dotnet / dotnet/aspnetcore

PolicyEvaluator drops authentication properties when authenticating a single scheme

Open
#60,506 1 comment 1 reaction 0 assignees View on GitHub
area-auth enhancement
Dominant language
C#
Stars
38.4k
Forks
10.9k
Avg merge
2d 6h
Merged PRs (30d)
290

Description

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Describe the bug

When authenticating a specific page or endpoint with a a specific authentication scheme via `[Authorize(AuthenticationSchemes = "MySchemeName")]`, the full authentication properties from authenticating that scheme get dropped by PolicyEvaluator. When I try to read the properties (in order to pass them along to a different sign-in scheme) in my code from IAuthenticateResultFeature, only the expiration property is present.

https://github.com/dotnet/aspnetcore/blob/e2151836317a0d027bf06680c59474086268c8af/src/Security/Authorization/Policy/src/PolicyEvaluator.cs#L57-L61

It appears that PolicyEvaluator is doing this to support merging authentication results from multiple schemes. However, when authenticating only a single scheme for a policy, I think this reduced-functionality merging logic shouldn't apply since there's nothing to merge - the singular set of properties from the singular scheme that was authenticated should be passed straight through.

What PolicyEvaluator receives from authenticating my single scheme:

![Image](https://github.com/user-attachments/assets/057e2009-94f0-477d-823c-8d94eef3c4c0)

What AuthorizationMiddleware receives from PolicyEvaluator (and therefore passes along to IAuthenticationResultFeature):

![Image](https://github.com/user-attachments/assets/443203c3-6630-4b78-b91d-418d48915da7)

### Expected Behavior

AuthorizationMiddleware populates IAuthenticationResultFeature with the full properties from the authenticated scheme when the scheme is overridden from the default by a policy (i.e. by attribute) that only authenticates a singular scheme (not multiple schemes that need to be merged)

### Steps To Reproduce

Can provide a repro if needed, but the issue is fairly self-evident from the merging logic code in PolicyEvaluator.

### Exceptions (if any)

N/A

### .NET Version

9.0.102

### Anything else?

aspnetcore 9.0.1

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.