0

I have checked all the details inside Web.config file and it is properly configured as well.

public async Task SignIn()
    {
        if (!Request.IsAuthenticated)
        {
            HttpContext.GetOwinContext().Authentication.Challenge(
                new AuthenticationProperties { RedirectUri = "/" },
                OpenIdConnectAuthenticationDefaults.AuthenticationType);
        }
 }

Also try some solution found in similar problem but it didn't work for me.

Request.IsAuthenticated is always false

<system.webServer>
<modules>
<remove name="FormsAuthentication" />
<add name="FormsAuthentication" type="System.Web.Security.FormsAuthenticationModule" />
</modules>
</system.webServer>

I am following code sample by Azure https://learn.microsoft.com/en-us/azure/active-directory/develop/sample-v2-code (Web Application - Asp.net)

https://github.com/Azure-Samples/ms-identity-aspnet-webapp-openidconnect/tree/master/WebApp

enter image description here

Falgun
  • 1
  • 1
    The issue here is that there is no refresh token process? You want it to refresh your token after an hour but not to log out? – misha130 Dec 02 '21 at 08:15
  • By any how I want to keep user login. I want to configure the authentication to be keep session alive and let the user use system. Token and refresh token come into picture when I want to call some api to get resource (ex - Graph). – Falgun Dec 03 '21 at 04:05
  • I have implemented below code to refresh the token but the thing is why Request.IsAuthenticated set false after 1 hour and How can I increase it ? Moreover, ClaimPrincipal.Current as well set null after 1 hour. I used AcquireTokenSilent method to refresh the token. – Falgun Dec 03 '21 at 04:13
  • This is what I am facing too. https://stackoverflow.com/questions/69007820/azure-ad-sso-successful-received-idtoken-but-request-isauthenticated-is-false-an – Falgun Dec 03 '21 at 04:20
  • Just to note - you shouldn't increase it. This one hour is the time when your token is validated. So it expires then using the refresh token you try to get another one if you can and thus the process makes sure that you still have a valid user every hour. You need to honestly see that your refresh token process doesn't log you out at all. – misha130 Dec 03 '21 at 10:23
  • @Falgun I'm facing the exact same problem. Did you find a solution ? – Bronzato May 17 '22 at 07:57

1 Answers1

0

If i am understanding correct,it seems you are trying to call api. Access tokens are required to call api and that can be refreshed. Please select Access tokens and id tokens in portal authentication.

ID Token is there to be consumed by the application. It contains claims which you can validate to authenticate the end user and is of one time use and from then on. Access token is there for authorization. It is intended to be used against a protected resource (ex:- API protected by OAuth 2.0 tokens).

Access tokens has a validity of 1 hour and refresh tokens last for 14 days. The expiration time for ID tokens in Azure AD is 1 hour. As long as the user session with AAD is active, the acquireTokenSilent method will be able to renew the idtokens. However, if the AAD session is expired, the token renewal will result in a failure. You will need to handle the failure with an interactive call prompting user to sign in again. Please check this

References:

  1. intent of ID Token expiry time in OpenID Connect? - Stack Overflow
  2. How to store the token received in AcquireTokenAsync with Active Directory - Stack Overflow
  3. Configurable lifetimes
kavyaS
  • 8,026
  • 1
  • 7
  • 19