title: Authenticating custom Umbraco controller with OWIN/OIDC against Azure AD B2C
body: <p>I am stuck.</p>
  
  <p>I have a custom Umbraco controller which inherits from <code>RenderMvcController</code> and when the <code>Index()</code> action method is hit a file is returned. This works, but what I want to do is to protect it by decorating the action with an <code>AuthorizeAttribute</code> and then requiring the user to authenticate.</p>
  
  <pre><code>namespace MyNamespace.Controllers
  {
      public class MyModelController : RenderMvcController
      {
          [Authorize]
          public ActionResult Index(RenderModel model)
          {
              // ...
          }
      }
  }
  </code></pre>
  
  <p>The authentication is to be made using OWIN and OpenId Connect against an Azure AD B2C app. This also works and is tested, but in a non-Umbraco context.</p>
  
  <p>I have read numerous threads and code relating to the subject, but I am struggling to integrate it within Umbraco. I have a custom startup class which inherits from <code>UmbracoDefaultOwinStartup</code>. I register a custom route to my <code>AuthController</code> and configure OIDC via <code>IAppBuilder.UseOpenIdConnectAuthentication()</code>.</p>
  
  <p>But I need the Umbraco glue and have problems understanding how I should configure the cookies. I have checked that the startup <code>Configuration()</code> method is invoked.</p>
  
  <pre><code>namespace MyNamespace
  {
      public class CustomOwinStartup : UmbracoDefaultOwinStartup
      {
          public override void Configuration(IAppBuilder app)
          {
              base.Configuration(app);
              ConfigureAuth(app);
  
              RouteTable.Routes.MapRoute(
                  "CustomAuth",
                  "CustomAuth/{action}",
                  new { controller = "Auth" }
              );
          }
  
          private void ConfigureAuth(IAppBuilder app)
          {
              app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);
              app.UseCookieAuthentication(new CookieAuthenticationOptions
              {
                  AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
                  LoginPath = new PathString("/CustomAuth/SignUpSignIn") // TODO: What should I put here?
              });
              app.UseExternalSignInCookie(DefaultAuthenticationTypes.ExternalCookie);
              app.UseOpenIdConnectAuthentication(
                  // Passing options that are tested and working
              );
          }
      }
  }
  </code></pre>
  
  <p>And then I have my auth controller which is very simple for the time being. I have no requirement to sync the auth info with Umbraco users.</p>
  
  <pre><code>namespace MyNamespace.Controllers
  {
      public partial class CustomAuthController : Controller
      {
          public CustomAuthController() : base()
          {
          }
  
          public void SignUpSignIn()
          {
              if (!Request.IsAuthenticated)
              {
                  HttpContext.GetOwinContext().Authentication.Challenge();
                  return;
              }
  
              Response.Redirect("/"); // TODO: Maybe this should redirect me back to original route MyModel/Index in some way
          }
      }
  }
  </code></pre>
  
  <p>If I run this and try to via my attribute-decorated custom Umbraco controller I get this error:</p>
  
  <blockquote>
    <p><strong>Page not found</strong></p>
    
    <p>No umbraco document matches the url <code>'/login.aspx?ReturnUrl=MYORIGINALROUTEHTTPENCODED'</code>.
    This page can be replaced with a custom 404. Check the documentation for "custom 404".</p>
  </blockquote>
  
  <p>My guess is that this is because of the <code>&lt;authentication mode="Forms"&gt;</code> setting in <code>Web.config</code>, but if I remove this or set the attribute <code>mode</code> to <code>"None"</code>, will this not impact the back-office login?</p>
  
  <p>Very thankful if anyone can help me point me in the right direction!</p>