CODEWITHSUNDEEP
webformsowinidentityserver4openid-connectidentityserver3
pinale
pinale

Reputation: 2214

IdentityServer (OpenId Connect) authentication on asp.net webform

i'm trying to use IdentityServer3 to authenticate users on an asp.net webform application with owin pipeline (no mvc)

All the examples suggest to configure the application like a mvc application, but in this way the application doesn't perform a redirection to the IdentityServer Login page when i try to access to a protected resource of the webform application

this is my client (webform) configuration

[Startup.cs]

app.UseCookieAuthentication(new CookieAuthenticationOptions { 
                AuthenticationMode = AuthenticationMode.Active,
                AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie
                //LoginPath = new PathString ("/Account/Login")   //<--enabling this path property redirect me to a local login page but not to the external IdentityServer login page
            });



app.UseOpenIdConnectAuthentication(
                new OpenIdConnectAuthenticationOptions
                { 
                    Authority = "https://localhost:44300/identity",     //<<--url of the identityServer
                    ClientId = "webform",
                    ClientSecret = "ciccio",
                    Scope = "openid profile roles",
                    RedirectUri = "https://localhost:44302/",           //<-- url of the client (to come back ofter the login) 
                    ResponseType = "id_token",
                    SignInAsAuthenticationType = "Cookies"
                });

i'm sure i forgot something

Upvotes: 1

Views: 1859

Answers (2)

d_f
d_f

Reputation: 4859

It looks, you missed app.UseStageMarker(PipelineStage.Authenticate); at the bottom of your Startup.cs.
The reason is that (according to the documentation):

Owin middleware components (OMCs) run at the latest stage, which by default is PreHandlerExecute. The stage markers are used to make them to run earlier.

The complete sample including cookie mapping and support for logout is in IdSrv repo

posting this just in case someone else's still looking a solution for the same problem like we did recently, finding this question without an answer

Upvotes: 1

pinale
pinale

Reputation: 2214

as workaround i tried these solution suggested in this article but they DON'T WORK

Login page on different domain

both solutions in the example page force a "brutal" redirection to the IdentityServer, but doing so, the IdentityServer doesn't show you the login page because the performed request is not in the correct form

the "signin=xxxxxx" parameter attached to the querystring, needed to legitimate the login request is not present.

i've tried to use an mvc client as well, in this case every requests made to a protected resource (with Authorize attribute) is redirected to the IdentityServer in the correct way (the url where the user should be redirected to log-in page is in this format https://localhost:44300/identity/login?signin=4f7ee6677aec2d2aca6ebc40e4d13720) with the "signin" parameter attached to the querystring this behaviour doesn't happen in a webform application (at least with the same configuration used in a mvc application) I'm sure that something is missing, something like a "httpModule" that intercepts the "http 401 not authorized response" and composes a correctr url to redirect towards the login page of the IdentityServer

forgive me for my english

Upvotes: 0

Related Questions