Session cookies with Identity Server

Configuration

• Version: 0.7.1
• Integration: native, Kotlin
• Identity provider: IdentityServer 4

Description

It appears that cookies are not stored or somehow ignored when trying to “stay logged in” and to recreate a session while using the custom tabs browser.

We are using the grant type code, with the scope “openid profile email api”. For actual authentication through the provided identity server login mask we are using the regular getAuthoriziationRequestIntent method and custom tabs.

    @TargetApi(Build.VERSION_CODES.LOLLIPOP)
    public Intent getAuthorizationRequestIntent(
            @NonNull AuthorizationRequest request) {
        return getAuthorizationRequestIntent(request, createCustomTabsIntentBuilder().build());
    }

However, when returning to the login mask after already logging in successfully, and basically telling identity server to maintain a session, it just does not remember and gives us a new session with new idrsrv.session cookie and .AspNetCore.Identity.Application cookie.

We would expect an immediate redirect. My understanding is, that custom tabs actually do store and use cookies, they even have shared cookie storage with chrome. So my question would be, if there are any known pitfalls or issues, that we might be overseeing, because at this point we are kinda dumbfounded.

[brockallen]

You should really discuss this with IdentityServer developers if you need further help as it’s a topic on how you write and configure your service.

Strictly speaking, it’s the feature of the ASP.NET Core cookie authentication handler, and not specifically IdentityServer.

[agologan]

IsPersistent is IdentityServer-related. Not exactly sure how it looks in IdentityServer 4 but on IdentityServer3 it was directly on the AuthenticationOptions.CookieOptions.IsPersistent You should really discuss this with IdentityServer developers if you need further help as it’s a topic on how you write and configure your service.