WsFederation and local user mixed authentication

I am trying to connect my login to Azure AD credentials (using the OWIN WsFederation plugin) or use a local user account with asp.net microsoft id in MVC 5.1 web app.

Logging in with local users works fine, logging in with a federated account only works once, and I need to reload the app for it to work again.

I believe the issue is due to incorrect handling of the response on the Microsoft login page

Infact, using two different browsers (chrome + ie) in private mode and Fiddler, I can see that my cookie is set on the first request, but not on a subsequent request made from another browser

First request

Second request

This is my ConfigureAuth

     public void ConfigureAuth(IAppBuilder app)
    {
        AntiForgeryConfig.UniqueClaimTypeIdentifier = ClaimTypes.NameIdentifier;

        app.CreatePerOwinContext(ApplicationDbContext.Create);
        app.CreatePerOwinContext<ApplicationUserManager>(ApplicationUserManager.Create);

        app.SetDefaultSignInAsAuthenticationType("ExternalCookie");

        app.UseCookieAuthentication(new CookieAuthenticationOptions
        {
            AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
            LoginPath = new PathString("/Account/Login"),
            AuthenticationMode = Microsoft.Owin.Security.AuthenticationMode.Active,
        });


        // these two lines of code are needed if you are using any of the external authentication middleware
        app.UseCookieAuthentication(new CookieAuthenticationOptions
        {
            AuthenticationType = "ExternalCookie",
            AuthenticationMode = Microsoft.Owin.Security.AuthenticationMode.Passive,
        });


        app.UseWsFederationAuthentication(new Microsoft.Owin.Security.WsFederation.WsFederationAuthenticationOptions()
        {
            MetadataAddress = "https://login.windows.net/XXXXXXX.onmicrosoft.com/federationmetadata/2007-06/federationmetadata.xml",
            Wtrealm = "https://MYREALM",

            AuthenticationType = WsFederationAuthenticationDefaults.AuthenticationType,
        });

    }

      

        
        
        
      

    

This is part of the account controller

    //
    // POST: /Account/ExternalLogin
    [HttpPost]
    [AllowAnonymous]
    [ValidateAntiForgeryToken]
    public ActionResult ExternalLogin(string provider, string returnUrl)
    {
        // Request a redirect to the external login provider
        return new ChallengeResult(provider, Url.Action("ExternalLoginCallback", "Account", new { ReturnUrl = returnUrl }));
    }


    // GET: /Account/ExternalLoginCallback
    [AllowAnonymous]
    public ActionResult ExternalLoginCallback(string returnUrl)
    {

        var ctx = Request.GetOwinContext();
        var result = ctx.Authentication.AuthenticateAsync("ExternalCookie").Result;

        if (result != null) //null on request other than the first (!!!)
        {
            ctx.Authentication.SignOut("ExternalCookie");

            var claims = result.Identity.Claims.ToList();
            claims.Add(new Claim(ClaimTypes.AuthenticationMethod, "External Account"));
            var email = claims.Where(x => x.Type == "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name").SingleOrDefault().Value;
            var ci = new ClaimsIdentity(claims, DefaultAuthenticationTypes.ApplicationCookie);
            ctx.Authentication.SignIn(ci);
        }

        return RedirectToLocal(returnUrl);
    }