Discussion for Auth 2.0

[HaoK]

Related discussion thread of issues/questions about aspnet/Announcements#262

[joeaudette]

Hi,

In the announcement for the breaking changes you said:

"In 1.0, it was possible to configure different Authentication middleware with branching, this is no longer possible with a single middleware and shared services across all branches. A workaround could be to use different schemes/options for each branch."

I am facing this problem and would appreciate some elaboration on specifically how I can use different schemes per branch. My solution can provision new tenants at runtime, so iterating through tenants in startup to add schemes is not a solution for me.

Wondering if you could provide some guidance on what I could override to dynamically resolve schemes and options per request. PostConfigureCookieAuthenticationOptions, looks like a potential candidate that might allow me to do that, but not sure if that allows me to adjust the options per request. IAuthenticationSchemeProvider sounds like another potential thing to implement.

Could you offer a suggestion of the right thing to implement/override to achieve a way to resolve auth scheme/options on a per request basis?

Thanks in advance for any advice!

[HaoK]

Alternatively you could also try replacing the IAuthenticationHandlerProvider to return the appropriate instance for your branch and use the same name in each branch. The default implementation of this is just a scoped dictionary cache: https://github.com/aspnet/HttpAbstractions/blob/dev/src/Microsoft.AspNetCore.Authentication.Core/AuthenticationHandlerProvider.cs

If you had a implementation that was branch aware, that should be a step in the right direction. You'll still have to figure out how to resolve the appropriate options, but you could do that via plugging in your own IOptionsMonitor that is branch aware.

[joeaudette]

Thank you! Really appreciate the prompt response! I will give IAuthenticationHandlerProvider a try.

Can you tell me what is the purpose of IOptionsMonitor? what is it used for? I'm familiar with IOptions of T but IOptionsMonitor is new to me.

[HaoK]

Its basically the same thing, it just adds the ability to name options IOptionsMonitor.Get(authenticationScheme) is what you will need to implement

[joeaudette]

Thanks!
Wondering also about cookie name, in my current 1.1 solution I support tenants based on the first folder segment so for that I have been using different auth scheme names with the cookie named the same as the auth scheme so that is is possible to login to multiple tenants without cookies stepping on each other. ie since the host name is not different per tenant I have to account for the fact that the browser will share cookies for the host name and use different cookie names
Can we still configure different cookie names or will they be named after the authscheme so it would be sufficient to use different auth scheme names per tenant to get different named cookies?

[HaoK]

You can configure them however you like the underlying options haven't changed that much

[joeaudette]

Awesome, thanks very much! Will let you know how it goes or if I run into any troubles, working on the netcore20 branch in my open source project here https://github.com/joeaudette/cloudscribe , just got it to build but mainly by commenting out the broken bits, now I will try to get it working again following your advice.

[valeriob]

I'm trying to bring our owin authentication code to aspnetcore 2.0, so much stuff have changed !
I hope i can bring there same functionality back, i'll give feedback on it.
At first impact i see too much use of new() generic constraint, it's kinda a bad smell to be honest, i think the framework should not instantiate anything but let the user build his types providing the right hooks, like owin did, i see no reason why the framework should instantiate AuthenticationSchemeOptions and AuthenticationHandler.

[Banashek]

So I'm just trying to add a simple claim based on a boolean column in my ApplicationUser table in my database. This seems prohibitively difficult.

I set up an IClaimsTransformation implementation which would get the user from the database and add the claim depending on the column value. I'm guessing because it's registered as a transient service is the reason that it's being called every single request, so it seems to be the wrong approach in my case.

I might not be approaching the problem correctly, but I'm not sure what the correct way to solve this problem is. All I want to do is check if a ApplicationUser.IsEnabled property is true in my authorization.

I kinda just want a simple function isUserEnabled, but feel like I have to go through a SpringBeanComparerFactoryFacadeAdapterFactory to check this.

I'll put the problem clearly here:
How do I authorize a user based on a boolean database column?
Is there a way to do it without hitting the database on every request? (claims seem to be the right approach here)
If claims are the right approach, how do I add a claim to a user? (All the auth docs talk about checking claims, but never adding them)
If I need to update a claim on my user, how can I do this? (Say I want to enable a disabled user after they update their payment method)

Thanks for any advice available.

[joeaudette]

@HaoK thanks to your previous help I managed to get my multi-tenant cookie auth working again. Now I am moving on to working on getting my multi-tenant social auth working and could use more advice about what to implement in order to resolve correct MicrosoftAccountOptions per tenant. I am working against preview2 and I see there are additional changes after preview2 such as use of IOptionsSnapshot in preview2 vs IOptionsMonitor in the current code. Since I am targeting preview2 for the moment, I was able to handle the mutlit-tenant cookie auth by implementing a custom

IOptionsSnapshot<CookieAuthenticationOptions>.

Since that worked I figured a similar solution should work for Microsoft Account Authentication by implementing a custom

IOptionsSnapshot<MicrosoftAccountOptions>

But currently I'm getting an error:

    System.NullReferenceException: Object reference not set to an instance of an object.
   at Microsoft.AspNetCore.Authentication.OAuth.OAuthHandler`1.BuildChallengeUrl(AuthenticationProperties properties, String redirectUri) at Microsoft.AspNetCore.Authentication.OAuth.OAuthHandler`1.<HandleChallengeAsync>d__11.MoveNext()

I had a similar null reference when I first implemented the cookie auth but was able to solve it by taking a dependency on

IPostConfigureOptions<CookieAuthenticationOptions>

and calling PostConfigure on my options which seemed to solve whatever was null on my cookie options.

But I don't see anything similar to that to call for my MicrosoftAccountOptions, there exists MicrosoftAccountConfigureOptions but it is internal so I cannot use it even if it would solve the problem.

Wonder if you could shed any light or advice on how best to override the options per request based on my resolved tenant. Mainly I need to adjust the clientid, clientsecret, and callbackpath per tenant.

[joeaudette]

@HaoK it looks like what is null on my MicorosoftAccountOptions is StateDataFormat

What would be the correct way to populate that?