ASP.NET Web API 2 with Multiple Authentication Filters

Question

What is the intended semantics for multiple authentication filters? It is allowed? and if so, how do they work together?

Here is an example. Suppose I have a controller class like

[BasicAuthenticator] [LocalAuthenticator] [Authorize] public class TestController : ApiController { [AllowAnonymous] public IHttpActionResult GetProduct(int id) { } // etc. etc } 

in which BasicAuthenticator and LocalAuthenticator implement the IAuthenticationFilter.

Each authenticator will get a chance to succeed. If either succeeds, it will set context.Principal to a new object with the corresponding ClaimsIdentity identifier (name, type and isAuthenticated = true).

What if the authenticator does not work? I think that he should not do anything so that another has a chance to succeed. Right?

And what if both succeed? Depending on what the second time removes the Principal created the first? Wouldn't it make sense to combine the ClaimsIdentity collections of the two main objects together?

If the authenticator fails, it should not do anything, right? Because another authenticator may succeed. The semantics of the presence of two authenticators is that the action will be performed, if one of them succeeds, correct?

I think that the Authorize class will look at all ClaimsIdentity in the main, and if any ClaimsIdentity has "isAuthenticated = true", then it will allow the controller action to start. Otherwise, it will set status = 401. This seems to work. It is right?

The purpose of [AllowAnonymous] is to disable all other authorization filters, fix it? The controller (or method of action) is decorated with [AllowAnonymous] , then I assume that it should always start, even if authentication fails. It is right?

Answer 1

With the recent authentication filter introduced in Web API 2, I assume that it is assumed that authentication requires one attribute and possibly one authorization attribute, since the MS team has separated the two issues. Thus, the semantics must have one for authentication.

It seems to me that the fact that you can add several authentication attributes is just a coincidence, because you set filters on the controllers and their actions using attributes, and since you can add several attributes .. The same thing happens with the verification filter setting authentication throughout the project on all actions of all controllers: since you can add multiple filters, this does not necessarily mean that you need to add multiple authentication filters.

If you need to support multiple authentication mechanisms (for example, Basic and Local ), you can simply have one single attribute / filter that intercepts the request and that will try to use both mechanisms, implementing any AND / OR user logic that you may need.

Answer 2

The last authentication filter that runs successfully simply captures the Principal. When you look at the Principal object and the ridiculously complex claims collections that come with it, you will think that all this complexity is undoubtedly designed to support several successful authentications! But you are mistaken. Only one can succeed. There is no reason for complexity other than indulging the vanity of some architect at Microsoft.