IdenityServer4 - doesn't redirect after MFA

Question

My Auth Server uses IdentityServer4. Redirect configured as follows for a client

                RedirectUris = new List<string>
                {
                    "https://localhost:44342/signin-oidc"
                }

this works fine for those users for whom MFA is not enabled. But when it is enabled, and kicks in, the redirect doesn't work. After successful 2nd FA, user stays back on the AuthServer page.

Any idea why?

Pablo Recalde Pablo Recalde · Accepted Answer · 2020-01-07T15:40:10

Multifactor authentication is not implemented by Identityserver4. Identityserver4 is about how the third party application gets access to protected resources on behalf of the user.

The means of how the user gets authenticated are out of the identityserver4 scope. In other words, this is not related to identityserver4.

If you're using the identityserver4 quickstart it comes with ASPNET Identity, ASPNET Identity provides you with a local authentication system for ASPNET applications. MultiFactor Authentication is probably there.

Being said that, when you try to POST to the /authorize endpoint (note authorize not authenticate) from your client application IdentityServer tries to authorize your request and to do so it makes you authenticate first, by presenting you the Login Form.

If you look at the Address bar on this point, you'll notice there's an encoded url as returnUrl param, on the controller code you'll see a check that if that param is present, redirect to that url after successful login.

So, check the flow on your application and see where does that parameter get lost on the redirect hell, at some point you're not passing the returnUrl.

IdenityServer4 - doesn't redirect after MFA

1 Answers