Azure AD and Redirect Uri with infinite login loop

Question

Good morning, I created a Blazor Server Side application in .NET5 with the standard VS2019 template and I want to authenticate via Azure OpenId.

The app must be deployed under IIS in HTTP mode and a reverse proxy will give users an HTTPS url: the final url given by the reverse proxy is https://myapp-test.domain.it.

My problem is that both when I debug the application in VS both when I publish it under IIS the application reload in loops the authentication page and the the login fails.

My Startup.cs:

public void ConfigureServices(IServiceCollection services)
        {
services.AddAuthentication(OpenIdConnectDefaults.AuthenticationScheme)
                .AddMicrosoftIdentityWebApp(Configuration.GetSection("AzureAd"))
                .EnableTokenAcquisitionToCallDownstreamApi()
                .AddInMemoryTokenCaches(); 

            services.AddControllersWithViews()
                .AddMicrosoftIdentityUI();

            services.Configure(options =>
            {
                options.ForwardedHeaders =
                    ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto | ForwardedHeaders.XForwardedHost;
            });

            string redirectUri = Configuration.GetSection("AzureAd:RedirectUri").Value;
            string clientSecret = Configuration.GetSection("AzureAd:ClientSecret").Value;
            if (!string.IsNullOrWhiteSpace(redirectUri))
            {
                services.Configure(OpenIdConnectDefaults.AuthenticationScheme, options =>
                {
                    options.SaveTokens = true;
                    var redirectToIdpHandler = options.Events.OnRedirectToIdentityProvider;
                    options.Events.OnRedirectToIdentityProvider = async context =>
                    {
                        await redirectToIdpHandler(context);
                        context.ProtocolMessage.RedirectUri = redirectUri;
                    };
                });
            }
//...
}

public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
        {
            app.UseForwardedHeaders();
//...
}

My appsettings.json:

{  
  "AzureAd": {
    "Instance": "https://login.microsoftonline.com/",
    "Domain": "XXXXXXX",
    "TenantId": "XXXXXXX",
    "ClientId": "XXXXXXX",
    "ClientSecret": "XXXXXXX",
    "RedirectUri": "https://myapp-test.domain.it",
    "CallbackPath": "/signin-oidc"
  },
  "Logging": {
    "LogLevel": {
      "Default": "Information",
      "Microsoft": "Warning",
      "Microsoft.Hosting.Lifetime": "Information"
    }
  },
  "AllowedHosts": "*"
}

In the redirect URIs on Azure I setted:

https://myapp-test.domain.it/
https://myapp-test.domain.it/signin-oidc

I run the application (or I hosted it under IIS) with the following url: http://localhost:39146; but as I said calling the app with http://localhost:39146 or with https://myapp-test.domain.it produces and "infinite" login loop that fails at the end.

user_15997509 · Answer

Initially you can try with latest versions of Microsoft packages , which may fix the issue.
This problem may occur if website uses http protocol.Please check if the reverse proxy listen HTTPS request but forward the request to the app as HTTP.See forward-the-scheme-for-linux-and-non-iis-reverse-proxies.Note that the cookie is only sent for secure https request.

One way is to force https navigation to the site. You can customize the Cookies Authentication middleware to allow the authentication AspNet cookie for both http and https scheme by setting the CookieSecure attribute to CookieSecureOption.Never as followed in the Startup.Auth.cs file but not recommended in certain cases.

app.UseCookieAuthentication(new CookieAuthenticationOptions
    {
        CookieSecure = CookieSecureOption.Never
    });

So some cases of owin middleware please try to update app’s Microsoft.Owin.Host.SystemWeb package be at least version 3.1.0.0

app.UseCookieAuthentication(new CookieAuthenticationOptions 
{ 
    AuthenticationType = "Cookies", 
    CookieManager = new Microsoft.Owin.Host.SystemWeb.SystemWebChunkingCookieManager() 
});

Also you can check this way OWIN and Azure AD HTTPS to HTTP Redirect Loop - Stack Overflow

References:

infinite redirect loop between Azure AD and MVC Asp.net app (aaddevsup.xyz)

Azure AD and Redirect Uri with infinite login loop

1 Answers