Endpoints 404 with Asp.net MVC 5

I’m trying to get OpenIddict running with Asp.Net 4.8 and MVC 5.

I first followed the OWIN example at https://kevinchalet.com/2020/03/03/adding-openiddict-3-0-to-an-owin-application/. I am using the the recommended AutoFac registration method.

I was able to get this working properly. The tutorial says that the same should apply for other hosts, including System.Web.

However, I cannot get through to the token endpoint (or authorization endpoint if I try to add that). It always returns a 404.
So far I’ve tried

• Ignoring the endpoint routes in the MVC route config
• Adding Autofac.Mvc5 and Autofac.Mvc5.Owin
  • adding calls to app.UseAutofacMvc(); DependencyResolver.SetResolver(new AutofacDependencyResolver(container)); and builder.RegisterControllers(typeof(MvcApplication).Assembly);
• Adding a test route app.Map('/test', b => b.Run(ctx => ctx.Response.WriteAsync("hello"));
  • This also cannot be reached

My suspicion is that this is a routing issue, but I just can’t seem to find the right lead to figure it out.

Are there any special requirements for using OpenIddict with MVC 5?

[farlee2121]

Good point. I was working in a new MVC 5 project straight from the template, but I forgot to change the identity option from ‘none’ to individual accounts.

This means that the project doesn’t come with Microsoft.Owin.Host.SystemWeb out of the box. It also doesn’t install that library when you install the other requisite Owin packages or if you choose to add an Owin startup file through the ‘add new’ menu.

Installing Microsoft.Owin.Host.SystemWeb fixed the issue

[farlee2121]

Ah. I figured it should be possible to get the Authentication context off of the event context. I first looked for it on Principle, got as far as context.Transaction.GetOwinRequest(), and got tripped up at Context. This is definitely a nicer solution.

HandleResponse() does work. I just misinterpreted the description thinking that it would prevent my login flow from taking over. It doesn’t because the challenge writes a response rather than some internal call or middleware.

I was trying to avoid the pass through option, since I’m working with two company-owned sites that will always have an implicit grant. It’s good to see that option laid out clearly out though.