Azure AD Signin from MVC App Redirect Loop

Viewed 1065

Ive read many posts, and all come down to the Cookies when autheticating. However, when Im experiencing the Redirect loop directly after logging in, it is effected over any client that logs in, not just specific PC's.

I have tried everything that I possibly can, and I can post everything ive done, but I dont see how this can be a cookie issue if it is happening to ALL users. So one moment it works, the next no one can log in due to redirect loop.

Logically it MUST be something to do with authentication cookies, but how can it be effecting everyone at the same time ?

Is this not something within Azure that may be causing an issue ? It seems that it has to be ?

Any Ideas would be greatly appreciated, as I am receiving a lot of flak from my client now :(

This is my startup.auth if it helps at all

private static string clientId = ConfigurationManager.AppSettings["ida:ClientId"];
        private static string tenant = ConfigurationManager.AppSettings["ida:Tenant"];
        private static string aadInstance = ConfigurationManager.AppSettings["ida:AADInstance"];
        private static string redirectUri = ConfigurationManager.AppSettings["ida:RedirectUri"];
        private static string postLogoutRedirectUri = ConfigurationManager.AppSettings["ida:PostLogoutRedirectUri"];


        // Concatenate aadInstance, tenant to form authority value       
        private string authority = string.Format(CultureInfo.InvariantCulture, aadInstance, tenant);

        // ConfigureAuth method  
        public void ConfigureAuth(IAppBuilder app)
        {
            app.CreatePerOwinContext(ApplicationDbContext.Create);
            app.CreatePerOwinContext<ApplicationUserManager>(ApplicationUserManager.Create);
            app.CreatePerOwinContext<ApplicationRoleManager>(ApplicationRoleManager.Create);
            app.CreatePerOwinContext<ApplicationSignInManager>(ApplicationSignInManager.Create);

            app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);

            //app.UseCookieAuthentication(new CookieAuthenticationOptions());

            //Enable the application to use a cookie to store information for the signed in user

            //and to use a cookie to temporarily store information about a user logging in with a third party login provider

            //Configure the sign in cookie


            //app.UseCookieAuthentication(new CookieAuthenticationOptions
            //{
            //    AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
            //    LoginPath = new PathString("/Account/Login"),
            //    Provider = new CookieAuthenticationProvider
            //    {
            //        // Enables the application to validate the security stamp when the user logs in.
            //        // This is a security feature which is used when you change a password or add an external login to your account.  
            //        OnValidateIdentity = SecurityStampValidator.OnValidateIdentity<ApplicationUserManager, ApplicationUser>(
            //            validateInterval: TimeSpan.FromMinutes(30),
            //            regenerateIdentity: (manager, user) => user.GenerateUserIdentityAsync(manager))
            //    },
            //    CookieSecure = CookieSecureOption.Always
            //});

            app.UseCookieAuthentication(new CookieAuthenticationOptions
            {
                CookieName = "Local_Login",
                AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
                LoginPath = new PathString("/Account/Login"),
                Provider = new CookieAuthenticationProvider
                {
                    // Enables the application to validate the security stamp when the user logs in.
                    // This is a security feature which is used when you change a password or add an external login to your account.  
                    OnValidateIdentity = SecurityStampValidator.OnValidateIdentity<ApplicationUserManager, ApplicationUser>(
                            validateInterval: TimeSpan.FromMinutes(30),
                            regenerateIdentity: (manager, user) => user.GenerateUserIdentityAsync(manager))
                },
                //CookieManager = new SystemWebCookieManager(),
                SlidingExpiration = true
            });

            //app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);
            app.UseCookieAuthentication(new CookieAuthenticationOptions());

            app.UseOpenIdConnectAuthentication(

                            new OpenIdConnectAuthenticationOptions
                            {
                                ClientId = clientId,
                                Authority = authority,
                                RedirectUri = redirectUri,
                                PostLogoutRedirectUri = postLogoutRedirectUri,
                                Notifications = new OpenIdConnectAuthenticationNotifications
                                {
                                    AuthenticationFailed = (context) =>
                                    {
                                        context.HandleResponse();
                                        context.OwinContext.Response.Redirect("/Account/Login");
                                        return Task.FromResult(0);
                                    }
                                }
                            });


        } // end - ConfigureAuth method  
1 Answers

So after many many hours and a number of late nights, I finally seem to have found the solution.

So based on my understanding, at some point the 'MVC' cookie(Which I think is the application.cookie) and the Azure AD cookie(Which I think is the aspnet.cookie) delete each other, due to a bug within microsoft, which has not been fixed after many years of having this problem. So what is happening, is you have signed into Azure AD and the auth cookie says you are now authenticated, yet when hitting the controller, the 'MVC' cookie(as it was said in a post) says you are not authenticated, so redirects back to the Azure AD sign in, but sees you have been authenticated via Azure AD, and so the endless loop continues.

I saw many people referring to the Kentor Cookie Saver and that it helped, one or two that said it didnt, but I decided to give it a try, and I have not had the client complain for the last 2-3 days, so it must have worked.

Here is the link I used: Kentor Cookie Saver

I hope this helps or leads someone in the right direction.

Cheers!

Related