Set Expires or Max-Age for .AspNet.Cookies with Owin OpenIdConnect Middleware

Question

I am running this sample to create multitenant web app that connects using AzureAD with Owin OpenIDConnect middleware. The issued .AspNet.Cookies to authenticate between "my client" and "my server" is always a Session cookie. I would like to set it a Max-Age or an expiration date instead. I have tried several correction without success, for example, I tried to change the the ExpireTimeSpan (see code below) but in my browser cookie inspector I still see Expiration/ Max-Age: Session.

Also, why the SignOut method uses openidconnect and cookies for authentication types while the SignIn method only openidconnect?

AccountController

public void SignIn()
{
    HttpContext.GetOwinContext()
        .Authentication.Challenge(new AuthenticationProperties {RedirectUri = SettingsHelper.LoginRedirectRelativeUri},
            OpenIdConnectAuthenticationDefaults.AuthenticationType);

}
public void SignOut()
{
    HttpContext.GetOwinContext().Authentication.SignOut(
        new AuthenticationProperties { RedirectUri = SettingsHelper.LogoutRedirectRelativeUri,  },
        OpenIdConnectAuthenticationDefaults.AuthenticationType, CookieAuthenticationDefaults.AuthenticationType);
}

And in Start.Auth.cs

public void ConfigureAuth(IAppBuilder app)
{
    app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);

    app.UseCookieAuthentication(new CookieAuthenticationOptions()
    {
        ExpireTimeSpan = TimeSpan.FromHours(1),

    });

    app.UseOpenIdConnectAuthentication(
        new OpenIdConnectAuthenticationOptions
        {
            AuthenticationType = OpenIdConnectAuthenticationDefaults.AuthenticationType,
            ClientId = SettingsHelper.ClientId,
            Authority = SettingsHelper.Authority,

            TokenValidationParameters = new System.IdentityModel.Tokens.TokenValidationParameters
            {
                  ValidateIssuer = false
            },

            Notifications = new OpenIdConnectAuthenticationNotifications()
            {
                // If there is a code in the OpenID Connect response, redeem it for an access token and refresh token, and store those away. 
                AuthorizationCodeReceived = (context) =>
                {
                    var code = context.Code;

                    ClientCredential credential = new ClientCredential(SettingsHelper.ClientId, SettingsHelper.AppKey);
                    string tenantID = context.AuthenticationTicket.Identity.FindFirst("http://schemas.microsoft.com/identity/claims/tenantid").Value;
                    string signInUserId = context.AuthenticationTicket.Identity.FindFirst(ClaimTypes.NameIdentifier).Value;

                    AuthenticationContext authContext = new AuthenticationContext(string.Format("{0}/{1}", SettingsHelper.AuthorizationUri, tenantID), new ADALTokenCache(signInUserId));
                    AuthenticationResult result = authContext.AcquireTokenByAuthorizationCode(code, new Uri(HttpContext.Current.Request.Url.GetLeftPart(UriPartial.Path)), credential, SettingsHelper.AADGraphResourceId);

                    return Task.FromResult(0);
                },

                RedirectToIdentityProvider = (context) =>
                {
                    string appBaseUrl = context.Request.Scheme + "://" + context.Request.Host + context.Request.PathBase;
                    context.ProtocolMessage.RedirectUri = appBaseUrl + SettingsHelper.LoginRedirectRelativeUri;
                    context.ProtocolMessage.PostLogoutRedirectUri = appBaseUrl + SettingsHelper.LogoutRedirectRelativeUri;

                    return Task.FromResult(0);
                },

                AuthenticationFailed = (context) =>
                {
                    context.HandleResponse();
                    return Task.FromResult(0);
                }
            }
        });
}

Alluvion

Answer 1

app.UseCookieAuthentication(new CookieAuthenticationOptions()
{
    ExpireTimeSpan = TimeSpan.FromHours(1),

    Provider = new CookieAuthenticationProvider
    {
        OnResponseSignIn = c =>
        {
            // prevent cookie expiration from being set to "Session"
            c.Properties.IsPersistent = true;
        }
    }
});

Confine