title: Use Azure AD only for Authentication and not Authorization
body: <p>I've been messing with this for a few days now...</p>
  
  <p>What I would like to do is Authenticate users with Azure AD, and when successful, automatically log them in using ASP.NET Identity for authorization. If they do not have an account I would like to create one automatically.</p>
  
  <p>Essentially Azure AD is just confirming that they are a part of the organization, the ASP.NET Identity portion is it's own database where I can use the <code>[Authorize]</code> attribute to set up custom roles OUTSIDE of Azure AD.</p>
  
  <p>This is my <code>ConfigureAuth()</code> method:</p>
  
  <pre><code>public void ConfigureAuth(IAppBuilder app)
      {
          // Configure the db context, user manager and signin manager to use a single instance per request
          app.CreatePerOwinContext(IntranetApplicationDbContext.Create);
          app.CreatePerOwinContext&lt;ApplicationUserManager&gt;(ApplicationUserManager.Create);
          app.CreatePerOwinContext&lt;ApplicationSignInManager&gt;(ApplicationSignInManager.Create);
  
          app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);
  
          app.UseCookieAuthentication(new CookieAuthenticationOptions());
  
          app.UseOpenIdConnectAuthentication(
              new OpenIdConnectAuthenticationOptions
              {
                  ClientId = SettingsHelper.ClientId,
                  Authority = SettingsHelper.Authority,
  
                  Notifications = new OpenIdConnectAuthenticationNotifications()
                  {
                      // If there is a code in the OpenID Connect response, redeem it for an access token and refresh token, and store those away.
                      AuthorizationCodeReceived = (context) =&gt;
                      {
                          var code = context.Code;
                          ClientCredential credential = new ClientCredential(SettingsHelper.ClientId, SettingsHelper.AppKey);
                          String signInUserId = context.AuthenticationTicket.Identity.FindFirst(ClaimTypes.NameIdentifier).Value;
  
                          AuthenticationContext authContext = new AuthenticationContext(SettingsHelper.Authority, new ADALTokenCache(signInUserId));
                          AuthenticationResult result = authContext.AcquireTokenByAuthorizationCode(code, new Uri(HttpContext.Current.Request.Url.GetLeftPart(UriPartial.Path)), credential, SettingsHelper.AADGraphResourceId);
  
                          return Task.FromResult(0);
                      },
                      RedirectToIdentityProvider = (context) =&gt;
                      {
                          // This ensures that the address used for sign in and sign out is picked up dynamically from the request
                          // this allows you to deploy your app (to Azure Web Sites, for example)without having to change settings
                          // Remember that the base URL of the address used here must be provisioned in Azure AD beforehand.
                          string appBaseUrl = context.Request.Scheme + "://" + context.Request.Host + context.Request.PathBase;
                          context.ProtocolMessage.RedirectUri = appBaseUrl + "/";
                          context.ProtocolMessage.PostLogoutRedirectUri = appBaseUrl;
  
                          return Task.FromResult(0);
                      },
                      AuthenticationFailed = (context) =&gt;
                      {
                          // Suppress the exception if you don't want to see the error
                          context.HandleResponse();
                          return Task.FromResult(0);
                      }
                  }
  
              });
  
          // Enable the application to use a cookie to store information for the signed in user
          // and to use a cookie to temporarily store information about a user logging in with a third party login provider
          // Configure the sign in cookie
          app.UseCookieAuthentication(new CookieAuthenticationOptions
          {
              AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
              LoginPath = new PathString("/Account/Login"),
              Provider = new CookieAuthenticationProvider
              {
                  // Enables the application to validate the security stamp when the user logs in.
                  // This is a security feature which is used when you change a password or add an external login to your account.  
                  OnValidateIdentity = SecurityStampValidator.OnValidateIdentity&lt;ApplicationUserManager, ApplicationUser&gt;(
                      validateInterval: TimeSpan.FromMinutes(30),
                      regenerateIdentity: (manager, user) =&gt; user.GenerateUserIdentityAsync(manager))
              },
          });
      }
  </code></pre>
  
  <p>Right now the ASP.NET Identity is taking over when I do a <code>HttpContext.Request.IsAuthenticated</code> which is okay, <strong>I just need a way to check if the OpenID portion is authenticated</strong> or not so I can put in my custom logic to automatically sign the user in.</p>