如何使用托管在 .Net framework 4.6 应用程序中的登录页面对 .Net Core 3.1 上的 IdentityServer4 应用程序进行身份验证？

Question

We have a current login page on a .Net framework 4.6 application. We are building a new .Net Core 3.1 IdentityServer4 application primarily for issuing tokens, but during the code authentication flow we want to redirect to a login page which is hosted in our current .Net framework 4.6 application.

The redirect for login page from IDServer app to .Net framework 4.6 app works fine, but after the .Net framework 4.6 app creates and sets the cookie, IdentityServer4 doesn't seem to be responding to this cookie.

Does anyone know how to achieve logging-in in the .Net framework 4.6 application and then redirecting back to IdentityServer and handling the tokens after the login?

In IdentityServer, the following code makes it possible to redirect to .Net framework 4.6 application:

services.AddIdentityServer(options =>
{
    options.UserInteraction.LoginUrl = "https://localhost:44352/login/";
    options.UserInteraction.LoginReturnUrlParameter = "returnUrl";
})

But after the app running on "https://localhost:44352/login/" sets the identity cookie and redirects back to IdentityServer4 with the provided returnUrl, the IdentityServer4 is not reading that cookie. We've even tried to create the Identity cookie using another .Net Core 3.1 application using Microsoft's Identity package, which works when doing it in IdentityServer4, but it doesn't work when creating this cookie in another application and passing it to IdentityServer4.

Answer 1

I haven't tried that but you can do following things (In general case)

1. Cookies domain and name should be same at both platforms (web apps)
2. Machine Key must be same on both apps

Answer 2

Your applications (ASP.NET Core and classic ASP) and IdentityServer does not share the same cookies.

IdentityServer issues their own cookies and session cookies can't be read between ASP.NET and ASP.NET core (they are protected differently).

In general, I think to get the single-signon experience both applications (ASP.NET and ASP.NET core) needs to authenticate indepedently to IdentityServer and get its own set of tokens. But the user only needs to login once to IdentityServer beause after the first login, the IdentityServer will using its cookie remember who you are.