如何在ASP.NET核心中间件中强制执行实际的身份验证工作流

Question

I want to inject some application context that is based on authenticated user into the execution context so that business/service layers can use it transparently. I am planning to use middleware for setting up the same. Sample code in startup is

app.UseAuthentication();

// my custom middleware
app.Use(async (context, next) =>
{
    // use context.User to build the application context 
    // ...

    // inject into execution context
    // ...
}

app.UseMvc(..)

Unfortunately, HttpContext.User.Identity.IsAuthenticated remains false in my custom middleware. Actual authentication based on JWT Tokens gets triggered when MVC Authorization filters are hit. So how can I overcome this issue? Is there a way to know when actual authentication stage is finished (similar to global.asax in classic ASP.NET pipeline) or how can I enforce authentication handlers in my middleware. I tried playing with extension methods context.AuthenticateAsync to force the construction of actual user principal but in vain.

Another issue that I hit is carrier for my application context. I earlier chose AsycLocal<T> but found out that what I set in my middleware is not available at downstream code. So currently, I am using HttpContext.Items to carry my application context which will work but I am curious to know why AsycLocal<T> failed. Is it not guaranteed to be carried over execution context in ASP.NET pipeline?

As requested, ConfigureServices part

    // Add Azure AD JWT Bearer Token support for API authentication
    services.AddAuthentication(AzureADDefaults.JwtBearerAuthenticationScheme)
                       .AddAzureADBearer(options => Configuration.Bind("AzureAd", options));
    ...
    // Add Azure AD OpenID authentication support for interactive UI
    services.AddAzureAdV2Authentication(Configuration);

Also found need for adding schemes in policy for multiple schemes to work

        // Add MVC with authentication/authorization
        services.AddMvc(options =>
        {
            var policy = new AuthorizationPolicyBuilder()
                .RequireAuthenticatedUser()
                .AddAuthenticationSchemes(AzureADDefaults.OpenIdScheme,
                    AzureADDefaults.JwtBearerAuthenticationScheme)
                .Build();
            options.Filters.Add(new AuthorizeFilter(policy));
        })

Finally, in my middleware, I was trying to enforce authentication using snippet such as

     if (!context.User.Identity.IsAuthenticated)
     {
          if(context.Request.Headers.ContainsKey(HeaderNames.Authorization))
          {
               await context.AuthenticateAsync(
                   AzureADDefaults.JwtBearerAuthenticationScheme);
          }
          else
          {
              // issue OpenID challange
              ...
          }
       }

      // here, I still found context.User.Identity.IsAuthenticated false

Answer 1

app.UseAuthentication() only tries to authenticate with the default scheme and I'm guessing JWT Tokens is not your default. You can try context.AuthenticateAsync(JwtBearerDefaults.AuthenticationScheme) to authenticate with jwt scheme.