ASP.NET Request Pipeline (OWIN & HttpModules)
Hello,
I'm hoping that someone here can help point me in the right direction. Bit of background, I am tasked with updating our application's authentication to interface with Azure AD, instead of our on-prem Active Directory. After taking a look around, it seems that OpenID Connect is the way to go (Seamless SSO is a requirement). There is a library maintained by Microsoft (Microsoft.Owin.Security.OpenIdConnect) that uses OWIN middleware to handle all the dirty stuff under the hood, but my application is a little too old for OWIN. It is built using a .NET CMS (Web Forms, C#). This framework is using the older HttpModules to authenticate requests; aside from modifying it to authenticate and authorize against our AD, there have been no customization made to their code-base. Completely overhauling the asp.net pipeline to OWIN does not seem feasible at this point. I also don't think it's a good idea to try and write my own library to handle OpenID's protocol. The only HttpModule example I've found does not seem to be actively maintained.
Is it possible to run OWIN middleware alongside existing HttpModules? I am only interested in replacing the authentication portion. Could I simply deregister the HttpModule responsible for authentication in the web.config, and create a Startup class that only registers my OpenID middleware?
What would be your recommendation for integrating OpenID Connect in this scenario?
Thanks in advance.











