Enabling federated authentication using a feature flag in Code

Question

We have managed to configure our Auth0 custom identity provider in our solution. Migrating from forms authentication however will take a bit more effort than just a bunch of config.

In order to avoid a really long lived branch, would there be a possibility to switch federated security on/off using a feature switch service like Launch Darkly.

Example of config:

<?xml version="1.0" encoding="utf-8"?>

<configuration xmlns:patch="http://www.sitecore.net/xmlconfig/" xmlns:role="http://www.sitecore.net/xmlconfig/role/" xmlns:set="http://www.sitecore.net/xmlconfig/set/">
    <!--    This configuration disables Owin and Federated Auth which prevents Sitecore Membership Provider
            from allow website visitors to authenticate and maintain a authenticated session. 
            This only applies to Standalone used for local dev and ContentDelivery for public website. 
            The CMS will still use Sitecore Identity Server to Authenticate. -->
     <sitecore role:require="Standalone or ContentDelivery">
        <settings>
            <setting name="Owin.Authentication.Enabled" value="false" />
            <setting name="FederatedAuthentication.Enabled" value="false" />
        </settings>

        <sites>
            <site name="shell" set:loginPage="/sitecore/login" />
            <site name="admin" set:loginPage="/sitecore/admin/login.aspx" />
        </sites>
    </sitecore>
</configuration>

Where the flags like Owin.Authentication.Enabled can be switched on to True at runtime by fetching this from another service.

Answer 1

There are 2 different parts to this questions:

1. Updating the Sitecore config at runtime is possible but hard, see this post for more details. However:
2. I don't believe succeeding in task 1 will actually help you. The OWIN middleware used by FederatedAuthentication gets registered when the Application Pool starts. The middleware is already registered if you change the setting at runtime later. This middleware cannot be removed later see this.

I would suggest looking into one of below approaches:

1. If the main goal is about preventing a long lived branch, then perhaps you merge and delete this branch but keep Owin.Authentication.Enabled disabled until you are ready to introduce this change (which will require a deployment)?
2. If above option does not work for your scenario, then you could look into the approach which is also linked here about wrapping the execution of the middleware with a condition. This might require a lot of customizations to Sitecore as some of the middleware is registered by Sitecore.