Asp.Net Core 2 with Google Auth & Cookie auth on subdomains - azure-web-app-service

Question

I have 3 web applications on Azure.
Webapp1 is www.mydomain.com
Webapp2 is admin.mydomain.com
Webapp3 is user.mydomain.com
When I log on WebApp1, I want to be logged on all other subdomains.
I want to use social providers to authenticate my users, and use asp.net Identity for authorization.
After reading docs & SO questions here is what I have in my Startup.cs
public void ConfigureServices(IServiceCollection services)
{
/*
* Some code
*/
// Creating a blob storage account to share keys for all applications
var storageAccount = CloudStorageAccount.Parse(configuration.GetConnectionString("IdentityStr"));
CloudBlobClient blobClient = storageAccount.CreateCloudBlobClient();
CloudBlobContainer container = blobClient.GetContainerReference("identity");
AsyncContext.Run(() => container.CreateIfNotExistsAsync());
services.AddDataProtection()
.SetApplicationName("MYAPP")
.PersistKeysToAzureBlobStorage(container, "keys.xml");
/*
* BEGIN DISGUSTING: I recreate the data protection provider here
* because I need the instance of it below for the Cookie options
*/
var serviceCollection = new ServiceCollection();
serviceCollection.AddDataProtection()
.SetApplicationName("MYAPP")
.PersistKeysToAzureBlobStorage(container, "keys.xml");
var service2 = serviceCollection.BuildServiceProvider();
var dataProtector = service2.GetRequiredService<IDataProtectionProvider>();
/*
* END DISGUSTING
*/
services.AddDbContext<AuthDbContext>(options =>
options.UseSqlServer(connectionString));
services.AddIdentity<AuthUser, AuthRole>()
.AddEntityFrameworkStores<AuthDbContext>()
.AddDefaultTokenProviders();
services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
.AddCookie(o =>
{
o.LoginPath = "/account/login";
o.LogoutPath = "/account/logout";
o.Cookie.Domain = "mydomain.com";
o.DataProtectionProvider = dataProtector;
o.TicketDataFormat = new TicketDataFormat(dataProtector.CreateProtector("Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationMiddleware", "Cookies", "v2"));
})
.AddGoogle(o =>
{
o.ClientId = configuration["Authentication:Google:ClientId"];
o.ClientSecret = configuration["Authentication:Google:ClientSecret"];
});
/*
* Some code
*/
}
public void Configure(IApplicationBuilder app, IHostingEnvironment env)
{
/*
* Some code
*/
app.UseAuthentication();
/*
* Some code
*/
}
The cookie is working fine on the Webapp1 but the domain attached is not as the one defined in o.Cookie.Domain but www.mydomain.om
Here is a view of chrome's cookies
And fiddler's view:
I probably missed something...

Answer 1

The identity cookie doesn't have a domain set. You don't need to add Cookie a second time, because Identity already adds it, and you need to configure that instance, not the new one you're creating
So try using ConfigureApplicationCookie
services.AddIdentity<AuthUser, AuthRole>()
.AddEntityFrameworkStores<AuthDbContext>()
.AddDefaultTokenProviders();
services.AddAuthentication()
.AddGoogle(o =>
{
// Google options.
});
services.ConfigureApplicationCookie(options =>
{
// Cookie settings
});