ASP.NET OWIN Custom Cookie Authentication

Question

We are running a classic asp web application, and want to it to work together with new developed MVC application. We want to make use of the authentication of the classic asp app in the MVC application.

The idea is when user log into the classic asp app, it will issue kind of auth cookie, the cookie is encrypted in our own method. Cookie will contain use identity.

Client then browse to the MVC app along with this auth cookie. The MVC app will check if the cookie present and validate it. With it is not redirect to the classic asp login page.

So I'm thinking to customize the OWIN cookie authentication to use my own authentication logic. I tried to implement the CookieAuthenicationProvider however I don't know where to put my logic.

app.UseCookieAuthentication(new CookieAuthenticationOptions
        {
            AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
            LoginPath = new PathString("/Account/Login"),
            CookieName = ".classicauth",
            CookieSecure = CookieSecureOption.SameAsRequest,
            CookieHttpOnly = true,
            Provider = new CookieAuthenticationProvider
            {
                OnValidateIdentity = context => {
                    //?? where I can extract the cookie and validate it??
                    context.RejectIdentity();
                    return Task.FromResult<int>(0);
                },
                OnApplyRedirect = context => {
                    context.Response.Redirect("classic_asp_login_url");
                }
            }
        });            

The CookieAuthenticationProvider have a OnValidateIdentity, however it seem not the right place to extract cookie and validate it.

Thanks. Jason.

Answer 1

I haven't tested it my self in that particular context. But CookieManager works for me.

OnValidateIdentity = context => {
  var cookie = context.Options.CookieManager.GetRequestCookie(context.OwinContext, context.Options.CookieName);
  context.RejectIdentity();
  return Task.FromResult<int>(0);
},