title: Cannot Authenticate with Azure AD, losing cookie and redirect is showing no permissions
body: <p>Really having a nightmare with this in all honesty.</p>
  
  <p>I have the repo from <a href="https://github.com/Azure-Samples/active-directory-aspnetcore-webapp-openidconnect-v2/tree/master/1-WebApp-OIDC" rel="nofollow noreferrer">https://github.com/Azure-Samples/active-directory-aspnetcore-webapp-openidconnect-v2/tree/master/1-WebApp-OIDC</a> which should set up Azure AD and Open Id with ASP Core 3.0. </p>
  
  <p>I am using Azure to deploy an application using ASP Core 3.0 MVC.
  I have implemented the above repo into my solution which should take care of everything in startup.cs, my localhost is working absolutely fine.</p>
  
  <p>Start up is the same as the 1-WebApp-OIDC solution (other than logging and DI related registrations).</p>
  
  <p>The app is registered in the Azure portal, the tenant id and client id are fine, correct redirects are in there as well.
  App Service Auth is turned off also (I read this could be an issue as many had solved this by turning it off).
  Also Home, Index controller has [Authorize] attribute on.</p>
  
  <p>Now when it comes to deployment I keep getting;
  You do not have permission to view this directory or page.’
  On my /signin-oidc redirect url.
  <em>Just to note I was getting this message even when not using the openidconnect class library.</em></p>
  
  <p>If I go to <a href="https://mysite.azurewebsites.net/.auth/login/aad/callback" rel="nofollow noreferrer">https://mysite.azurewebsites.net/.auth/login/aad/callback</a> -
  I get 'You have successfully logged in' page, with the 'RETURN TO THE WEBSITE' link.
  Once clicked, back to the same message as above.</p>
  
  <p>I'm also getting a token from <a href="https://mysite.azurewebsites.net/.auth.me" rel="nofollow noreferrer">https://mysite.azurewebsites.net/.auth.me</a> - have read <a href="https://stackoverflow.com/questions/49151961/net-core-app-with-azure-app-service-authentication">.NET Core app with Azure App Service Authentication</a> but he was able to get past the login and just wasn't getting the right claim identities. </p>
  
  <p>Now .. when I check in Azure at the domain's sign ins, it shows as success.
  I then log into Kudu to check the logs (in .../application) with contradictions.</p>
  
  <p>The diagnostics logs say:</p>
  
  <pre><code>2020-02-01 10:32:19.279 +00:00 [Debug] Microsoft.AspNetCore.Routing.EndpointRoutingMiddleware: Request did not match any endpoints
  2020-02-01 10:32:19.279 +00:00 [Debug] Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationHandler: AuthenticationScheme: AzureADCookie was not authenticated.
  </code></pre>
  
  <p>The other set of logs which generate a guid for each session show:</p>
  
  <pre><code>2020-02-01T10:32:01  PID[3780] Verbose     Received request: GET https://mysite.azurewebsites.net/
  2020-02-01T10:32:01  PID[3780] Information Redirecting: https://login.windows.net/89f3808f-0cff-4297-b17a-313007c7b8a6/oauth2/authorize?response_type=id_token&amp;redirect_uri=https%3A%2F%2Fmysite.azurewebsites.net%2F.auth%2Flogin%2Faad%2Fcallback&amp;client_id=f70bd4d6-3cb3-463e-9fca-974053e2f177&amp;scope=openid+profile+email&amp;response_mode=form_post&amp;nonce=6f1c5c8d07f5481193439dd95c3cf03b_20200201103701&amp;state=redir%3D%252F
  2020-02-01T10:32:02  PID[3780] Verbose     Received request: POST https://mysite.azurewebsites.net/.auth/login/aad/callback
  2020-02-01T10:32:02  PID[3780] Verbose     JWT validation succeeded. Subject: 'C6JYPu8NBYT8sC-s6G33w6sxNkct28RdeeyfL1SndjA', Issuer: 'https://sts.windows.net/89f3808f-0cff-4297-b17a-313007c7b8a6/'.
  2020-02-01T10:32:02  PID[3780] Information Login completed for 'DanADLogin@company.com'. Provider: 'aad'.
  2020-02-01T10:32:02  PID[3780] Verbose     Writing 'AppServiceAuthSession' cookie for site 'mysite.azurewebsites.net'. Length: 920.
  2020-02-01T10:32:02  PID[3780] Information Redirecting: https://mysite.azurewebsites.net/
  2020-02-01T10:32:02  PID[3780] Verbose     Received request: GET https://mysite.azurewebsites.net/
  2020-02-01T10:32:02  PID[3780] Verbose     Found 'AppServiceAuthSession' cookie for site 'mysite.azurewebsites.net'. Length: 920.
  2020-02-01T10:32:02  PID[3780] Verbose     Authenticated DanADLogin@company.com successfully using 'Session Cookie' authentication.
  2020-02-01T10:32:19  PID[3780] Verbose     Received request: POST https://mysite.azurewebsites.net/signin-oidc
  2020-02-01T10:32:19  PID[3780] Verbose     Found 'AppServiceAuthSession' cookie for site 'mysite.azurewebsites.net'. Length: 920.
  2020-02-01T10:32:19  PID[3780] Information Sending response: 403.60 Forbidden
  2020-02-01T10:32:19  PID[3780] Warning     Cross-site request forgery detected for user 'DanADLogin@company.com' from referer 'login.microsoftonline.com'!
  2020-02-01T10:32:19  PID[3780] Verbose     Received request: GET https://mysite.azurewebsites.net/favicon.ico
  2020-02-01T10:32:19  PID[3780] Verbose     Found 'AppServiceAuthSession' cookie for site 'mysite.azurewebsites.net'. Length: 920.
  2020-02-01T10:32:19  PID[3780] Verbose     Authenticated DanADLogin@company.com successfully using 'Session Cookie' authentication.
  </code></pre>
  
  <p>Clearly the cookie is being lost somewhere, I've read about a redirect loop that interferes with cookies from core and cookies from open id.
  I’ve exhausted stack overflow and other articles all to no avail.</p>
  
  <p>There is one issue that is very similar but using Google Auth - <a href="https://stackoverflow.com/questions/40413516/requesting-refresh-token-fails-no-refresh-tokens-were-found-in-the-token-store">Requesting refresh token fails.No refresh tokens were found in the token store</a>. This does not work for AAD.</p>
  
  <p>I’m genuinely out of what to do, I have persevered long enough and I think I may go mad if I spend another day on this. I'm sure it cannot be this difficult .</p>
  
  <p>Any help or guidance would be greatly appreciated.</p>