From e88ffd669325cad3c53b10b6ef71451191ea6998 Mon Sep 17 00:00:00 2001
From: Chris Jacobsen <jacobsen9026@gmail.com>
Date: Sun, 31 Mar 2024 20:54:27 -0400
Subject: [PATCH 1/2] Duo partially working

---
 BLAZAM/BLAZAM.csproj                          |  2 +-
 BLAZAM/Pages/Login.razor                      | 23 +++++++--
 BLAZAM/Pages/MFACallback.cshtml               |  7 +++
 BLAZAM/Pages/MFACallback.cshtml.cs            | 13 +++++
 BLAZAM/Program.cs                             |  2 +-
 BLAZAM/ProgramEvents.cs                       |  3 ++
 BLAZAM/ProgramHelpers.cs                      |  7 +++
 BLAZAM/wwwroot/js/blazam.js                   | 13 +++--
 BLAZAMCommon/AppEvent.cs                      |  1 +
 BLAZAMCommon/Data/LoginRequest.cs             |  1 +
 BLAZAMGui/UI/Outputs/StatusCheck.razor        | 29 +++++++----
 .../UI/Settings/AuthenticationSetting.razor   | 14 +++---
 .../AppAuthenticationStateProvider.cs         | 49 ++++++++++++-------
 BLAZAMServices/Duo/DuoClientProvider.cs       |  2 +-
 BLAZAMServices/ServiceEvents.cs               | 18 +++++++
 BLAZAMSession/ApplicationUserState.cs         |  3 ++
 .../Interfaces/IApplicationUserState.cs       |  4 +-
 .../IApplicationUserStateService.cs           |  1 +
 18 files changed, 146 insertions(+), 46 deletions(-)
 create mode 100644 BLAZAM/Pages/MFACallback.cshtml
 create mode 100644 BLAZAM/Pages/MFACallback.cshtml.cs
 create mode 100644 BLAZAMServices/ServiceEvents.cs

diff --git a/BLAZAM/BLAZAM.csproj b/BLAZAM/BLAZAM.csproj
index 6d1f5171..99ff5003 100644
--- a/BLAZAM/BLAZAM.csproj
+++ b/BLAZAM/BLAZAM.csproj
@@ -6,7 +6,7 @@
 		<ImplicitUsings>enable</ImplicitUsings>
 		<ServerGarbageCollection>false</ServerGarbageCollection>
 		<AssemblyVersion>0.9.0</AssemblyVersion>
-		<Version>2024.03.30.1734</Version>
+		<Version>2024.04.01.0037</Version>
 		<IncludeSourceRevisionInInformationalVersion>false</IncludeSourceRevisionInInformationalVersion>
 		<RootNamespace>BLAZAM</RootNamespace>
 		<GenerateDocumentationFile>False</GenerateDocumentationFile>
diff --git a/BLAZAM/Pages/Login.razor b/BLAZAM/Pages/Login.razor
index dfe5e21d..9c531b6f 100644
--- a/BLAZAM/Pages/Login.razor
+++ b/BLAZAM/Pages/Login.razor
@@ -1,6 +1,6 @@
 @page "/login"
 @using BLAZAM.Static;
-
+@inject IHttpContextAccessor HttpContextAccessor
 @inherits ValidatedForm
 @inject IJSRuntime JSRuntime
 @layout LoginLayout
@@ -96,7 +96,11 @@
 
     </MudElement>
 </MudContainer>
-
+<AppModal @ref=_mfaModal Title="MFA" Options="new(){ MaxWidth=MaxWidth.Large, FullWidth=true}">
+    <ChildContent>
+        <iframe class="w-100" style="height:70vh" src="@_modalUri"></iframe>
+    </ChildContent>
+</AppModal>
 <style>
     .brand-icon {
         position: fixed;
@@ -119,19 +123,28 @@
 @code {
     MudTextField<string>? _usernameTextField;
     MudTextField<string>? _passwordTextField;
-
+    string? _modalUri;
     bool attemptingSignIn = false;
     string redirectUrl;
-
+    AppModal? _mfaModal;
     bool DemoCustomLogin = false;
     LoginRequest LoginRequest = new();
     protected override async Task OnInitializedAsync()
     {
         await base.OnInitializedAsync();
         redirectUrl = Nav.Uri;
+        ServiceEvents.MFARequested += MFARequested;
         if (Monitor.AppReady != ServiceConnectionState.Up)
             Monitor.OnAppReadyChanged += AppReadyChanged;
     }
+    async void MFARequested(Guid id, string uri)
+    {
+        if (LoginRequest.Id == id)
+        {
+            _modalUri = uri;
+            InvokeAsync(()=>_mfaModal?.Show());
+        }
+    }
 
     async void AppReadyChanged(ServiceConnectionState state)
     {
@@ -148,7 +161,7 @@
         if (ValidateInput(out authenticationResult))
             try
             {
-                authenticationResult = await JSRuntime.InvokeAsync<string>("attemptSignIn", null);
+                authenticationResult = await JSRuntime.InvokeAsync<string>("attemptSignIn", LoginRequest);
             }
             catch (Exception ex)
             {
diff --git a/BLAZAM/Pages/MFACallback.cshtml b/BLAZAM/Pages/MFACallback.cshtml
new file mode 100644
index 00000000..3635222d
--- /dev/null
+++ b/BLAZAM/Pages/MFACallback.cshtml
@@ -0,0 +1,7 @@
+@page
+@using BLAZAM.Pages
+@model MFACallbackModel
+<p>Authenticated... logging you in...</p>
+@{
+   
+}
diff --git a/BLAZAM/Pages/MFACallback.cshtml.cs b/BLAZAM/Pages/MFACallback.cshtml.cs
new file mode 100644
index 00000000..04a47d51
--- /dev/null
+++ b/BLAZAM/Pages/MFACallback.cshtml.cs
@@ -0,0 +1,13 @@
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc.RazorPages;
+
+namespace BLAZAM.Pages
+{
+    public class MFACallbackModel : PageModel
+    {
+        
+        public void OnGet(string? state=null,string? code=null)
+        {
+        }
+    }
+}
diff --git a/BLAZAM/Program.cs b/BLAZAM/Program.cs
index 8e325b67..29c9b718 100644
--- a/BLAZAM/Program.cs
+++ b/BLAZAM/Program.cs
@@ -147,7 +147,7 @@ public static void Main(string[] args)
             AppInstance.UseCookiePolicy();
             AppInstance.UseAuthentication();
             AppInstance.UseAuthorization();
-
+            AppInstance.UseSession();
             //AppInstance.MapControllers();
             AppInstance.MapBlazorHub();
             AppInstance.MapFallbackToPage("/_Host");
diff --git a/BLAZAM/ProgramEvents.cs b/BLAZAM/ProgramEvents.cs
index 5634ad2b..277685fa 100644
--- a/BLAZAM/ProgramEvents.cs
+++ b/BLAZAM/ProgramEvents.cs
@@ -29,5 +29,8 @@ public static void InvokeTemplatesChanged()
         {
             TemplatesChanged?.Invoke();
         }
+
+
+      
     }
 }
diff --git a/BLAZAM/ProgramHelpers.cs b/BLAZAM/ProgramHelpers.cs
index aa630907..784eba91 100644
--- a/BLAZAM/ProgramHelpers.cs
+++ b/BLAZAM/ProgramHelpers.cs
@@ -138,6 +138,13 @@ completed so it may not be usable as is
             });
             */
 
+            builder.Services.AddDistributedMemoryCache();
+            builder.Services.AddSession(options =>
+            {
+                options.IdleTimeout = TimeSpan.FromSeconds(10);
+                options.Cookie.HttpOnly = true;
+                options.Cookie.IsEssential = true;
+            });
 
             //Enable razor pages
             builder.Services.AddRazorPages();
diff --git a/BLAZAM/wwwroot/js/blazam.js b/BLAZAM/wwwroot/js/blazam.js
index 6d450b04..087a3995 100644
--- a/BLAZAM/wwwroot/js/blazam.js
+++ b/BLAZAM/wwwroot/js/blazam.js
@@ -20,16 +20,21 @@ window.updateCookieExpiration = async () => {
     }
 };
 
-window.attemptSignIn = async () => {
+window.attemptSignIn = async (loginReq) => {
     //Get the form from the current page
     var form = document.querySelector("form");
+
     var formData = new FormData();
+    for (var key in loginReq) {
+        formData.append(key, loginReq[key]);
+    }
+
     //Load the form data
-    for (var x = 0; x < form.length; x++) {
+    //for (var x = 0; x < form.length; x++) {
         //console.log(form[x].name);
         //console.log(form[x].value);
-        formData.append(form[x].name,form[x].value)
-    }
+     //   formData.append(form[x].name,form[x].value)
+    //}
     //var data = Array.from(formData);
     //console.log(data);
     
diff --git a/BLAZAMCommon/AppEvent.cs b/BLAZAMCommon/AppEvent.cs
index 5ad1e7f1..ca2eb933 100644
--- a/BLAZAMCommon/AppEvent.cs
+++ b/BLAZAMCommon/AppEvent.cs
@@ -3,4 +3,5 @@ namespace BLAZAM
 {
     public delegate void AppEvent();
     public delegate void AppEvent<T>(T value);
+    public delegate void AppEvent<T,T2>(T value,T2 value2);
 }
diff --git a/BLAZAMCommon/Data/LoginRequest.cs b/BLAZAMCommon/Data/LoginRequest.cs
index 7ae46ed9..766882ce 100644
--- a/BLAZAMCommon/Data/LoginRequest.cs
+++ b/BLAZAMCommon/Data/LoginRequest.cs
@@ -8,6 +8,7 @@ namespace BLAZAM.Common.Data
 {
     public class LoginRequest
     {
+        public Guid Id { get; set; }= Guid.NewGuid();
         private SecureString? password;
         /// <summary>
         /// The username provided during the app login attempt
diff --git a/BLAZAMGui/UI/Outputs/StatusCheck.razor b/BLAZAMGui/UI/Outputs/StatusCheck.razor
index 28658de5..994bfbb7 100644
--- a/BLAZAMGui/UI/Outputs/StatusCheck.razor
+++ b/BLAZAMGui/UI/Outputs/StatusCheck.razor
@@ -1,25 +1,36 @@
 
 
 
-<MudIcon Icon="@_classes"></MudIcon>
+<MudIcon Color=@Color Icon="@Icon">@Text</MudIcon>
 
 @code {
     [Parameter]
-    public bool Status { get; set; } = false;
-
-    private string _trueClasses = "fa-solid fa-check text-primary";
-    private string _falseClasses = "fa-solid fa-times text-danger";
-    private string _classes = "fa-solid fa-times text-danger";
+    public bool? Status { get; set; } = false;  
+    [Parameter]
+    public string? Text { get; set; }
+    private Color Color = Color.Error;
+    private string Icon = Icons.Material.Filled.Close;
 
 
 
     protected override async void OnParametersSet()
     {
 
-        if (Status)
-            _classes = _trueClasses;
+        if (Status == true)
+        {
+            Color=Color.Success;
+            Icon = Icons.Material.Filled.Check;
+        }
+        else if(Status ==false)
+        {
+            Color = Color.Error;
+            Icon = Icons.Material.Filled.Close;
+        }
         else
-            _classes = _falseClasses;
+        {
+            Color = Color.Warning;
+            Icon = Icons.Material.Filled.QuestionMark;
+        }
 
         await InvokeAsync(StateHasChanged);
 
diff --git a/BLAZAMGui/UI/Settings/AuthenticationSetting.razor b/BLAZAMGui/UI/Settings/AuthenticationSetting.razor
index b3bed6aa..d76a0ee6 100644
--- a/BLAZAMGui/UI/Settings/AuthenticationSetting.razor
+++ b/BLAZAMGui/UI/Settings/AuthenticationSetting.razor
@@ -1,5 +1,6 @@
+@using BLAZAM.Services.Duo
 @inherits SettingsComponents
-
+@inject IDuoClientProvider Duo
 
 
 
@@ -17,9 +18,10 @@
         <MudNumericField Label="@AppLocalization["Session Timeout"]" HelperText="Time in minute" T="int?" @bind-Value="@settings.SessionTimeout" />
 
     </SettingsField>
-    @*
+
     <MudText>Duo Security MFA (optional)</MudText>
     <br />
+    <StatusCheck Status=duoHealthCheckResult Text="@AppLocalization["Duo Health Check"]"/>
     <SettingsField Label="Duo ClientID">
 
     <MudTextField Label="Duo ClientID" InputType="InputType.Password" @bind-Value="@settings.DuoClientId" />
@@ -34,7 +36,7 @@
 
     <MudTextField Label="Duo ApiHost" InputType="InputType.Password" @bind-Value="@settings.DuoApiHost" />
 
-    </SettingsField>*@
+    </SettingsField>
 
 
    
@@ -49,11 +51,11 @@
 
 </MudForm>
 @code {
-#nullable disable warnings
+    #nullable disable warnings
     AuthenticationSettings settings = new AuthenticationSettings();
     string newAdminPassword;
     string adminPasswordInDb;
-
+    bool? duoHealthCheckResult = null;
 
     string _timeoutString = "Loading...";
     protected override async Task OnInitializedAsync()
@@ -61,7 +63,7 @@
         LoadingData = true;
         await InvokeAsync(StateHasChanged);
 
-
+        duoHealthCheckResult = await Duo.GetDuoClient().DoHealthCheck();
         originalSettings = await Context.AuthenticationSettings.AsNoTracking().FirstOrDefaultAsync();
 
         settings = await Context.AuthenticationSettings.FirstOrDefaultAsync();
diff --git a/BLAZAMServices/AppAuthenticationStateProvider.cs b/BLAZAMServices/AppAuthenticationStateProvider.cs
index b22ad348..b62e047c 100644
--- a/BLAZAMServices/AppAuthenticationStateProvider.cs
+++ b/BLAZAMServices/AppAuthenticationStateProvider.cs
@@ -19,6 +19,10 @@
 using BLAZAM.Server.Helpers;
 using BLAZAM.Logger;
 using BLAZAM.Services.Audit;
+using Microsoft.EntityFrameworkCore.Metadata.Internal;
+using Microsoft.AspNetCore.Components;
+using BLAZAM.Nav;
+using System.Net.WebSockets;
 
 namespace BLAZAM.Services
 {
@@ -44,8 +48,10 @@ public AppAuthenticationStateProvider(IAppDatabaseFactory factory,
             this._factory = factory;
             this._permissionHandler = permissionHandler;
             this._userStateService = userStateService;
-            this.CurrentUser = this.GetAnonymous();
             this._httpContextAccessor = ca;
+
+            this.CurrentUser = this.GetAnonymous(ca.HttpContext?.Session.Id);
+
             this._duoClientProvider = dcp;
             this._audit = audit;
         }
@@ -55,6 +61,7 @@ public AppAuthenticationStateProvider(IAppDatabaseFactory factory,
         private readonly AuditLogger _audit;
         private readonly ApplicationInfo _applicationInfo;
         private readonly IEncryptionService _encryption;
+        private readonly AppNavigationManager _nav;
         private readonly IActiveDirectoryContext _directory;
         private readonly IAppDatabaseFactory _factory;
         private readonly PermissionApplicator _permissionHandler;
@@ -111,15 +118,15 @@ public override Task<AuthenticationState> GetAuthenticationStateAsync()
         /// before login.
         /// </summary>
         /// <returns>An unauthenticated annonymous User ClaimsPrincipal</returns>
-        private ClaimsPrincipal GetAnonymous()
+        private ClaimsPrincipal GetAnonymous(string? sessionId=null)
         {
-
+           
             var identity = new ClaimsIdentity(new[]
            {
-                    new Claim(ClaimTypes.Sid, "0"),
+                    new Claim(ClaimTypes.Sid, sessionId.IsNullOrEmpty()==true?"0":sessionId),
                     new Claim(ClaimTypes.Name, "Anonymous"),
                     new Claim(ClaimTypes.Role, "Anonymous"),
-                    new Claim(ClaimTypes.Actor,"0")
+                    new Claim(ClaimTypes.Actor,sessionId.IsNullOrEmpty()==true?"0":sessionId)
                 }, null);
 
             return new ClaimsPrincipal(identity);
@@ -158,7 +165,7 @@ private ClaimsPrincipal GetLocalAdmin(string name = "admin")
         public async Task<LoginResult> Login(LoginRequest loginReq)
         {
             LoginResult loginResult = new();
-             var newUserState = _userStateService.CreateUserState(GetAnonymous());
+             var newUserState = _userStateService.CreateUserState(GetAnonymous(_httpContextAccessor.HttpContext?.Session.Id));
             newUserState.IPAddress = loginReq.IPAddress;
             
 
@@ -265,8 +272,7 @@ public async Task<LoginResult> Login(LoginRequest loginReq)
             if (!loginReq.Impersonation)
             {
                 user = _directory.Authenticate(loginReq);
-                /*
-                 * Duo Authentication if i ever get it working with blazor server
+ 
                 if (user != null)
                 {
                     //Check if we need to perform MFA
@@ -280,20 +286,25 @@ public async Task<LoginResult> Login(LoginRequest loginReq)
                             authSettings.DuoApiHost != null
                             )
                         {
+                            var mfaRRedirect = await PerformDuoAuthentication(loginUser);
                             //Settings are configured so
-                            if (!(await PerformDuoAuthentication(loginReq)))
+                            if (mfaRRedirect.IsNullOrEmpty())
                             {
                                 //Duo authentication failed;
 
                                 return null;
 
                             }
-                            //Duo authentication succeeded
+                            _userStateService.SetUserState(loginUser);
+                            ServiceEvents.InvokeMFARequested(loginReq.Id,mfaRRedirect);
+                            var principal = await CreateDirectoryPrincipal(loginUser, user, loginReq);
+                            //return ;
+                            //Duo authentication requested
 
                         }
                     }
                 }
-                */
+                
             }
             else
                 user = _directory.Users.FindUsersByString(loginReq.Username, true, true).FirstOrDefault();
@@ -304,7 +315,7 @@ public async Task<LoginResult> Login(LoginRequest loginReq)
 
         }
 
-        private async Task<bool> PerformDuoAuthentication(LoginRequest loginReq)
+        private async Task<string> PerformDuoAuthentication(IApplicationUserState loginUser)
         {
             // Initiate the Duo authentication for a specific username
 
@@ -317,18 +328,21 @@ private async Task<bool> PerformDuoAuthentication(LoginRequest loginReq)
 
             // Generate a random state value to tie the authentication steps together
             string state = Client.GenerateState();
+
+            loginUser.DuoAuthState  = state; 
             // Save the state and username in the session for later
             //HttpContext.Session.SetString(STATE_SESSION_KEY, state);
             //HttpContext.Session.SetString(USERNAME_SESSION_KEY, username);
 
             // Get the URI of the Duo prompt from the client.  This includes an embedded authentication request.
-            string promptUri = duoClient.GenerateAuthUri(loginReq.Username, state);
-
+            string promptUri = duoClient.GenerateAuthUri(loginUser.Username, state);
+            
             // Redirect the user's browser to the Duo prompt.
             // The Duo prompt, after authentication, will redirect back to the configured Redirect URI to complete the authentication flow.
             // In this example, that is /duo_callback, which is implemented in Callback.cshtml.cs.
             // return new RedirectResult(promptUri);
-            return true;
+            
+            return promptUri;
         }
 
         /// <summary>
@@ -394,8 +408,7 @@ private async Task<bool> PerformDuoAuthentication(LoginRequest loginReq)
                 claims.Add(new Claim(ClaimTypes.Surname, user.Surname));
             if (user.Email != null)
                 claims.Add(new Claim(ClaimTypes.Email, user.Email));
-
-
+            
             if (loginReq.Impersonation)
             {
                 //Handle Impersonated login
@@ -495,7 +508,7 @@ public Task<AuthenticationState> SetUser(ClaimsPrincipal claimsPrincipal)
         public Task<AuthenticationState> Logout(ClaimsPrincipal claimsPrincipal)
         {
             _userStateService.RemoveUserState(claimsPrincipal);
-            this.CurrentUser = this.GetAnonymous();
+            this.CurrentUser = this.GetAnonymous(_httpContextAccessor.HttpContext?.Session.Id);
             var task = this.GetAuthenticationStateAsync();
             this.NotifyAuthenticationStateChanged(task);
             return task;
diff --git a/BLAZAMServices/Duo/DuoClientProvider.cs b/BLAZAMServices/Duo/DuoClientProvider.cs
index d8e50034..45810d1a 100644
--- a/BLAZAMServices/Duo/DuoClientProvider.cs
+++ b/BLAZAMServices/Duo/DuoClientProvider.cs
@@ -34,7 +34,7 @@ public Client GetDuoClient()
                     ClientId = auth.DuoClientId;
                     ClientSecret = auth.DuoClientSecret;
                     ApiHost = auth.DuoApiHost;
-                    RedirectUri = "https://localhost/test";
+                    RedirectUri = "https://localhost/mfacallback";
 
                 }
             }
diff --git a/BLAZAMServices/ServiceEvents.cs b/BLAZAMServices/ServiceEvents.cs
new file mode 100644
index 00000000..0708f2d0
--- /dev/null
+++ b/BLAZAMServices/ServiceEvents.cs
@@ -0,0 +1,18 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text;
+using System.Threading.Tasks;
+
+namespace BLAZAM.Services
+{
+    public static class ServiceEvents
+    {
+        public static AppEvent<Guid, string> MFARequested { get; set; }
+
+        public static void InvokeMFARequested(Guid id, string uri)
+        {
+            MFARequested?.Invoke(id, uri);
+        }
+    }
+}
diff --git a/BLAZAMSession/ApplicationUserState.cs b/BLAZAMSession/ApplicationUserState.cs
index 2b6de1f4..2eb869c6 100644
--- a/BLAZAMSession/ApplicationUserState.cs
+++ b/BLAZAMSession/ApplicationUserState.cs
@@ -138,6 +138,7 @@ public async Task<bool> MarkRead(UserNotification notification)
             }
             return false;
         }
+
         private void GetUserSettingFromDB()
         {
             try
@@ -335,6 +336,8 @@ public bool HasRole(string userRole)
 
         public bool CanUnlockUsers => HasObjectActionPermission(ActiveDirectoryObjectType.User,ObjectActions.Unlock);
 
+        public string DuoAuthState { get; set; } = "";
+
         private bool HasObjectActionPermission(ActiveDirectoryObjectType objectType, ObjectAction actionType)
         {
             return HasPermission(objectType,
diff --git a/BLAZAMSession/Interfaces/IApplicationUserState.cs b/BLAZAMSession/Interfaces/IApplicationUserState.cs
index d6ee6c4e..a8d92283 100644
--- a/BLAZAMSession/Interfaces/IApplicationUserState.cs
+++ b/BLAZAMSession/Interfaces/IApplicationUserState.cs
@@ -76,7 +76,9 @@ public interface IApplicationUserState
         bool HasOUPrivilege { get; }
         bool HasCreateOUPrivilege { get; }
         bool HasComputerPrivilege { get; }
-        bool CanUnlockUsers { get;  }
+        bool CanUnlockUsers { get; }
+        string DuoAuthState { get; set; }
+
         IList<ReadNewsItem>? ReadNewsItems { get; }
 
         //List<ReadChatMessage> ReadChatMessages { get; }
diff --git a/BLAZAMSession/Interfaces/IApplicationUserStateService.cs b/BLAZAMSession/Interfaces/IApplicationUserStateService.cs
index 75d3052d..2a00c647 100644
--- a/BLAZAMSession/Interfaces/IApplicationUserStateService.cs
+++ b/BLAZAMSession/Interfaces/IApplicationUserStateService.cs
@@ -9,6 +9,7 @@ public interface IApplicationUserStateService
         AppEvent<IApplicationUserState> UserStateAdded { get; set; }
         IList<IApplicationUserState> UserStates { get; }
 
+
         IApplicationUserState CreateUserState(ClaimsPrincipal user);
         IApplicationUserState? GetUserState(ClaimsPrincipal userClaim);
 

From c9762b54dcf0565d23a3b733f8361a120cfada5a Mon Sep 17 00:00:00 2001
From: Chris Jacobsen <jacobsen9026@gmail.com>
Date: Mon, 1 Apr 2024 14:18:12 -0400
Subject: [PATCH 2/2] Duo fully implemented

---
 BLAZAM/BLAZAM.csproj                          |   2 +-
 BLAZAM/Middleware/UserStateMiddleware.cs      |  10 +-
 BLAZAM/Pages/Login.razor                      |  40 +++--
 BLAZAM/Pages/MFACallback.cshtml               |   1 +
 BLAZAM/Pages/MFACallback.cshtml.cs            |  85 ++++++++-
 BLAZAM/Pages/SSO.cshtml.cs                    |   2 +-
 BLAZAM/Pages/SignIn.cshtml                    |   4 +-
 BLAZAM/Pages/SignIn.cshtml.cs                 |  29 +--
 BLAZAM/ProgramHelpers.cs                      |  12 +-
 BLAZAMCommon/Data/LoginRequest.cs             |  74 +++++++-
 BLAZAMCommon/Data/LoginResult.cs              |   8 +-
 .../Models/User/UserFavoriteEntry.cs          |   4 +-
 .../Dashboard/Widgets/FavoritesWidget.razor   |   2 +-
 BLAZAMGui/UI/Dev/DevTools.razor               |   2 +-
 BLAZAMGui/UI/Outputs/StatusCheck.razor        |   2 +-
 .../UI/Settings/AuthenticationSetting.razor   |  20 ++-
 .../AppAuthenticationStateProvider.cs         | 165 +++++++++---------
 BLAZAMServices/Audit/ComputerAudit.cs         |   2 +-
 BLAZAMServices/Audit/DirectoryAudit.cs        |   2 +-
 BLAZAMServices/Audit/LogonAudit.cs            |  12 +-
 BLAZAMServices/Duo/DuoClientProvider.cs       |   1 +
 BLAZAMServices/Duo/DuoResult.cs               |  92 ++++++++++
 BLAZAMServices/MFARequestedException.cs       |  32 ++++
 BLAZAMServices/ServiceEvents.cs               |   7 +
 BLAZAMSession/ApplicationUserState.cs         |   4 +-
 BLAZAMSession/ApplicationUserStateService.cs  |  18 ++
 BLAZAMSession/CurentUserStateService.cs       |   2 +-
 .../Interfaces/IApplicationUserState.cs       |   2 +-
 .../IApplicationUserStateService.cs           |   2 +
 29 files changed, 491 insertions(+), 147 deletions(-)
 create mode 100644 BLAZAMServices/Duo/DuoResult.cs
 create mode 100644 BLAZAMServices/MFARequestedException.cs

diff --git a/BLAZAM/BLAZAM.csproj b/BLAZAM/BLAZAM.csproj
index 99ff5003..de94ab50 100644
--- a/BLAZAM/BLAZAM.csproj
+++ b/BLAZAM/BLAZAM.csproj
@@ -6,7 +6,7 @@
 		<ImplicitUsings>enable</ImplicitUsings>
 		<ServerGarbageCollection>false</ServerGarbageCollection>
 		<AssemblyVersion>0.9.0</AssemblyVersion>
-		<Version>2024.04.01.0037</Version>
+		<Version>2024.04.01.1814</Version>
 		<IncludeSourceRevisionInInformationalVersion>false</IncludeSourceRevisionInInformationalVersion>
 		<RootNamespace>BLAZAM</RootNamespace>
 		<GenerateDocumentationFile>False</GenerateDocumentationFile>
diff --git a/BLAZAM/Middleware/UserStateMiddleware.cs b/BLAZAM/Middleware/UserStateMiddleware.cs
index 81557763..79439bb7 100644
--- a/BLAZAM/Middleware/UserStateMiddleware.cs
+++ b/BLAZAM/Middleware/UserStateMiddleware.cs
@@ -33,8 +33,14 @@ public Task Invoke(HttpContext httpContext, ICurrentUserStateService currentUser
                     currentUserStateService.State = state;
 
                 }
-                if (httpContext.Connection != null && httpContext.Connection.RemoteIpAddress != null && currentUserStateService.State != null && currentUserStateService.State.IPAddress != httpContext.Connection.RemoteIpAddress)
-                    currentUserStateService.State.IPAddress = httpContext.Connection.RemoteIpAddress;
+                if (httpContext.Connection != null &&
+                    httpContext.Connection.RemoteIpAddress != null &&
+                    currentUserStateService.State != null &&
+                    currentUserStateService.State.IPAddress != httpContext.Connection.RemoteIpAddress.ToString())
+                {
+                    currentUserStateService.State.IPAddress = httpContext.Connection.RemoteIpAddress.ToString();
+                }
+
             }
             return _next(httpContext);
         }
diff --git a/BLAZAM/Pages/Login.razor b/BLAZAM/Pages/Login.razor
index 9c531b6f..64a57a22 100644
--- a/BLAZAM/Pages/Login.razor
+++ b/BLAZAM/Pages/Login.razor
@@ -64,6 +64,10 @@
             }
             else if (ApplicationInfo.InDemoMode)
             {
+                LoginRequest.Username = "demo";
+                LoginRequest.Password = "demo";
+
+
                 <MudContainer Class="d-none">
 
                     <MudTextField name="username" Value=@("demo") hidden />
@@ -133,18 +137,11 @@
     {
         await base.OnInitializedAsync();
         redirectUrl = Nav.Uri;
-        ServiceEvents.MFARequested += MFARequested;
+        LoginRequest.ReturnUrl = Nav.Uri;
         if (Monitor.AppReady != ServiceConnectionState.Up)
             Monitor.OnAppReadyChanged += AppReadyChanged;
     }
-    async void MFARequested(Guid id, string uri)
-    {
-        if (LoginRequest.Id == id)
-        {
-            _modalUri = uri;
-            InvokeAsync(()=>_mfaModal?.Show());
-        }
-    }
+
 
     async void AppReadyChanged(ServiceConnectionState state)
     {
@@ -157,11 +154,12 @@
     {
         attemptingSignIn = true;
         await InvokeAsync(StateHasChanged);
-        string? authenticationResult;
+        LoginRequest? authenticationResult;
         if (ValidateInput(out authenticationResult))
             try
             {
-                authenticationResult = await JSRuntime.InvokeAsync<string>("attemptSignIn", LoginRequest);
+                var response = await JSRuntime.InvokeAsync<string>("attemptSignIn", LoginRequest);
+                authenticationResult = JsonConvert.DeserializeObject<LoginRequest>(response);
             }
             catch (Exception ex)
             {
@@ -171,11 +169,10 @@
 
         attemptingSignIn = false;
 
-        if (!authenticationResult.IsNullOrEmpty())
+        if (authenticationResult!=null)
         {
-            int resultCode = int.Parse(authenticationResult);
 
-            switch ((LoginResultStatus)resultCode)
+            switch (authenticationResult.AuthenticationResult)
             {
 
                 case LoginResultStatus.NoUsername:
@@ -202,10 +199,17 @@
                 case LoginResultStatus.UnknownFailure:
                     SnackBarService.Error("Unknown error while attempting to log in");
 
+                    break;
+                case LoginResultStatus.MFARequested:
+                    attemptingSignIn = true;
+                    Nav.NavigateTo(authenticationResult.MFARedirect);
                     break;
                 case LoginResultStatus.OK:
                     attemptingSignIn = true;
-                    Nav.NavigateTo(redirectUrl, true);
+                    if (!_mfaModal.IsShown)
+                    {
+                        Nav.NavigateTo(redirectUrl, true);
+                    }
                     break;
             }
 
@@ -213,16 +217,16 @@
 
         await InvokeAsync(StateHasChanged);
     }
-    bool ValidateInput(out string? validationResult)
+    bool ValidateInput(out LoginRequest? validationResult)
     {
         validationResult = null;
         if (LoginRequest.Valid || (ApplicationInfo.InDemoMode && !DemoCustomLogin)) return true;
 
 
         if (LoginRequest.Password.IsNullOrEmpty())
-            validationResult = ((int)LoginResultStatus.NoPassword).ToString();
+            validationResult.AuthenticationResult = LoginResultStatus.NoPassword;
         if (LoginRequest.Username.IsNullOrEmpty())
-            validationResult = ((int)LoginResultStatus.NoUsername).ToString();
+            validationResult.AuthenticationResult = LoginResultStatus.NoUsername;
         return false;
     }
 
diff --git a/BLAZAM/Pages/MFACallback.cshtml b/BLAZAM/Pages/MFACallback.cshtml
index 3635222d..408f0ee3 100644
--- a/BLAZAM/Pages/MFACallback.cshtml
+++ b/BLAZAM/Pages/MFACallback.cshtml
@@ -2,6 +2,7 @@
 @using BLAZAM.Pages
 @model MFACallbackModel
 <p>Authenticated... logging you in...</p>
+@Model.AuthResponse
 @{
    
 }
diff --git a/BLAZAM/Pages/MFACallback.cshtml.cs b/BLAZAM/Pages/MFACallback.cshtml.cs
index 04a47d51..37aa38c5 100644
--- a/BLAZAM/Pages/MFACallback.cshtml.cs
+++ b/BLAZAM/Pages/MFACallback.cshtml.cs
@@ -1,13 +1,94 @@
+using BLAZAM.Server;
+using BLAZAM.Services;
+using BLAZAM.Services.Audit;
+using BLAZAM.Services.Duo;
+using BLAZAM.Session.Interfaces;
+using DuoUniversal;
+using Microsoft.AspNetCore.Authentication;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.AspNetCore.Mvc.RazorPages;
+using Microsoft.Identity.Client;
+using Octokit;
+using Org.BouncyCastle.Ocsp;
+using System.Security.Claims;
+using System.Text.Json;
 
 namespace BLAZAM.Pages
 {
     public class MFACallbackModel : PageModel
     {
-        
-        public void OnGet(string? state=null,string? code=null)
+        private readonly AuditLogger _audit;
+        private readonly AppAuthenticationStateProvider _auth;
+        private readonly IDuoClientProvider _duoClientProvider;
+        private readonly IApplicationUserStateService _userStateService;
+
+        public MFACallbackModel(IDuoClientProvider duoClientProvider,
+            IApplicationUserStateService userStateService,
+            AppAuthenticationStateProvider appAuthenticationStateProvider,
+            AuditLogger logger
+            )
         {
+            _audit = logger;
+            _auth = appAuthenticationStateProvider;
+            _duoClientProvider = duoClientProvider;
+            _userStateService = userStateService;
+        }
+
+        public string AuthResponse { get; private set; }
+
+        public async Task<IActionResult> OnGet(string? state=null,string? code=null)
+        {
+            // Duo should have sent a 'state' and 'code' parameter.  If either is missing or blank, something is wrong.
+            if (string.IsNullOrWhiteSpace(state))
+            {
+                throw new DuoException("Required state value was empty");
+            }
+            if (string.IsNullOrWhiteSpace(code))
+            {
+                throw new DuoException("Required code value was empty");
+            }
+            if(User!=null && User.HasClaim(c=>c.Type == ClaimTypes.Rsa))
+            {
+                if (state == User.Claims.FirstOrDefault(c => c.Type == ClaimTypes.Rsa)?.Value)
+                {
+
+                    //This is a valid callback for this user
+                    var user = _userStateService.GetMFAUser(state);
+                    if (user != null)
+                    {
+
+
+
+                        // Get the Duo client again.  This can be either be cached in the session or newly built.
+                        // The only stateful information in the Client is your configuration, so you could even use the same client for multiple
+                        // user authentications if desired.
+                        Client duoClient = _duoClientProvider.GetDuoClient();
+                        var username = user.User.Claims.FirstOrDefault(c => c.Type == ClaimTypes.WindowsAccountName)?.Value;
+                        // Get a summary of the authentication from Duo.  This will trigger an exception if the username does not match.
+                        IdToken token = await duoClient.ExchangeAuthorizationCodeFor2faResult(code, username);
+                        if (token.AuthResult.Result.Equals("allow", StringComparison.InvariantCultureIgnoreCase))
+                        {
+                            var authenticatedState = await _auth.SetUser(user.User);
+                            await HttpContext.SignInAsync(user.User);
+                            await _audit.Logon.Login(user.User,HttpContext.Connection.RemoteIpAddress?.ToString());
+                            return new RedirectResult("/");
+                        }
+                
+
+                      
+                    }
+
+                  
+
+                 
+                }
+                else
+                {
+                    throw new DuoException("Session state did not match the expected state");
+                }
+
+            }
+            return Page();
         }
     }
 }
diff --git a/BLAZAM/Pages/SSO.cshtml.cs b/BLAZAM/Pages/SSO.cshtml.cs
index 75dc60c4..f4810c24 100644
--- a/BLAZAM/Pages/SSO.cshtml.cs
+++ b/BLAZAM/Pages/SSO.cshtml.cs
@@ -52,7 +52,7 @@ public async Task<IActionResult> OnPost([FromFormAttribute]LoginRequest req)
             try
             {
                 var result = await Auth.Login(req);
-                if (result != null && result.Status == LoginResultStatus.OK)
+                if (result != null && result.AuthenticationResult == LoginResultStatus.OK)
                 {
                     await HttpContext.SignInAsync(result.AuthenticationState.User);
                     await AuditLogger.Logon.Login(result.AuthenticationState.User);
diff --git a/BLAZAM/Pages/SignIn.cshtml b/BLAZAM/Pages/SignIn.cshtml
index d9501318..0f6422b0 100644
--- a/BLAZAM/Pages/SignIn.cshtml
+++ b/BLAZAM/Pages/SignIn.cshtml
@@ -5,7 +5,7 @@
 }
 <div class="container-fluid">
     Redirecting... 
-</div>
+</div>@* 
 <script>
     window.location.href='@Model.RedirectUri';
-</script>
+</script> *@
diff --git a/BLAZAM/Pages/SignIn.cshtml.cs b/BLAZAM/Pages/SignIn.cshtml.cs
index 8451ef2c..60e5213f 100644
--- a/BLAZAM/Pages/SignIn.cshtml.cs
+++ b/BLAZAM/Pages/SignIn.cshtml.cs
@@ -15,7 +15,7 @@ namespace BLAZAM.Server.Pages
     [IgnoreAntiforgeryToken]
     public class SignInModel : PageModel
     {
-        public SignInModel(AppAuthenticationStateProvider auth, NavigationManager _nav,ConnMonitor _monitor,AuditLogger logger)
+        public SignInModel(AppAuthenticationStateProvider auth, NavigationManager _nav, ConnMonitor _monitor, AuditLogger logger)
         {
             Auth = auth;
             Nav = _nav;
@@ -30,7 +30,7 @@ public SignInModel(AppAuthenticationStateProvider auth, NavigationManager _nav,C
         public ConnMonitor Monitor { get; private set; }
         public AuditLogger AuditLogger { get; private set; }
 
-        public void OnGet(string returnUrl="")
+        public void OnGet(string returnUrl = "")
         {
             ViewData["Layout"] = "_Layout";
             if (returnUrl.IsUrlLocalToHost())
@@ -39,39 +39,44 @@ public void OnGet(string returnUrl="")
             }
         }
 
-      
+
         /// <summary>
         /// The authentication endpoint for web clients
         /// </summary>
         /// <param name="req"></param>
         /// <returns></returns>
-        public async Task<IActionResult> OnPost([FromFormAttribute]LoginRequest req)
+        public async Task<IActionResult> OnPost([FromFormAttribute] LoginRequest req)
         {
             try
             {
-                req.IPAddress = HttpContext.Connection.RemoteIpAddress;
-            }catch(Exception ex)
+                req.IPAddress = HttpContext.Connection.RemoteIpAddress?.ToString();
+            }
+            catch (Exception ex)
             {
                 Loggers.SystemLogger.Error("Error setting ip address for login request {@Error}", ex);
             }
             try
             {
-                
+
                 var result = await Auth.Login(req);
-                if (result != null && result.Status == LoginResultStatus.OK)
+                req.Password = null;
+                req.AuthenticationResult = result.AuthenticationResult;
+                if (result != null && (result.AuthenticationResult == LoginResultStatus.OK || result.AuthenticationResult == LoginResultStatus.MFARequested))
                 {
+
                     await HttpContext.SignInAsync(result.AuthenticationState.User);
-                    await AuditLogger.Logon.Login(result.AuthenticationState.User,req.IPAddress);
+                    if (result.AuthenticationState.User.Identity?.IsAuthenticated == true)
+                        await AuditLogger.Logon.Login(result.AuthenticationState.User, req.IPAddress);
                 }
-                return new ObjectResult(result?.Status);
+                return new JsonResult(req);
 
             }
             catch (Exception ex)
             {
                 return new ObjectResult(ex.Message);
             }
-           
-            
+
+
         }
 
 
diff --git a/BLAZAM/ProgramHelpers.cs b/BLAZAM/ProgramHelpers.cs
index 784eba91..94a89294 100644
--- a/BLAZAM/ProgramHelpers.cs
+++ b/BLAZAM/ProgramHelpers.cs
@@ -26,6 +26,9 @@
 using BLAZAM.Common;
 using BLAZAM.Nav;
 using BLAZAM.Session;
+using Microsoft.AspNetCore.Authentication;
+using Microsoft.AspNetCore.Mvc.RazorPages;
+using Org.BouncyCastle.Ocsp;
 
 namespace BLAZAM.Server
 {
@@ -106,11 +109,13 @@ public static WebApplicationBuilder InjectServices(this WebApplicationBuilder bu
                 options.CheckConsentNeeded = context => true;
                 options.MinimumSameSitePolicy = SameSiteMode.None;
             });
-            builder.Services.AddAuthentication(
-                CookieAuthenticationDefaults.AuthenticationScheme)
+            builder.Services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
                 .AddCookie(AppAuthenticationStateProvider.ApplyAuthenticationCookieOptions());
 
-
+            builder.Services.Configure<AuthenticationOptions>(options =>
+            {
+                options.RequireAuthenticatedSignIn = false;
+            });
             /*
             Keeping  this here for a possible API in the future
             It's some original test code from before AppAuthenticatinProvider was
@@ -265,5 +270,6 @@ completed so it may not be usable as is
 
             return builder;
         }
+
     }
 }
diff --git a/BLAZAMCommon/Data/LoginRequest.cs b/BLAZAMCommon/Data/LoginRequest.cs
index 766882ce..f385b71e 100644
--- a/BLAZAMCommon/Data/LoginRequest.cs
+++ b/BLAZAMCommon/Data/LoginRequest.cs
@@ -2,7 +2,9 @@
 using System.Net;
 using System.Security;
 using System.Security.Claims;
+using System.Text.Json.Serialization;
 using BLAZAM.Helpers;
+using Microsoft.AspNetCore.Components.Authorization;
 
 namespace BLAZAM.Common.Data
 {
@@ -55,6 +57,76 @@ public bool Valid
         /// <summary>
         /// The remote IP of the login attempt
         /// </summary>
-        public IPAddress? IPAddress { get; set; }
+        public string? IPAddress { get; set; }
+
+        public string? MFAToken { get; set; }
+        public string? MFARedirect { get; set; }
+
+        public LoginResultStatus? AuthenticationResult { get; set; } = null;
+
+
+        public LoginRequest UnauthorizedImpersonation()
+        {
+            AuthenticationResult = LoginResultStatus.UnauthorizedImpersonation;
+
+            return this;
+        }
+        public LoginRequest MFARequested(AuthenticationState state)
+        {
+            AuthenticationState = state;
+            AuthenticationResult = LoginResultStatus.MFARequested;
+
+            return this;
+        }
+
+        public LoginRequest BadCredentials()
+        {
+            AuthenticationResult = LoginResultStatus.BadCredentials;
+
+            return this;
+        }
+        public LoginRequest NoData()
+        {
+            AuthenticationResult = LoginResultStatus.NoData;
+
+            return this;
+        }
+        public LoginRequest NoUsername()
+        {
+            AuthenticationResult = LoginResultStatus.NoUsername;
+
+            return this;
+        }
+        public LoginRequest NoPassword()
+        {
+            AuthenticationResult = LoginResultStatus.NoPassword;
+
+            return this;
+        }
+
+
+
+        public LoginRequest UnknownFailure()
+        {
+            AuthenticationResult = LoginResultStatus.UnknownFailure;
+
+            return this;
+        }
+        [JsonIgnore]
+        public AuthenticationState AuthenticationState { get; set; }
+        public LoginRequest Success(AuthenticationState result)
+        {
+            AuthenticationResult = LoginResultStatus.OK;
+            AuthenticationState = result;
+            return this;
+        }
+
+        public LoginRequest DeniedLogin()
+        {
+            AuthenticationResult = LoginResultStatus.DeniedLogin;
+
+            return this;
+        }
+
     }
 }
diff --git a/BLAZAMCommon/Data/LoginResult.cs b/BLAZAMCommon/Data/LoginResult.cs
index ceaaa868..40f49ea2 100644
--- a/BLAZAMCommon/Data/LoginResult.cs
+++ b/BLAZAMCommon/Data/LoginResult.cs
@@ -4,7 +4,7 @@
 namespace BLAZAM.Common.Data
 {
     public enum LoginResultStatus { OK,BadCredentials,UnauthorizedImpersonation, NoData,NoUsername, NoPassword, UnknownFailure,
-        DeniedLogin
+        DeniedLogin, MFARequested
     }
     public class LoginResult
     {
@@ -17,7 +17,13 @@ public LoginResult UnauthorizedImpersonation()
 
             return this;
         }
+        public LoginResult MFARequested(AuthenticationState state)
+        {
+            AuthenticationState = state;
+            Status = LoginResultStatus.MFARequested;
 
+            return this;
+        }
 
         public LoginResult BadCredentials()
         {
diff --git a/BLAZAMDatabase/Models/User/UserFavoriteEntry.cs b/BLAZAMDatabase/Models/User/UserFavoriteEntry.cs
index 67f182dc..4e466d2a 100644
--- a/BLAZAMDatabase/Models/User/UserFavoriteEntry.cs
+++ b/BLAZAMDatabase/Models/User/UserFavoriteEntry.cs
@@ -14,9 +14,9 @@ public class UserFavoriteEntry : AppDbSetBase
 
         public override bool Equals(object? obj)
         {
-            if(obj is UserFavoriteEntry)
+            if(obj is UserFavoriteEntry user)
             {
-                var user = obj as UserFavoriteEntry;
+                if (user.DN == null) return false;            
                 return user.DN.Equals(DN) && user.UserId.Equals(UserId);
             }
             return false;
diff --git a/BLAZAMGui/UI/Dashboard/Widgets/FavoritesWidget.razor b/BLAZAMGui/UI/Dashboard/Widgets/FavoritesWidget.razor
index a8fce39b..b45a7b6d 100644
--- a/BLAZAMGui/UI/Dashboard/Widgets/FavoritesWidget.razor
+++ b/BLAZAMGui/UI/Dashboard/Widgets/FavoritesWidget.razor
@@ -16,7 +16,7 @@
              Class="py-0"
              SortMode="SortMode.Single">
     <Columns>
-        <TemplateColumn Title="Type">
+        <TemplateColumn Style="width:100px;" Title="Type">
             <CellTemplate>
                 <MudIcon Icon="@context.Item.TypeIcon()" />
             </CellTemplate>
diff --git a/BLAZAMGui/UI/Dev/DevTools.razor b/BLAZAMGui/UI/Dev/DevTools.razor
index 5a1e755c..3c30da53 100644
--- a/BLAZAMGui/UI/Dev/DevTools.razor
+++ b/BLAZAMGui/UI/Dev/DevTools.razor
@@ -34,7 +34,7 @@
         <MudDataGrid Items="@UserStateService.UserStates">
             <Columns>
                 <PropertyColumn Title="Username" Property="x => x.User.Identity==null?null:x.User.Identity.Name" />
-                <PropertyColumn Title="IP Address" Property="x => x.IPAddress==null?null:x.IPAddress.ToString()" />
+                <PropertyColumn Title="IP Address" Property="x => x.IPAddress==null?null:x.IPAddress" />
 
                 <PropertyColumn Title="Auth Type" Property="x => x.User.Identity==null || x.User.Identity.AuthenticationType==null?null:x.User.Identity.AuthenticationType.ToString()" />
                 <PropertyColumn Title="Authenticated" Property="x => x.User.Identity==null?null:x.User.Identity.IsAuthenticated.ToString()" />
diff --git a/BLAZAMGui/UI/Outputs/StatusCheck.razor b/BLAZAMGui/UI/Outputs/StatusCheck.razor
index 994bfbb7..cb78dc54 100644
--- a/BLAZAMGui/UI/Outputs/StatusCheck.razor
+++ b/BLAZAMGui/UI/Outputs/StatusCheck.razor
@@ -1,7 +1,7 @@
 
 
 
-<MudIcon Color=@Color Icon="@Icon">@Text</MudIcon>
+<MudChip Color=@Color Icon="@Icon" >@Text</MudChip>
 
 @code {
     [Parameter]
diff --git a/BLAZAMGui/UI/Settings/AuthenticationSetting.razor b/BLAZAMGui/UI/Settings/AuthenticationSetting.razor
index d76a0ee6..4bbb9351 100644
--- a/BLAZAMGui/UI/Settings/AuthenticationSetting.razor
+++ b/BLAZAMGui/UI/Settings/AuthenticationSetting.razor
@@ -18,28 +18,30 @@
         <MudNumericField Label="@AppLocalization["Session Timeout"]" HelperText="Time in minute" T="int?" @bind-Value="@settings.SessionTimeout" />
 
     </SettingsField>
+    <MudDivider Class="my-6"/>
+    <SettingsField Label="@AppLocalization["Duo Security MFA (optional)"]">
+
+        <StatusCheck Status=duoHealthCheckResult Text="@AppLocalization["Duo Health Check"]" />
+    </SettingsField>
 
-    <MudText>Duo Security MFA (optional)</MudText>
-    <br />
-    <StatusCheck Status=duoHealthCheckResult Text="@AppLocalization["Duo Health Check"]"/>
     <SettingsField Label="Duo ClientID">
 
-    <MudTextField Label="Duo ClientID" InputType="InputType.Password" @bind-Value="@settings.DuoClientId" />
+        <MudTextField Label="Duo ClientID" InputType="InputType.Password" @bind-Value="@settings.DuoClientId" />
 
     </SettingsField>
     <SettingsField Label="Duo ClientSecret">
 
-    <MudTextField Label="Duo ClientSecret" InputType="InputType.Password" @bind-Value="@settings.DuoClientSecret" />
+        <MudTextField Label="Duo ClientSecret" InputType="InputType.Password" @bind-Value="@settings.DuoClientSecret" />
 
     </SettingsField>
     <SettingsField Label="Duo ApiHost">
 
-    <MudTextField Label="Duo ApiHost" InputType="InputType.Password" @bind-Value="@settings.DuoApiHost" />
+        <MudTextField Label="Duo ApiHost" InputType="InputType.Password" @bind-Value="@settings.DuoApiHost" />
 
     </SettingsField>
 
 
-   
+
 
     <SettingsField>
 
@@ -51,7 +53,7 @@
 
 </MudForm>
 @code {
-    #nullable disable warnings
+#nullable disable warnings
     AuthenticationSettings settings = new AuthenticationSettings();
     string newAdminPassword;
     string adminPasswordInDb;
@@ -92,7 +94,7 @@
             adminPasswordInDb = settings.AdminPassword;
 
         }
-       
+
         await AuditLogger.System.SettingsChanged("Authentication", settings.GetChanges(originalSettings));
         base.Save();
         await InvokeAsync(StateHasChanged);
diff --git a/BLAZAMServices/AppAuthenticationStateProvider.cs b/BLAZAMServices/AppAuthenticationStateProvider.cs
index b62e047c..2a204c06 100644
--- a/BLAZAMServices/AppAuthenticationStateProvider.cs
+++ b/BLAZAMServices/AppAuthenticationStateProvider.cs
@@ -76,17 +76,17 @@ public static Action<CookieAuthenticationOptions> ApplyAuthenticationCookieOptio
 
                 options.Events.OnSigningIn = async (context) =>
                 {
-                   if (DatabaseCache.AuthenticationSettings?.SessionTimeout != null)
+                    if (DatabaseCache.AuthenticationSettings?.SessionTimeout != null)
                     {
                         var currentUtc = DateTimeOffset.UtcNow;
                         context.Properties.IssuedUtc = currentUtc;
                         context.Properties.ExpiresUtc = currentUtc.AddMinutes((double)DatabaseCache.AuthenticationSettings.SessionTimeout);
                     }
                 };
-                
+
                 options.Events.OnValidatePrincipal = async (context) =>
                 {
-                   if (DatabaseCache.AuthenticationSettings?.SessionTimeout != null)
+                    if (DatabaseCache.AuthenticationSettings?.SessionTimeout != null)
                     {
                         var currentUtc = DateTimeOffset.UtcNow;
                         context.Properties.IssuedUtc = currentUtc;
@@ -98,7 +98,7 @@ public static Action<CookieAuthenticationOptions> ApplyAuthenticationCookieOptio
                 if (DatabaseCache.AuthenticationSettings?.SessionTimeout != null)
                     options.ExpireTimeSpan = TimeSpan.FromMinutes((double)DatabaseCache.AuthenticationSettings.SessionTimeout);
                 else
-                  options.ExpireTimeSpan = TimeSpan.FromSeconds(10);
+                    options.ExpireTimeSpan = TimeSpan.FromSeconds(10);
 
                 options.SlidingExpiration = true;
             };
@@ -118,9 +118,9 @@ public override Task<AuthenticationState> GetAuthenticationStateAsync()
         /// before login.
         /// </summary>
         /// <returns>An unauthenticated annonymous User ClaimsPrincipal</returns>
-        private ClaimsPrincipal GetAnonymous(string? sessionId=null)
+        private ClaimsPrincipal GetAnonymous(string? sessionId = null, string? mfaToken = null)
         {
-           
+
             var identity = new ClaimsIdentity(new[]
            {
                     new Claim(ClaimTypes.Sid, sessionId.IsNullOrEmpty()==true?"0":sessionId),
@@ -128,6 +128,10 @@ private ClaimsPrincipal GetAnonymous(string? sessionId=null)
                     new Claim(ClaimTypes.Role, "Anonymous"),
                     new Claim(ClaimTypes.Actor,sessionId.IsNullOrEmpty()==true?"0":sessionId)
                 }, null);
+            if (mfaToken != null)
+            {
+                identity.AddClaim(new Claim(ClaimTypes.Rsa, mfaToken));
+            }
 
             return new ClaimsPrincipal(identity);
         }
@@ -162,14 +166,13 @@ private ClaimsPrincipal GetLocalAdmin(string name = "admin")
         /// </summary>
         /// <param name="loginReq">The authentication details and options for login</param>
         /// <returns>A fully processed AuthenticationState with all Claims and application permissions applied.</returns>
-        public async Task<LoginResult> Login(LoginRequest loginReq)
+        public async Task<LoginRequest> Login(LoginRequest loginReq)
         {
-            LoginResult loginResult = new();
-             var newUserState = _userStateService.CreateUserState(GetAnonymous(_httpContextAccessor.HttpContext?.Session.Id));
+            var newUserState = _userStateService.CreateUserState(GetAnonymous(_httpContextAccessor.HttpContext?.Session.Id));
             newUserState.IPAddress = loginReq.IPAddress;
-            
 
-            AuthenticationState? result = null;
+
+            AuthenticationState? authenticationState = null;
 
             //Set the current user from the HttpContext which gets it from the user's browser cookie
             CurrentUser = _httpContextAccessor?.HttpContext?.User;
@@ -178,8 +181,8 @@ public async Task<LoginResult> Login(LoginRequest loginReq)
                 && CurrentUser != null
                 && !CurrentUser.Claims.Any(c => c.Type == ClaimTypes.Role && c.Value == UserRoles.SuperAdmin))
             {
-               await _audit.Logon.AttemptedPersonation(loginReq.IPAddress);
-                return loginResult.UnauthorizedImpersonation();
+                await _audit.Logon.AttemptedPersonation(loginReq.IPAddress);
+                return loginReq.UnauthorizedImpersonation();
             }
             //If the user is impersonating then we want to remember who we were before
             if (loginReq.Impersonation)
@@ -192,30 +195,30 @@ public async Task<LoginResult> Login(LoginRequest loginReq)
             }
             else
             {
-                if (loginReq == null) return loginResult.NoData();
-                if (loginReq.Username.IsNullOrEmpty()) return loginResult.NoUsername();
+                if (loginReq == null) return loginReq.NoData();
+                if (loginReq.Username.IsNullOrEmpty()) return loginReq.NoUsername();
             }
             //Pull the authentication settings from the database so we can check admin credentials
             var settings = _factory.CreateDbContext().AuthenticationSettings.FirstOrDefault();
             //Check admin credentials
-            if (settings != null 
-                && loginReq.Username!=null 
+            if (settings != null
+                && loginReq.Username != null
                 && loginReq.Username.Equals("admin", StringComparison.OrdinalIgnoreCase))
             {
                 var adminPass = _encryption.DecryptObject<string>(settings.AdminPassword);
                 if (loginReq.Password == adminPass)
-                    result = await SetUser(this.GetLocalAdmin());
+                    authenticationState = await SetUser(this.GetLocalAdmin());
                 else
-                    await _audit.Logon.AttemptedLogin(GetLocalAdmin(),loginReq.IPAddress);
+                    await _audit.Logon.AttemptedLogin(GetLocalAdmin(), loginReq.IPAddress);
 
 
             }
             //Check if we're in demo mode and this is a demo login
-            else if (_applicationInfo.InDemoMode && settings != null 
-                && loginReq.Username != null 
+            else if (_applicationInfo.InDemoMode && settings != null
+                && loginReq.Username != null
                 && loginReq.Username.Equals("demo", StringComparison.OrdinalIgnoreCase) && loginReq.Password == "demo")
             {
-                result = await SetUser(this.GetDemoUser());
+                authenticationState = await SetUser(this.GetDemoUser());
 
             }
             else
@@ -224,21 +227,57 @@ public async Task<LoginResult> Login(LoginRequest loginReq)
                 {
                     //Login username is not "admin" or "demo" or we're not in demo mode, so we'll try active directory
                     var userClaim = await AttemptADLogin(newUserState, loginReq);
-                    //If active directory login/impersonation succeeded the userClaim will be popluated
-                    if (userClaim != null && userClaim.Identity?.IsAuthenticated == true)
-                        //Set the user in the authentication provider
-                        result = await SetUser(userClaim);
+
+                    if (userClaim != null)
+                    {
+                        //Check if we need to perform MFA
+                        using (var context = _factory.CreateDbContext())
+                        {
+                            //Get settings from DB
+                            var authSettings = context.AuthenticationSettings.FirstOrDefault();
+                            if (authSettings != null &&
+                                authSettings.DuoClientSecret != null &&
+                                authSettings.DuoClientId != null &&
+                                authSettings.DuoApiHost != null
+                                )
+                            {
+                                var mfaRRedirect = await PerformDuoAuthentication(loginReq);
+                                //Settings are configured so
+                                if (!mfaRRedirect.IsNullOrEmpty())
+                                {
+                                    var twostepState = GetAnonymous(loginReq.Id.ToString(), loginReq.MFAToken);
+                                    var authResult = await SetUser(twostepState);
+                                    newUserState.User = userClaim;
+                                    _userStateService.SetMFAUserState(loginReq.MFAToken, newUserState);
+                                    authenticationState = authResult;
+                                    return loginReq.MFARequested(authenticationState);
+
+                                }
+                                // var principal = await CreateDirectoryPrincipal(loginUser, user, loginReq);
+                                //return ;
+                                //Duo authentication requested
+
+                            }
+                        }
+
+
+                        //If active directory login/impersonation succeeded the userClaim will be popluated
+                        if (userClaim.Identity?.IsAuthenticated == true)
+                            //Set the user in the authentication provider
+                            authenticationState = await SetUser(userClaim);
+                    }
                 }
                 catch (DeniedLoginException)
                 {
-                    return loginResult.DeniedLogin();
+                    return loginReq.DeniedLogin();
                 }
+
             }
-            if (result?.User != null)
-            {               
+            if (authenticationState?.User != null)
+            {
                 //User claim processing is done so we can set the UserState with the new identity
-                newUserState.User = result.User;
-                
+                newUserState.User = authenticationState.User;
+
             }
             //Pass this state to the State Service for statefulness if it's populated
             if (newUserState.User != null)
@@ -246,14 +285,14 @@ public async Task<LoginResult> Login(LoginRequest loginReq)
 
 
             //Return the authenticationstate
-            if (result != null)
+            if (authenticationState != null)
             {
                 //await _audit.Logon.Login(result.User);
 
-                return loginResult.Success(result);
+                return loginReq.Success(authenticationState);
             }
             else
-                return loginResult.BadCredentials();
+                return loginReq.BadCredentials();
 
 
         }
@@ -272,39 +311,7 @@ public async Task<LoginResult> Login(LoginRequest loginReq)
             if (!loginReq.Impersonation)
             {
                 user = _directory.Authenticate(loginReq);
- 
-                if (user != null)
-                {
-                    //Check if we need to perform MFA
-                    using (var context = _factory.CreateDbContext())
-                    {
-                        //Get settings from DB
-                        var authSettings = context.AuthenticationSettings.FirstOrDefault();
-                        if (authSettings != null &&
-                            authSettings.DuoClientSecret != null &&
-                            authSettings.DuoClientId != null &&
-                            authSettings.DuoApiHost != null
-                            )
-                        {
-                            var mfaRRedirect = await PerformDuoAuthentication(loginUser);
-                            //Settings are configured so
-                            if (mfaRRedirect.IsNullOrEmpty())
-                            {
-                                //Duo authentication failed;
 
-                                return null;
-
-                            }
-                            _userStateService.SetUserState(loginUser);
-                            ServiceEvents.InvokeMFARequested(loginReq.Id,mfaRRedirect);
-                            var principal = await CreateDirectoryPrincipal(loginUser, user, loginReq);
-                            //return ;
-                            //Duo authentication requested
-
-                        }
-                    }
-                }
-                
             }
             else
                 user = _directory.Users.FindUsersByString(loginReq.Username, true, true).FirstOrDefault();
@@ -315,7 +322,7 @@ public async Task<LoginResult> Login(LoginRequest loginReq)
 
         }
 
-        private async Task<string> PerformDuoAuthentication(IApplicationUserState loginUser)
+        private async Task<string> PerformDuoAuthentication(LoginRequest loginReq)
         {
             // Initiate the Duo authentication for a specific username
 
@@ -329,19 +336,19 @@ private async Task<string> PerformDuoAuthentication(IApplicationUserState loginU
             // Generate a random state value to tie the authentication steps together
             string state = Client.GenerateState();
 
-            loginUser.DuoAuthState  = state; 
+            loginReq.MFAToken = state;
             // Save the state and username in the session for later
             //HttpContext.Session.SetString(STATE_SESSION_KEY, state);
             //HttpContext.Session.SetString(USERNAME_SESSION_KEY, username);
 
             // Get the URI of the Duo prompt from the client.  This includes an embedded authentication request.
-            string promptUri = duoClient.GenerateAuthUri(loginUser.Username, state);
-            
+            string promptUri = duoClient.GenerateAuthUri(loginReq.Username, state);
+            loginReq.MFARedirect = promptUri;
             // Redirect the user's browser to the Duo prompt.
             // The Duo prompt, after authentication, will redirect back to the configured Redirect URI to complete the authentication flow.
             // In this example, that is /duo_callback, which is implemented in Callback.cshtml.cs.
             // return new RedirectResult(promptUri);
-            
+
             return promptUri;
         }
 
@@ -360,7 +367,7 @@ private async Task<string> PerformDuoAuthentication(IApplicationUserState loginU
 
             if (user != null)
             {
-                principal = new ClaimsPrincipal(await CreateDirectoryIdentity(loginUser,user, loginReq));
+                principal = new ClaimsPrincipal(await CreateDirectoryIdentity(loginUser, user, loginReq));
             }
 
             return principal;
@@ -378,10 +385,10 @@ private async Task<string> PerformDuoAuthentication(IApplicationUserState loginU
 
             var identity = new ClaimsIdentity();
 
-            
-            
+
+
             //Load privilege levels for user
-            await _permissionHandler.LoadPermissions(loginUser,user);
+            await _permissionHandler.LoadPermissions(loginUser, user);
             var userRoles = TransformUserRoles(loginUser);
             //TransformUserRoles returns an empty list if the user has no login rights
             if (userRoles.Count < 1)
@@ -397,18 +404,20 @@ private async Task<string> PerformDuoAuthentication(IApplicationUserState loginU
             {
                 claims.Add(new Claim(ClaimTypes.Name, user.DisplayName));
             }
-            else
+            else if(user.SamAccountName != null)
             {
                 claims.Add(new Claim(ClaimTypes.Name, user.SamAccountName));
 
             }
+            if (user.UserPrincipalName != null)
+                claims.Add(new Claim(ClaimTypes.WindowsAccountName, user.UserPrincipalName));
             if (user.GivenName != null)
                 claims.Add(new Claim(ClaimTypes.GivenName, user.GivenName));
             if (user.Surname != null)
                 claims.Add(new Claim(ClaimTypes.Surname, user.Surname));
             if (user.Email != null)
                 claims.Add(new Claim(ClaimTypes.Email, user.Email));
-            
+
             if (loginReq.Impersonation)
             {
                 //Handle Impersonated login
@@ -451,7 +460,7 @@ private List<Claim> TransformUserRoles(IApplicationUserState user)
             {
                 userRoles.AddSuperAdmin();
                 userRoles.AddAllRoles();
-               
+
             }
             else
             {
diff --git a/BLAZAMServices/Audit/ComputerAudit.cs b/BLAZAMServices/Audit/ComputerAudit.cs
index 8e9dbc5a..4d7e2f86 100644
--- a/BLAZAMServices/Audit/ComputerAudit.cs
+++ b/BLAZAMServices/Audit/ComputerAudit.cs
@@ -39,7 +39,7 @@ private async Task<bool> Log(string action, IADComputer searchedComputer)
                     Action = action,
                     Target = searchedComputer.CanonicalName,
                     Username = UserStateService?.CurrentUsername,
-                    IpAddress = UserStateService?.CurrentUserState.IPAddress.ToString()
+                    IpAddress = UserStateService?.CurrentUserState?.IPAddress
 
                 });
                 context.SaveChanges();
diff --git a/BLAZAMServices/Audit/DirectoryAudit.cs b/BLAZAMServices/Audit/DirectoryAudit.cs
index 9ef19206..a7b6b9af 100644
--- a/BLAZAMServices/Audit/DirectoryAudit.cs
+++ b/BLAZAMServices/Audit/DirectoryAudit.cs
@@ -63,7 +63,7 @@ protected virtual async Task<bool> Log<T>(
                     BeforeAction = beforeAction,
                     AfterAction = afterAction,
                     Username = CurrentUser.AuditUsername,
-                    IpAddress = CurrentUser.IPAddress?.ToString(),
+                    IpAddress = CurrentUser.IPAddress,
                 };
                 table.Add(auditEntry);
                 context.SaveChanges();
diff --git a/BLAZAMServices/Audit/LogonAudit.cs b/BLAZAMServices/Audit/LogonAudit.cs
index 1500f513..cb3cef7e 100644
--- a/BLAZAMServices/Audit/LogonAudit.cs
+++ b/BLAZAMServices/Audit/LogonAudit.cs
@@ -12,25 +12,25 @@ public LogonAudit(IAppDatabaseFactory factory,
             IApplicationUserStateService userStateService) : base(factory, userStateService)
         {
         }
-        public async Task<bool> AttemptedPersonation(IPAddress iPAddress)
+        public async Task<bool> AttemptedPersonation(string? iPAddress=null)
         {
             CurrentUser = UserStateService.CurrentUserState;
             return await Log("Attempted Personation", iPAddress);
         }
 
-        public async Task<bool> AttemptedLogin(ClaimsPrincipal user, IPAddress iPAddress)
+        public async Task<bool> AttemptedLogin(ClaimsPrincipal user, string? iPAddress=null)
         {
             CurrentUser = UserStateService.CreateUserState(user);
             return await Log("Attempted Login", iPAddress);
         }
-        public async Task<bool> Login(ClaimsPrincipal user,IPAddress? ipAddress=null)
+        public async Task<bool> Login(ClaimsPrincipal user,string? ipAddress=null)
         {
             CurrentUser = UserStateService.CreateUserState(user);
             return await Log("Login", ipAddress);
         }
         public async Task<bool> Logout() => await Log("Logout");
 
-        private async Task<bool> Log(string action,IPAddress ipAddress=null)
+        private async Task<bool> Log(string action,string ipAddress=null)
         {
 
             try
@@ -42,9 +42,9 @@ private async Task<bool> Log(string action,IPAddress ipAddress=null)
                     Username = CurrentUser.AuditUsername,
                 };
                 if (ipAddress != null)
-                    newAuditEntry.IpAddress = ipAddress.ToString();
+                    newAuditEntry.IpAddress = ipAddress;
                 else
-                    newAuditEntry.IpAddress = CurrentUser.IPAddress?.ToString();
+                    newAuditEntry.IpAddress = CurrentUser.IPAddress;
 
                 context.LogonAuditLog.Add(newAuditEntry);
                 await context.SaveChangesAsync();
diff --git a/BLAZAMServices/Duo/DuoClientProvider.cs b/BLAZAMServices/Duo/DuoClientProvider.cs
index 45810d1a..20f769da 100644
--- a/BLAZAMServices/Duo/DuoClientProvider.cs
+++ b/BLAZAMServices/Duo/DuoClientProvider.cs
@@ -1,5 +1,6 @@
 using BLAZAM.Common.Data.Database;
 using BLAZAM.Database.Context;
+using BLAZAM.Session.Interfaces;
 using DuoUniversal;
 using Microsoft.EntityFrameworkCore;
 
diff --git a/BLAZAMServices/Duo/DuoResult.cs b/BLAZAMServices/Duo/DuoResult.cs
new file mode 100644
index 00000000..c50238d7
--- /dev/null
+++ b/BLAZAMServices/Duo/DuoResult.cs
@@ -0,0 +1,92 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text;
+using System.Threading.Tasks;
+
+namespace BLAZAM.Services.Duo
+{
+    public class AccessDevice
+    {
+        public object browser { get; set; }
+        public object browser_version { get; set; }
+        public object flash_version { get; set; }
+        public object hostname { get; set; }
+        public string ip { get; set; }
+        public object is_encryption_enabled { get; set; }
+        public object is_firewall_enabled { get; set; }
+        public object is_password_set { get; set; }
+        public object java_version { get; set; }
+        public Location location { get; set; }
+        public object os { get; set; }
+        public object os_version { get; set; }
+    }
+
+    public class Application
+    {
+        public string key { get; set; }
+        public string name { get; set; }
+    }
+
+    public class AuthContext
+    {
+        public AccessDevice access_device { get; set; }
+        public string alias { get; set; }
+        public Application application { get; set; }
+        public AuthDevice auth_device { get; set; }
+        public string email { get; set; }
+        public string event_type { get; set; }
+        public string factor { get; set; }
+        public DateTime isotimestamp { get; set; }
+        public object ood_software { get; set; }
+        public string reason { get; set; }
+        public string result { get; set; }
+        public int timestamp { get; set; }
+        public string trusted_endpoint_status { get; set; }
+        public string txid { get; set; }
+        public User user { get; set; }
+    }
+
+    public class AuthDevice
+    {
+        public object ip { get; set; }
+        public Location location { get; set; }
+        public object name { get; set; }
+    }
+
+    public class AuthResult
+    {
+        public string result { get; set; }
+        public string status { get; set; }
+        public string status_msg { get; set; }
+    }
+
+    public class Location
+    {
+        public string city { get; set; }
+        public string country { get; set; }
+        public string state { get; set; }
+    }
+
+    public class Root
+    {
+        public AuthContext AuthContext { get; set; }
+        public AuthResult AuthResult { get; set; }
+        public int AuthTime { get; set; }
+        public string Username { get; set; }
+        public string Iss { get; set; }
+        public DateTime Exp { get; set; }
+        public DateTime Iat { get; set; }
+        public string Sub { get; set; }
+        public string Aud { get; set; }
+        public object Nonce { get; set; }
+    }
+
+    public class User
+    {
+        public List<string> groups { get; set; }
+        public string key { get; set; }
+        public string name { get; set; }
+    }
+
+}
diff --git a/BLAZAMServices/MFARequestedException.cs b/BLAZAMServices/MFARequestedException.cs
new file mode 100644
index 00000000..004c0ac5
--- /dev/null
+++ b/BLAZAMServices/MFARequestedException.cs
@@ -0,0 +1,32 @@
+using BLAZAM.Common.Data;
+using Microsoft.AspNetCore.Components.Authorization;
+using System.Runtime.Serialization;
+
+namespace BLAZAM.Services
+{
+    [Serializable]
+    internal class MFARequestedException : Exception
+    {
+        public LoginRequest LoginRequest { get; set; }
+        public MFARequestedException(LoginRequest state)
+        {
+            LoginRequest = state;
+        }
+
+        public MFARequestedException(LoginRequest state, string? message) : base(message)
+        {
+            LoginRequest = state;
+
+        }
+
+        public MFARequestedException(LoginRequest state, string? message, Exception? innerException) : base(message, innerException)
+        {
+            LoginRequest = state;
+        }
+
+        protected MFARequestedException(LoginRequest state, SerializationInfo info, StreamingContext context) : base(info, context)
+        {
+            LoginRequest = state;
+        }
+    }
+}
\ No newline at end of file
diff --git a/BLAZAMServices/ServiceEvents.cs b/BLAZAMServices/ServiceEvents.cs
index 0708f2d0..023ee0f8 100644
--- a/BLAZAMServices/ServiceEvents.cs
+++ b/BLAZAMServices/ServiceEvents.cs
@@ -13,6 +13,13 @@ public static class ServiceEvents
         public static void InvokeMFARequested(Guid id, string uri)
         {
             MFARequested?.Invoke(id, uri);
+        } 
+
+        public static AppEvent<string, string> MFACallbackReceived { get; set; }
+
+        public static void InvokeMFACallbackReceived(string state, string code)
+        {
+            MFACallbackReceived?.Invoke(state, code);
         }
     }
 }
diff --git a/BLAZAMSession/ApplicationUserState.cs b/BLAZAMSession/ApplicationUserState.cs
index 2eb869c6..8c101d21 100644
--- a/BLAZAMSession/ApplicationUserState.cs
+++ b/BLAZAMSession/ApplicationUserState.cs
@@ -45,7 +45,7 @@ public class ApplicationUserState : IApplicationUserState
         public DateTime LastAccessed { get; set; } = DateTime.UtcNow;
 
 
-        public IPAddress IPAddress { get; set; }
+        public string? IPAddress { get; set; }
 
         public List<UserFavoriteEntry> FavoriteEntries => userSettings?.FavoriteEntries?? new List<UserFavoriteEntry>();
 
@@ -60,7 +60,7 @@ public IList<UserNotification>? Notifications
 
             }
         }
-        public IList<ReadNewsItem> ReadNewsItems => Preferences.ReadNewsItems;
+        public IList<ReadNewsItem> ReadNewsItems => Preferences?.ReadNewsItems??new();
         //public List<ReadChatMessage> ReadChatMessages => Preferences.ReadChatMessages.ToList();
 
         public int Id => Preferences!=null?Preferences.Id:0;
diff --git a/BLAZAMSession/ApplicationUserStateService.cs b/BLAZAMSession/ApplicationUserStateService.cs
index 412e089a..086f3b9f 100644
--- a/BLAZAMSession/ApplicationUserStateService.cs
+++ b/BLAZAMSession/ApplicationUserStateService.cs
@@ -34,6 +34,7 @@ public class ApplicationUserStateService : IApplicationUserStateService
 
         private int? Timeout { get; set; }
 
+        private Dictionary<string, IApplicationUserState> _mfaLoginQueue = new();
 
         /// <summary>
         /// Called when a new UserState is added to the cache.
@@ -193,6 +194,23 @@ private void AddUserState(IApplicationUserState state)
             //Invoke event so Active Directory can populate DirectoryUser if required
             //UserStateAdded?.Invoke(state);
         }
+        public void SetMFAUserState(string mfaToken,IApplicationUserState state)
+        {
+            _mfaLoginQueue.Add(mfaToken, state);
+            Task.Delay(60000).ContinueWith((val) => {
+                _mfaLoginQueue.Remove(mfaToken);
+            });
+            SetUserState(state);
+        }
+        public IApplicationUserState? GetMFAUser(string mfaToken)
+        {
+            var user= _mfaLoginQueue.FirstOrDefault(q=>q.Key== mfaToken).Value;
+            if(user != null)
+            {
+                _mfaLoginQueue.Remove(mfaToken );
+            }
+            return user;
+        }
         public void SetUserState(IApplicationUserState state)
         {
             if (state != null)
diff --git a/BLAZAMSession/CurentUserStateService.cs b/BLAZAMSession/CurentUserStateService.cs
index e1e951ba..05409148 100644
--- a/BLAZAMSession/CurentUserStateService.cs
+++ b/BLAZAMSession/CurentUserStateService.cs
@@ -51,7 +51,7 @@ private void RetryGetCurrentUserState(object? state = null)
             {
                 State = _applicationUserStateService.GetUserState(_httpContextAccessor.HttpContext?.User);
                 if (State != null && State.IsAuthenticated)
-                    State.IPAddress = _httpContextAccessor.HttpContext.Connection.RemoteIpAddress;
+                    State.IPAddress = _httpContextAccessor.HttpContext.Connection.RemoteIpAddress?.ToString();
                 _retryTimer?.Dispose();
 
             }
diff --git a/BLAZAMSession/Interfaces/IApplicationUserState.cs b/BLAZAMSession/Interfaces/IApplicationUserState.cs
index a8d92283..7f3ce961 100644
--- a/BLAZAMSession/Interfaces/IApplicationUserState.cs
+++ b/BLAZAMSession/Interfaces/IApplicationUserState.cs
@@ -63,7 +63,7 @@ public interface IApplicationUserState
         IList<UserNotification>? Notifications { get; }
         IApplicationUserSessionCache Cache { get; set; }
 
-        IPAddress IPAddress { get; set; }
+        string? IPAddress { get; set; }
 
         string LastUri { get; set; }
         bool IsAuthenticated { get; }
diff --git a/BLAZAMSession/Interfaces/IApplicationUserStateService.cs b/BLAZAMSession/Interfaces/IApplicationUserStateService.cs
index 2a00c647..1fa5b24e 100644
--- a/BLAZAMSession/Interfaces/IApplicationUserStateService.cs
+++ b/BLAZAMSession/Interfaces/IApplicationUserStateService.cs
@@ -11,11 +11,13 @@ public interface IApplicationUserStateService
 
 
         IApplicationUserState CreateUserState(ClaimsPrincipal user);
+        IApplicationUserState? GetMFAUser(string state);
         IApplicationUserState? GetUserState(ClaimsPrincipal userClaim);
 
         // IApplicationUserState? GetUserState(ClaimsPrincipal userClaim);
         void RemoveUserState(IApplicationUserState state);
         void RemoveUserState(ClaimsPrincipal currentUser);
+        void SetMFAUserState(string mfaToken, IApplicationUserState state);
         void SetUserState(IApplicationUserState state);
     }
 }
\ No newline at end of file