{"action":"created","issue":{"url":"https://api.github.com/repos/aspnet/Security/issues/277","labels_url":"https://api.github.com/repos/aspnet/Security/issues/277/labels{/name}","comments_url":"https://api.github.com/repos/aspnet/Security/issues/277/comments","events_url":"https://api.github.com/repos/aspnet/Security/issues/277/events","html_url":"https://github.com/aspnet/Security/issues/277","id":81171087,"number":277,"title":"OAuthBearerAuthentication Regression Between 1.0.0 beta 3 and beta 4","user":{"login":"psidebotham","id":238831,"avatar_url":"https://avatars.githubusercontent.com/u/238831?v=3","gravatar_id":"","url":"https://api.github.com/users/psidebotham","html_url":"https://github.com/psidebotham","followers_url":"https://api.github.com/users/psidebotham/followers","following_url":"https://api.github.com/users/psidebotham/following{/other_user}","gists_url":"https://api.github.com/users/psidebotham/gists{/gist_id}","starred_url":"https://api.github.com/users/psidebotham/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/psidebotham/subscriptions","organizations_url":"https://api.github.com/users/psidebotham/orgs","repos_url":"https://api.github.com/users/psidebotham/repos","events_url":"https://api.github.com/users/psidebotham/events{/privacy}","received_events_url":"https://api.github.com/users/psidebotham/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-05-26T22:45:54Z","updated_at":"2015-05-27T10:36:28Z","closed_at":null,"body":"I'm updating to 1.0.0-beta4, with an application that uses OpenIDConnect with Windows Azure for browser authentication, and OAuthBearerAuthentication for native client auth.\r\n\r\nOAuthBearer was chosen for compatibility with ADAL.\r\n\r\nAfter upgrading to beta 4, I was able to make a few changes and got OpenIdConnect working again.\r\nThe OAuthBearer middleware seems to be completely ignored, regardless of whether a request has a Bearer Authorization header. None of the notifications are hit. Since there are no OAuthBearer samples for this beta, I'm not sure what I'm missing.\r\n\r\nIn `Startup.ConfigureServices` I have:\r\n```c#\r\nservices.AddWebEncoders();\r\nservices.AddDataProtection();\r\nservices.Configure<ExternalAuthenticationOptions>(options =>\r\n{\r\n    options.SignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;\r\n});\r\n\r\nservices.AddMvc...\r\n\r\n```\r\nIn `Startup.Configure` I have:\r\n```c#\r\n\r\napp.UseCookieAuthentication(options =>\r\n{\r\n    options.AutomaticAuthentication = true;\r\n});\r\n         \r\napp.UseOAuthBearerAuthentication(options =>\r\n{\r\n    options.Audience = Configuration.Get(\"AzureAd:Audience\");\r\n    options.Authority = Configuration.Get(\"AzureAd:Authority\");\r\n    options.TokenValidationParameters.ValidateIssuer = false;\r\n    options.Notifications.ApplyChallenge = (context) =>\r\n    { // breakpoint never hit\r\n        context.HttpContext.Response.Headers.AppendValues(\"WWW-Authenticate\", context.Options.Challenge);\r\n        return Task.FromResult(0);\r\n    };\r\n    options.Notifications.MessageReceived = (context) =>\r\n    { // breakpoint never hit\r\n        return Task.FromResult(0);\r\n    };\r\n    options.Notifications.SecurityTokenReceived = (context) =>\r\n    { // breakpoint never hit\r\n        return Task.FromResult(0);\r\n    };\r\n    options.Notifications.SecurityTokenValidated = (context) =>\r\n    { // breakpoint never hit\r\n        TestIssuer(context.AuthenticationTicket); // does tenant specific issuer validation\r\n        return Task.FromResult(0);\r\n    };\r\n    options.Notifications.AuthenticationFailed = (context) =>\r\n    { // breakpoint never hit\r\n        return Task.FromResult(0);\r\n    };\r\n});\r\n\r\napp.UseOpenIdConnectAuthentication(options =>\r\n{\r\n// OpenIDConnect functions as expected\r\n});\r\n...\r\napp.UseMvc...\r\n```\r\n"},"comment":{"url":"https://api.github.com/repos/aspnet/Security/issues/comments/105860744","html_url":"https://github.com/aspnet/Security/issues/277#issuecomment-105860744","issue_url":"https://api.github.com/repos/aspnet/Security/issues/277","id":105860744,"user":{"login":"PinpointTownes","id":6998306,"avatar_url":"https://avatars.githubusercontent.com/u/6998306?v=3","gravatar_id":"","url":"https://api.github.com/users/PinpointTownes","html_url":"https://github.com/PinpointTownes","followers_url":"https://api.github.com/users/PinpointTownes/followers","following_url":"https://api.github.com/users/PinpointTownes/following{/other_user}","gists_url":"https://api.github.com/users/PinpointTownes/gists{/gist_id}","starred_url":"https://api.github.com/users/PinpointTownes/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/PinpointTownes/subscriptions","organizations_url":"https://api.github.com/users/PinpointTownes/orgs","repos_url":"https://api.github.com/users/PinpointTownes/repos","events_url":"https://api.github.com/users/PinpointTownes/events{/privacy}","received_events_url":"https://api.github.com/users/PinpointTownes/received_events","type":"User","site_admin":false},"created_at":"2015-05-27T10:36:27Z","updated_at":"2015-05-27T10:36:27Z","body":"@psidebotham set `options.AutomaticAuthentication` to `true` in `app.UseOAuthBearerAuthentication`.\r\n\r\n/cc @blowdart"}}