OWIN Cookie authentication not working on IIS 8.5

Question

I have developed an ASP.NET webapp with OWIN authentication, which works fine on my development machine (Windows 10/IIS 10), but when the webapp is published to my Windows 2012 server with IIS 8.5, the cookie authentication does not seem te work.

When I login (with the IsPersistent setting to true) and close the browser, I am still logged on when I start my browser again, so that's OK. But when I restart IIS and startup the browser, I have to logon again.

I have created a very simple application to test this, with the following code:

Startup.cs

public void ConfigureAuthentication(IAppBuilder app)
    {
        app.UseCookieAuthentication(new CookieAuthenticationOptions
        {
            AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
            LoginPath = new PathString("/Login"),
            CookieName = "ThisIsTheAuthCookie"
        });
    }

AuthenticationController.cs

public ActionResult Login(string userName, string password)
    {
        //For testing purposes every user/pwd is fine
        var identity = new ClaimsIdentity(new [] { new Claim(ClaimTypes.Name, userName), },
            DefaultAuthenticationTypes.ApplicationCookie,
            ClaimTypes.Name, ClaimTypes.Role);

        HttpContext.GetOwinContext().Authentication.SignIn(new AuthenticationProperties { IsPersistent = true }, identity);

        return RedirectToAction("index", "home");
    }

Even Chrome shows the cookie, but it looks like OWIN is not using it on IIS 8.5:

Does anybody have an idea what the problem is?

Thx, Danny

Answer 1

Can you try a couple of things and share the results :- 1. Restart the IIS , keeping the User-Agent. See if you are logged in now. 2. Enable logging in Katana and check for this warning/error in the logs.

Answer 2

Any result on this already?

For me it looks like you have the cookie with the session ID available but the IIS server is not aware anymore on this session. Are you sure you persist the session on the IIS server? (and not 'In Process')

You can find the option under Session State in the IIS configuration. See TechNet Article IIS

Answer 3

The problem is solved. I had to add the MachineKey element in the web.config!