-4.0" />
<remove name="OPTIONSVerbHandler" />
<remove name="TRACEVerbHandler" />
<add name="ExtensionlessUrlHandler-Integrated-4.0" path="*." verb="*" type="System.Web.Handlers.TransferRequestHandler" preCondition="integratedMode,runtimeVersionv4.0" />
</handlers>
</system.webServer>`
When a user logs into one applications, the user is automatically logged into the second application as well even though they are not a registered user in the second application.
similarly loggin out of one application automatically logs the user out of the second application.
This is happening if I authenticate using a Form or windows. How can I prevent this happening?
This is my login code on both applications:
[AllowAnonymous]
public ActionResult Login(string returnUrl)
{
// If user is already logged in
if (HttpContext.Request.IsAuthenticated)
{
return RedirectToAction("Index", "Manage");
}
ViewBag.ReturnUrl = returnUrl;
return View();
}
And this is what I have in startup.auth:
var cookieOptions = new CookieAuthenticationOptions
{
AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
LoginPath = new PathString("/Account/Login"),
Provider = new CookieAuthenticationProvider
{
// Enables the application to validate the security stamp when the user logs in.
// This is a security feature which is used when you change a password or add an external login to your account.
OnValidateIdentity = SecurityStampValidator.OnValidateIdentity<ApplicationUserManager, ApplicationUser>(
validateInterval: TimeSpan.FromMinutes(30),
regenerateIdentity: (manager, user) => user.GenerateUserIdentityAsync(manager))
}
};
app.UseCookieAuthentication(cookieOptions);
Is there an option to change the cookie name?