ProviderKey from ADFS changes when application restarts

Question

We've got our ASP.NET application configured to use multiple providers (Google, Microsoft, LinkedIn, and ADFS) with OWIN. When any of the providers other than ADFS authenticate, the ExternalLoginInfo has the same ProviderKey all the time. However, with ADFS, when we restart the application, which happens quite frequently when we're in development, we get a different ProviderKey. If we keep the application running, the ProviderKey will stay the same. This seems like it would mean that somewhere in our code, we should be able to configure something that would make it so ADFS returns the same ProviderKey all the time for the same user.

Below is our code for configuring our connection to ADFS.

WsFederationAuthenticationOptions ws = new WsFederationAuthenticationOptions();
ws.Wtrealm = "https://localhost:44300/";
ws.MetadataAddress = "https://sso.ourcompany.com/federationmetadata/2007-06/federationmetadata.xml";
ws.AuthenticationType = "Our-Federation";
ws.AuthenticationMode = AuthenticationMode.Passive;
app.UseWsFederationAuthentication(ws);

This is a problem because when the user authenticates we use the UserManager to add the login to the user. Of course, with a constantly changing key, it can't insert the new Login in and gets an error because there is a duplicate UserId and LoginProvider in the ApplicationUserLogin table.

To have persistent providerKey you need to setup the NameIdentifier claim to be issued from adfs. Most probably you haven't done so. Google for "adfs nameidentifier" for possible solutions to persistent nameidentifier claim. I am posting this as a comment rather than an answer as I am nit sure this solves your issue (you haven't elaborated on whether you have the NameIdentifier set up or not). — Wiktor Zychla
I don't think we have the NameIdentifier set up, but will check to be sure and report back. Thanks! — amrinea
@WiktorZychla It appears the Name ID was the cause. We had it set up to be transient so it would change for each session. If you post it as an answer, I'll mark it as correct. Thanks! — amrinea

Wiktor Zychla Wiktor Zychla · Accepted Answer · 2016-03-07T16:49:12

The solution accepted by the OP:

To have persistent providerKey you need to setup the NameIdentifier claim to be issued from adfs. Most probably you haven't done so. Google for "adfs nameidentifier" for possible solutions to persistent nameidentifier claim.

ProviderKey from ADFS changes when application restarts

1 Answers