Combining Forms auth and OpenIdConnect auth in the same WebForms app

Question

I have a legacy multi tenancy WebForms app where users authenticate using forms authentication. We are migrating the auth system to IdentityServer4 but can't do it all at once, so we want to gradually introduce this to our tenants. This means we need to run the WebForms app with both Forms Auth and the new OpenIdConnect Auth at the same time.

My problem is that whenever I run HttpContext.Current.GetOwinContext().Authentication.Challenge(), I'm redirected to Login.aspx because of this:

<authentication mode="Forms">
  <forms name="AuthCookieName" loginUrl="~/Login.aspx" timeout="60" protection="All" requireSSL="true" enableCrossAppRedirects="true" />
</authentication>

What I want is that whenever someone navigates to /OIDC.aspx, the challenge will redirect the user to IdentityServer as configured using OWIN. For all other requests, the existing Forms auth configuration can handle the authentication.

Is this at all possible?

Answer 1

I managed to prevent the unwanted redirect by setting the Response.SuppressFormsAuthenticationRedirect flag when invoking the authentication challenge, e.g.:

HttpContext.Current.Response.SuppressFormsAuthenticationRedirect = true;
HttpContext.Current.GetOwinContext().Authentication.Challenge(
    new AuthenticationProperties { RedirectUri = "/Home.aspx" });