User is not getting authenticated (cookies not getting set) after SAML getting processed successfully

Question

I am using an idp initiated SSO flow. I am using Kentor.AuthServices using OWIN middleware.

Most of the flow works except, user identity is not getting SET when the control reaches my callback method after successfully processing the SAML response.

Setting in web.config:

<kentor.authServices entityId="https://one-staging.com/MVSAMLServiceProvider" 
                     returnUrl="https://5814a15e.ngrok.io/api/Account/UnsolicitedExternalLogin">
    <identityProviders>
      <add entityId="https://shibidp.edu/idp/shibboleth"
          metadataLocation = "~/Providers/SAML2/Metadata/shibidp.edu.xml"
          allowUnsolicitedAuthnResponse="false" 
          disableOutboundLogoutRequests="false"
          binding="HttpRedirect">
      </add>
      <add entityId="abb:one:saml20:idp"
           metadataLocation="~/Providers/SAML2/Metadata/abb.xml"
           allowUnsolicitedAuthnResponse="true"
           disableOutboundLogoutRequests="false"
           binding="HttpRedirect">
      </add>
    </identityProviders>
</kentor.authServices>

Here is my Startup.cs:

public void ConfigureOAuth(IAppBuilder app)
{
    app.UseExternalSignInCookie(Microsoft.AspNet.Identity.DefaultAuthenticationTypes.ExternalCookie);

    OAuthBearerOptions = new OAuthBearerAuthenticationOptions();
    OAuthAuthorizationServerOptions OAuthServerOptions = new OAuthAuthorizationServerOptions()
    {
        //For Dev enviroment only (on production should be AllowInsecureHttp = false)
        AllowInsecureHttp = true,
        TokenEndpointPath = new PathString("/oauth2/token"),
        AccessTokenExpireTimeSpan = TimeSpan.FromMinutes(30),
        Provider = new CustomOAuthProvider(),
        AccessTokenFormat = new CustomJwtFormat()
    };

    // OAuth 2.0 Bearer Access Token Generation
    app.UseOAuthAuthorizationServer(OAuthServerOptions);
    app.UseOAuthBearerAuthentication(OAuthBearerOptions);

    googleAuthOptions = new GoogleOAuth2AuthenticationOptions()
    {
        ClientId = System.Configuration.ConfigurationManager.AppSettings["GoogleClientId"],
        ClientSecret = System.Configuration.ConfigurationManager.AppSettings["GoogleClientSecret"],
        Provider = new GoogleAuthProvider()
    };
    app.UseGoogleAuthentication(googleAuthOptions);


    app.Use(async (Context, next) =>{await next.Invoke();});    
    app.UseKentorAuthServicesAuthentication(CreateSAMLAuthServicesOptions());
    app.Use(async (Context, next) =>{await next.Invoke();});
}

Here are the Kentor logs (no errors in the logs):

DEBUG 2018-12-28 14:02:32,682  8859ms emv-authService-logger MoveNext           - Received unsolicited Saml Response _t0r6DHtsGygxkYcfNzdkEs72.M which is allowed for idp abb:one:saml20:idp
DEBUG 2018-12-28 14:02:32,729  8906ms emv-authService-logger MoveNext           - Signature validation passed for Saml Response _t0r6DHtsGygxkYcfNzdkEs72.M
DEBUG 2018-12-28 14:02:32,729  8906ms emv-authService-logger MoveNext           - Extracted SAML assertion oN4v.k9x2GE7s5S8OdeNWS.93j9
DEBUG 2018-12-28 14:02:32,729  8906ms emv-authService-logger MoveNext           - Validated conditions for SAML2 Response _t0r6DHtsGygxkYcfNzdkEs72.M
INFO  2018-12-28 14:02:32,729  8906ms emv-authService-logger ProcessResponse    - Successfully processed SAML response _t0r6DHtsGygxkYcfNzdkEs72.M and authenticated 10035094

Finally my redirect method:

[OverrideAuthentication]
[HostAuthentication(DefaultAuthenticationTypes.ApplicationCookie)]
[AllowAnonymous]
[Route("UnsolicitedExternalLogin", Name = "UnsolicitedExternalLogin")]
public async void GetUnsolicitedExternalLogin()
{
    bool isAuthenticated = User.Identity.IsAuthenticated; //getting false
}

I have unfortunately been stuck with this problem for a week now. I'm sure this is really close to getting done, so any help would be greatly appreciated.

Thanks!

Answer 1

Looking at the code, I think that there is a mismatch on authentication schemes.

In the pipeline setup, a cookie middleware for the external authentication scheme is setup. But in the GetUnsolicitedExternalLogin method, the ApplicationCookie scheme is referenced. Change it to reference the external scheme instead.

It is also a good idea to check if the redirect from ~/AuthServices/Acs to GetUnsolicitedExternalLogin sets an external authentication cookie.