Doesn't support matrix urls because semicolons get encoded.

[shonng]

Angular 2 uses matrix urls by default instead of querystrings. Matrix urls use semicolons which are part of the path instead of querystrings.

Example url:
http://localhost:53276/report/balance-sheet-k;locationId=4;year=2017;period=6

Authorization call from OWIN:
https:// login.microsoftonline.com/{guid}/oauth2/authorize?client_id={client id}&response_mode=form_post&response_type=code+id_token&scope=openid+profile&state=OpenIdConnect.AuthenticationProperties%3dt5yyZoleJsYyxRLKoLRd7b9jkuTde73pbhwS0weZ_kxZ7Gnn1owouZBUZ7waDEYjxLxgKetCznfWb-U57ehIKeWlqO_VGIF5QVCgEkqqGl-D9zyWx-w8uomBUeUSvxaVXJTz2Qe8-H-s1N9UOLKEHrflZoIu4NwC-sXmFDWaam5EffkhgjhWcBeU2L5pznLwZTjWhQiWpYlqgO0aq-cpzQ&nonce=636371414679867284.ZDRlNjk5YzUtZWI1MC00NzA1LTk2YzktODIyNGVhNTllOTIzM2Y3NWY5ODUtZjJkNy00NmZlLWFiZTMtYzRjNWI3YjFkNzYz

Redirect url from Microsoft.Owin: http:// localhost:53276/report/balance-sheet-k%3BlocationId%3D4%3Byear%3D2017%3Bperiod%3D6

I think the issue is at
src/Microsoft.Owin.Security.OpenIdConnect/OpenidConnectAuthenticationHandler.cs
line 151 where is calls Uri.EscapeDataString(). Semicolons aren't in the list of unreserved characters so they get encoded.

[Tratcher]

Your example url was for the initial request that was lacking credentials and initiated the login flow? In that case then it looks like the encoding issues happen here where it captures the initial url for later use:

AspNetKatana/src/Microsoft.Owin.Security.OpenIdConnect/OpenidConnectAuthenticationHandler.cs

Line 127 in a4ad9a8

properties.RedirectUri = CurrentUri;

AspNetKatana/src/Microsoft.Owin.Security.OpenIdConnect/OpenidConnectAuthenticationHandler.cs

Line 51 in a4ad9a8

Request.Path +

AspNetKatana/src/Microsoft.Owin/PathString.cs

Line 75 in a4ad9a8

return String.Join("/", _value.Split('/').Select(EscapeDataString));

This has been rewritten for Core and looks more compliant:
https://github.com/aspnet/HttpAbstractions/blob/c0f937239a0a099b73c67c96ab9e1c875952f67f/src/Microsoft.AspNetCore.Http.Abstractions/PathString.cs#L71

That would be a lot of code to copy.

Workaround: Initiate the login from a dedicated endpoint that does not use urls like this.