PolicyEvaluator drops authentication properties when authenticating a single scheme
- Dominant language
- C#
- Stars
- 38.4k
- Forks
- 10.9k
- Avg merge
- 2d 6h
- Merged PRs (30d)
- 290
Description
### Is there an existing issue for this?
- [x] I have searched the existing issues
### Describe the bug
When authenticating a specific page or endpoint with a a specific authentication scheme via `[Authorize(AuthenticationSchemes = "MySchemeName")]`, the full authentication properties from authenticating that scheme get dropped by PolicyEvaluator. When I try to read the properties (in order to pass them along to a different sign-in scheme) in my code from IAuthenticateResultFeature, only the expiration property is present.
https://github.com/dotnet/aspnetcore/blob/e2151836317a0d027bf06680c59474086268c8af/src/Security/Authorization/Policy/src/PolicyEvaluator.cs#L57-L61
It appears that PolicyEvaluator is doing this to support merging authentication results from multiple schemes. However, when authenticating only a single scheme for a policy, I think this reduced-functionality merging logic shouldn't apply since there's nothing to merge - the singular set of properties from the singular scheme that was authenticated should be passed straight through.
What PolicyEvaluator receives from authenticating my single scheme:

What AuthorizationMiddleware receives from PolicyEvaluator (and therefore passes along to IAuthenticationResultFeature):

### Expected Behavior
AuthorizationMiddleware populates IAuthenticationResultFeature with the full properties from the authenticated scheme when the scheme is overridden from the default by a policy (i.e. by attribute) that only authenticates a singular scheme (not multiple schemes that need to be merged)
### Steps To Reproduce
Can provide a repro if needed, but the issue is fairly self-evident from the merging logic code in PolicyEvaluator.
### Exceptions (if any)
N/A
### .NET Version
9.0.102
### Anything else?
aspnetcore 9.0.1
Contributor guide
Assessment
This issue has not been assessed yet.