{"action":"reopened","issue":{"url":"https://api.github.com/repos/aspnet/Security/issues/328","labels_url":"https://api.github.com/repos/aspnet/Security/issues/328/labels{/name}","comments_url":"https://api.github.com/repos/aspnet/Security/issues/328/comments","events_url":"https://api.github.com/repos/aspnet/Security/issues/328/events","html_url":"https://github.com/aspnet/Security/issues/328","id":92688802,"number":328,"title":"Why does AuthenticationHandler.ChallengeAsync call AuthenticateAsync()?","user":{"login":"brentschmaltz","id":3172421,"avatar_url":"https://avatars.githubusercontent.com/u/3172421?v=3","gravatar_id":"","url":"https://api.github.com/users/brentschmaltz","html_url":"https://github.com/brentschmaltz","followers_url":"https://api.github.com/users/brentschmaltz/followers","following_url":"https://api.github.com/users/brentschmaltz/following{/other_user}","gists_url":"https://api.github.com/users/brentschmaltz/gists{/gist_id}","starred_url":"https://api.github.com/users/brentschmaltz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/brentschmaltz/subscriptions","organizations_url":"https://api.github.com/users/brentschmaltz/orgs","repos_url":"https://api.github.com/users/brentschmaltz/repos","events_url":"https://api.github.com/users/brentschmaltz/events{/privacy}","received_events_url":"https://api.github.com/users/brentschmaltz/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/aspnet/Security/labels/question","name":"question","color":"cc317c"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-07-02T17:21:05Z","updated_at":"2015-07-07T01:29:36Z","closed_at":null,"body":"I noticed that if I make the code: \r\nawait context.Authentication.ChallengeAsync(OpenIdConnectAuthenticationDefaults.AuthenticationScheme, new AuthenticationProperties { RedirectUri = \"/\" })\r\nAuthenticationHandler.AuthenticateAsync() is called if context.Behavior ==ChallengeBehavior.Automatic.\r\nIf a ticket is returned, then the runtime calls  HandleForbiddenAsync().\r\n\r\nHow should I be thinking about this? Can you help me understand what HandleForbiddenAsync()  is for?"}}