Using the Authorize Attribute with Custom Cookie Authentication in ASP.NET Core

Question

I have the following code in Startup.cs:

public void ConfigureServices(IServiceCollection services)
{
    //Other middleware
    services.AddAuthentication(options =>
    {
        options.SignInScheme = "MyAuthenticationScheme";
    });

    services.AddAuthorization();
}

public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerFactory loggerFactory)
{
    //Other configurations.
    app.UseCookieAuthentication(options =>
    {
        options.AuthenticationScheme = "MyAuthenticationScheme";
        options.LoginPath = new PathString("/signin/");
        options.AccessDeniedPath = new PathString("/signin/");
        options.AutomaticAuthenticate = true;
    });
}

Then just for testing purposes, I have a login page where you just click a button and it posts back to itself, with this code in the controller.

SignInController.cs

public IActionResult Index()
{
    return View();
}

[HttpPost]
[AllowAnonymous]
public async Task<IActionResult> Index(SignInViewModel model)
{
    List<Claim> claimList = new List<Claim>();
    claimList.Add(new Claim("Admin", "true"));
    ClaimsIdentity identity = new ClaimsIdentity(claimList);
    ClaimsPrincipal principal = new ClaimsPrincipal(identity);
    await HttpContext.Authentication.SignInAsync("MyAuthenticationScheme", principal);
    return RedirectToAction(nameof(HomeController.Index), "Home");
}

Here's the HomeController.cs

[Authorize]
public async Task<IActionResult> Index()
{
    return View();
}

I get 401 unauthorized. From my understanding the SignInAsync call should authenticate the user, and the the [Authorize] attribute should allow any authenticated users. If I do something like this in HomeController.cs:

ClaimsPrincipal cp = await HttpContext.Authentication.AuthenticateAsync("MyAuthenticationScheme");

I can see that cp does contain the Admin claim that I gave it earlier. I would think that meant the user was successfully authenticated. Why isn't the [Authorize] attribute working?

Try adding options.AutomaticChallenge = true;

regnauld
– regnauld

2016-03-26 06:16:45 +00:00
Commented Mar 26, 2016 at 6:16 — regnauld
– regnauld, Commented Mar 26, 2016 at 6:16

Joe Audette · Accepted Answer · 2016-03-26 10:59:43Z

7

I think you need to specify the authscheme in the constructor of the identity, your code should be more like this:

var authProperties = new AuthenticationProperties();
var identity = new ClaimsIdentity("MyAuthenticationScheme");
identity.AddClaim(new Claim(ClaimTypes.NameIdentifier, "1"));
identity.AddClaim(new Claim(ClaimTypes.Name, "Admin"));
var principal = new ClaimsPrincipal(identity);
await HttpContext.Authentication.SignInAsync(
            "MyAuthenticationScheme", 
            claimsPrincipal, 
            authProperties);
return RedirectToAction(nameof(HomeController.Index), "Home");

answered Mar 26, 2016 at 10:59

Joe Audette

37.1k12 gold badges111 silver badges103 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

conterio Over a year ago

this isn't working for me, the only way i can see the new claim is if i log out and log back in...

Collectives™ on Stack Overflow

Using the Authorize Attribute with Custom Cookie Authentication in ASP.NET Core

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related