How to configure the OAuth callback to a different domain in ASP.NET Core authentication

Question

I am Authenticating against an OAuth endpoint where I can only configure 1 callback domain. (and localhost is whitelisted).

I have my web app running in Azure (myapp.azurewebsites.net) and have it available with two custom domains (myapp.cc and myapp.eu). When I use the default setup, the CallbackPath can only be a relative path (to the current domain)

The code documentation of CallbackPath indicates it's relative to the application's base path:

/// <summary>
/// The request path within the application's base path where the user-agent will be returned.
/// The middleware will process this request when it arrives.
/// </summary>
public PathString CallbackPath { get; set; }

I want to make sure the CallBack happens to the (only) domain that I whitelisted on the OAuth backend. I know I can implement everything manually, but I was hoping there would be an easy way to work around this design and still benefit from the baked in Authentication options.

So even if a user is logging on on the myapp.cc or the myapp.eu or the myapp.azurewebsites.net , it should redirect to myapp.azurewebsites.net/ (which is whitelisted on my Auth service)

A part of my Startup.cs file is pasted below:

services.AddAuthentication(options =>
    {
        options.DefaultChallengeScheme = "MyService";
    })
    .AddCookie()
    .AddOAuth("MyService", "MyService",
        options =>
        {
            options.ClientId = settings.ClientId;
            options.ClientSecret = settings.ClientOauthSecret;
            options.CallbackPath = "/relativeonlypath"; 

            options.SaveTokens = true; 

            options.SignInScheme = IdentityConstants.ExternalScheme;

            /// ...  removed for brevity
        }
    );

Any idea on how to implement this?

Thank you

Answer 1

I'm not sure it's possible, because to verify that the user is redirected to your application as part of a "genuine" authentication flow, the ASP.NET OAuth handler performs the following steps:

1. Before redirecting the user to the OAuth service, ASP.NET Core generates a "correlation" cookie that is tied to the current domain; and
2. When the user is redirected to the app, the handler looks for this cookie and validates its content.

So if the correlation cookie is generated in step #1 for one domain, let's say myapp.cc, and the user is redirected to another domain, myapp.azurewebsites.net, ASP.NET Core might not be able to read it because the browser will not have included it in the redirection request.

Note

As seen in the first comments, the original thought was to leverage the SameSiteproperty of the correlation cookie to have it sent by the browser to the second domain. This was all wrong, apologies!

I now think that you have 2 different options:

1. Redirect every request from myapp.cc and myapp.eu to myapp.azurewebsites.net, so that when the authentication flow happens, we're already on the right domain; or
2. Redirect the user to the myapp.azurewebsites.net domain before redirecting them to the OAuth server.

I won't go into the first solution, as there's plenty of ways to achieve this.

Here's some code that I haven't tested that could work for the second solution:

services
    .AddAuthentication(options =>
    {
        options.DefaultChallengeScheme = "MyService";
    })
    .AddCookie()
    .AddOAuth("MyService", options =>
    {
        options.Events.OnRedirectToAuthorizationEndpoint = context =>
        {
            var currentRequestUri = new Uri(context.Request.GetDisplayUrl());

            // 1. If we're not on the correct domain, redirect the user to the same page, but on the expected domain.
            // The assumption is that the authentication flow will also kick in on the other domain (see 2).
            if (currentRequestUri.Host != "myapp.azurewebsites.net")
            {
                var applicationRedirectUri = new UriBuilder(currentRequestUri)
                {
                    Host = "myapp.azurewebsites.net"
                }.Uri.ToString();

                context.Response.Redirect(applicationRedirectUri);
                return Task.CompletedTask;
            }

            // 2. If we reach here, it means we're on the right domain, so we can redirect to the OAuth server.
            context.Response.Redirect(context.RedirectUri);
            return Task.CompletedTask;
        };
    });