Unable to complete Azure ACS Authentication in MVC Applications

Question

I have an MVC 3 Application that I am trying to integrate with Azure-hosted ACS Identity Providers. I have been following the Tutorials but they do not appear to be working for me when using ASP.NET MVC.

Essentially, when I hit the View which I've flagged with [Authorize] the user is redirected to the Azure-hosted Login page with the list of Identity Providers. I choose a provider (in this case Live) and log in. At this point this all works as I expect. After I successfully authenticate it appears (visually) that I'm not redirected back to my application, instead I'm returned to the Identity Providers page. When watching this in Fiddler, it appears it actually returns but then starts the cycle all over again (HTTP Status Code 302).

Can someone explain what may be causing this?

Within the Azure portal, I have the following Urls configured for my relying party application

• Realm: http: //localhost:7777/
• Return Url: http: //localhost:7777/ (I also tried http: //localhost:7777/Home/About)
• In all other cases I have the default settings

The urls match what is in the Web.config (including the trailing slash)

There is only one controller with the following:

public class HomeController : Controller
{
    public ActionResult Index()
    {
        return View();
    }

    [Authorize]
    public ActionResult About()
    {
        Response.Write("Claims Received from ACS:");
        ClaimsIdentity ci = Thread.CurrentPrincipal.Identity as ClaimsIdentity; foreach (Claim c in ci.Claims)
        {
            Response.Write("Type: " + c.ClaimType + "- Value: " + c.Value + "");
        }

        return View();
    }
}

Note: This is a brand new project created to work through this integration. All the packages and related SDKs are all up-to-date.

Answer 1

I would like to know whether you mean is when you log in and return to your web application, it thinks you’re not logged in, and redirects you to the identity provider’s sign in page again.

Please check if you’ve configured the authorization logic correctly. For example, if you use role based authorization, it is needed to configure ACS to create a rule that returns a role. You can also use custom authorization instead of the Authorization attribute. In your custom authorization code, you can check if the required claims are present. The claims can be role or anything else (user name, age, etc.). Custom authorization is usually more agile than the Authorization attribute.

Best Regards,

Ming Xu.

Answer 2

Please make sure you haven’t modified the sample code. Since it is an official ACS SDK sample, a lot of people have tried it and it will work.

Also in your original post, you mentioned you’ve configured ASP.NET authorization:

<authorization>
     <deny users="?" />
   </authorization>

Please remove this (as indicated in the document), if you don’t want to use ASP.NET authorization(you want to use WIF).

Best Regards,

Ming Xu.