{"action":"created","issue":{"url":"https://api.github.com/repos/aspnet/Security/issues/345","labels_url":"https://api.github.com/repos/aspnet/Security/issues/345/labels{/name}","comments_url":"https://api.github.com/repos/aspnet/Security/issues/345/comments","events_url":"https://api.github.com/repos/aspnet/Security/issues/345/events","html_url":"https://github.com/aspnet/Security/issues/345","id":93890127,"number":345,"title":"Override default ClaimsPrincipal.PrimaryIdentitySelector","user":{"login":"blowdart","id":796298,"avatar_url":"https://avatars.githubusercontent.com/u/796298?v=3","gravatar_id":"","url":"https://api.github.com/users/blowdart","html_url":"https://github.com/blowdart","followers_url":"https://api.github.com/users/blowdart/followers","following_url":"https://api.github.com/users/blowdart/following{/other_user}","gists_url":"https://api.github.com/users/blowdart/gists{/gist_id}","starred_url":"https://api.github.com/users/blowdart/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/blowdart/subscriptions","organizations_url":"https://api.github.com/users/blowdart/orgs","repos_url":"https://api.github.com/users/blowdart/repos","events_url":"https://api.github.com/users/blowdart/events{/privacy}","received_events_url":"https://api.github.com/users/blowdart/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-07-08T21:03:42Z","updated_at":"2015-07-09T14:10:30Z","closed_at":null,"body":"In the case of multiple identities on a principal Principal.Identity returns the first one added (with no guarantee of this. Bad back compat decision, but what can you do?). I\r\n\r\nIf an unauthenicated identity is added first, followed by an authenticated one then User.Identity.IsAuthenticated will be false, which is probably not what people expect.\r\n\r\nWe should either override the identityselector to ensure ordering where authenticated identities are returned first, or remove all references to User.Identity.IsAuthenticated and replace them with a statement that looks in the Identities collection for any authenticated identity."},"comment":{"url":"https://api.github.com/repos/aspnet/Security/issues/comments/119994498","html_url":"https://github.com/aspnet/Security/issues/345#issuecomment-119994498","issue_url":"https://api.github.com/repos/aspnet/Security/issues/345","id":119994498,"user":{"login":"brentschmaltz","id":3172421,"avatar_url":"https://avatars.githubusercontent.com/u/3172421?v=3","gravatar_id":"","url":"https://api.github.com/users/brentschmaltz","html_url":"https://github.com/brentschmaltz","followers_url":"https://api.github.com/users/brentschmaltz/followers","following_url":"https://api.github.com/users/brentschmaltz/following{/other_user}","gists_url":"https://api.github.com/users/brentschmaltz/gists{/gist_id}","starred_url":"https://api.github.com/users/brentschmaltz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/brentschmaltz/subscriptions","organizations_url":"https://api.github.com/users/brentschmaltz/orgs","repos_url":"https://api.github.com/users/brentschmaltz/repos","events_url":"https://api.github.com/users/brentschmaltz/events{/privacy}","received_events_url":"https://api.github.com/users/brentschmaltz/received_events","type":"User","site_admin":false},"created_at":"2015-07-09T14:10:30Z","updated_at":"2015-07-09T14:10:30Z","body":"Good idea, we could then leave the Identities in the order that the Authentication Middleware placed them"}}