To give you an answer, forget the Okta method name, its confusing, UseMVCoptions is just a name, its required to be used in Web forms for example in your flow, When a request hits your server, the processing order is:
Browser request → IIS. → ASP.NET pipeline (OWIN lives here) → Web Forms page handler (.aspx)
The name is misleading but intentional. UseOktaMvc is part of the Okta.AspNet package which targets classic ASP.NET Framework and not ASP.NET Core MVC. It works identically in Web Forms because OWIN sits in the request pipeline before IIS decides whether a request goes to a .aspx handler or anywhere else. Whether your app uses Web Forms or MVC is irrelevant to the OWIN middleware layer.
Code flow path would be something like below.
Microsoft.Owin.Host.SystemWeb triggers Startup discovery on application start. It checks three places in this order:
1. web.config appSetting key owin:appStartup
2. [assembly: OwinStartup(typeof(YourNamespace.Startup))] assembly attribute - (default)
3. A class named exactly Startup with a Configuration(IAppBuilder app) method - (fallback)
The recommended approach is the assembly attribute in your Startup.cs:
[assembly: OwinStartup(typeof(YourApp.Startup))]
namespace YourApp
{
public class Startup
{
public void Configuration(IAppBuilder app)
{
app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);
app.UseCookieAuthentication(new CookieAuthenticationOptions());
app.UseOktaMvc(new OktaMvcOptions()
{
OktaDomain = ConfigurationManager.AppSettings["okta:OktaDomain"],
ClientId = ConfigurationManager.AppSettings["okta:ClientId"],
ClientSecret = ConfigurationManager.AppSettings["okta:ClientSecret"],
RedirectUri = ConfigurationManager.AppSettings["okta:RedirectUri"],
PostLogoutRedirectUri = ConfigurationManager.AppSettings["okta:PostLogoutRedirectUri"],
});
}
}
}
Fix for the 404
How does the above fix the 404?
The 404 is caused by using /signin-oidc as the callback path. That is the ASP.NET Core default and does not apply here. For classic ASP.NET with Okta.AspNet, the callback path is /authorization-code/callback. (based on your code its not changed)
So Update two places:
- web.config:
- Okta Admin Console → Applications → Your App → Sign-in redirect URIs: same URL
Your IIS configuration (runAllManagedModulesForAllRequests=“true” + ExtensionlessUrlHandler) is already correctly set up I think based on what you shared so no changes needed there.
Version note: Okta.AspNet 4.x requires .NET 4.8.1. If you are on .NET 4.8, you will need to either upgrade the framework or use 3.x (which is retired and no longer supported).
Refer the sample I shared if you have any issues setting this up/