Azure authentication redirecting to undesired URL - azure

Question

I'm building an Azure AD authentication, let's say my application url is https://hostname/applicationName/Default.aspx so after hitting this url user is redirected to Azure login.
The issue is that even if an user is not part of the AD group still they are being redirected to the default page of application instead of throwing invalid user message.
Can someone let me know where to look for, below is a snippet of the code I'm using in app startup.cs:
private static string clientId = ConfigurationManager.AppSettings["ClientId"];
private static string aadInstance = EnsureTrailingSlash(ConfigurationManager.AppSettings["Authority"]);
private static string tenantId = ConfigurationManager.AppSettings["Tenant"];
private static string postLogoutRedirectUri = ConfigurationManager.AppSettings["redirectUri"];
string authority = aadInstance + tenantId;
public void Configuration(IAppBuilder app)
{
app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);
app.UseKentorOwinCookieSaver();
app.UseCookieAuthentication(new CookieAuthenticationOptions());
app.UseOpenIdConnectAuthentication(
new OpenIdConnectAuthenticationOptions
{
ClientId = clientId,
Authority = authority,
RedirectUri = postLogoutRedirectUri,
PostLogoutRedirectUri = postLogoutRedirectUri,
Scope = OpenIdConnectScope.OpenIdProfile,
ResponseType = OpenIdConnectResponseType.IdToken,
TokenValidationParameters = new TokenValidationParameters()
{
ValidateIssuer = true
},
Notifications = new OpenIdConnectAuthenticationNotifications
{
AuthenticationFailed = OnAuthenticationFailed
}
}
);
}
The redirectUri in my web.config file is https://hostname/applicationName/Default.aspx
In my home page of the application I've the following code in Page_Load()
if (!Page.IsPostBack)
{
if (!Request.IsAuthenticated)
{
HttpContext.Current.GetOwinContext().Authentication.Challenge(
new AuthenticationProperties { RedirectUri = ConfigurationManager.AppSettings["redirectUri"] },
OpenIdConnectAuthenticationDefaults.AuthenticationType);
// Is this RedirectUri property correct?
}
//Application code
}
I've set the following in startup.cs
TokenValidationParameters = new TokenValidationParameters()
{
ValidateIssuer = true
}
Let me know if any additional data is needed.

Answer 1

According to your description 'if an user is not part of the AD group still they are being redirected to the default page of application', I assumed that you may set the value of 'ConfigurationManager.AppSettings["Tenant"];' as 'common'.
I have tested in my place and when I set the tenant id of my organization, and I can't login in with a outside user. And with the value of 'common' that means any users could access the application so that I can successfully sign in with the user account which can't use to login just now.
Pls let me know if it doesn't work.

Answer 2

You have a couple of options depending on the scenario that you are trying to achieve.
If what you want is users not part of your Azure AD tenant to not be able to log in, then you should ensure the tenant property is not 'common' but your own tenant ID which you can get from Azure portal as below
If what you want to achieve is a more involved process of group-based AuthZ you can refer to this sample from Microsoft for all the details