External Cookie for External Login in ASP.NET OWIN

Question

We have a legacy system which is built on ASP.NET Mvc 4, now we would like to support Signal Sign On via Azure Active Directory for current users as well as new users. Since we have managed our own authentication workflow, ASP.NET Identity definitely does not fit in our case.

I have managed to build a demo which is working on OWIN OpenIdConnect middleware passive mode without using ASP.NET Identity. The below code works correctly:

app.SetDefaultSignInAsAuthenticationType("ExternalCookie");
app.UseCookieAuthentication(new CookieAuthenticationOptions
{
    AuthenticationType = "ExternalCookie",
    AuthenticationMode = AuthenticationMode.Passive,
});

app.UseOpenIdConnectAuthentication(
    new OpenIdConnectAuthenticationOptions
    {
        AuthenticationMode = AuthenticationMode.Passive,
        ClientId = ClientId,
        Authority = Authority

        // More code
    });

And in ExternalLoginCallback action:

public async Task<ActionResult> ExternalLoginCallback(string returnUrl)
{
    var authManager = Request.GetOwinContext().Authentication;

    var result = await authManager.AuthenticateAsync("ExternalCookie");
    authManager.SignOut("ExternalCookie");

    //More code to convert to local identity
}

This case is really common even using other providers like Google, Facebook or Twitter. One thing I have not much clear is ExternalCookie, maybe I have missed the whole thing. My understanding is when external login is successfully, external cookie is used to store the external claim identity. And then we call:

var result = await authManager.AuthenticateAsync("ExternalCookie");
authManager.SignOut("ExternalCookie");

In order to get the external claim identity and then convert external identity to local identity. I have a little bit confusion why we have to call SignOut external cookie in this case.

Also, I'm not sure whether External Cookie is a must when using external login, or do we have other ways around without using External Cookie.

Please someone give an explanation on this point.

Answer 1

To answer your last question, you change the name of cookie in startup.auth file where you configure external cookie -

app.UseExternalSignInCookie(DefaultAuthenticationTypes.ExternalCookie);

You can use a string instead of DefaultAuthenticationTypes enum and directly specify the name of the cookie like -

app.UseExternalSignInCookie("myExternalCookie");