Request.IsAuthenticated is always true in asp.net mvc sso

Important point here is the Windows Authentication section. When you are using Windows Authentication, the web server starts to authenticate the incoming request before passing it to the application.

When the authentication done successfully, web server forward the logged in user information beside the other request payload to application. Finally your application(with the help of owin or whatever) receives the request and sets the User Identity.

With all these in mind, these are why you get IsAuthenticated=true in your application and these all are expected behaviours.

 

You can read more about windows authentication here:

https://learn.microsoft.com/en-us/iis/configuration/system.webserver/security/authentication/windowsauthentication/

The Request.IsAuthenticated property is not directly related to two-factor authentication (2FA) but rather indicates whether the current user is authenticated or not, based on the authentication mechanism used. If Request.IsAuthenticated is returning true, it means that the user has already been authenticated using some method, such as Windows authentication in your case.

Adjust your login process to prompt the user for the two-factor code after successful primary authentication (e.g., Windows authentication). Check the validity of the two-factor code and then set the ClaimsIdentity accordingly.

It's important to note that 2FA is an extra layer of security on top of the primary authentication mechanism (e.g., Windows authentication). You may still see Request.IsAuthenticated as true because Windows authentication has already been successful, and you're implementing 2FA as an additional security step.