Azure. Owin OpenId authentication. Added custom claims. AuthorizationCodeReceived is not called

Question

I've almost configured my OpenId owin authentication / authorization in Azure Active Directory . My configuration is the following:

 app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);
 app.UseCookieAuthentication(new CookieAuthenticationOptions()
 {
     CookieName = "AppServiceAuthSession"
 });

 app.UseOpenIdConnectAuthentication(new OpenIdConnectAuthenticationOptions
 {

     ClientId = ClientId,
     Authority = _authority,
     PostLogoutRedirectUri = PostLogoutRedirectUri,
     RedirectUri = PostLogoutRedirectUri,
     Notifications = new OpenIdConnectAuthenticationNotifications
     {
           AuthenticationFailed = context =>
           {
                 context.HandleResponse();
                 context.Response.Redirect("/Error?message=" + context.Exception.Message);
                 return Task.FromResult(0);
           },                   
           AuthorizationCodeReceived = async context =>
           {
                 var id = new ClaimsIdentity(context.AuthenticationTicket.Identity.AuthenticationType);
                 id.AddClaims(context.AuthenticationTicket.Identity.Claims);
                 var appToken = "MyToken";
                 id.AddClaim(new Claim("MyTokenKey", appToken));

                 context.AuthenticationTicket = new AuthenticationTicket
                 (
                      new ClaimsIdentity(id.Claims, context.AuthenticationTicket.Identity.AuthenticationType),
                        context.AuthenticationTicket.Properties
                 );
           }
            },
        });

But I want to add one more application token (not user token) to claims list to be able to have ability to use this token in any place on my site. Also it's good point for me that I don't need to get this token from my external token provider more then one time per an authentication session.

But place, where I'm going to add my logic ( AuthorizationCodeReceived as well as other methods from OpenIdConnectAuthenticationNotifications ) is called only when I use my local IIS(run locally), when I try to use azure IIS, this method has not been called at all. In this case my User is authenticated anyway, but this method and the similar methods from OpenIdConnectAuthenticationNotifications (except RedirectToIdentityProvider ) are not fired.

I've downloaded the git source code of Katana project and referenced this project to my instead of the official nuget packages to debug its and as I think currently, I've found the reason why it happens. The AuthorizationCodeReceived "event" method is called from OpenIdConnectAuthenticationHandler class in AuthenticateCoreAsync method. But also, the calling of this method is required that the below checking must give the true result:

 if (string.Equals(Request.Method, "POST", StringComparison.OrdinalIgnoreCase)
 && !string.IsNullOrWhiteSpace(Request.ContentType) // May have media/type; charset=utf-8, allow partial match.
 && Request.ContentType.StartsWith("application/x-www-form-urlencoded", StringComparison.OrdinalIgnoreCase)
 && Request.Body.CanRead)
 {
 //some necessary preparation to call `AuthorizationCodeReceived` event method
 } 

As we can see, this checking allows only POST requests and I see these POST requests when I run app in local IIS , but I cannot see these POST requests when I deploy my application in azure portal (I've debugged both of options : on local IIS and in azure portal ). As summary from the above, this is the only one difference between these runnings. (Azure IIS doesn't send POST request at all by some reason).Any other methods in Katana project (which I checked) are called in the same way.

Could anybody help with it?

PS Note, I check any changes only after clearing of browser data (cache/history and so on).

Answer 1

The answer is the following:

The authorization in azure portal should be configured as shown above. In case if you chose LogIn with Azure Active Directory , then app services auth takes place outside of your app, and the custom authorization is not triggered.