{"action":"created","issue":{"url":"https://api.github.com/repos/aspnet/Security/issues/510","labels_url":"https://api.github.com/repos/aspnet/Security/issues/510/labels{/name}","comments_url":"https://api.github.com/repos/aspnet/Security/issues/510/comments","events_url":"https://api.github.com/repos/aspnet/Security/issues/510/events","html_url":"https://github.com/aspnet/Security/issues/510","id":110635455,"number":510,"title":"Question: Authorize attribute with policy requirement throwing: The following authentication scheme was not accepted","user":{"login":"sulhome","id":6747192,"avatar_url":"https://avatars.githubusercontent.com/u/6747192?v=3","gravatar_id":"","url":"https://api.github.com/users/sulhome","html_url":"https://github.com/sulhome","followers_url":"https://api.github.com/users/sulhome/followers","following_url":"https://api.github.com/users/sulhome/following{/other_user}","gists_url":"https://api.github.com/users/sulhome/gists{/gist_id}","starred_url":"https://api.github.com/users/sulhome/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sulhome/subscriptions","organizations_url":"https://api.github.com/users/sulhome/orgs","repos_url":"https://api.github.com/users/sulhome/repos","events_url":"https://api.github.com/users/sulhome/events{/privacy}","received_events_url":"https://api.github.com/users/sulhome/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-10-09T10:56:57Z","updated_at":"2015-10-09T12:26:32Z","closed_at":null,"body":"I have this simple setup for policy requirement. I am assuming that this should return 401 but instead it is throwing an exception\r\n\r\n**Startup.cs**\r\n\r\n    public class Startup\r\n    {\r\n        public Startup(IHostingEnvironment env)\r\n        {\r\n        }\r\n        \r\n        public void ConfigureServices(IServiceCollection services)\r\n        {\r\n            services.ConfigureAuthorization(options =>\r\n            {\r\n                var policyBuilder = new AuthorizationPolicyBuilder();                \r\n                policyBuilder.AddRequirements(new MyPolicyRequirement());\r\n                options.AddPolicy(\"MyPolicy\", policyBuilder.Build());\r\n            });\r\n            services.AddMvc();            \r\n        }\r\n\r\n        // Configure is called after ConfigureServices is called.\r\n        public void Configure(IApplicationBuilder app, IHostingEnvironment env)\r\n        {\r\n            //app.UseErrorPage();            \r\n            app.UseStaticFiles();            \r\n            app.UseMvc();           \r\n        }\r\n    }\r\n\r\n**MyPolicyRequirement.cs**\r\n\r\n    public class MyPolicyRequirement : AuthorizationHandler<MyPolicyRequirement>, IAuthorizationRequirement\r\n    {\r\n        protected override void Handle(AuthorizationContext context, MyPolicyRequirement requirement)\r\n        {            \r\n            if (!context.User.HasClaim(c => c.Type == \"yes\"))\r\n            {\r\n                context.Fail();\r\n                return;\r\n            }\r\n\r\n            context.Succeed(requirement);                 \r\n        }\r\n    }\r\n\r\n**ValuesController.cs**\r\n\r\n    [Route(\"api/[controller]\")]\r\n    public class ValuesController : Controller\r\n    {\r\n        [Authorize(Policy = \"MyPolicy\")]\r\n        [HttpGet]\r\n        public IEnumerable<string> Get()\r\n        {\r\n            return new string[] { \"value1\", \"value2\" };\r\n        }        \r\n    }\r\n\r\nThe process flow for this as I understand it is that you register an Authorization policy then you use it with the Authorize attribute then this will be checked prior of executing the method on the controller however this is not happening and instead I am getting this exception\r\n\r\n**Exception**\r\n\r\n    System.InvalidOperationException\r\n    The following authentication scheme was not accepted: \r\n    at Microsoft.AspNet.Http.Authentication.Internal.DefaultAuthenticationManager.<ChallengeAsync>d__10.MoveNext() \r\n    at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) \r\n    at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) \r\n    at System.Runtime.CompilerServices.TaskAwaiter.GetResult() \r\n    at Microsoft.AspNet.Mvc.ChallengeResult.<ExecuteResultAsync>d__14.MoveNext() \r\n    at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) \r\n    at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) \r\n    at System.Runtime.CompilerServices.TaskAwaiter.GetResult() \r\n    at Microsoft.AspNet.Mvc.Core.FilterActionInvoker.<InvokeResultAsync>d__53.MoveNext() \r\n    at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) \r\n    at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) \r\n    at System.Runtime.CompilerServices.TaskAwaiter.GetResult() \r\n    at Microsoft.AspNet.Mvc.Core.FilterActionInvoker.<InvokeAsync>d__41.MoveNext() \r\n    at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) \r\n    at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) \r\n    at System.Runtime.CompilerServices.TaskAwaiter.GetResult() \r\n    at Microsoft.AspNet.Mvc.MvcRouteHandler.<InvokeActionAsync>d__7.MoveNext() \r\n    at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) \r\n    at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) \r\n    at System.Runtime.CompilerServices.TaskAwaiter.GetResult() \r\n    at Microsoft.AspNet.Mvc.MvcRouteHandler.<RouteAsync>d__6.MoveNext() \r\n    at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) \r\n    at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) \r\n    at System.Runtime.CompilerServices.TaskAwaiter.GetResult() \r\n    at Microsoft.AspNet.Mvc.Routing.InnerAttributeRoute.<RouteAsync>d__10.MoveNext() \r\n    at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) \r\n    at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) \r\n    at System.Runtime.CompilerServices.TaskAwaiter.GetResult() \r\n    at Microsoft.AspNet.Routing.RouteCollection.<RouteAsync>d__9.MoveNext() \r\n    at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) \r\n    at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) \r\n    at System.Runtime.CompilerServices.TaskAwaiter.GetResult() \r\n    at Microsoft.AspNet.Builder.RouterMiddleware.<Invoke>d__4.MoveNext() \r\n    at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) \r\n    at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) \r\n    at System.Runtime.CompilerServices.TaskAwaiter.GetResult() \r\n    at Microsoft.AspNet.Hosting.Internal.RequestServicesContainerMiddleware.<Invoke>d__3.MoveNext() \r\n    at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) \r\n    at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) \r\n    at System.Runtime.CompilerServices.TaskAwaiter.GetResult() \r\n    at Microsoft.AspNet.Hosting.Internal.HostingEngine.<>c__DisplayClass29_0.<<Start>b__0>d.MoveNext() \r\n    at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) \r\n    at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) \r\n    at System.Runtime.CompilerServices.TaskAwaiter.GetResult() \r\n    at Microsoft.AspNet.Loader.IIS.RuntimeHttpApplication.<ProcessRequestAsyncImpl>d__13.MoveNext() \r\n    --- exception rethrown --- \r\n    at Microsoft.AspNet.Loader.IIS.RuntimeHttpApplication.<ProcessRequestAsyncImpl>d__13.MoveNext() \r\n    at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) \r\n    at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) \r\n    at System.Runtime.CompilerServices.TaskAwaiter.GetResult() \r\n    at Microsoft.AspNet.Loader.IIS.HttpApplicationBase.<InvokeProcessRequestAsyncImpl>d__9.MoveNext()"},"comment":{"url":"https://api.github.com/repos/aspnet/Security/issues/comments/146850012","html_url":"https://github.com/aspnet/Security/issues/510#issuecomment-146850012","issue_url":"https://api.github.com/repos/aspnet/Security/issues/510","id":146850012,"user":{"login":"DAllanCarr","id":13968716,"avatar_url":"https://avatars.githubusercontent.com/u/13968716?v=3","gravatar_id":"","url":"https://api.github.com/users/DAllanCarr","html_url":"https://github.com/DAllanCarr","followers_url":"https://api.github.com/users/DAllanCarr/followers","following_url":"https://api.github.com/users/DAllanCarr/following{/other_user}","gists_url":"https://api.github.com/users/DAllanCarr/gists{/gist_id}","starred_url":"https://api.github.com/users/DAllanCarr/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/DAllanCarr/subscriptions","organizations_url":"https://api.github.com/users/DAllanCarr/orgs","repos_url":"https://api.github.com/users/DAllanCarr/repos","events_url":"https://api.github.com/users/DAllanCarr/events{/privacy}","received_events_url":"https://api.github.com/users/DAllanCarr/received_events","type":"User","site_admin":false},"created_at":"2015-10-09T12:26:32Z","updated_at":"2015-10-09T12:26:32Z","body":"Excellent article from @leastprivilege outlining supported middlewares.\r\nhttp://leastprivilege.com/2015/07/21/the-state-of-security-in-asp-net-5-and-mvc-6-claims-authentication/\r\n"}}