Add multiple AAD authentication options using AddMicrosoftIdentityWebAppAuthentication not possible

[wmmihaa]

Which version of Microsoft Identity Web are you using?
Microsoft Identity Web 1.6.0

Where is the issue?

• Web app
  • Sign-in users
  • Sign-in users and call web APIs
• Web API
  • Protected web APIs (validating tokens)
  • Protected web APIs (validating scopes)
  • Protected web APIs call downstream web APIs
• Token cache serialization
  • In-memory caches
  • Session caches
  • Distributed caches
• Other (please describe)

I have an app which needs to support authentication using multiple AAD's, but if I try to call AddMicrosoftIdentityWebAppAuthentication multiple times it seams that only the last one takes affect, but I get a "Unable to unprotect the message.State" exception although I've set different CallbackPath.

Is there an other way to do this?

  "azuread1": {
    "Instance": "https://login.microsoftonline.com/",
    "Domain": "azuread1.onmicrosoft.com",
    "TenantId": "xxxxx",
    "ClientId": "xxxxxx",
    "ClientSecret": "xxxxx",
    "CallbackPath": "/signin-oidc/azuread1",
    "SignedOutCallbackPath": "/signout-callback-oidc"
  },
 "azuread2": {
    "Instance": "https://login.microsoftonline.com/",
    "Domain": "azuread2.onmicrosoft.com",
    "TenantId": "yyyyy",
    "ClientId": "yyyyy",
    "ClientSecret": "yyyyy",
    "CallbackPath": "/signin-oidc/azuread2",
    "SignedOutCallbackPath": "/signout-callback-oidc"
  },

services.AddMicrosoftIdentityWebAppAuthentication(configuration: Configuration,
                                                              configSectionName: "azuread1",
                                                              openIdConnectScheme: "azuread1",
                                                              cookieScheme: null);

 services.AddMicrosoftIdentityWebAppAuthentication(configuration: Configuration,
                                                              configSectionName: "azuread2",
                                                              openIdConnectScheme: "azuread2",
                                                              cookieScheme: null);

If I try to logging using azuread1 it will say the user dows not exist in azuread2.onmicrosoft.com, while if I log in using azuread2 I get an "Unable to unprotect the message.State" exception.

[jmprieur]

@wmmihaa : this is duplicate of #955

[wmmihaa]

@wmmihaa : this is duplicate of #955

Not sure it is as this relates to multiple auth schemes of the same type

[wmmihaa]

Is there a plan to support integration with multiple AAD using AddMicrosoftIdentityWebAppAuthentication?

[jmprieur]

@wmmihaa : AddMicrosoftIdentityWebAppAuthentication is a shortcut for the simple case where you don't want to specify the scheme, whereas the multi AAD scenario is the very case where you want to control the scheme.
You'll want to do;

AddAuthentication(defaultScheme)
 .AddMicrosoftIdentityWebApp(configSection1, scheme1)

AddAuthentication()
 .AddMicrosoftIdentityWebApp(configSection2, scheme2)

We think we'll work on supporting this in 1.18.

[wmmihaa]

I think the problem is in SignInManager.ConfigureExternalAuthenticationProperties which will always route to the same AAD independently of the provider...

public IActionResult OnPost(string provider, string returnUrl = null)
{
    // Request a redirect to the external login provider.
    var redirectUrl = Url.Page("./ExternalLogin", pageHandler: "Callback", values: new { returnUrl });
    var properties = _signInManager.ConfigureExternalAuthenticationProperties(provider, redirectUrl);
    return new ChallengeResult(provider, properties);
}

The line above will always route to the last added Authentication ...

StartUp.cs:

services.AddAuthentication(("azuread1)
    .AddMicrosoftIdentityWebApp(Configuration.GetSection("azuread1"), "azuread1", null);

services.AddAuthentication()
    .AddMicrosoftIdentityWebApp(Configuration.GetSection("azuread2"), "azuread2", null);

Each of the line above work by it self, but not together

Let me know if you want med to demo this through a teams session

[wmmihaa]

I've made short video to better explain the scenario and issue.
https://youtu.be/SSuciNOnt-0
hth

[wmmihaa]

I've raised the issue in the aspnetcore repo: dotnet/aspnetcore#30472

[wmmihaa]

Any news on this?
btw...I would not consider this an enhancement but a bug

dotnet/aspnetcore#30472 is closed so this is no longer duplicate.

[jmprieur]

@wmmihaa : we are currently working on higher priority very requested features (performance and resilience of the token cache adapters, and rotation of certificates)
This would be next.

[wmmihaa]

@jmprieur Thank you for the feedback. We will continue working on other things while we wait.