I’m having an issue getting the login working for our application. I have set it up using this example project listed in your documentation. https://github.com/okta/samples-aspnet/tree/master/self-hosted-login/okta-aspnet-mvc-example
Html for login widget
<!-- Render the login widget here -->
<div id="okta-login-container"></div>
<form id="okta-submit-form" method="POST" action="Login">
@Html.Hidden("sessionToken")
@Html.Hidden("oktaUserId")
@Html.AntiForgeryToken()
</form>
<!-- Script to init the widget -->
<script>
const signIn = new OktaSignIn({
baseUrl: '@ViewBag.OktaOrgUrl'
});
signIn.renderEl({ el: '#okta-login-container' }, (res) => {
$("#sessionToken").val(res.session.token);
$("#oktaUserId").val(res.user.id);
$("#okta-submit-form").submit();
}, (err) => {
console.error(err);
});
</script>
Startup code
public void ConfigureAuth(IAppBuilder app)
{
app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);
app.UseCookieAuthentication(new CookieAuthenticationOptions());
ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12 | SecurityProtocolType.Tls11 | SecurityProtocolType.Tls;
// Enable the application to use a cookie to store information for the signed in user
app.UseOktaMvc(new OktaMvcOptions()
{
OktaDomain = ConfigurationManager.AppSettings["OktaOrgUrl"],
ClientId = ConfigurationManager.AppSettings["OktaClientId"],
ClientSecret = ConfigurationManager.AppSettings["OktaClientSecret"],
RedirectUri = "/authorization-code/callback",
PostLogoutRedirectUri = "/Account/LogOff",
GetClaimsFromUserInfoEndpoint = true,
Scope = new List<string> { "openid", "profile", "email" },
});
}
Login Post Method
[HttpPost]
[ValidateAntiForgeryToken, AllowAnonymous]
public ActionResult Login(FormCollection form)
{
if (!HttpContext.User.Identity.IsAuthenticated)
{
var properties = new AuthenticationProperties();
properties.Dictionary.Add("sessionToken", form.Get("sessionToken"));
properties.RedirectUri = "/Home/Index";
HttpContext.GetOwinContext().Authentication.Challenge(properties,OktaDefaults.MvcAuthenticationType);
// I tried removing this and still same result
return new HttpUnauthorizedResult();
}
return RedirectToAction("Index", "Home");
}
Once the code hits this part in the login post method
HttpContext.GetOwinContext().Authentication.Challenge(properties,OktaDefaults.MvcAuthenticationType);
The owin response goes to 401.
Error response with stack trace
So im not exactly sure where to go from here. Any help would be great and let me know if you need more info and I will try to supply it.
