title: How to protect child applications using OWIN and AzureAD and OpenID Connect
body: <p>I have .Net web application (Web Form) which is developed using .Net 4.5.1. Lets call this as "Main" application. In Main application i have implemented Authentication using Azure AD + OWIN + OpenID Connect. The authentication process is working fine so far.</p>
  
  <p>Now i have to authorize the access to resources inside Main application, and as well as authorize access to child applications.</p>
  
  <p>We have 3 other applications (MVC, WCF Services) all developed in 4.5.1. The Main application is hosted in IIS as default web site, and these 3 other applications are added as virtual directory under the main application. So we can access it as   </p>
  
  <pre><code>   www.main.com   
     www.main.com/mvcapp   
     www.main.com/wcfservice1   
     www.main.com/wcfservice2
  </code></pre>
  
  <p>i want to protect child applications from anonymous access. So i added authorize element in Main application's web.config. <strong><em>I am guessing because of inheritance the Authorize tag will apply to child applications as well</em></strong>.
  Here is my complete web.config</p>
  
  <pre><code>&lt;configuration&gt;
    &lt;appSettings&gt;
      &lt;add key="webpages:Version" value="3.0.0.0" /&gt;
      &lt;add key="webpages:Enabled" value="false" /&gt;
      &lt;add key="ClientValidationEnabled" value="true" /&gt;
      &lt;add key="UnobtrusiveJavaScriptEnabled" value="true" /&gt;
      &lt;add key="owin:AutomaticAppStartup" value="true" /&gt;
      &lt;add key="ida:ClientId" value="someclientid" /&gt;
      &lt;add key="ida:Tenant" value="mytenant.onmicrosoft.com" /&gt;
      &lt;add key="ida:AADInstance" value="https://login.microsoftonline.com/{0}" /&gt;
      &lt;add key="ida:PostLogoutRedirectUri" value="http://localhost/Default.aspx" /&gt;
    &lt;/appSettings&gt;
    &lt;system.web&gt;
      &lt;compilation debug="true" targetFramework="4.5.1" /&gt;
      &lt;httpRuntime targetFramework="4.5.1" /&gt;
      &lt;authorization&gt;
        &lt;deny users="?" /&gt;
      &lt;/authorization&gt;
    &lt;/system.web&gt;
    &lt;location path="Default.aspx"&gt;
      &lt;system.web&gt;
        &lt;authorization&gt;
          &lt;allow users="*" /&gt;
        &lt;/authorization&gt;
      &lt;/system.web&gt;
    &lt;/location&gt;
  &lt;/configuration&gt;
  </code></pre>
  
  <p>Note that default.aspx is excluded from authentication. I have OWIN startup class in main application. and Default.aspx redirects user if he is not authenticated.</p>
  
  <pre><code>public class Default : System.Web.UI.Page
  {
      protected void Page_Load(object sender, EventArgs e)
      {
          SignIn();
      }
  
      public void SignIn()
      {
          // Send an OpenID Connect sign-in request.
          if (!System.Web.HttpContext.Current.Request.IsAuthenticated)
          {
              HttpContext.Current.GetOwinContext().Authentication.Challenge(new AuthenticationProperties { RedirectUri = "/" }, OpenIdConnectAuthenticationDefaults.AuthenticationType);
          }
      }
  }
  </code></pre>
  
  <p>with such settings user can access the main application after authentocated however if authenticated user tries to access any child application he gets access denied error. Not sure why authentication ticket is not carried down to child applications.</p>
  
  <p>I do not have any authentication or authorized attribute configured in child application. I do not have any OWIN setup in child applications.</p>