User205042623 posted
I am writing an ASP.NET Core Web App which has 2 authentication schemes. One is a simple cookie based scheme, the other uses OAuth. The OAuth authentication scheme is only used to log onto a government web site and make api calls. The app has a database
and when I save records I want to save the CreatedBy and ModifiedBy using the username from the Cookie authentication scheme.
When I log in using the Cookie authentication, the User.Identity and User.Identities are set as expected with the identity of the cookie authentication. However if I then access a page which requires authentication by the OAuth authentication scheme, then
I can no longer get the username from the cookie based authentication. It doesn't appear in User.Identity or User.Identities.
Authentication is set up as follows:
services.AddAuthentication(options =>
{
options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
options.DefaultAuthenticateScheme = CookieAuthenticationDefaults.AuthenticationScheme;
options.DefaultSignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;
options.DefaultChallengeScheme = "OAuthTest";
})
.AddCookie()
.AddOAuth("OAuthTest", options =>
{
options.ClientId = Configuration["HMRC:ClientId"];
options.ClientSecret = Configuration["HMRC:ClientSecret"];
options.CallbackPath = new PathString("/account/auth-redirect");
options.AuthorizationEndpoint = "https://test-api.service.hmrc.gov.uk/oauth/authorize";
options.TokenEndpoint = "https://test-api.service.hmrc.gov.uk/oauth/token";
options.Scope.Add("read:vat");
options.SaveTokens = true;
options.Events = new OAuthEvents
{
OnCreatingTicket = async context =>
{
var claims = new List<Claim>
{
new Claim(ClaimTypes.NameIdentifier, Guid.NewGuid().ToString())
};
var identity = new ClaimsIdentity(claims, "OAuthTest", ClaimTypes.NameIdentifier, null);
context.Principal.AddIdentity(identity);
}
};
});
I have added this Authorize attribute to a page which requires the cookie base authentication:
[Authorize(AuthenticationSchemes = CookieAuthenticationDefaults.AuthenticationScheme)]
and this Authorize attribute to the page which requires OAuth authentication:
[Authorize(AuthenticationSchemes = "OAuthTest")]
I have pushed a cut down version of the application to github. This just has 2 pages one authorised by each authentication scheme. The SignIn button automatically logs into the Cookie Authentication scheme. Both pages display the data contained in
User.Identity and User.Identities.
https://github.com/rick1c/multiple-auth-scheme/tree/master/MultipleAuthSchemes
