title: How to protect all contents(.aspx,.asp,.js and img ,etc) of an asp.net web site if we use Azure AD authentication?
body: <pre><code> &lt;authorization&gt;
    &lt;deny users=&quot;?&quot;/&gt;
    &lt;allow users=&quot;*&quot;/&gt;
  &lt;/authorization&gt;
  &lt;authentication mode=&quot;None&quot;&gt;
    &lt;forms loginUrl=&quot;~/login.aspx&quot; timeout=&quot;2880&quot;/&gt;
  &lt;/authentication&gt;
  </code></pre>
  <p>This configuration doesn't even taking me login screen.</p>
  <p><a href="https://i.stack.imgur.com/JsfYX.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/JsfYX.png" alt="enter image description here" /></a></p>
  <p>My startup.cs has configuration for Azure AD. but where exactly/what code to be made for protecting all contents(.aspx,.asp,.js and .img)</p>
  <pre><code> app.SetDefaultSignInAsAuthenticationType(OpenIdConnectAuthenticationDefaults.AuthenticationType);
          app.UseCookieAuthentication(new CookieAuthenticationOptions());
          app.UseOpenIdConnectAuthentication(
              new OpenIdConnectAuthenticationOptions
              {
                  Authority = authority,
                  ClientId = clientId,
                  ClientSecret= clientsecret,
                  RedirectUri = redirectUri,
                  PostLogoutRedirectUri = redirectUri,
                  Scope = $&quot;openid&quot;,
                  TokenValidationParameters = new TokenValidationParameters()
                  {
                      NameClaimType = &quot;preferred_username&quot;,
                      ValidateIssuer = true,
                      ValidIssuer = tenant
                  },
                  Notifications = new OpenIdConnectAuthenticationNotifications
                  {
                      RedirectToIdentityProvider = OnRedirectToIdentityProvider,
                      AuthorizationCodeReceived = OnAuthorizationCodeReceived,
                      AuthenticationFailed = OnAuthenticationFailed
                  }
              }
          ); 
  
   private Task OnRedirectToIdentityProvider(RedirectToIdentityProviderNotification&lt;OpenIdConnectMessage, OpenIdConnectAuthenticationOptions&gt; notification)
      {
          var policy = notification.OwinContext.Get&lt;string&gt;(&quot;Policy&quot;);
  
          if (!string.IsNullOrEmpty(policy) &amp;&amp; !policy.Equals(DefaultPolicy))
          {
              notification.ProtocolMessage.Scope = OpenIdConnectScope.OpenId;
              notification.ProtocolMessage.ResponseType = OpenIdConnectResponseType.IdToken;
              notification.ProtocolMessage.IssuerAddress = notification.ProtocolMessage.IssuerAddress.ToLower().Replace(DefaultPolicy.ToLower(), policy.ToLower());
          }
  
          return Task.FromResult(0);
      }
      private Task OnAuthenticationFailed(AuthenticationFailedNotification&lt;OpenIdConnectMessage, OpenIdConnectAuthenticationOptions&gt; context)
      {
          context.HandleResponse();
          context.Response.Redirect(&quot;/?errormessage=&quot; + context.Exception.Message);
          return Task.FromResult(0);
      }
      private async Task OnAuthorizationCodeReceived(AuthorizationCodeReceivedNotification notification)
      {
          try
          {                
              IConfidentialClientApplication confidentialClient = MsalAppBuilder.BuildConfidentialClientApplication(new ClaimsPrincipal(notification.AuthenticationTicket.Identity));
  
              // Upon successful sign in, get &amp; cache a token using MSAL
              AuthenticationResult result = await confidentialClient.AcquireTokenByAuthorizationCode(Scopes, notification.Code).ExecuteAsync();
  
              string username = notification.AuthenticationTicket.Identity.FindFirst(&quot;preferred_username&quot;).Value;
              FormsAuthenticationTicket authTicket = new FormsAuthenticationTicket(1, username, DateTime.Now, DateTime.Now.AddMinutes(60), true, &quot;&quot;);
              string encryptedTicket = FormsAuthentication.Encrypt(authTicket);
              notification.Response.Cookies.Append(FormsAuthentication.FormsCookieName, encryptedTicket);
          }
          catch (Exception ex)
          {
              throw new HttpResponseException(new HttpResponseMessage
              {
                  StatusCode = HttpStatusCode.BadRequest,
                  ReasonPhrase = $&quot;Unable to get authorization code {ex.Message}.&quot;
              });
          }
      }
  
  &lt;authentication mode=&quot;Forms&quot;&gt;
    &lt;forms loginUrl=&quot;~/login.aspx&quot; timeout=&quot;2880&quot;/&gt;
  &lt;/authentication&gt;
  </code></pre>
  <p>This config lets me to go login page. but even after Azure authentication , it doesn't that realize user is authenticated and not landing to default.aspx , instead it goes back login screen again. Please help.</p>