How to get Servicestack Authentication to work in an Umbraco installtion - umbraco

Question

I can't get SS authentication to work together with an Umbraco installation. Whenever I access a DTO or service with the Authenticate attribute, I get redirected to an umbraco login.
To reproduce:
I've created a new project, and installed Umbraco from Nuget (tried 4.7.1, 4.8.1 and 4.9.0 with same result), and SS from Nuget. I setup SS to run under the /api path in the web.config:
<location path="api">
<system.web>
<httpHandlers>
<add path="*" type="ServiceStack.WebHost.Endpoints.ServiceStackHttpHandlerFactory, ServiceStack" verb="*" />
</httpHandlers>
</system.web>
<!-- Required for IIS 7.0 -->
<system.webServer>
<modules runAllManagedModulesForAllRequests="true" />
<validation validateIntegratedModeConfiguration="false" />
<handlers>
<add path="*" name="ServiceStack.Factory" type="ServiceStack.WebHost.Endpoints.ServiceStackHttpHandlerFactory, ServiceStack" verb="*" preCondition="integratedMode" resourceType="Unspecified" allowPathInfo="true" />
</handlers>
</system.webServer>
</location>
and added /api to reserved paths to avoid Umbraco handling this:
<add key="umbracoReservedPaths" value="~/umbraco,~/install/,~/api" />
And in the AppHost.cs I've changed the EndpointHostConfig and enabled authentication:
SetConfig(new EndpointHostConfig
{
DebugMode = true, //Show StackTraces when developing
ServiceStackHandlerFactoryPath = "api"
});
//Enable Authentication
ConfigureAuth(container);
And I've changed the connectionstring in ConfigureAuth to use the Umbraco database:
var connectionString = ConfigurationManager.AppSettings["umbracoDbDSN"];
Finally I set the attribute on HelloWorldService:
[Authenticate]
public class HelloService : ServiceBase<Hello>
{
protected override object Run(Hello request)
{
return new HelloResponse { Result = "Hello, " + request.Name };
}
}
I then access the HelloWorldService through REST Uri:
http://localhost:56835/api/hello
and right away I'm redirected to:
http://localhost:56835/apilogin?redirect=http%3a%2f%2flocalhost%3a56835%2fapi%2fhello
and presented with the default Umbraco 404 page, which means that SS suddenly makes Umbraco handle the authentication. If I remove the Authenticate attribute, SS handles the request perfectly.
What am I missing?

Answer 1

It seems that FormsAuthentication is just plain annoying, and when it spots a 401 it changes that to 302 login.aspx.
My solution was use use the idea from this link: http://haacked.com/archive/2011/10/04/prevent-forms-authentication-login-page-redirect-when-you-donrsquot-want.aspx
In short it revert the 401->302 change from FormsAuthentication back to 401.
I changed it a bit in the detection code:
if (response.StatusCode == 401 && request.RawUrl.ToLower().StartsWith("/api"))
and removed the Register and added it manually AFTER the FormsAuthentication module in web.config