18

I'm building an ASP.NET MVC 5 web site using Asp.net Identity (OWIN) and want to support both traditional username/password authentication as well as authentication against Azure Active Directory. This app does not need to authenticate against Microsoft IDs (Live IDs), Facebook, Twitter or any of the other external providers. The closest SO question I found is this one: How to do both Azure Active Directory Single Sign On and Forms Authentications on ASP.NET MVC

I've looked at the samples that get created when you create a project using the "Individual User Accounts" option as well as the "Work and School Accounts" option in VS 2015. I have authentication working well individually; it's only when I try to combine them that I'm running into problems.

In my Startup_Auth.cs file, I am configuring OWIN like this:

    public void ConfigureAuth(IAppBuilder app)
    {

        app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);

        //app.UseCookieAuthentication(new CookieAuthenticationOptions { });

        app.UseCookieAuthentication(new CookieAuthenticationOptions
        {
            AuthenticationType = DefaultAuthenticationTypes.ExternalCookie,
            LoginPath = new PathString("/account/sign-in")
        });

        app.UseOpenIdConnectAuthentication(
            new OpenIdConnectAuthenticationOptions
            {
                ClientId = clientId,
                Authority = authority,
                TokenValidationParameters = new System.IdentityModel.Tokens.TokenValidationParameters
                {
                    ValidateIssuer = false,
                },
                Notifications = new OpenIdConnectAuthenticationNotifications()
                {
                    SecurityTokenValidated = (context) => 
                    {
                        return Task.FromResult(0);
                    },
                    AuthorizationCodeReceived = (context) =>
                    {
                        return Task.FromResult(0);
                    },
                    AuthenticationFailed = (context) =>
                    {
                        context.OwinContext.Response.Redirect("/Home/Error");
                        context.HandleResponse(); // Suppress the exception
                        return Task.FromResult(0);
                    }
                }
            }
        );
    }  

This configuration works for password authentication, but doesn't work for AAD authentication. To enable AAD authentication I need to either comment out the line setting the AuthenticationType

AuthenticationType = DefaultAuthenticationTypes.ExternalCookie,

Or, just set CookieAuthentication with no values.

app.UseCookieAuthentication(new CookieAuthenticationOptions { });

I'd guess that there is a relatively simple approach to this and would appreciate some ideas on where to start looking.

3
  • 1
    Hi Chris, did you ever get a solution for this? Sep 14, 2016 at 11:52
  • Hi, @j.strugnell, I didn't get a solution for this. In my current app, I authenticate exclusively against AAD, and don't support username/password authentication. This is the traditional sample that's shown in the samples, for example as below.
    – ChrisW
    Oct 20, 2016 at 5:02
  • Have you seen this post? Seems to answer your question: stackoverflow.com/questions/42415140/…
    – T M
    Oct 14, 2019 at 14:29

3 Answers 3

2
+50

I searched examples from Microsoft. And all of them look like your solution. Look here:

  1. WebApp-WSFederation-DotNet
  2. WebApp-MultiTenant-OpenIdConnect-DotNet
  3. WebApp-OpenIDConnect-DotNet

Another example is here with WindowsAzureActiveDirectoryBearerAuthenticationOptions

4
  • 3
    I appreciate the links, but I've seen all of those before. My problem isn't that I don't know how to implement AAD authentication. I get that. But implementing AAD with standard password auth in the same solution was what my question was all about, and none of your links show that scenario.
    – ChrisW
    Aug 6, 2015 at 19:23
  • @ChrisW you asked if there is a simple approach to do this. So, as ia researched, answer is no. Your solution is similar to official one.
    – Backs
    Aug 7, 2015 at 1:28
  • 1
    @ChrisW can you let us know if you finally got this solved, and if so, how? (i.e. did you use any of the above links, or...?) I'm trying to do the same thing, but with on premise AD and am hoping that I could extrapolate from your solution to aid with mine. Thanks! Oct 19, 2016 at 22:43
  • Hi @ScottK.Fraley, as I commented above, I didn't solve this issue.
    – ChrisW
    Oct 20, 2016 at 5:03
2

Just recently Damian Edwards from the ASP.NET team open sourced their community standup website on github. They are using Azure AD so I hope it helps in the right direction, I unfortunately don't have any experience with Azure AD.

Here is also the youtube video of the standup where they talk about it, I think there are a few tips and maybe hints which you might be able to make use of.

1
  • My comment on your answer is the same as I gave to @Backs. I understand how to implement AAD authentication. But implementing AAD authentication in the same solution as standard password/cookie auth is the heart of my problem, and your link doesn't speak to that.
    – ChrisW
    Aug 6, 2015 at 19:25
0

I realize that this is an old question. I am potentially looking to do something similar but probably more like ASP.Net identity auth to more than one Azure AD tenant. I found this Integrating Azure AD into ASP.NET Core where this statement:

...then leverage the OnTokenValidated notification to implement your own issuer validation logic depending on which tenants you want to support (any tenant, Microsoft Account + specific list of Azure AD, single Azure AD, just Microsoft Account, etc)...

leads me to believe that the sample code there may hold the key to this mixed auth scenario.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.