Hey guys.

i need your help.

We're building a solution that relies on AD FS login for the back office. We got the login working fine locally. But the issue is that after the solution's been running for an hour or so i production, the backoffice login stops working and will just loop the user back to the umbraco login screen with no error. To fix this we restart the app pool, but doing this every hour really sucks.

I noticed that when the login is failing the 302 umbraco cookie that's supposed to contain redirect info like:

"cookies": [
            {
              "name": "UMB_EXTLOGIN",
              "value": "***",
              "path": "/",
              "expires": null,
              "httpOnly": true,
              "secure": true
            }
          ],

And UMB_UCONTEXT and the like is missing it like so:

"cookies":[]

Also it seems like ADFS is authenticating the user as it should, but my guess is since the cookie is missing the umbraco info, that's why the user is just redirected to /umbraco.

I've also reported this on: https://github.com/umbraco/UmbracoIdentityExtensions

But i'm still making this post in case that any of you guys have an idea what to do next?

Here's our ADFS Authentication code if it's of any use. Cheers guys!

public static class AdfsAuthenticationExtensions
    {
        public static void ConfigureBackOfficeAdfsAuthentication(
            this IAppBuilder app,
            string caption = "AD FS",
            string style = "btn-microsoft",
            string icon = "fa-users")
        {
            var adfsFederationServerIdentifier = ConfigurationManager.AppSettings["AdfsFederationServerIdentifier"];
            var adfsMetadataEndpoint = ConfigurationManager.AppSettings["AdfsMetadataEndpoint"];
            var adfsRelyingParty = ConfigurationManager.AppSettings["AdfsRelyingParty"];
            app.SetDefaultSignInAsAuthenticationType(Constants.Security.BackOfficeExternalAuthenticationType);
            var wsFedOptions = new WsFederationAuthenticationOptions
            {
                Wtrealm = adfsRelyingParty,
                MetadataAddress = adfsMetadataEndpoint,
                SignInAsAuthenticationType = Constants.Security.BackOfficeExternalAuthenticationType,
                Wreply = $"{adfsRelyingParty}umbraco",
                Notifications = new WsFederationAuthenticationNotifications
                {
                    SecurityTokenValidated = async context =>
                    {
                        var idClaim = context.AuthenticationTicket.Identity.FindFirst(ClaimTypes.NameIdentifier);
                        var name = context.AuthenticationTicket.Identity.Name;
                        var email = context.AuthenticationTicket.Identity.FindFirstValue(ClaimTypes.Email);
                        try
                        {
                            var userService = ApplicationContext.Current.Services.UserService;
                            var issuer = idClaim.Issuer;
                            var val = idClaim.Value;
                            var userManager = context.OwinContext.GetUserManager<BackOfficeUserManager>();
                            var user = userService.GetByEmail(email);
                            var identity = await userManager.FindByEmailAsync(email);
                            LogHelper.Info(typeof(AdfsAuthenticationExtensions), string.Format("\nADFS USER login : \nID:{0}\nidClaim:{1}\nName:{2}\nEmail:{3}\n", identity.Id , idClaim, name, email));
                        }
                        catch (Exception e)
                        {
                            LogHelper.Info(typeof(AdfsAuthenticationExtensions), string.Format("\n{0}\nCORRUPT ADFS USER : \nName:{1}\nEmail:{2}\n", e.ToString(), name, email));
                        }

                    }
                },
                TokenValidationParameters = new TokenValidationParameters() { ValidAudience = adfsRelyingParty }
            };

            wsFedOptions.ForUmbracoBackOffice(style, icon);
            //important, do this after calling "wsFedOptions.ForUmbracoBackOffice()" since this method 
            // overrides the AuthenticationType property
            wsFedOptions.AuthenticationType = adfsFederationServerIdentifier;
            wsFedOptions.SetExternalSignInAutoLinkOptions(new ExternalSignInAutoLinkOptions(autoLinkExternalAccount: true,defaultUserGroups: new string[] { "Writers" }, defaultCulture: "da-DK"));
            wsFedOptions.Caption = caption;
            app.UseWsFederationAuthentication(wsFedOptions);
        }
    }