Trying to use Microsoft.Identity.Web solution to make an external provider connection in Asp.net Core application.
I’ve connected it, using next C# code:
services.AddAuthentication(OpenIdConnectDefaults.AuthenticationScheme).AddMicrosoftIdentityWebApp(Configuration.GetSection("AzureAd"));
It integrates ok, as External provider.
However, when I log in, using current provider, I got an exception
System.Exception: ‘An error was encountered while handling the remote login.’
InnerException.
Exception: Correlation failed.
As I researched, I found out that is it “Correlation cookie” problem (means the provider, won’t find cookie to “correlate” with”). As I checked,
Request.Cookie.Count == 0
but Browser sends .AspNetCore.Correlation and .AspNetCore.OpenIdConnect.Nonce cookies with “N” value.
Application’s cookie configuration setup are:
services.ConfigureApplicationCookie(config =>
{
config.Cookie.SameSite = SameSiteMode.Strict;
});
services.ConfigureExternalCookie(options =>
{
options.Cookie.Name = "Identity.Application";
options.Cookie.SameSite = SameSiteMode.Strict;
});
…
app.UseCookiePolicy(new CookiePolicyOptions()
{
MinimumSameSitePolicy = Microsoft.AspNetCore.Http.SameSiteMode.Lax,
HttpOnly = HttpOnlyPolicy.None
});
What’s wrong with setup? May be something’s wrong, or absent?
UPD: Cookie Setup added due to IdentityServer4 usage and customization. As I found out, Microsoft.Identity.Web adds own cookie scheme, not using Default one. So, correlation Cookie won’t pass, cause different cookie scheme used (Request.Cookies.Length = 0). So, those one remains in conflict. Nevertheless, this question should stays opened, may be there will be some update, that fixes this issue, or my conclusions are wrong.
2
I can reproduce your issue.
Just comment this line MinimumSameSitePolicy = Microsoft.AspNetCore.Http.SameSiteMode.Lax,
, then this issue will disapper.
In my humble opinion, we don’t require to set the cookie policy. You can take a look at the Azure AD samples, no cookie policy is set. Only builder.Services.AddAuthentication(OpenIdConnectDefaults.AuthenticationScheme).AddMicrosoftIdentityWebApp(builder.Configuration.GetSection("AzureAd"));
is required.
7