Infinite Login Loop with Owin

Question

We have a major problem with login loops. Our asp.net mvc website is protected with organisational accounts, using owin. Login works well for a day or two, but after a couple of days, user gets trapped in a login-loop.

Flipping every other second between url, looking like this:

https://login.microsoftonline.com/da0c0a60-dc05-40a0-9603-d8f1ccca750c/oauth2/authorize?client_id=xxx&response_mode=form_post&response_type=code+id_token&scope=openid+profile&state=OpenIdConnect.AuthenticationProperties%3dN0VcDqbXjy8-ZgPz_dFvmMZNh4nUoALmnhD1g3WH9Bort98U38_TN-5D7owmpvZ1eknKgLP7yzUMIRuXsbdAB9VT5hZ4sNRPqn1z73WuoOdbV0mPphggmlSNjNnPwLeBOb-_UfHDDfXZfEKsetkfYA&nonce=635845625658654791.ZDQ0YjFhODEtMzZjYi00ZDcxLWIzY2MtZWZiYjJiZWI2NTY2ZDAzYjQxOTUtNTA3MS00MWUzLTlhZmQtNzI5MjRlYzZjYmM3

And so on. This is a major problem for us! I've re-written the login code several times, also ripped out everything and replaced the login code from a fresh asp.net mvc project created from VS2015. Deployed to a https url (I know there's been probs with non-https url logins)

If I restart or redeply the website, it works again for a day or two.

---

/Johan

Answer 1

Hello,

This issue is because of the authentication mode selected(by default) by the MVC 5 Template, which triggers the ReturnUrl Style of redirection that might lead to an infinite loop if not configured correctly.

To disable OWIN startup discovery,add this key to your webconfig file.
<add key="owin:AutomaticAppStartup" value="false"/>

you can also refer this stackoverflow thred:
http://stackoverflow.com/questions/23065466/infinite-redirect-loop-for-basic-or-windows-authentication

Regards DOD...

Answer 2

I'm afraid that's not it. If I add that setting, I'm never redirected to the microsoft azure ad login page. The whole website is supposed to be protected.

---

/Johan

Answer 3

Hello JoDan,

I understand that I could be too late for this. This issue can be caused, if you visit the application without HTTPS. Please refer to the link below as one of the use was able to resolve the issue:

https://github.com/aspnet/Security/issues/219

Thanks,
Syed Irfan Hussain

Answer 4

Check this out:

http://katanaproject.codeplex.com/wikipage?title=System.Web%20response%20cookie%20integration%20issues&referringTitle=Documentation

HTH, Benjamin

Answer 5

Hello Johan,

We are experiencing this exact same thing.  Did you ever get it resolved and if so, what were the steps you took?

TIA...Bob Baldwin
AKA VSDotNetGuy

---

TIA...vsdotnetguy

Answer 6

This one solved it for me.  If this is on an App Service Web App, you might require HTTPS.

https://blogs.msdn.microsoft.com/benjaminperkins/2014/01/07/https-only-on-windows-azure-web-sites/

HTH, Benjamin

Answer 7

Thank you BenjaminPerkins!

http://katanaproject.codeplex.com/wikipage?title=System.Web%20response%20cookie%20integration%20issues&referringTitle=Documentation

My issue was caused by the Cookie manager issue where System.Web.Cookies conflicts with OWIN cookies and can cause the OWIN auth to fail.

The thing that drove me crazy was that the authentication would work once in a while and then fail after closing the browser and re-opening it.   I, too, went ahead and set up a brand new MVC project with the same OWIN Startup.  It worked fine on the brand new project that didn't make use of System.Web.Cookies and Sessions, yet.   I was quite baffled.

Adding the custom cookie manager in the linked article fixed the issue for me.  I am so relieved.

Wish I found this earlier, as I have been troubleshooting for hours and hours. 

Answer 8

Hi,

is this fix still required in 5.0. It mentions that this was fixed ?

I have the same problem and its driving me crazy. A re-deploy will work for a while then the redirect starts again. Every day.

Rob

---

Rob

Answer 9

Just to clarify, have you installed the 5.0 ver and still experiencing login loops? And do let us know if you are receiving any specific error message?

--------------------------------------------------------------------------------------------------

Do click on "Mark as Answer" on the post that helps you, this can be beneficial to other community members.

Answer 10

Did you solve this problem? I have tried everything....Same as you it work after redeploy

---

CRM Consultant/Business Advisor at Skill AS in Norway
RockStar365 profile

Answer 11

Take a look into this similar discussion thread and GitHub Page for some pointers.

 

If you have tried all the suggestions posted in this thread and the issues still persist, for a thorough analysis on this specific issue, you may raise a support ticket as mentioned in the link(s) below, which will help you work closely with the support for speedy resolution:

How to create an Azure support request or Technical Support for Microsoft Partners

---------------------------------------------------------------------------------------------------

Do click on "Mark as Answer" on the post that helps you, this can be beneficial to other community members.