title: How can I authenticate against ADFS by passing login info as Request headers?
body: <p>We have a mobile app that wants to access a view on our ASP.NET MVC4 website. In order to do so, the app needs to authenticate by different means than our ADFS login process. The mobile app makes a request to the service and passes in the username and password as Request headers. In the ASP.NET application <code>global.asax</code> file, we have the following:</p>
  
  <pre><code>    protected void Application_AuthenticateRequest(Object sender, EventArgs e)
      {
          string username = HttpContext.Current.Request.Headers[Mobile.Configuration.iPadUsername];
          string password = HttpContext.Current.Request.Headers[Mobile.Configuration.iPadPassword];
          string acctID = HttpContext.Current.Request.Headers[Mobile.Configuration.iPadAcctStr];
  
          //bypass adfs
          if (!string.IsNullOrEmpty(username)
              &amp;&amp; !string.IsNullOrEmpty(password)
              &amp;&amp; !HttpContext.Current.Request.IsAuthenticated)
          {
  
              //web service call to authenticate the user
  
              if (success)
              {
                  var genIden = new GenericIdentity(usrnm);
                  var genClaim = new GenericPrincipal(genIden, new string[] { });
                  HttpContext.Current.User = genClaim;
                  var token = FederatedAuthentication.SessionAuthenticationModule.CreateSessionSecurityToken(genClaim, "test mobile", DateTime.UtcNow, DateTime.UtcNow.AddDays(1), true);
                  FederatedAuthentication.SessionAuthenticationModule.AuthenticateSessionSecurityToken(token, true);
  
  
                  Response.Clear();
  
                  Response.Status = "301 Moved Permanently";
  
                  Response.AddHeader("Location", "/Default/IndexRedirectFromMobile");
  
                  Response.End();
              }
          }
      }
  </code></pre>
  
  <p>What ends up happening is when setting the user to the <code>GeneralPrincipal</code> above, we have <code>HttpContext.Current.Request.IsAuthenticated</code> set to <code>true</code>. However, after we try to redirect the user to the correct landing page, the request is no longer authenticated and they get caught in an infinite loop.</p>
  
  <p>What can we do to prevent this from happening?</p>