OpenIdConnect - add extensibility point for custom redirect behavior

[tomasherceg]

We are using OpenIdConnect and we need to customize the redirect behavior. In our scenario, the redirect is a reaction to AJAX request and instead of returning HTTP 302, we need to return HTTP 401 with the Location header specifying the target URL.

We cannot use the OnRedirectToIdentityProvider, becasue it is called too early.
https://github.com/aspnet/Security/blob/dev/src/Microsoft.AspNetCore.Authentication.OpenIdConnect/OpenIdConnectHandler.cs#L343

The redirectContext.ProtocolMessage.State is not set by that time, so when we call ProtocolMessage.CreateAuthenticationRequestUrl(), we get an invalid login URL - it displays the login page, but when we get back, we get the error that the message.State is empty string or null.

Basically we need to add the OnApplyRedirect method which we could call instead of the following code:
https://github.com/aspnet/Security/blob/dev/src/Microsoft.AspNetCore.Authentication.OpenIdConnect/OpenIdConnectHandler.cs#L373

I can make the change and send the PR, but I'd like to discuss the way how to do it. I don't like the OpenIdConnectRedirectBehavior enum because it kills the extensibility. But since it is there and removing it would be a breaking change, we could do this:

1. Add a new member Custom in the OpenIdConnectRedirectBehavior enum.

2. Add an extensibility point in the OpenIdConnectEvents - something like this:

public Func<RedirectContext, Task> OnApplyCustomRedirect { get; set; } = context => TaskCache.CompletedTask;

3. Call this method in all cases where the OpenIdConnectHandler needs to perform the redirect, and when the redirect behavior is set to Custom.

[Tratcher]

You could set the state in OnRedirectToIdentityProvider:

Security/src/Microsoft.AspNetCore.Authentication.OpenIdConnect/OpenIdConnectHandler.cs

Line 365 in 2d7cd60

message.State = Options.StateDataFormat.Protect(properties);

Using JwtBearer would likely be better though.

[tomasherceg]

I know, that's what I did in my application. But I am not a fan of copy pasting pieces of code from library in such cases. The implementation can change any time and the code can stop working.

I think that there should be a simple extensibility point. Additionally, the way how redirects work is different in the Cookie authentication package, which could also be unified.

[Eilon]

Closing because there seems to be little demand for this feature.