Using Resource Owner Flow to issue a cookie - identityserver3

Question

I've read through similar issues, but am not finding my use case. We have an older MVC application using AspNetIdentity Forms Authentication. We are starting to transition parts of the site over to a new system that uses the IdentityServer3 IdP. From a user's prospective they log into the "old" site. Further into the site they may be redirected to the new site. Currently when this happens they have to log in again to the SSO page to get the new SSO cookie. We are trying to alleviate the dual signin.
On the back end the user's accounts are synchronized between the two authentication databases so their usernames and passwords are always in sync. To reduce the dual signin I was attempting to use the Resource Owner flow at the "old" site's signin page so it performs the Forms Auth signin first then uses Resource Owner to pass the credentials over to the IdentityServer for authentication with the new system. I figure if the SSO server auth happens at this time a cookie can be built so later when they navigate to the SSO protected sites they already have a valid cookie. The problem I'm finding is that the Resource Owner method doesn't seem to issue cookies. I created a MVC controller on the IdentityServer hosting website that performs the Resource Owner authentication. I have the "old" site opening a new browser tab to this page so that the HttpGet controller response will return to the browser if the Set-Cookie is issued. The Resource Owner auth works, I get an access token and the userInfo get works as well. I build up the ClaimsIdentity and SignIn using the OWIN authentication manager. The claims principal shows the user is authenticated, but I'm not getting a cookie. Is there a way to make this happen.
In summary, using their plaintext credentials at "old" system signin I want to pre-authenticate them with SSO to get a cookie so later navigation to SSO sites doesn't ask for a login.
Here is the Resource Owner Auth Get controller.
public ActionResult LoginGet(string username, string password) {
try {
username = HttpUtility.UrlDecode(username);
password = HttpUtility.UrlDecode(password);
//create identityserver sso cookie as well
var tokenClient = new TokenClient(
"https://localhost.fiddler:44333/core/connect/token",
"clientId",
"secret"
);
var scopes = "openid profile sampleApi roles";
var token = tokenClient.RequestResourceOwnerPasswordAsync(username, password, scopes).Result;
if (token != null && !String.IsNullOrWhiteSpace(token.AccessToken)) {
var claims = new List<Claim>();
var claimsClient = new UserInfoClient(new Uri("https://localhost.fiddler:44333/core/connect/userinfo"), token.AccessToken);
var userInfo = claimsClient.GetAsync().Result;
userInfo.Claims.ToList().ForEach(t => claims.Add(new Claim(t.Item1, t.Item2)));
claims.Add(new Claim("token", token.AccessToken));
var claimsId = new ClaimsIdentity(claims, "Cookies");
Request.GetOwinContext().Authentication.SignIn(claimsId);
ViewBag.Worked = true;
ClaimsPrincipal cp = Request.GetOwinContext().Authentication.User;
if(cp != null) {
ViewBag.IsAuthed = cp.Identity.IsAuthenticated;
}
return View();
}
} catch (Exception ex) {
return new HttpStatusCodeResult(HttpStatusCode.BadRequest);
}
return View();
}

Answer 1

The call to the token endpoint in a API/backchannel call. For setting an SSO cookie, you must redirect the browser to IdentityServer.
IOW - what you want to do is not possible without a browser redirect.

Answer 2

To reduce the dual signin I was attempting to use the Resource Owner flow at the "old" site's signin page so it performs the Forms Auth signin first then uses Resource Owner to pass the credentials over to the IdentityServer for authentication with the new system. I figure if the SSO server auth happens at this time a cookie can be built so later when they navigate to the SSO protected sites they already have a valid cookie.
You can't access or set cookies for a path(IdentityServer here) from another path even within the same host name (there sure are tricky ways to do that but of course, you'd know what to set, etc). See https://security.stackexchange.com/q/12439
In summary, using their plaintext credentials at "old" system signin I want to pre-authenticate them with SSO to get a cookie so later navigation to SSO sites doesn't ask for a login.
A very simple way to achieve this is to use the authorize endpoint that allows to pass additional authentication related information to the user service.
https://identityserver.github.io/Documentation/docsv2/endpoints/authorization.html. Then, on landing on the IdentityServer's sign in page, you can retrieve the user's identity.
To keep things simple:
From your "old" system, encrypt user's details or provide some form of unique hash
Include hash in authorization endpoint parameters when redirecting to IdentityServer or OWIN middleware
Grab this added parameter (hash) in your Custom UserService and retrieve user details from hash
From within your custom UserService, Populate the signin fields providing a user friendly message to proceed,
-- OR create a custom ViewService submitting the form dynamically
-- OR a custom LoginPage. Check here for samples