{"action":"created","issue":{"url":"https://api.github.com/repos/NWebsec/NWebsec/issues/65","labels_url":"https://api.github.com/repos/NWebsec/NWebsec/issues/65/labels{/name}","comments_url":"https://api.github.com/repos/NWebsec/NWebsec/issues/65/comments","events_url":"https://api.github.com/repos/NWebsec/NWebsec/issues/65/events","html_url":"https://github.com/NWebsec/NWebsec/issues/65","id":102431683,"number":65,"title":"Session Security Redirect Loop","user":{"login":"jlegan","id":2712321,"avatar_url":"https://avatars.githubusercontent.com/u/2712321?v=3","gravatar_id":"","url":"https://api.github.com/users/jlegan","html_url":"https://github.com/jlegan","followers_url":"https://api.github.com/users/jlegan/followers","following_url":"https://api.github.com/users/jlegan/following{/other_user}","gists_url":"https://api.github.com/users/jlegan/gists{/gist_id}","starred_url":"https://api.github.com/users/jlegan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jlegan/subscriptions","organizations_url":"https://api.github.com/users/jlegan/orgs","repos_url":"https://api.github.com/users/jlegan/repos","events_url":"https://api.github.com/users/jlegan/events{/privacy}","received_events_url":"https://api.github.com/users/jlegan/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":{"login":"klings","id":938299,"avatar_url":"https://avatars.githubusercontent.com/u/938299?v=3","gravatar_id":"","url":"https://api.github.com/users/klings","html_url":"https://github.com/klings","followers_url":"https://api.github.com/users/klings/followers","following_url":"https://api.github.com/users/klings/following{/other_user}","gists_url":"https://api.github.com/users/klings/gists{/gist_id}","starred_url":"https://api.github.com/users/klings/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/klings/subscriptions","organizations_url":"https://api.github.com/users/klings/orgs","repos_url":"https://api.github.com/users/klings/repos","events_url":"https://api.github.com/users/klings/events{/privacy}","received_events_url":"https://api.github.com/users/klings/received_events","type":"User","site_admin":false},"milestone":null,"comments":8,"created_at":"2015-08-21T17:52:28Z","updated_at":"2015-08-27T22:40:08Z","closed_at":null,"body":"Andre,\r\n\r\nI spent some time with Troy Hunt's latest Pluralsight video the other day and came across your project for the first time. I had been implementing most of this functionality myself but your project was a huge win in terms of portability and thoroughness of implementation so thank you very much.\r\n\r\nNow onto what I am seeing. I had everything implemented in NWebSec with the exception of SessionSecurity and everything was working as expected. While I know this is not a defect in your code it appears to be an interoperability issue between my IdP (Thinktecture's IdentityServer 3) and the massaging that SessionSecurity is performing on the identity. Without SessionSecurity in the web.config I get redirected to my IdP, authenticate and can login without incident. When I say without it in the web.config I mean entirely. Simply setting enabled=\"false\" does not allow me to login.\r\n\r\nI can walk the AuthorizationCodeReceived notification of the OpenId event and see that the AuthenticationTicket is written out correctly. I then receive a RedirectToIdentityProvider event as something is invalidating the User and I suspect it is in the massaging of SessionSecurity. \r\n\r\nAre there any known defects or \"gotchas\" when using OIDC, how the authentication tickets are written, etc... that would allow me to move past this?\r\n\r\nThanks,\r\n\r\nJim"},"comment":{"url":"https://api.github.com/repos/NWebsec/NWebsec/issues/comments/135575333","html_url":"https://github.com/NWebsec/NWebsec/issues/65#issuecomment-135575333","issue_url":"https://api.github.com/repos/NWebsec/NWebsec/issues/65","id":135575333,"user":{"login":"klings","id":938299,"avatar_url":"https://avatars.githubusercontent.com/u/938299?v=3","gravatar_id":"","url":"https://api.github.com/users/klings","html_url":"https://github.com/klings","followers_url":"https://api.github.com/users/klings/followers","following_url":"https://api.github.com/users/klings/following{/other_user}","gists_url":"https://api.github.com/users/klings/gists{/gist_id}","starred_url":"https://api.github.com/users/klings/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/klings/subscriptions","organizations_url":"https://api.github.com/users/klings/orgs","repos_url":"https://api.github.com/users/klings/repos","events_url":"https://api.github.com/users/klings/events{/privacy}","received_events_url":"https://api.github.com/users/klings/received_events","type":"User","site_admin":false},"created_at":"2015-08-27T22:40:08Z","updated_at":"2015-08-27T22:40:08Z","body":"Hmm, that smells like an ASP.NET/Katana bug. Thanks for investigating!"}}