2 openid connect in asp.net core application

Question

I've been trying to add second identity provider to my web app, but have a problem with the configuration.

The app has the folowing configuration

builder.Services.AddAuthentication(options =>
{
  options.DefaultScheme = "cookie";
  options.DefaultSignInScheme = "cookie";
  options.DefaultChallengeScheme = "oidc";
  options.DefaultSignOutScheme = "oidc";
})
    .AddCookie("cookie")
    .AddOpenIdConnect("oidc", options =>
    {
      options.Authority = AppConfig.AuthorizationServerAdress;
      options.ClientId = AppConfig.OpenidApp;
      options.ClientSecret = AppConfig.OpenidAppSecret;
      options.ResponseType = OpenIdConnectResponseType.Code;
      options.ResponseMode = OpenIdConnectResponseMode.Query;
      options.UsePkce = true;
      options.SaveTokens = true;
      options.GetClaimsFromUserInfoEndpoint = true;
    })

    .AddCookie("cookie2")
    .AddOpenIdConnect("oidc2", options =>
    {
        options.Authority = AppConfig.AuthorizationExternalServerAdress;
        options.ClientId = AppConfig.OpenidExternalApp;
        options.ClientSecret = AppConfig.OpenidExternalAppSecret;
        options.ResponseType = OpenIdConnectResponseType.Code;
        options.ResponseMode = OpenIdConnectResponseMode.Query;
        options.UsePkce = true;
        options.SaveTokens = true;
        options.GetClaimsFromUserInfoEndpoint = true;
    });

It works by default with the first oidc provider, but if I use oidc2 to log in and then navigate to my app, I'll go to my default oidc provider. It means that the second provider will be ignored. Can somebody help me with the configuration, please?

Answer 1

The problem is that both handlers will listen for the callback request from your identityprovider on URL /signin-oidc

So, to solve it, you need to make sure they are different, like:

.AddOpenIdConnect("oidc", options =>
{
  //other options
  options.CallbackPath = new PathString("/oidc/handler1");
}
.AddOpenIdConnect("oidc2", options =>
{
  //other options
  options.CallbackPath = new PathString("/oidc/handler2");
}

also, see OpenIdConnect: Manually handle Callback

But, in general I advice that your clients and apps only should trust one provider (token issuer) and let users choose how to authenticate through your primary provider, like in this picture: