Hi folks,

I'm trying to implement a mixed-mode authentication on .net core Optimizely 12 (EPiServer.CMS 12.3.2, EPiServer.CMS.AspNetCore.Mvc 12.4.1) with an Okta Owin authentication (similar to Azure AD Authentication really) for end users on the public site and a regular Optimizely login for the CMS edit/admin section by login on /util/login

Integrating Okta authentication works just fine using their provided services.AddOktaMvc() (which is just Okta custom version of AddOpenIdConnect() )

But as soon as I add the Optimizely login for the CMS section by adding services.AddCmsAspNetIdentity<ApplicationUser>() I'm getting a redirect loop when trying to log in with Okta : on any controller action having [Authorize] attribute :
- I get redirected to Okta sign in widget
- I log in fine, then get redirected to the Okta callback method which validates the successful login
(all good until there, same as without services.AddCmsAspNetIdentity() addition)
- I am redirected to the page I am trying to access which thinks I am not authenticated, so I'm instantly redirected to Okta login page, but as I'm logged in fine on Okta, I'm instantly redirected to the page I am trying to access and so on forever

It looks like HttpContext.User.Identity is not populated based on the returned infos from Okta (whereas it works just fine if I just comment out services.AddCmsAspNetIdentity<ApplicationUser>(); (see code below)

I was thinking it would be some sort of cookie issue between the 2 authentication modes, so I've tried to use SystemWebChunkingCookieManager as CookieManager and various other things but to no avail.

I'm not sure what I am missing and what needs to be done to get this working.
Optimizely has a documentation page for use case for asp.net only : https://world.optimizely.com/documentation/developer-guides/archive/cms/security2/configuring-mixed-mode-owin-authentication-10-11/ but nothing for .net core, same for an example git repo implementing a mixed mode authentication with Optimizely's services.AddCmsAspNetIdentity(), there is one for asp.net, but nothing for .net core

I have been scouring the internet to try to find something, but to no avail and I'm running out of ideas.

Has anyone been able to set up this mixed mode authentication successfully on .net Core and is willing to share its startup.cs file config for this ?

Many thanks for the help, is has been driving me crazy the last days !

Here is what I have in Startup.cs at the moment : 

using System;
using System.IO;
using System.Linq;
using System.Security.Claims;
using System.Text;
using System.Threading.Tasks;
using EPiServer.Cms.UI.AspNetIdentity;
using EPiServer.Data;
using EPiServer.Labs.LinkItemProperty;
using EPiServer.Security;
using EPiServer.ServiceLocation;
using EPiServer.Web.Routing;
using Geta.NotFoundHandler.Infrastructure.Initialization;

using Microsoft.AspNetCore.Authentication.Cookies;
using Microsoft.AspNetCore.Authentication.OpenIdConnect;
using Microsoft.AspNetCore.Builder;
using Microsoft.AspNetCore.Hosting;
using Microsoft.AspNetCore.Http;
using Microsoft.AspNetCore.Mvc.Infrastructure;
using Microsoft.Extensions.Configuration;
using Microsoft.Extensions.DependencyInjection;
using Microsoft.Extensions.FileProviders;
using Microsoft.Extensions.Hosting;
using Microsoft.IdentityModel.Tokens;
using Microsoft.Owin.Host.SystemWeb;
using Okta.AspNetCore;

namespace MyProject.Web
{
    public class Startup
    {

        private readonly IWebHostEnvironment _webHostingEnvironment;
        private readonly IConfiguration _configuration;

        public Startup(IWebHostEnvironment webHostingEnvironment, IConfiguration configuration)
        {
            _webHostingEnvironment = webHostingEnvironment;
            _configuration = configuration;
        }

        public void ConfigureServices(IServiceCollection services)
        {
            services.Configure<DataAccessOptions>(o =>
            {
                o.CreateDatabaseSchema = true;
            });

            this.ConfigureAuthentication(services);

            services.AddMvc();
            services.AddRazorPages();

            services.AddCms();

            services.AddFind();

            services.AddLinkItemProperty();

            services.AddTransient<IActionContextAccessor, ActionContextAccessor>();
            services.AddHttpContextAccessor();

            services.Configure<MyProjectGlobalAppSettings>(
                _configuration.GetSection("GlobalAppSettings"));

            services.AddOptions();
        }

        public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
        {
            app.UseNotFoundHandler();
            if (env.IsDevelopment())
            {
                app.UseDeveloperExceptionPage();
            }
            else
            {
                app.UseHttpsRedirection();
            }

            app.UseStaticFiles();
            app.UseStaticFiles(new StaticFileOptions
            {
                FileProvider = new PhysicalFileProvider(
                    Path.Combine(Directory.GetCurrentDirectory(), "Areas")),
                RequestPath = "/Areas"
            });
            app.UseStaticFiles(new StaticFileOptions
            {
                FileProvider = new PhysicalFileProvider(
                    Path.Combine(Directory.GetCurrentDirectory(), "ClientResources")),
                RequestPath = "/ClientResources"
            });

            app.UseRouting();

            app.UseAuthentication();
            app.UseAuthorization();

            app.UseEndpoints(endpoints =>
            {
                endpoints.MapRazorPages();

                endpoints.MapDefaultControllerRoute();

                endpoints.MapContent();
            });
        }

        /// <summary>
        /// Configures the authentication handlers for MyProject :
        /// (1) ApplicationCookie - for users logging in via /util/login.aspx or any custom login page
        /// (2) B2CAuthentication - for MyProject customers logging in via OKTA login page
        /// </summary>
        private void ConfigureAuthentication(IServiceCollection services)
        {
            //(1) ApplicationCookie - for users logging in via /util/login.aspx or any custom login page

            services.AddCmsAspNetIdentity<ApplicationUser>();

            services.ConfigureApplicationCookie(options =>
            {
                options.CookieManager = new SystemWebChunkingCookieManager() as ICookieManager;

                options.LoginPath = "/Account/SignIn";
                options.ExpireTimeSpan = TimeSpan.FromMinutes(30);
                options.SlidingExpiration = true;
            });

            //(2) B2C Authentication - for MyProject customers logging in via OKTA login page
            var oktaConfig = _configuration.GetSection("Okta").Get<OktaAppSettings>();

            services.AddAuthentication(options =>
            {
                options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
                options.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme; 
            })
            //maybe a simple .AddCookie() is enough ?
            .AddCookie(options =>
            {
                options.CookieManager = new SystemWebChunkingCookieManager() as ICookieManager;
            })
            .AddOktaMvc(new OktaMvcOptions
            {
                OktaDomain = oktaConfig.B2C.OktaDomain,
                AuthorizationServerId = oktaConfig.B2C.AuthorizationServerId,
                ClientId = oktaConfig.B2C.ClientId,
                ClientSecret = oktaConfig.B2C.ClientSecret,
                Scope = oktaConfig.B2C.Scopes.Split(new string[] { " " }, StringSplitOptions.RemoveEmptyEntries).Where(x => !string.IsNullOrWhiteSpace(x)).ToArray(),
                //Maybe next line is not needed ?
                GetClaimsFromUserInfoEndpoint = true,
                OpenIdConnectEvents = new OpenIdConnectEvents
                {
                    OnAuthenticationFailed = context =>
                    {
                        context.HandleResponse();
                        context.Response.BodyWriter.WriteAsync(Encoding.ASCII.GetBytes(context.Exception.Message));
                        return Task.FromResult(0);
                    },
                    OnTokenValidated = (ctx) =>
                    {
                        var redirectUri = new Uri(ctx.Properties.RedirectUri, UriKind.RelativeOrAbsolute);
                        if (redirectUri.IsAbsoluteUri)
                        {
                            ctx.Properties.RedirectUri = redirectUri.PathAndQuery;
                        }
                        //Sync user and the roles to EPiServer in the background
                        ServiceLocator.Current.GetInstance<ISynchronizingUserService>().SynchronizeAsync(ctx.Principal.Identity as ClaimsIdentity);
                        return Task.FromResult(0); 
                    },
                    OnRedirectToIdentityProvider = context =>
                    {
                        // To avoid a redirect loop to the federation server send 403
                        // when user is authenticated but does not have access
                        if (context.Response.StatusCode == 401 &&
                        context.HttpContext.User.Identity.IsAuthenticated)
                        {
                            context.Response.StatusCode = 403;
                            context.HandleResponse();
                        }

                        // XHR requests cannot handle redirects to a login screen, return 401
                        if (context.Response.StatusCode == 401 && IsXhrRequest(context.Request))
                            context.HandleResponse();

                        return Task.CompletedTask;
                    }
                }
            });

            //AddOktaMvc() does not allow to set the TokenValidationParameters in its parameters, so we need to do it afterwards
            services.PostConfigureAll<OpenIdConnectOptions>(options =>
            {
                options.TokenValidationParameters = new TokenValidationParameters
                {
                    RoleClaimType = ClaimTypes.Role,
                    NameClaimType = ClaimTypes.Name,
                    ValidateIssuer = false,
                };
            });
        }

        #region various private helper methods

        private static bool IsXhrRequest(HttpRequest request)
        {
            const string xRequestedWith = "X-Requested-With";

            var query = request.Query;
            if ((query != null) && (query[xRequestedWith] == "XMLHttpRequest"))
                return true;

            var headers = request.Headers;
            return (headers != null) && (headers[xRequestedWith] == "XMLHttpRequest");
        }

        #endregion
    }
}