0

We have implemented OpenID connect using OWIN middleware on Sitecore 8.2.

Unfortunately, the way secure pages have been defined in this site is by pages inheriting a particular template, as opposed to the regular way of using deny permissions on roles. To deal with that fact we have the following code in the mvcRequestBegin pipeline:

if (DoesCurrentPageRequireAuthentication())
{
    args.PageContext.RequestContext.HttpContext.GetOwinContext().Authentication
        .Challenge(new AuthenticationProperties()
        {
            RedirectUri = $"/identity/ExternalLogin?returnUrl={httpContext.Request.Url}"
        });
    args.AbortPipeline();
}

But there is an issue with this code in that args.AbortPipeline() doesn't seem to abort the request and let openid connect handle the challenge and redirect to the login page. Instead, the renderings are invoked as normal, and if a controller rendering contains a redirect in it, this redirect is performed and trumps the authentication challenge.

I have tried moving this code into the httpBeginRequest processor, but I receive the exception: No owin.Environment item was found in the context. If I comment out the challenge method I get a 404 as expected because the pipeline IS being actually being aborted which is the desired behavior.

So my question is: where can I put this code that needs to check if the current item has a particular template to run the Challenge? Is there a more appropriate pipeline?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.