For reference, here's my current ConfigureBackOfficeAzureActiveDirectoryAuth method:

        public static void ConfigureBackOfficeAzureActiveDirectoryAuth(this IAppBuilder app,
        string tenant, string clientId, string postLoginRedirectUri, Guid issuerId,
        string caption = "Active Directory", string style = "btn-microsoft", string icon = "fa-windows") {
        var authority = string.Format(
            CultureInfo.InvariantCulture,
            "https://login.windows.net/{0}",
            tenant);

        var adOptions = new OpenIdConnectAuthenticationOptions {
            SignInAsAuthenticationType = Umbraco.Core.Constants.Security.BackOfficeExternalAuthenticationType,
            ClientId = clientId,
            Authority = authority,
            RedirectUri = postLoginRedirectUri,
            AuthenticationMode = AuthenticationMode.Passive,
            Notifications = new OpenIdConnectAuthenticationNotifications {
                AuthorizationCodeReceived = async context =>
                {
                    var userService = ApplicationContext.Current.Services.UserService;

                    var email = context.JwtSecurityToken.Claims.First(x => x.Type == "email").Value;
                    var issuer = context.JwtSecurityToken.Claims.First(x => x.Type == "iss").Value;
                    var providerKey = context.JwtSecurityToken.Claims.First(x => x.Type == "sub").Value;
                    var name = context.JwtSecurityToken.Claims.First(x => x.Type == "name").Value;
                    var userManager = context.OwinContext.GetUserManager<BackOfficeUserManager>();

                    var user = userService.GetByEmail(email);

                    if (user == null) {
                        var writerUserType = userService.GetUserTypeByName("writer");
                        user = userService.CreateUserWithIdentity(email, email, writerUserType);
                    }

                    var identity = await userManager.FindByEmailAsync(email);
                    if (identity.Logins.All(x => x.ProviderKey != providerKey)) {
                        identity.Logins.Add(new IdentityUserLogin(issuer, providerKey, user.Id));
                        identity.Name = name;
                        await userManager.UpdateAsync(identity);
                    }
                }
            }
        };

        adOptions.ForUmbracoBackOffice(style, icon);
        adOptions.Caption = caption;
        adOptions.SetExternalSignInAutoLinkOptions(new ExternalSignInAutoLinkOptions(autoLinkExternalAccount: true));

        //Need to set the auth type as the issuer path
        adOptions.AuthenticationType = string.Format(
            CultureInfo.InvariantCulture,
            "https://sts.windows.net/{0}/",
            issuerId);

        app.UseOpenIdConnectAuthentication(adOptions);
    }

You'll need to first diagnose the simpler case. Before adding any auto-linking options and custom auto-linking code, you need to first ensure that you can actually link your OAuth provider to an existing account.

So first thing to do is:

• Remove the callback AuthorizationCodeReceived
• Remove the call to SetExternalSignInAutoLinkOptions

So that you have the simplest code possible (least moving parts). You need to make sure this works before doing any auto-linking.

So now create a new back office user and log in as them, then try to link their account to your AD OAuth provider in the dialog when you click on your Avatar in the back office.

If this doesn't work then some debugging needs to happen. Because Azure AD is a bit odd, it uses the 'issuer path' as the auth type ... though it's been a very long time since I last tested this, I'm unsure if this has changed. I suspect that if this is not working that perhaps the auth-type isn't matching. In which case, you can have a look at the DB table contents: umbracoExternalLogin to see what information was recorded and take note of the data that was entered for the user you just tried to link your AD too, that might yield why this isn't working.

Hi Shannon,

Thanks for this. I've stripped the code back to the basics, but we're getting the same result. If I log in as a local user and then try to link accounts, I just get redirected back to /umbraco with the option still there to link. If I then log out and try to log in with Azure AD, I get the message The requested provider has not been linked to an account. At no point is anything written to the umbracoExternalLogin table either.

We can pick up a response from Azure AD with the expected results, but this then seems to disappear within Umbraco. There is an empty UMB_EXTLOGIN cookie being set, and there's a second cookie that is only there for a split second before the login redirect to Microsoft occurs, but neither persist with any data.

I've also tried changing the AuthenticationType to Cookie and Bearer with no luck (same responses), and the current type is using the https://sts.windows.net/{tenantId}. Where would you recommend I look from here?

I'm not sure why you are trying to change AuthenticationType to cookie or bearer, that is definitely not going to work ;)

What information are you passing into this method for

• tenant, clientId
  • these need to match exactly, there's a bunch of information on how to setup Azure AD here https://github.com/Azure-Samples/active-directory-dotnet-webapp-webapi-openidconnect

• postLoginRedirectUri

  • this also needs to match exactly what you have configured in your AD

  • other docs https://github.com/umbraco/UmbracoIdentityExtensions/blob/master/src/App_Start/UmbracoADAuthExtensions.cs#L25

• issuerId see https://github.com/umbraco/UmbracoIdentityExtensions/blob/master/src/App_Start/UmbracoADAuthExtensions.cs#L28

In many cases people have just forgotten an ending '/' on the login redirect Url or other character mistakes with the above since they need to be exact.

The next step is that you'll need to debug the callbacks. Sorry but this is the only way to know what data is coming and going into your app which is something that you'll need to do to try to figure out where the problem lies. To do that you can use the Notifications on the OpenIdConnectAuthenticationOptions, then set callbacks for each available callback method and put a breakpoint there to see what is happening.

Thanks again, Shannon!

I've double checked the values to make sure they match. If one of them doesn't, we pick up errors and/or the Microsoft callbacks don't complete.

Checking the logs, we only see one message: WARN Umbraco.Core.Logging.OwinLogger - Event Id: 0, state: The state field is missing or invalid. I'm trying to trace this back but I can't pick up where it's directly coming from - I get the impression state isn't directly related to Azure AD, but I'm not 100% sure?

For the callbacks, they get hit in this order at the moment, and don't appear to list any errors (and do include my details back from Azure AD): MessageReceived, RedirectToIdentityProvider, MessageReceived, SecurityTokenReceived, SecurityTokenValidated, AuthorizationCodeReceived. Is there something specific I should look for in one of these that can further point me to the issue?

Hi Ed,

Did you manage to resolve this issue? Im getting the same error...

Ive been battling various issues getting User authentication via AD on 7.11 for a few days.

I also had the same error in the logs and thanks to this post Ive now got it working.

I was using the default Configuration from UmbracoStandardOwinStartup + SetExternalSignInAutoLinkOptions (to attempt to get the auto linking).

public static void ConfigureBackOfficeAzureActiveDirectoryAuth(this IAppBuilder app,
        string tenant, string clientId, string postLoginRedirectUri, Guid issuerId,
        string caption = "Active Directory", string style = "btn-microsoft", string icon = "fa-windows")
    {
        var authority = string.Format(
            CultureInfo.InvariantCulture, "https://login.windows.net/{0}", tenant);

        var adOptions = new OpenIdConnectAuthenticationOptions
        {
            SignInAsAuthenticationType = Constants.Security.BackOfficeExternalAuthenticationType,
            ClientId = clientId,
            Authority = authority,
        };
        adOptions.SetExternalSignInAutoLinkOptions(new ExternalSignInAutoLinkOptions(autoLinkExternalAccount: true, defaultUserGroups: null));
        adOptions.ForUmbracoBackOffice(style, icon);
        adOptions.Caption = caption;
        //Need to set the auth tyep as the issuer path
        adOptions.AuthenticationType = string.Format( CultureInfo.InvariantCulture, "https://sts.windows.net/{0}/", issuerId);
        app.UseOpenIdConnectAuthentication(adOptions);
    }

I then tried adding the following, which was detailed in this post

RedirectUri = postLoginRedirectUri,
            AuthenticationMode = Microsoft.Owin.Security.AuthenticationMode.Passive,
            Notifications = new OpenIdConnectAuthenticationNotifications .....

and I managed to get to the point of it failing on obtaining the email addr. In another post somewhere on the web, I read that the email was in a prop called 'upn'

var email = context.JwtSecurityToken.Claims.First(x => x.Type == "upn").Value;

So i now have AD auth and auto linking, so thanks for the help - although this does not solve reason behind

Umbraco.Core.Logging.OwinLogger - Event Id: 0, state: The state field is missing or invalid.

is working on a reply...