A 407 Proxy Authentication Required when using remote authentication about systemweb-adapters

[TheJayMann]

Testing this with WS-Federation shows that the issue has been resolved.

[mjrousos]

Thanks for reporting this, @TheJayMann. It looks like the shared auth support isn't working quite right with WS-Fed auth. /systemweb-adapters/authenticate is the endpoint that serves authentication information from the ASP.NET app (the ASP.NET Core app will call it from its remote app auth handler) but users shouldn't be re-directed back to that URL (since, as you've discovered, it will fail with 407 for any requests not coming from the ASP.NET Core app).

For other auth scenarios (ASP.NET Identity cookie auth), there's logic in the auth handler to actually intercept redirects to /systemweb-adapters/authenticate and rewrite them. It seems that isn't working for the WS-Fed scenario, though. Probably it's because the auth process actually redirects away from the site entirely and when the STS redirects back the 'redirect back to' URL it was given is /systemweb-adapters/authenticate and the result processor that usually fixes up redirects won't apply.

I've got some ideas of how we might be able to solve this. One option would be to include the "real" re-direct URI in a query string when calling /systemweb-adapters/authenticate and then look for that when the redirect comes back. Whether that works or not would depend on whether or not query strings persist through auth and redirection. Another option would be to just allow users to configure a URL that should be used instead if an auth process tries to redirect to /systemweb-adapters/authenticate.

I'll investigate this week and report back with what I find and which options seem the most promising.

[mjrousos]

It looks like OIDC cookie scenarios (like using AAD B2C from an MVC app) has a similar problem, which is nice since that's an easier scenario to repro (no need to set up an STS). It seems the common thing that doesn't work well is the flow of the ASP.NET app having to redirect to an external site for authentication and then handle a redirect when auth is complete. I'll work on getting a fix together.