OWIN produces different behavior between IIS express and IIS

See more:

C#

IIS

OWIN

IIS-Express

I'm building a authentication app using OWIN. I'm trying to get both the Bear token and userinfo claims. The code below gets me to 85% of what I want. While initially writing the code I used IIS Express. I debugged and coded towards that environment. For whatever reason after the initial challenge called in the else block the request.isauthenticated is false after the return from the login screen (Using KeyCloak as idp). The code then drops the user into the else if block where I find request.form has my Bearer token. I must then execute the authentication.challenge again (no KeyCloak login screen opens) and I return to the top of the page_load and this time the request.isauthenticated is true and I can get the userinfo but the request.form is empty. This is find for me because I can store all the info off somewhere for later use.

Once I got to this point I targeted IIS. Ran the code and got different behavior. The code drops into the else block initially (same as before) I login but upon return from the idp this time the request.isAuthenticated is true. I have the userinfo but not the Bearer token. Any ideas why??

What I have tried:

protected void Page_Load(object sender, EventArgs e)
    {
        if (Request.IsAuthenticated)
        {
            String str = String.Empty;

            var qry = ((System.Security.Claims.ClaimsPrincipal)Request.RequestContext.HttpContext.User).Claims;

            if (null != qry)
            {
                foreach (System.Security.Claims.Claim item in qry)
                {
                    if (item.Type == "preferred_username")
                    {
                        str = item.Value;
                    }
                }
            }
        }else if (!Request.IsAuthenticated && Request.Form.Count > 0)
        {                
            HttpContext.Current.GetOwinContext().Authentication.Challenge(
                new AuthenticationProperties { },
                  OpenIdConnectAuthenticationDefaults.AuthenticationType);
        }
        else
        {
            HttpContext.Current.GetOwinContext().Authentication.Challenge(
                new AuthenticationProperties { RedirectUri = "/XXXapp locationXXX/" },
                  OpenIdConnectAuthenticationDefaults.AuthenticationType);
        }
    }