I would expect you not to be authorized to get in to the editor/admin unless you have the right claims/groups coming back

Out of the box there's 3 roles setup in a default configuration 

• WebEditors - Editor can edit the site.
• WebAdmins - Admins can manage roles and perform all task actions
• Administrators - Admin the site. (can do a few extra things that WebAdmins can't)

So I'd expect unless you've modified the virtual roles configuration this you'd have the minimum role WebEditors as a role claim which would need to be setup in your directory for the login your using

Thanks a lot. After gettings role claims from ADFS, I can finally login to admin site:

We had allow roles in our web.config and after getting EPiServerxx1 claim from ADFS i was allowed to login

 <authorization>
        <allow roles="WebEditors, EPiServerxx1, EPiServerxx2, EPiServerxx3" />
      </authorization>

We are using ADFS for our internal employes while front-end users will be using OIDC implemented in startup.cs. 

The ODIC is set to passive AuthenticationMode.Passive, to be only kicked when user clicks login button. If we also set ADFS to passive then how can this be kicked in when internal employes try to access xx.com/episerver ? We don't want unauthenticated request kicks any of the login flows 

From what I remember although it's been a while this is achieved by setting the Path as they are doing in https://world.optimizely.com/documentation/developer-guides/archive/cms/security2/configuring-mixed-mode-owin-authentication-10-11/  

I think setting the path or ADFS to the default authentication mechansim but I've not used ADFS for a long time so not 100% it has the same properties to set it all up.

Hi Scott

Thanks for your reply.

Below code is what I am trying to implement as we are using OIDC (as one of the flow others are MVC post) for front-end users and ADFS forn back-end users. I have created a get method on one of the page which calls challgenge for the ADFS. (I don't know if there is better way to do it)

 HttpContext.GetOwinContext().Authentication.Challenge(new AuthenticationProperties()
            {
                RedirectUri = "/episerver",
                
            }, WsFederationAuthenticationDefaults.AuthenticationType);
            return new UnautorizedResult();

The problem I am facing right now is that when the front-end user is already logged and in the same browser back-end users try to go to episerver admin side (by invoking actionmethod). The CookieAuthentication takes over after ADFS validation and the user is prevented redirect to  EPIServer admin page. I think its trying to redirect to admin page in front-end user context.(which ofcourse doesn't have access to admin page).

How can I redirect to EPiServer admin page in backend user context (ADFS) ?

using Microsoft.Owin;
using Owin;
using System;
using System.Collections.Generic;
using System.Configuration;
using System.Net;
using System.Net.Http;
using System.Net.Http.Headers;
using System.Threading.Tasks;
using System.Security.Claims;
using System.Web.Helpers;
using EPiServer;
using EPiServer.Security;
using EPiServer.ServiceLocation;
//using EPiServer.Cms.UI.AspNetIdentity;
using Microsoft.AspNet.Identity;
using Microsoft.IdentityModel.Logging;
using Microsoft.Owin.Security.Notifications;
using Microsoft.Owin.Security.OpenIdConnect;
using Microsoft.IdentityModel.Protocols.OpenIdConnect;
using Microsoft.IdentityModel.Protocols.WsFederation;
using Microsoft.Owin.Extensions;
using Microsoft.Owin.Security;
using Microsoft.Owin.Security.Cookies;
using Microsoft.Owin.Security.WsFederation;
using Newtonsoft.Json.Linq;

[assembly: OwinStartup(typeof(MyApplication.Startup))]

namespace MyApplication
{
    public class Startup
    {
        private readonly string _clientId = "xxx";
        private readonly string _redirectUri = "xxx";
        private readonly string _postLogoutRedirectUri = "xxxx";
        private readonly string _authority = "xxx";
        private readonly string _clientSecret = "xxx";
        private const string LogoutUrl = "xxx";


        public void Configuration(IAppBuilder app)
        {
            IdentityModelEventSource.ShowPII = true;
            ServicePointManager.SecurityProtocol |= SecurityProtocolType.Tls12 | SecurityProtocolType.Tls11 | SecurityProtocolType.Ssl3 | SecurityProtocolType.Ssl3;
            //// For more information on how to configure your application, visit https://go.microsoft.com/fwlink/?LinkID=316888
            ConfigureAuth(app);
        }

        public void ConfigureAuth(IAppBuilder app)
        {

            app.UseCookieAuthentication(new CookieAuthenticationOptions
            {
                AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
                LoginPath = new PathString("/LogMeIn/"),
                LogoutPath = new PathString("/"),
            });

            app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);

            app.UseExternalSignInCookie(DefaultAuthenticationTypes.ExternalCookie);

            app.UseOpenIdConnectAuthentication(new OpenIdConnectAuthenticationOptions
            {
                ClientId = _clientId,
                ClientSecret = _clientSecret,
                Authority = _authority,
                RedirectUri = _redirectUri,
                PostLogoutRedirectUri = _postLogoutRedirectUri,
                ResponseType = OpenIdConnectResponseType.CodeIdToken,
                Scope = "xxx",
                SaveTokens = true,
                AuthenticationMode = AuthenticationMode.Passive,

                Notifications = new OpenIdConnectAuthenticationNotifications
                {
                    AuthenticationFailed = notification =>
                    {
                       xxxxx
                        return Task.CompletedTask;
                    },

                    // Retrieve an access token from the remote token endpoint
                    // using the authorization code received during the current request.
                    AuthorizationCodeReceived = async notification =>
                    {
                       xxxxxx
                    },

                    // Attach the id_token stored in the authentication cookie to the logout request.
                    RedirectToIdentityProvider = notification =>
                    {
                        xxxxxx

                        return Task.CompletedTask;
                    },

                }
            });







            ////Enable cookie authentication, used to store the claims between requests
          //  app.SetDefaultSignInAsAuthenticationType(WsFederationAuthenticationDefaults.AuthenticationType);
            app.UseCookieAuthentication(new CookieAuthenticationOptions
            {
                AuthenticationType = WsFederationAuthenticationDefaults.AuthenticationType,
                CookieName = "xxx",
                AuthenticationMode = AuthenticationMode.Passive
            });

            //Enable federated authentication
            app.UseWsFederationAuthentication(new WsFederationAuthenticationOptions()
            {
                //Trusted URL to federation server meta data
                MetadataAddress = "xxx",
                //Value of Wtreal must *exactly* match what is configured in the federation server
                Wtrealm = "xxx/",

                AuthenticationMode = AuthenticationMode.Passive,


                Notifications = new WsFederationAuthenticationNotifications()
                {
                    RedirectToIdentityProvider = (ctx) =>
                    {
                        //  To avoid a redirect loop to the federation server send 403 when user is authenticated but does not have access
                        if (ctx.OwinContext.Response.StatusCode == 401 && (ctx.OwinContext.Authentication.User.Identity.AuthenticationType == WsFederationAuthenticationDefaults.AuthenticationType && ctx.OwinContext.Authentication.User.Identity.IsAuthenticated))
                        {
                            ctx.OwinContext.Response.StatusCode = 403;
                            ctx.HandleResponse();
                        }
                        //XHR requests cannot handle redirects to a login screen, return 401
                        if (ctx.OwinContext.Response.StatusCode == 401 && IsXhrRequest(ctx.OwinContext.Request))
                        {
                            ctx.HandleResponse();
                        }
                        return Task.FromResult(0);
                    },
                    //AuthenticationFailed = (ctx) =>
                    //{
                    //    if (ctx.OwinContext.Response.StatusCode == 401)
                    //    {

                    //    }

                    //    return Task.FromResult(0);
                    //},

                    //MessageReceived = (ctx) =>
                    //{
                    //    if (ctx.OwinContext.Response.StatusCode == 401)
                    //    {

                    //    }
                    //    return Task.FromResult(0);
                    //},

                    SecurityTokenValidated = (ctx) =>
                    {

                        //Ignore scheme/host name in redirect Uri to make sure a redirect to HTTPS does not redirect back to HTTP
                        var redirectUri = new Uri(ctx.AuthenticationTicket.Properties.RedirectUri, UriKind.RelativeOrAbsolute);
                        if (redirectUri.IsAbsoluteUri)
                        {
                            ctx.AuthenticationTicket.Properties.RedirectUri = redirectUri.PathAndQuery;
                        }
                        //Sync user and the roles to EPiServer in the background
                        ServiceLocator.Current.GetInstance<ISynchronizingUserService>().SynchronizeAsync(ctx.AuthenticationTicket.Identity);
                        return Task.FromResult(0);
                    }
                }
            });
            //Add stage marker to make sure WsFederation runs on Authenticate (before URL Authorization and virtual roles)
            app.UseStageMarker(PipelineStage.Authenticate);

            //Remap logout to a federated logout
            app.Map(LogoutUrl, map =>
            {
                map.Run(ctx =>
                {
                    ctx.Authentication.SignOut();
                    return Task.FromResult(0);
                });
            });
          
}

I have also followed this link:

https://hacksbyme.net/2017/05/11/mixed-mode-owin-authentication-for-episerver-editors/

I found out that I had to set AuthenticatioMode to Active in second cookie authentication , so now its working:

app.UseCookieAuthentication(new CookieAuthenticationOptions { 
AuthenticationType = WsFederationAuthenticationDefaults.AuthenticationType,
CookieName = "xxx", AuthenticationMode = 
AuthenticationMode.Active });

       public void Configuration(IAppBuilder app)
    {
        //IdentityModelEventSource.ShowPII = true;
        ServicePointManager.SecurityProtocol |= SecurityProtocolType.Tls12 | SecurityProtocolType.Tls11;
        //// For more information on how to configure your application, visit https://go.microsoft.com/fwlink/?LinkID=316888

        ConfigureMemberAuth(app);

        ConfigureAdminAuth(app);
    }

    private void ConfigureMemberAuth(IAppBuilder app)
    {
        app.UseCookieAuthentication(new CookieAuthenticationOptions
        {
            AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
            LoginPath = new PathString("/logmein/"),
            LogoutPath = new PathString("/"),
            AuthenticationMode = AuthenticationMode.Active

        });

        app.UseExternalSignInCookie(DefaultAuthenticationTypes.ExternalCookie);

       _ = app.UseOpenIdConnectAuthentication(new OpenIdConnectAuthenticationOptions
        {
            ClientId = ApplicationSettings.OIDCClientId,
            ClientSecret = ApplicationSettings.OIDCClientSecret,
            Authority = ApplicationSettings.OIDCAuthority,
            RedirectUri = $"{ApplicationSettings.Domain}{_oidcRedirectMethod}",
            PostLogoutRedirectUri = ApplicationSettings.Domain,
            ResponseType = OpenIdConnectResponseType.CodeIdToken,
            Scope = "xxx",
            SaveTokens = true,
            AuthenticationMode = AuthenticationMode.Passive,
            AuthenticationType = OpenIdConnectAuthenticationDefaults.AuthenticationType,
            
            Notifications = new OpenIdConnectAuthenticationNotifications
            {
                AuthenticationFailed = notification =>
                {
                    if (string.Equals(notification.ProtocolMessage.Error, "xxx", StringComparison.Ordinal))
                    {
                        notification.HandleResponse();

                        if (string.Equals(notification.ProtocolMessage.ErrorDescription, "xxx", StringComparison.Ordinal))
                            notification.Response.Redirect(ApplicationSettings.Domain);
                        else
                        {
                            var errorPage = UrlResolver.GetUrl(PageHelper.GetAdminPage().LoginBox.NemIDErrorPage.GetFriendlyUrl());
                            notification.Response.Redirect(errorPage);
                        }
                    }

                    return Task.CompletedTask;
                },

                // Retrieve an access token from the remote token endpoint
                // using the authorization code received during the current request.
                AuthorizationCodeReceived = async notification =>
                {
                    using (var client = new HttpClient())
                    {
                        var configuration = await notification.Options.ConfigurationManager.GetConfigurationAsync(notification.Request.CallCancelled);
                        var tokenEndpointResult = await ExchangeCodeForTokens(notification, client, configuration);

                        // Add the identity token to the returned ClaimsIdentity to make it easier to retrieve.
                        notification.AuthenticationTicket.Identity.AddClaim(new Claim(
                            type: OpenIdConnectParameterNames.IdToken,
                            value: tokenEndpointResult.Value<string>(OpenIdConnectParameterNames.IdToken)));

                        // Retrieve the claims from UserInfo endpoint using the access token as bearer token.
                        var accesstoken = tokenEndpointResult.Value<string>(OpenIdConnectParameterNames.AccessToken);
                        var userInfoEndpointResult = await UserInfoEndpointClaims(notification, client, configuration, accesstoken);

                        //Security note: It is important to verify that the sub claim from ID token matches the sub claim in the UserInfo response
                        var userinfoSub = userInfoEndpointResult["xx"].Value<string>();
                        var idtokenSub = notification.AuthenticationTicket.Identity.FindFirst("http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier").Value;
                        if (userinfoSub == idtokenSub)
                        {
                            //add claims from UserInfo endpoint to identity
                            foreach (var entry in userInfoEndpointResult)
                            {
                                if (!notification.AuthenticationTicket.Identity.HasClaim(c => c.Type == entry.Key))
                                {
                                    notification.AuthenticationTicket.Identity.AddClaim(new Claim(
                                        type: entry.Key,
                                        value: entry.Value.ToString()));
                                }
                            }
                            // Add access token to claims.
                            notification.AuthenticationTicket.Identity.AddClaim(new Claim(
                                OpenIdConnectParameterNames.AccessToken,
                                 accesstoken));
                        }
                    }
                },

                // Attach the id_token stored in the authentication cookie to the logout request.
                RedirectToIdentityProvider = notification =>
                {
                    if (notification.ProtocolMessage.RequestType == OpenIdConnectRequestType.Logout)
                    {
                        var token = notification.OwinContext.Authentication.User?.FindFirst(OpenIdConnectParameterNames.IdToken);
                        if (token != null)
                        {
                            notification.ProtocolMessage.IdTokenHint = token.Value;
                        }

                        notification.Response.Redirect(ApplicationSettings.Domain);
                    }

                    return Task.CompletedTask;
                },

            }
        });

    }

    private void ConfigureAdminAuth(IAppBuilder app)
    {



        //Enable cookie authentication, used to store the claims between requests

        app.SetDefaultSignInAsAuthenticationType(WsFederationAuthenticationDefaults.AuthenticationType);
        app.UseCookieAuthentication(new CookieAuthenticationOptions
        {
            AuthenticationType = WsFederationAuthenticationDefaults.AuthenticationType,
            CookieName = WsFederationAuthenticationDefaults.CookieName,
            AuthenticationMode = AuthenticationMode.Active,
            CookieHttpOnly = true,
        });

        //Enable federated authentication
        _ = app.UseWsFederationAuthentication(new WsFederationAuthenticationOptions()
        {
            //Trusted URL to federation server meta data
            MetadataAddress = ApplicationSettings.MetaDataAddress,
            //Value of Wtreal must *exactly* match what is configured in the federation server
            Wtrealm = ApplicationSettings.RelyPartyUri,
            AuthenticationMode = AuthenticationMode.Passive,

            Notifications = new WsFederationAuthenticationNotifications()
            {
                RedirectToIdentityProvider = (ctx) =>
                {
                    //  To avoid a redirect loop to the federation server send 403 when user is authenticated but does not have access
                    if (ctx.OwinContext.Response.StatusCode == 401 && (ctx.OwinContext.Authentication.User.Identity.AuthenticationType == WsFederationAuthenticationDefaults.AuthenticationType && ctx.OwinContext.Authentication.User.Identity.IsAuthenticated))
                    {
                        ctx.OwinContext.Response.StatusCode = 403;
                        ctx.HandleResponse();
                    }
                    //XHR requests cannot handle redirects to a login screen, return 401
                    if (ctx.OwinContext.Response.StatusCode == 401 && IsXhrRequest(ctx.OwinContext.Request))
                    {
                        ctx.HandleResponse();
                    }
                    return Task.FromResult(0);
                },
                SecurityTokenValidated = (ctx) =>
                {

                    //Ignore scheme/host name in redirect Uri to make sure a redirect to HTTPS does not redirect back to HTTP
                    var redirectUri = new Uri(ctx.AuthenticationTicket.Properties.RedirectUri, UriKind.RelativeOrAbsolute);
                    if (redirectUri.IsAbsoluteUri)
                    {
                        ctx.AuthenticationTicket.Properties.RedirectUri = redirectUri.PathAndQuery;
                    }
                    //Sync user and the roles to EPiServer in the background
                    ServiceLocator.Current.GetInstance<ISynchronizingUserService>().SynchronizeAsync(ctx.AuthenticationTicket.Identity);
                    return Task.FromResult(0);
                },

            }
        });
        //Add stage marker to make sure WsFederation runs on Authenticate (before URL Authorization and virtual roles)
        app.UseStageMarker(PipelineStage.Authenticate);

        // Remap logout to a federated logout
        app.Map(LogoutUrl, map =>
        {
            map.Run(ctx =>
            {
                ctx.Authentication.SignOut();
                ctx.Response.Redirect(ApplicationSettings.Domain);
                return Task.FromResult(0);
            });
        });
    }