Owin security could not handle callback "signin-oidc", Error 404 On Asp.net Mvc!

Hi @Hamed Vaziri ,

Thanks for providing the details.

If you’re seeing a 404 on /signin-oidc after redirecting back from Keycloak, it usually means OWIN isn’t set up to catch that callback. Here’s the exact Configuration method setup that fixed it for me, using ASP.NET MVC (.NET Framework 4.8) with Keycloak and OpenID Connect. It is recommended that you use Authorization Code flow with "Standard Flow" enabled in Keycloak.

Key Points

• Register cookie authentication first.
• Set the default sign-in authentication type with app.SetDefaultSignInAsAuthenticationType("Cookies").
  This is critical, missing this line can cause the callback to fail.
• OpenID Connect must use the correct callback path and redirect URI, and both must match the Keycloak configuration exactly.
• Use debug logging to confirm OWIN sees requests (including /signin-oidc).

Here is my implementation of Configuration part of your code, consider checking it out:

[assembly: OwinStartup(typeof(KeycloakApp.Startup))]
namespace KeycloakApp
{
    public class Startup
    {
        public void Configuration(IAppBuilder app)
        {
            // Optional: log to verify requests hit OWIN (including /signin-oidc)
            app.Use(async (ctx, next) =>
            {
                System.Diagnostics.Debug.WriteLine("OWIN request: " + ctx.Request.Method + " " + ctx.Request.Scheme + "://" + ctx.Request.Host + ctx.Request.PathBase + ctx.Request.Path);
                await next();
            });
 
            ConfigureAuth(app);
        }
 
        public void ConfigureAuth(IAppBuilder app)
        {
            var authority = ConfigurationManager.AppSettings["Keycloak:Authority"];
            var clientId = ConfigurationManager.AppSettings["Keycloak:ClientId"];
            var clientSecret = ConfigurationManager.AppSettings["Keycloak:ClientSecret"];
            var redirectUri = ConfigurationManager.AppSettings["Keycloak:RedirectUri"]; // must match Keycloak
 
            // 1) Cookie auth FIRST
            app.UseCookieAuthentication(new CookieAuthenticationOptions
            {
                AuthenticationType = CookieAuthenticationDefaults.AuthenticationType,
                CookieSecure = CookieSecureOption.Always,
#if NET48
                CookieSameSite = Microsoft.Owin.SameSiteMode.None
#endif
            });
 
            // 2) Default sign-in type
            app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);
 
            // 3) OIDC
            app.UseOpenIdConnectAuthentication(new OpenIdConnectAuthenticationOptions
            {
                AuthenticationType = OpenIdConnectAuthenticationDefaults.AuthenticationType,
 
                Authority = authority,
                ClientId = clientId,
                ClientSecret = clientSecret,
 
                ResponseType = "code",
                Scope = "openid profile email offline_access",
                RequireHttpsMetadata = false,
 
                RedirectUri = redirectUri,
                CallbackPath = new PathString("/signin-oidc"),
 
                SignInAsAuthenticationType = CookieAuthenticationDefaults.AuthenticationType,
                RedeemCode = true,
 
                TokenValidationParameters = new TokenValidationParameters
                {
                    ValidateIssuer = true,
                    ValidIssuer = authority,
                    ValidateAudience = true,
                    ValidAudience = clientId
                },
 
                Notifications = new OpenIdConnectAuthenticationNotifications
                {
                    // Save the id_token when sign-in succeeds
                    SecurityTokenValidated = n =>
                    {
                        if (!string.IsNullOrEmpty(n.ProtocolMessage.IdToken))
                        {
                            n.AuthenticationTicket.Properties.Dictionary["id_token"] = n.ProtocolMessage.IdToken;
                        }
                        return Task.FromResult(0);
                    },
 
                    // Set RedirectUri for login; set IdTokenHint for logout
                    RedirectToIdentityProvider = async n =>
                    {
                        var req = n.Request;
                        var baseUri = req.Scheme + "://" + req.Host + req.PathBase;
 
                        if (n.ProtocolMessage.RequestType == OpenIdConnectRequestType.Authentication)
                        {
                            // Must exactly match Keycloak Valid redirect URIs
                            n.ProtocolMessage.RedirectUri = redirectUri; // baseUri + "/signin-oidc" also ok if that equals redirectUri
                        }
                        else if (n.ProtocolMessage.RequestType == OpenIdConnectRequestType.Logout)
                        {
                            // Read id_token saved in the auth cookie and send as id_token_hint
                            var signInType = n.Options.SignInAsAuthenticationType; // "Cookies"
                            var auth = await n.OwinContext.Authentication.AuthenticateAsync(signInType);
                            if (auth != null && auth.Properties.Dictionary.TryGetValue("id_token", out var idToken) && !string.IsNullOrEmpty(idToken))
                            {
                                n.ProtocolMessage.IdTokenHint = idToken;
                            }
 
                            // Optional: some servers accept client_id as well
                            n.ProtocolMessage.ClientId = clientId;
 
                            // Where to go after logout
                            n.ProtocolMessage.PostLogoutRedirectUri = baseUri + "/";
                        }
                    },
 
                    AuthenticationFailed = n =>
                    {
                        n.HandleResponse();
                        n.Response.Redirect("/Home/Error?message=" + HttpUtility.UrlEncode(n.Exception.Message));
                        return Task.FromResult(0);
                    }
                }
            });
        }
    }
}

Also remember to:

• Check Keycloak’s "Valid Redirect URIs" setting: Must match your app’s RedirectUri (including protocol and port).
• The OWIN pipeline should always see the /signin-oidc request—debug logs can confirm this.

In short. this configuration tells OWIN to handle /signin-oidc internally, so your app won’t generate a 404 after authenticating with Keycloak. If you follow these steps, authentication should flow smoothly.

Let me know if you need more details or run into any other issues!