Question 88042 in ASP.NET Question posted in
The official documentation can be found here.

User unauthorized after Azure AD login to different application simultaneously – Asp.net

I have two MVC applications AppA and AppB, and implemented Azure AD authentication for login.
I am able to sign-in successfully to both applications.
But the issue is, after I login to AppA and then to AppB, after sometime when I return back to AppA I am facing the issue where user has been logged out, and it again redirects to login screen (in AppA).
After I login to AppA (second time) and go back to AppB (user in AppB is logged out).

Client IDs are different ; TenandID is same. Both apps are hosted in same server.

Startup file:

public void ConfigureAuth(IAppBuilder app)
        {
            app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);
            app.UseCookieAuthentication(new CookieAuthenticationOptions
            {
                AuthenticationType = CookieAuthenticationDefaults.AuthenticationType,
                SlidingExpiration = true,
                Provider = new CookieAuthenticationProvider
                {
                    OnResponseSignIn = context =>
                    {
                        context.Properties.AllowRefresh = true;
                        context.Properties.ExpiresUtc = DateTimeOffset.UtcNow.AddDays(1);
                    },
                    OnValidateIdentity = MyCookieValidateIdentity
                },
                ExpireTimeSpan = TimeSpan.FromDays(2)
            });

            app.UseOpenIdConnectAuthentication(
            new OpenIdConnectAuthenticationOptions
            {
                ClientId = appId,
                //CookieManager=new SameSiteCookieManager(new SystemWebCookieManager()),
                Authority = "https://login.microsoftonline.com/xxxxxx/v2.0",
                Scope = $"openid email profile offline_access {graphScopes}",
                RedirectUri = redirectUri,
                PostLogoutRedirectUri = redirectUri,
                TokenValidationParameters = new TokenValidationParameters
                {
                    ValidateIssuer = true,
                },
                Notifications = new OpenIdConnectAuthenticationNotifications
                {
                    RedirectToIdentityProvider = (context) =>
                    {
                        context.ProtocolMessage.DomainHint = "xyz.com";
                        return Task.FromResult(0);
                    },
                    // SecurityTokenValidated = OnSecurityTokenValidated,
                    AuthenticationFailed = OnAuthenticationFailedAsync,
                    AuthorizationCodeReceived = OnAuthorizationCodeReceivedAsync
                }
            }
            );
        }

actionContext.RequestContext.Principal.Identity.IsAuthenticated is returning False

I am assuming it has to do something with the cookie. Can someone please help resolve this ?

Edit:
Debugged further and found:
Initially if the cookies for AppA are set as:
.AspNet.Cookies = A_abc123 ; ASP.NET_SessionId = A_def456
And for AppB .AspNet.Cookies = B_mno123 ; ASP.NET_SessionId = B_pqr456
Then after I click any link in AppA, the cookie’s values are updated with AppB’s cookies, i.e. .AspNet.Cookies = B_mno123 ; ASP.NET_SessionId = B_pqr456

      .AspNet.Cookies   ASP.NET_SessionId 
AppA  A_abc123          A_def456
AppB  B_mno123          B_pqr456
AppA  B_mno123          B_pqr456
Tags:

2

Answers


  1. Chosen as BEST ANSWER
    0 
     public void ConfigureAuth(IAppBuilder app)
 {
            app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);

            app.UseCookieAuthentication(new CookieAuthenticationOptions
            {
                //AuthenticationType = CookieAuthenticationDefaults.AuthenticationType,// DefaultAuthenticationTypes.ApplicationCookie,
                CookieName = ".AspNet.AppA.Cookies",
                SlidingExpiration = true,
                CookieManager = new SystemWebCookieManager(),
                Provider = new CookieAuthenticationProvider
                {
                    OnResponseSignIn = context =>
                    {
                        context.Properties.AllowRefresh = true;
                        context.Properties.ExpiresUtc = DateTimeOffset.UtcNow.AddDays(1);
                    },
                },
               ExpireTimeSpan = TimeSpan.FromDays(2)
            });
            //... code removed for brevity //
}

    The Default Cookie Name set by the application was: .AspNet.Cookies And when I modified the default cookie name, the issue got resolved. Each application was generating its own cookiename and hence the other application was not signing out the user.


  2. 0

    One thing that you need to do is to configure the Data Protection API so that both services uses the same cookie protection key. Out of the box each service creates its own unique key, and a cookie from one service is not valid in a different service.

    I also did a blog post about the data protection API here.

    See

    Login or Signup to reply.
Please signup or login to give your own answer.

Back To Top
Search