How to use MVC4 Client with IdentityServer4?

Question

Does anyone know how to have MVC 4 client app to use identityserver4 as auth provider?

I have tried the sample codes of identityserver3 but no success. Upon request to [Authorize] action it redirects to identityserver4 probably login end point and gives unknown error.

As far as I know, I am not able to define client at both identityserver4 'start-up.cs' and MVC client with OWIN's 'startup.cs'.

Update

The code from my IdentityServer4 app - MVC 4 Client Definition

// OpenID Connect hybrid flow and client credentials client (MVC)
            new Client
            {
                ClientId = "mvc4",
                ClientName = "MVC 4 Client",
                AllowedGrantTypes = GrantTypes.HybridAndClientCredentials,

                RequireConsent = false,

                ClientSecrets =
                {
                    new Secret("secret".Sha256())
                },

                RedirectUris = { "http://localhost:53173/signin-oidc" },
                PostLogoutRedirectUris = { "http://localhost:53173/signout-callback-oidc" },

                AllowedScopes =
                {
                    IdentityServerConstants.StandardScopes.OpenId,
                    IdentityServerConstants.StandardScopes.Profile,
                    "api1"
                },
                AllowOfflineAccess = true
            }

And the code from 'Startup.cs' of my MVC 4 app

public void Configuration(IAppBuilder app)
    {

        JwtSecurityTokenHandler.DefaultInboundClaimTypeMap = new Dictionary<string, string>();

        app.UseCookieAuthentication(new CookieAuthenticationOptions
        {
            AuthenticationType = "Cookies"
        });

        app.UseOpenIdConnectAuthentication(new OpenIdConnectAuthenticationOptions
        {
            Authority = "http://localhost:5000/",
            RequireHttpsMetadata = false,

            ClientId = "mvc4",
            ClientSecret = "secret",
            ResponseType = "code id_token",

            Scope = "openid profile api1 offline_access",

            UseTokenLifetime = false,
            SignInAsAuthenticationType = "Cookies",
        });
    }

Update 2

I changed the Startup.cs of my MVC 4 Client to:

app.UseOpenIdConnectAuthentication(new OpenIdConnectAuthenticationOptions
        {
            AuthenticationType = "oidc",
            SignInAsAuthenticationType = "Cookies",

            Authority = "http://localhost:5000",
            RequireHttpsMetadata = false,
            RedirectUri = "http://localhost:53173/signin-oidc",

            ClientId = "mvc4",
            ClientSecret = "secret",
            ResponseType = "code id_token"
        });

It now presents a login page, logs in the user and then the IdentityServer has gone into never ending loop:

Update 3

public void Configuration(IAppBuilder app)
    {
        JwtSecurityTokenHandler.DefaultInboundClaimTypeMap = new Dictionary<string, string>();            

        app.UseOpenIdConnectAuthentication(new OpenIdConnectAuthenticationOptions
        {
            AuthenticationType = "oidc",
            SignInAsAuthenticationType = "Cookies",

            Authority = "http://localhost:5000",
            RequireHttpsMetadata = false,
            RedirectUri = "http://localhost:53173/signin-oidc",

            ClientId = "mvc4",
            ClientSecret = "secret",
            ResponseType = "code id_token",

            Scope = "openid profile api1 offline_access",

            AuthenticationMode = AuthenticationMode.Active
        });
    }

As recommended added the scopes but still there is a loop; the request swings between MVC4 client and IdentityServer4.

Update 4

Solved - Check my answer.

Answer 1

I finally got it working.

Firstly, there is a bug (Katana Bug #197) in the OWIN which makes it to handle the tokens rather 'awkwardly'. So a workaround is nuget package Kentor.OwinCookieSaver by Kentor. One will need to install at the MVC4 Client.

Thereafter, modify the client configuration as under:-

 new Client
            {
                ClientId = "mvc4",
                ClientName = "MVC 4 Web Client",
                AllowedGrantTypes = {
                    GrantType.Hybrid,
                    GrantType.ClientCredentials
                },
                AllowAccessTokensViaBrowser = true,

                RequireConsent = false,

                ClientSecrets =
                {
                    new Secret("secret".Sha256())
                },

                RedirectUris = { "http://localhost:53173/signin-oidc" },
                PostLogoutRedirectUris = { "http://localhost:53173/signout-callback-oidc" },

                AllowedScopes =
                {
                    IdentityServerConstants.StandardScopes.OpenId,
                    IdentityServerConstants.StandardScopes.Profile,
                    "api1"
                },
                AllowOfflineAccess = true
            }

Modify the Configuration of 'Startup.cs' at MVC4 client as under

 public void Configuration(IAppBuilder app)
    {
        app.UseKentorOwinCookieSaver();

        JwtSecurityTokenHandler.DefaultInboundClaimTypeMap = new Dictionary<string, string>();

        app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);
        app.UseCookieAuthentication(new CookieAuthenticationOptions
        {
            AuthenticationType = CookieAuthenticationDefaults.AuthenticationType
        });

        app.UseOpenIdConnectAuthentication(new OpenIdConnectAuthenticationOptions
        {
            AuthenticationType = "oidc",
            SignInAsAuthenticationType = "Cookies",

            Authority = "http://localhost:5000",
            RequireHttpsMetadata = false,
            RedirectUri = "http://localhost:53173/signin-oidc",

            ClientId = "mvc4",
            ClientSecret = "secret",
            ResponseType = OpenIdConnectResponseType.CodeIdTokenToken,

            Scope = "openid profile api1 offline_access",

            Notifications = new OpenIdConnectAuthenticationNotifications
            {
                SecurityTokenValidated = notification =>
                {
                    notification.AuthenticationTicket.Identity.AddClaim(new Claim("id_token", notification.ProtocolMessage.IdToken));
                    notification.AuthenticationTicket.Identity.AddClaim(new Claim("access_token", notification.ProtocolMessage.AccessToken));

                    return Task.FromResult(0);
                },

                RedirectToIdentityProvider = notification =>
                {
                    return Task.FromResult(0);
                }
            }
        });

Rebuild Solution >> Clean and Run. Now you can use IdentityServer4 oidc for MVC4 Client.

Answer 2

I would recommend you review all URLs and make sure that they are all identical and there is no any extra / in Identity or client configuration.

One more thing, I can't see you scope in "Update 2".