Is there a way to authenticate users with Azure AD in web applications without relying on sessions?

I was tasked with adding an Azure AD authentication option to an older web application (it runs on .NET 4.7.2) that already authenticates users locally, but I can't figure how to exactly do this... Let me first explain how it authenticates users currently. It's fairly simple:

1. The user enters its user name and password in the login page;

2. The data is passed to an API endpoint which validates it against a database, creates a JWT security token with some claims and stores it as a cookie.

   [AllowAnonymous]
   [HttpPost]
   [Route("login")]
   [ResponseType(typeof(DataItemResponse<UserAuthViewModel>))]
   public IHttpActionResult Login([FromBody]AuthenticateViewModel request)
   {
       var user = _authenticate.Login(request);
       var token = _authenticate.CreateToken(request.Username, request.Password, request.UserDomainName, request.UserRemember);
   
       HttpCookie authCookie = _authenticate.CreateCookie(token, request.UserRemember);
       HttpContext.Current.Response.Cookies.Add(authCookie);
   
       return Ok(new DataItemResponse<UserAuthViewModel>(new UserAuthViewModel(user)));
   }
   

3. All subsequent calls to protected API endpoints are validated by extracting the claims from the token cookie on the System.Net.Http.DelegatingHandler.SendAsync method and validating them. Basically this:

    CookieHeaderValue cookie = request.Headers.GetCookies("Authorization").FirstOrDefault();
    string token = cookie["Authorization"].Value;
    var identity = JwtTokenHelper.ValidateToken(token);
    if (identity != null)
    {
    	if (_authService.ValidateAuth(identity))
    	{
    		Thread.CurrentPrincipal = identity;
    		HttpContext.Current.User = identity;
    		return base.SendAsync(request, cancellationToken);
    	}
    }
   

It works on <sessionState mode="Off"/>.

Now some guys asked us to be able to login using their Azure AD accounts. We can't get rid of the current local authentication, of course, so I was hoping to put a "Login with Microsoft" option that would redirect to that Microsoft login page and then back to our application.

I was taking a look at some examples, like this one, but they all use the Microsoft.Owin lib which does not work on the <sessionState mode="Off"/> (as far as I figured). There's also this example which does things manually in a similar manner to the way it's done in our local authentication, but it's designed for desktop applications...

I've tested a simple example of this using the 4.7.2 framework. I set up OIDC authentication in like this:

web.config:

  <appSettings>
    <add key="ClientId" value="xxxxxxxx" />
    <add key="redirectUri" value="https://localhost:xxxxxx/" />
  </appSettings>
  <system.web>
	<sessionState mode="Off" />
    <compilation debug="true" targetFramework="4.7.2" />
    <httpRuntime targetFramework="4.7.2" />
  </system.web>

Startup.cs:

string clientId = System.Configuration.ConfigurationManager.AppSettings["ClientId"];
string redirectUri = System.Configuration.ConfigurationManager.AppSettings["RedirectUri"];
public void Configuration(IAppBuilder app)
{
    app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);

    app.UseCookieAuthentication(new CookieAuthenticationOptions());
    app.UseOpenIdConnectAuthentication(
    new OpenIdConnectAuthenticationOptions
    {
        // Sets the ClientId, authority, RedirectUri as obtained from web.config
        ClientId = clientId,
        Authority = "https://login.microsoftonline.com/common/v2.0",
        RedirectUri = redirectUri,
        PostLogoutRedirectUri = redirectUri,
        Scope = "openid email profile offline_access User.Read",
        // ResponseType is set to request the code id_token - which contains basic information about the signed-in user
        ResponseType = OpenIdConnectResponseType.CodeIdToken,
        UseTokenLifetime = false,
        TokenValidationParameters = new TokenValidationParameters
        {
            ValidateIssuer = false,
        },
        Notifications = new OpenIdConnectAuthenticationNotifications
        {
            AuthenticationFailed = OnAuthenticationFailed,
            RedirectToIdentityProvider = OnRedirectToIdentityProvider
        }
    }
);
}

OnAuthenticationFailed & OnRedirectToIdentityProvider don't contain references to session, they're just making sure scopes get set correctly and redirecting users to error pages as appropriate.

Login Action Code:

HttpContext.GetOwinContext().Authentication.Challenge(
                    new AuthenticationProperties { RedirectUri = "/" },
                    OpenIdConnectAuthenticationDefaults.AuthenticationType);

And that's enough to get this working with the session switched off.

Alternatively:

If you're absolutely tied to your current method you could try overriding the existing OnAuthorizationCodeReceivedAsync and removing references to the session. My own implementation of this revolves around exchanging the code you get from the notification for an access token for use with MSGraph. Please note the example is separate from the method above. This is simplified example and is probably overkill for your situation:

Notifications = new OpenIdConnectAuthenticationNotifications
{
    AuthorizationCodeReceived = OnAuthorizationCodeReceivedAsync
}

private async Task OnAuthorizationCodeReceivedAsync(AuthorizationCodeReceivedNotification notification)
{    
    notification.HandleCodeRedemption();
    var idClient = ConfidentialClientApplicationBuilder.Create(OpenIDSettings.AppID)
            .WithRedirectUri(OpenIDSettings.RedirectUri)
            .WithClientSecret(OpenIDSettings.AppSecret)
            .Build();
     var result = await idClient.AcquireTokenByAuthorizationCode(
                scopes, notification.Code).ExecuteAsync();
     notification.HandleCodeRedemption(null, result.IdToken);
}