title: AddOpenIdConnect with Azure AD V2
body: <p>Having some issues with AddOpenIdConnect in net core 2.0 and Azure AD (V2). After challenging, entering credentials in Azure AD and being returned back to my application the authenticationhandler seems to redirect me to the original method that initiated the challenge rather than the defined callback method.
  However, the httpcontext.user is populated with a claims identity with the correct claims on it.</p>
  
  <p>Code is simplified for the purpose of this post.</p>
  
  <p>Startup looks like:</p>
  
  <pre><code>            services.AddAuthentication(o =&gt;
              {
                  o.DefaultChallengeScheme = "aad";
                  o.DefaultSignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;
                  o.DefaultAuthenticateScheme = CookieAuthenticationDefaults.AuthenticationScheme;
              })
              .AddJwtBearer(JwtBearerDefaults.AuthenticationScheme, o =&gt;
              {
                  if (!Environment.IsProduction())
                  {
                      o.RequireHttpsMetadata = false;
                  }
                  o.Authority = Configuration.GetValue&lt;string&gt;("Authentication:Authority");
                  o.Audience = Constants.Audiences.Self;
                  o.TokenValidationParameters = new TokenValidationParameters
                  {
                      NameClaimType = OpenIdConnectConstants.Claims.Subject,
                      RoleClaimType = OpenIdConnectConstants.Claims.Role,
                      IssuerSigningKey =
                          new X509SecurityKey(
                              GetSigningCertificate(Configuration.GetValue&lt;string&gt;("Certificates:Signing")))
                  };
              })
              .AddCookie()
              .AddOpenIdConnect("aad", o =&gt;
              {
                  if (!Environment.IsProduction())
                  {
                      o.RequireHttpsMetadata = false;
                  }
                  o.Authority = "https://login.microsoftonline.com/{tenantID}/v2.0";
                  o.AuthenticationMethod = OpenIdConnectRedirectBehavior.RedirectGet;
                  o.ClientId = "[clientid]";
                  o.ClientSecret = "[clientsecret]";
                  o.ResponseMode = "form_post";
                  o.ResponseType = "id_token";
                  o.CallbackPath = new PathString("/api/connect/microsoftcallback2");
                  o.TokenValidationParameters = new TokenValidationParameters
                  {
                      ValidIssuer = "https://login.microsoftonline.com/{tenantID}/v2.0"
                  };
              });
  </code></pre>
  
  <p>Challenge:</p>
  
  <pre><code>    [AllowAnonymous]
      [HttpGet("authorize", Name = "authorize")]
      public async Task&lt;IActionResult&gt; ChallengeTemp()
      {
          return Challenge("aad");
      }
  </code></pre>
  
  <p>Trace log:</p>
  
  <blockquote>
    <p>Microsoft.AspNetCore.Hosting.Internal.WebHost:Information: Request starting HTTP/1.1 POST <a href="https://localhost:44301/api/connect/microsoftcallback2" rel="noreferrer">https://localhost:44301/api/connect/microsoftcallback2</a> application/x-www-form-urlencoded 1771
    Microsoft.AspNetCore.Hosting.Internal.WebHost:Information: Request starting HTTP/1.1 POST <a href="https://localhost:44301/api/connect/microsoftcallback2" rel="noreferrer">https://localhost:44301/api/connect/microsoftcallback2</a> application/x-www-form-urlencoded 1771
    Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler:Trace: Entering Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler's HandleRemoteAuthenticateAsync.
    Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler:Trace: Entering Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler's HandleRemoteAuthenticateAsync.
    Microsoft.AspNetCore.Server.Kestrel:Debug: Connection id "0HLC9LOBLM019", Request id "0HLC9LOBLM019:00000004": started reading request body.
    Microsoft.AspNetCore.Server.Kestrel:Debug: Connection id "0HLC9LOBLM019", Request id "0HLC9LOBLM019:00000004": started reading request body.
    Microsoft.AspNetCore.Server.Kestrel:Debug: Connection id "0HLC9LOBLM019", Request id "0HLC9LOBLM019:00000004": done reading request body.
    Microsoft.AspNetCore.Server.Kestrel:Debug: Connection id "0HLC9LOBLM019", Request id "0HLC9LOBLM019:00000004": done reading request body.
    Microsoft.AspNetCore.DataProtection.KeyManagement.KeyRingBasedDataProtector:Trace: Performing unprotect operation to key {keyremoved} with purposes ('workspace', 'Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler', 'aad', 'v1').
    Microsoft.AspNetCore.DataProtection.KeyManagement.KeyRingBasedDataProtector:Trace: Performing unprotect operation to key {keyremoved} with purposes ('workspace', 'Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler', 'aad', 'v1').
    Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler:Trace: MessageReceived: '?id_token={keyremoved}'.
    Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler:Trace: MessageReceived: '?id_token={keyremoved}'.
    Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler:Debug: Updating configuration
    Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler:Debug: Updating configuration
    Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler:Debug: Received 'id_token'
    Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler:Debug: Received 'id_token'
    Microsoft.AspNetCore.DataProtection.KeyManagement.KeyRingBasedDataProtector:Trace: Performing unprotect operation to key {keyremoved} with purposes ('workspace', 'Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler', 'System.String', 'aad', 'v1').
    Microsoft.AspNetCore.DataProtection.KeyManagement.KeyRingBasedDataProtector:Trace: Performing unprotect operation to key {keyremoved} with purposes ('workspace', 'Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler', 'System.String', 'aad', 'v1').
    Microsoft.AspNetCore.DataProtection.KeyManagement.KeyRingBasedDataProtector:Trace: Performing protect operation to key {keyremoved} with purposes ('workspace', 'Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationMiddleware', 'Cookies', 'v2').
    Microsoft.AspNetCore.DataProtection.KeyManagement.KeyRingBasedDataProtector:Trace: Performing protect operation to key {keyremoved} with purposes ('workspace', 'Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationMiddleware', 'Cookies', 'v2').
    Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationHandler:Information: AuthenticationScheme: Cookies signed in.
    Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationHandler:Information: AuthenticationScheme: Cookies signed in.
    Microsoft.AspNetCore.Server.Kestrel:Debug: Connection id "0HLC9LOBLM019" completed keep alive response.
    Microsoft.AspNetCore.Server.Kestrel:Debug: Connection id "0HLC9LOBLM019" completed keep alive response.
    Microsoft.AspNetCore.Hosting.Internal.WebHost:Information: Request finished in 129.6921ms 302 
    Microsoft.AspNetCore.Hosting.Internal.WebHost:Information: Request finished in 129.6921ms 302 
    Microsoft.AspNetCore.Hosting.Internal.WebHost:Information: Request starting HTTP/1.1 GET <a href="https://localhost:44301/api/connect/authorize" rel="noreferrer">https://localhost:44301/api/connect/authorize</a><br>
    Microsoft.AspNetCore.Hosting.Internal.WebHost:Information: Request starting HTTP/1.1 GET <a href="https://localhost:44301/api/connect/authorize" rel="noreferrer">https://localhost:44301/api/connect/authorize</a><br>
    Microsoft.AspNetCore.DataProtection.KeyManagement.KeyRingBasedDataProtector:Trace: Performing unprotect operation to key {keyremoved} with purposes ('workspace', 'Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationMiddleware', 'Cookies', 'v2').
    Microsoft.AspNetCore.DataProtection.KeyManagement.KeyRingBasedDataProtector:Trace: Performing unprotect operation to key {keyremoved} with purposes ('workspace', 'Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationMiddleware', 'Cookies', 'v2').
    Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationHandler:Information: AuthenticationScheme: Cookies was successfully authenticated.
    Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationHandler:Information: AuthenticationScheme: Cookies was successfully authenticated.
    Microsoft.AspNetCore.Routing.Tree.TreeRouter:Debug: Request successfully matched the route with name 'authorize' and template 'api/connect/authorize'.
    Microsoft.AspNetCore.Routing.Tree.TreeRouter:Debug: Request successfully matched the route with name 'authorize' and template 'api/connect/authorize'.</p>
  </blockquote>