ASP.NET OWIN Custom Cookie Authentication

Question

We are running a classic asp web application, and want to it to work together with new developed MVC application. We want to make use of the authentication of the classic asp app in the MVC application.

The idea is when user log into the classic asp app, it will issue kind of auth cookie, the cookie is encrypted in our own method. Cookie will contain use identity.

Client then browse to the MVC app along with this auth cookie. The MVC app will check if the cookie present and validate it. With it is not redirect to the classic asp login page.

So I'm thinking to customize the OWIN cookie authentication to use my own authentication logic. I tried to implement the CookieAuthenicationProvider however I don't know where to put my logic.

app.UseCookieAuthentication(new CookieAuthenticationOptions
        {
            AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
            LoginPath = new PathString("/Account/Login"),
            CookieName = ".classicauth",
            CookieSecure = CookieSecureOption.SameAsRequest,
            CookieHttpOnly = true,
            Provider = new CookieAuthenticationProvider
            {
                OnValidateIdentity = context => {
                    //?? where I can extract the cookie and validate it??
                    context.RejectIdentity();
                    return Task.FromResult<int>(0);
                },
                OnApplyRedirect = context => {
                    context.Response.Redirect("classic_asp_login_url");
                }
            }
        });

The CookieAuthenticationProvider have a OnValidateIdentity, however it seem not the right place to extract cookie and validate it.

Thanks. Jason.

user9612909 · Accepted Answer · 2018-04-07 20:50:36Z

2

I haven't tested it my self in that particular context. But CookieManager works for me.

OnValidateIdentity = context => {
  var cookie = context.Options.CookieManager.GetRequestCookie(context.OwinContext, context.Options.CookieName);
  context.RejectIdentity();
  return Task.FromResult<int>(0);
},

answered Apr 7, 2018 at 20:50

user9612909

212 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

ASP.NET OWIN Custom Cookie Authentication

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related