ASP.NET Core 2.0 Preview 1: How to set up Cookie Authentication with custom login path

Question

In ASP.NET Core 2.0 the .UseAuthentication() middleware has a breaking change that no longer allows the old syntax mentioned here to work.

The new version appears to deal with config in addAuthentication, but I can't find any details anywhere on how to change my old code that specified a custom login and logout url.

        services.AddAuthentication(o =>
        {
            // Where can I specify this?????
            var opt = new CookieAuthenticationOptions()
            {
                LoginPath = "/api/login",
                LogoutPath = "/api/logout",
            };

           o.DefaultSignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;
           o.DefaultAuthenticateScheme = CookieAuthenticationDefaults.AuthenticationScheme;
        });

Any help would be appreciated...

Massimiliano Kraus · Accepted Answer · 2018-01-02 19:54:58Z

13

Updated as this has changed slightly again in the 2.0 RTM bits

It turns out it's a lot easier than expected, but as the official documentation hasn't been updated yet, here is exactly what works for plain Cookie auth:

Configuration:

In ConfigureServices() configure the specific Authentication mechanism:

services
    .AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
    .AddCookie(o =>
    {
        o.LoginPath = "/api/login";
        o.LogoutPath = "/api/logout";
        // additional config options here
    });

Then in Configure() to actually hook up the middleware:

app.UseAuthentication();

Using the Auth Components

Then to use the actual Auth components the logic has shifted from the HttpContext.Authentication object, down to just HttpContext in application logic like controller code:

await HttpContext.SignInAsync(CookieAuthenticationDefaults.AuthenticationScheme,
            new ClaimsPrincipal(identity));

or:

await HttpContext.SignOutAsync(CookieAuthenticationDefaults.AuthenticationScheme);

edited Jan 2, 2018 at 19:54

Massimiliano Kraus

3,8925 gold badges32 silver badges51 bronze badges

answered Aug 13, 2017 at 20:02

Rick Strahl

17.8k15 gold badges100 silver badges143 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Lost_In_Library Over a year ago

Just a note: You need to add this nuget package: "Microsoft.AspNetCore.Authentication.Cookies" for CookieAuthenticationDefaults, ***Defaults etc.

Rick Strahl Over a year ago

@Lost_In_Library - you don't need to add this if you use the ASP.NET Core meta package. You only add it if you explicitly add individual ASP.NET packages.

Jason Spake Over a year ago

Another note to hopefully save someone a headache: The extension method for HttpContext.SignInAsync only shows up if you have the using import for "Microsoft.AspNetCore.Authentication"

Tseng · Accepted Answer · 2017-05-14 09:13:31Z

10

The example you posted doesn't seem to be a real code anyways (i.e. new CookieAuthenticationOptions() being inside the AddAuthentication call, rather than as argument to AddCookieAuthentication). You don't add authorizations inside the AddAuthorization call, you just setup standards middlewares here, see this announcement.

Old:

services.AddAuthentication(sharedOptions => 
       sharedOptions.SignInScheme = CookieAuthenticationDefaults.AuthenticationScheme);

app.UseOpenIdConnectAuthentication(new OpenIdConnectOptions
   AutomaticChallenge = true,
   AutomaticAuthenticate = true,

New:

app.AddAuthentication(o => {
   o.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme;
   o.DefaultSignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;
   o.DefaultAuthenticateScheme = CookieAuthenticationDefaults.AuthenticationScheme;
});

And the

services.AddXxxAuthentication(new XxxOptions() { ... });

are replaced with

services.AddXxxAuthentication(options => {
});

to be inline with all other methods which accept a configuration.

Also always worth a look at the ASP.NET Core Announcements GitHub Repository, where the ASP.NET Core Team announces breaking changes for the next version, just select a specific milestone there, i.e. 2.0.0-preview1, 2.0.0-preview2, etc.

answered May 14, 2017 at 9:13

Tseng

64.5k18 gold badges200 silver badges215 bronze badges

4 Comments

Nico Over a year ago

good post, spent half a day on this. All of what you said is visible in the basic .netcoreapp2.0 template (with local authorization) A key point to add is the section HttpContext.Authentication will be obsolete as the way you Authenticate\SignIn\Signout etc has changed

jAC Over a year ago

I know the Git Announcement states otherwise but in my case, IApplicationBuilder has no method called Add*, so shouldn't app.AddAuthentication(...) be service.AddAuthentication(...)?

Tseng Over a year ago

@JanesAbouChleih: Yea, I guess so. Probably a typo while manually typing it in w/o an IDE

Rick Strahl Over a year ago

Thanks Tseng. I couldn't make your code (or the code in the change log) to work because I was still running the pre-release builds. Once switching to RTM the code works. I've added another answer with the relevant code specific for Cookie auth, but your answer led me to the right place. Thanks.

Collectives™ on Stack Overflow

ASP.NET Core 2.0 Preview 1: How to set up Cookie Authentication with custom login path

2 Answers 2

3 Comments

4 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

3 Comments

4 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related