CookieAuthenticationOptions.LoginPath value not used when also using app.UseOpenIdConnectAuthentication

Question

I am using OWIN middleware for cookie authentication and openIdConnect. Before I added openIdConnect authentication to my startup auth code the cookie authentication option, LoginPath was used as the destination for redirecting unauthenticated users. This worked really well and is the functionality I would like to keep.

However, when I added app.UseOpenIdConnectAuthentication to my project, it started automatically redirecting unauthenticated users to my OpenIdConnect Authority (https://login.windows.net/).

Is there a way I can disable OpenIdConnectAuthentication setting the redirect path for unauthenticated users and rely on the LoginPath set for cookie authentication? My current work around is to manually set the redirect path in my authorize attribute, but I would like to let OWIN middleware handle this if possible.

Thanks.

Code:

public void ConfigureAuth(IAppBuilder app)
    {
        // Enable the application to use a cookie to store information for the signed in user
        // and to use a cookie to temporarily store information about a user logging in with a third party login provider
        var cookieOptions = new CookieAuthenticationOptions();
        cookieOptions.AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie;
        cookieOptions.LoginPath = new PathString("/Account/Login");

        app.SetDefaultSignInAsAuthenticationType(cookieOptions.AuthenticationType);

        app.UseCookieAuthentication(cookieOptions);

        app.UseOpenIdConnectAuthentication(new OpenIdConnectAuthenticationOptions
        {
            AuthenticationType = FranchiseAuthType,
            ClientId = franchiseClientId,
            Authority = FranchiseAuthority,
            PostLogoutRedirectUri = postLogoutRedirectUri,
        });
}

Answer 1

I'm not sure if you were able to resolve this issue, but what you want to do it is add

AuthenticationMode = AuthenticationMode.Passive

To your authentication options. This will make the OpenIdConnect authentication rely solely on your code to make calls to it. I believe this is what you intend to happen.

So your new code should look like this:

public void ConfigureAuth(IAppBuilder app)
{
    // Enable the application to use a cookie to store information for the signed in user
    // and to use a cookie to temporarily store information about a user logging in with a third party login provider
    var cookieOptions = new CookieAuthenticationOptions();
    cookieOptions.AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie;
    cookieOptions.LoginPath = new PathString("/Account/Login");

    app.SetDefaultSignInAsAuthenticationType(cookieOptions.AuthenticationType);

    app.UseCookieAuthentication(cookieOptions);

    app.UseOpenIdConnectAuthentication(new OpenIdConnectAuthenticationOptions
    {
        AuthenticationType = FranchiseAuthType,
        AuthenticationMode = AuthenticationMode.Passive,
        ClientId = franchiseClientId,
        Authority = FranchiseAuthority,
        PostLogoutRedirectUri = postLogoutRedirectUri,
    });
 }

Answer 2

EDIT: This looked like it fixed my problems but it caused a more serious issue than the one it fixed. If I set use cookies after use open Id connect then my openidconnect notifications will have a null sessions HttpContext.Current.Session and after authentication my authentication result is not stored in the cookie.

Whichever authentication is added last becomes the authoritative source for setting the redirect path for unauthenticated uses.

By moving

app.UseCookieAuthentication();

After app.UseOpenIdConnectAuthentication() the desired behavior was achieved.

public void ConfigureAuth(IAppBuilder app)
{
    // Enable the application to use a cookie to store information for the signed in user
    // and to use a cookie to temporarily store information about a user logging in with a third party login provider
    var cookieOptions = new CookieAuthenticationOptions();
    cookieOptions.AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie;
    cookieOptions.LoginPath = new PathString("/Account/Login");

    app.SetDefaultSignInAsAuthenticationType(cookieOptions.AuthenticationType);



    app.UseOpenIdConnectAuthentication(new OpenIdConnectAuthenticationOptions
    {
        AuthenticationType = FranchiseAuthType,
        ClientId = franchiseClientId,
        Authority = FranchiseAuthority,
        PostLogoutRedirectUri = postLogoutRedirectUri,
    });
    //move this after UseOpenIdConnectAuthentication and the LoginPath 
    //value is used for redirecting unauthenticated users
    app.UseCookieAuthentication(cookieOptions);

}