Question

I’m using DotNetOpenAuth. I configured my application with Custom form authentication with Gmail OpenID through (DotNetOpenAuth). I can successfully login to my app. But say for eg. i logged out from application and click login (with in 10 to 15 Sec) its not redirecting to gmail login. It generated authentication token by itself without asked from user.(I hope something is cached OpenID)

I used PAPE

  request.AddExtension(new PolicyRequest()
                        {
                            MaximumAuthenticationAge = TimeSpan.Zero
                        });

And also tried to configure in web.config.

<openid cacheDiscovery="false">

Is there any workaround for the same.

NOTE : Once i logged out i used to clear ALL Session and call FormAuthentication.SignOut()

Answer 1

With OpenID, you as the relying party cannot force the login policy for the user at their Provider. You can request that the provider relogin the user as you have with the PAPE extension, but the Provider may still ignore that.

The cacheDiscovery setting is irrelevant to pass-through login, so I suggest you remove that entry as it will simply slow down all logins.

I think you’re mistaken when you say it’s not redirecting to Google. If you look at the logs, or what your browser’s URL bar, Google.com should be redirected to, but at that point Google decides the user has a login session and avoids prompting them to login again, and redirects the user immediately back to your site.