Using openidconnect to rework the login method of a .NET framework 4.7 web app. I ran into an issue with the session not being set after a random time. This only occurs after deploying the app to IIS. Happens after 30 minutes, but sometimes it takes a couple hours for it to happen. Whenever the issue occurs not a single user can login to the web application.

Implementation of Entra:

app.UseOpenIdConnectAuthentication(new OpenIdConnectAuthenticationOptions
{
    AuthenticationType = "Entra",
    Caption = "Sign-in with Entra",

    ClientId = EntraService.ClientId,
    RedirectUri = EntraService.RedirectUrl,
    Authority = EntraService.Authority,
    PostLogoutRedirectUri = EntraService.RedirectUrl,

    Scope = OpenIdConnectScope.OpenIdProfile + " " + OpenIdConnectScope.Email,
    ResponseType = OpenIdConnectResponseType.CodeIdToken,
    ProtocolValidator = new OverrideOpenIdConnectProtocolValidator(false),

    Notifications = new OpenIdConnectAuthenticationNotifications()
    {
       SecurityTokenValidated = (context) =>
       {
          UserHelper userMigration = new UserHelper();
          if (!userMigration.AuthorizeFlow(context))
          {
             Log.Information("Entra: SecurityTokenValidated AuthorizeFlow fail");
             return Task.FromResult(0);
          }

          Log.Information("Entra: SecurityTokenValidated AuthorizeFlow success");
          return Task.FromResult(0);
       }
    }
 });

The user is authenticated in the AuthorizeFlow function after setting the right claims:

context.AuthenticationTicket = new AuthenticationTicket(new ClaimsIdentity(authorizedIdentity.Claims, context.AuthenticationTicket.Identity.AuthenticationType), context.AuthenticationTicket.Properties);
Log.Information("Setting AuthenticationTicket identity");

When the issue occurs, whenever a user signs in using SSO they get redirected to the home page because the application expected a login. Using the logs I could follow the code in the acceptance environment where it was going through all the steps to set the login session. But in reality the cookies were not being set, and were not present in the response headers.

Cookie authentication settings:

 app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);
 app.UseCookieAuthentication(new CookieAuthenticationOptions()
 {
    AuthenticationType = CookieAuthenticationDefaults.AuthenticationType,
    LoginPath = new PathString("/Login"),
    CookieSameSite = SameSiteMode.None,
    CookieSecure = CookieSecureOption.Always,
    ExpireTimeSpan = TimeSpan.FromMinutes(60)
 });

The (acceptance) IIS server has CIS hardening.

Any idea on how to move forward with this issue?