Prototype Auth 2.0 changes

global.json

@@ -0,0 +1 @@
+{ "sdk": { "version": "2.0.0-preview1-005783" } }

src/Microsoft.AspNetCore.Server.HttpSys/AuthenticationHandler.cs

@@ -4,9 +4,9 @@
 using System;
 using System.Collections.Generic;
 using System.Security.Claims;
-using System.Security.Principal;
 using System.Threading.Tasks;
-using Microsoft.AspNetCore.Http.Features.Authentication;
+using Microsoft.AspNetCore.Authentication;
+using Microsoft.AspNetCore.Http;
 using Microsoft.Extensions.Internal;
 
 namespace Microsoft.AspNetCore.Server.HttpSys
@@ -16,111 +16,94 @@ internal class AuthenticationHandler : IAuthenticationHandler
         private RequestContext _requestContext;
         private AuthenticationSchemes _authSchemes;
         private AuthenticationSchemes _customChallenges;
+        private AuthenticationScheme _scheme;
 
-        internal AuthenticationHandler(RequestContext requestContext)
-        {
-            _requestContext = requestContext;
-            _authSchemes = requestContext.Response.AuthenticationChallenges;
-            _customChallenges = AuthenticationSchemes.None;
-        }
-
-        public Task AuthenticateAsync(AuthenticateContext context)
+        public Task<AuthenticateResult> AuthenticateAsync()
         {
             var identity = _requestContext.User?.Identity;
-
-            foreach (var authType in ListEnabledAuthSchemes())
+            if (identity != null && identity.IsAuthenticated)
             {
-                var authScheme = authType.ToString();
-                if (string.Equals(authScheme, context.AuthenticationScheme, StringComparison.Ordinal))
+                foreach (var scheme in ListEnabledAuthSchemes())
                 {
-                    if (identity != null && identity.IsAuthenticated
-                        && string.Equals(authScheme, identity.AuthenticationType, StringComparison.Ordinal))
-                    {
-                        context.Authenticated(_requestContext.User, properties: null, description: null);
-                    }
-                    else
+                    if (string.Equals(scheme.ToString(), identity.AuthenticationType, StringComparison.Ordinal))
                     {
-                        context.NotAuthenticated();
+                        return Task.FromResult(AuthenticateResult.Success(new AuthenticationTicket(_requestContext.User, properties: null, authenticationScheme: _scheme.Name)));
                     }
                 }
             }
-            return TaskCache.CompletedTask;
+            return Task.FromResult(AuthenticateResult.None());
         }
 
         public Task ChallengeAsync(ChallengeContext context)
         {
-            var automaticChallenge = string.Equals("Automatic", context.AuthenticationScheme, StringComparison.Ordinal);
-            foreach (var scheme in ListEnabledAuthSchemes())
+            switch (context.Behavior)
             {
-                var authScheme = scheme.ToString();
-                // Not including any auth types means it's a blanket challenge for any auth type.
-                if (automaticChallenge || string.Equals(context.AuthenticationScheme, authScheme, StringComparison.Ordinal))
-                {
-                    switch (context.Behavior)
+                case ChallengeBehavior.Forbidden:
+                    _requestContext.Response.StatusCode = 403;
+                    break;
+                case ChallengeBehavior.Unauthorized:
+                    _requestContext.Response.StatusCode = 401;
+                    foreach (var scheme in ListEnabledAuthSchemes())
                     {
-                        case ChallengeBehavior.Forbidden:
-                            _requestContext.Response.StatusCode = 403;
-                            context.Accept();
-                            break;
-                        case ChallengeBehavior.Unauthorized:
-                            _requestContext.Response.StatusCode = 401;
-                            _customChallenges |= scheme;
-                            context.Accept();
-                            break;
-                        case ChallengeBehavior.Automatic:
-                            var identity = (ClaimsIdentity)_requestContext.User?.Identity;
-                            if (identity != null && identity.IsAuthenticated
-                                && (automaticChallenge || string.Equals(identity.AuthenticationType, context.AuthenticationScheme, StringComparison.Ordinal)))
+                        _customChallenges |= scheme;
+                    }
+                    break;
+                case ChallengeBehavior.Automatic:
+                    var identity = (ClaimsIdentity)_requestContext.User?.Identity;
+                    if (identity != null && identity.IsAuthenticated)
+                    {
+                        foreach (var scheme in ListEnabledAuthSchemes())
+                        {
+                            if (string.Equals(identity.AuthenticationType, scheme.ToString(), StringComparison.Ordinal))
                             {
                                 _requestContext.Response.StatusCode = 403;
-                                context.Accept();
-                            }
-                            else
-                            {
-                                _requestContext.Response.StatusCode = 401;
-                                _customChallenges |= scheme;
-                                context.Accept();
+                                break;
                             }
-                            break;
-                        default:
-                            throw new NotSupportedException(context.Behavior.ToString());
+                        }
                     }
-                }
+                    else
+                    {
+                        _requestContext.Response.StatusCode = 401;
+                        foreach (var scheme in ListEnabledAuthSchemes())
+                        {
+                            _customChallenges |= scheme;
+                        }
+                    }
+                    break;
+                default:
+                    throw new NotSupportedException(context.Behavior.ToString());
             }
+
             // A challenge was issued, it overrides any pre-set auth types.
             _requestContext.Response.AuthenticationChallenges = _customChallenges;
             return TaskCache.CompletedTask;
         }
 
-        public void GetDescriptions(DescribeSchemesContext context)
+        public Task InitializeAsync(AuthenticationScheme scheme, HttpContext context)
         {
-            // TODO: Caching, this data doesn't change per request.
-            foreach (var scheme in ListEnabledAuthSchemes())
+            _scheme = scheme;
+            _requestContext = context.Features.Get<RequestContext>();
+
+            if (_requestContext == null)
             {
-                context.Accept(GetDescription(scheme.ToString()));
+                throw new InvalidOperationException("No RequestContext found.");
             }
+
+            _authSchemes = _requestContext.Response.AuthenticationChallenges;
+            _customChallenges = AuthenticationSchemes.None;
+            return TaskCache.CompletedTask;
         }
 
         public Task SignInAsync(SignInContext context)
         {
-            // Not supported. AuthenticationManager will throw if !Accepted.
-            return TaskCache.CompletedTask;
+            throw new NotSupportedException();
         }
 
         public Task SignOutAsync(SignOutContext context)
         {
-            // Not supported. AuthenticationManager will throw if !Accepted.
             return TaskCache.CompletedTask;
         }
 
-        private IDictionary<string, object> GetDescription(string authenticationScheme)
-        {
-            return new Dictionary<string, object>()
-            {
-                { "AuthenticationScheme", authenticationScheme },
-            };
-        }
-
         private IEnumerable<AuthenticationSchemes> ListEnabledAuthSchemes()
         {
             // Order by strength.

src/Microsoft.AspNetCore.Server.HttpSys/FeatureContext.cs

@@ -52,7 +52,6 @@ internal class FeatureContext :
         private string _traceIdentitfier;
         private X509Certificate2 _clientCert;
         private ClaimsPrincipal _user;
-        private IAuthenticationHandler _authHandler;
         private CancellationToken _disconnectToken;
         private Stream _responseStream;
         private IHeaderDictionary _responseHeaders;
@@ -68,7 +67,6 @@ internal FeatureContext(RequestContext requestContext, bool enableResponseCachin
         {
             _requestContext = requestContext;
             _features = new FeatureCollection(new StandardFeatureCollection(this));
-            _authHandler = new AuthenticationHandler(requestContext);
             _enableResponseCaching = enableResponseCaching;
 
             // Pre-initialize any fields that are not lazy at the lower level.
@@ -446,11 +444,8 @@ ClaimsPrincipal IHttpAuthenticationFeature.User
             set { _user = value; }
         }
 
-        IAuthenticationHandler IHttpAuthenticationFeature.Handler
-        {
-            get { return _authHandler; }
-            set { _authHandler = value; }
-        }
+        [Obsolete("See https://go.microsoft.com/fwlink/?linkid=845470")]
+        IAuthenticationHandler IHttpAuthenticationFeature.Handler { get; set; }
 
         string IHttpRequestIdentifierFeature.TraceIdentifier
         {

src/Microsoft.AspNetCore.Server.HttpSys/MessagePump.cs

@@ -2,9 +2,12 @@
 // Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
 
 using System;
+using System.Collections.Generic;
 using System.Diagnostics.Contracts;
+using System.Linq;
 using System.Threading;
 using System.Threading.Tasks;
+using Microsoft.AspNetCore.Authentication;
 using Microsoft.AspNetCore.Hosting.Server;
 using Microsoft.AspNetCore.Hosting.Server.Features;
 using Microsoft.AspNetCore.Http.Features;
@@ -30,7 +33,7 @@ internal class MessagePump : IServer
 
         private readonly ServerAddressesFeature _serverAddresses;
 
-        public MessagePump(IOptions<HttpSysOptions> options, ILoggerFactory loggerFactory)
+        public MessagePump(IOptions<HttpSysOptions> options, ILoggerFactory loggerFactory, IEnumerable<IAuthenticationSchemeProvider> authentication)
         {
             if (options == null)
             {
@@ -40,10 +43,21 @@ public MessagePump(IOptions<HttpSysOptions> options, ILoggerFactory loggerFactor
             {
                 throw new ArgumentNullException(nameof(loggerFactory));
             }
-
             _options = options.Value;
             Listener = new HttpSysListener(_options, loggerFactory);
             _logger = LogHelper.CreateLogger(loggerFactory, typeof(MessagePump));
+
+            if (_options.Authentication.Schemes != AuthenticationSchemes.None)
+            {
+                var auth = authentication.FirstOrDefault();
+                if (auth == null)
+                {
+                    throw new InvalidOperationException("AddAuthentication() is required to use Authentication.");
+                }
+
+                auth.AddScheme(new AuthenticationScheme("Windows", displayName: null, handlerType: typeof(AuthenticationHandler)));
+            }
+
             Features = new FeatureCollection();
             _serverAddresses = new ServerAddressesFeature();
             Features.Set<IServerAddressesFeature>(_serverAddresses);

src/Microsoft.AspNetCore.Server.HttpSys/Microsoft.AspNetCore.Server.HttpSys.csproj

@@ -12,6 +12,7 @@
   </PropertyGroup>
 
   <ItemGroup>
+    <PackageReference Include="Microsoft.AspNetCore.Authentication.Core" Version="$(AspNetCoreVersion)" />
     <PackageReference Include="Microsoft.AspNetCore.Hosting" Version="$(AspNetCoreVersion)" />
     <PackageReference Include="Microsoft.Extensions.RuntimeEnvironment.Sources" Version="$(AspNetCoreVersion)" PrivateAssets="All" />
     <PackageReference Include="Microsoft.Extensions.TaskCache.Sources" Version="$(AspNetCoreVersion)" PrivateAssets="All" />

src/Microsoft.AspNetCore.Server.HttpSys/WebHostBuilderHttpSysExtensions.cs

@@ -2,6 +2,7 @@
 // Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
 
 using System;
+using Microsoft.AspNetCore.Authentication;
 using Microsoft.AspNetCore.Hosting.Server;
 using Microsoft.AspNetCore.Server.HttpSys;
 using Microsoft.Extensions.DependencyInjection;