{"action":"created","issue":{"url":"https://api.github.com/repos/aspnet/Mvc/issues/1601","labels_url":"https://api.github.com/repos/aspnet/Mvc/issues/1601/labels{/name}","comments_url":"https://api.github.com/repos/aspnet/Mvc/issues/1601/comments","events_url":"https://api.github.com/repos/aspnet/Mvc/issues/1601/events","html_url":"https://github.com/aspnet/Mvc/issues/1601","id":49492321,"number":1601,"title":"Calling passive authentication middleware from MVC/Web API","user":{"login":"BadriL","id":4556372,"avatar_url":"https://avatars.githubusercontent.com/u/4556372?v=3","gravatar_id":"","url":"https://api.github.com/users/BadriL","html_url":"https://github.com/BadriL","followers_url":"https://api.github.com/users/BadriL/followers","following_url":"https://api.github.com/users/BadriL/following{/other_user}","gists_url":"https://api.github.com/users/BadriL/gists{/gist_id}","starred_url":"https://api.github.com/users/BadriL/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/BadriL/subscriptions","organizations_url":"https://api.github.com/users/BadriL/orgs","repos_url":"https://api.github.com/users/BadriL/repos","events_url":"https://api.github.com/users/BadriL/events{/privacy}","received_events_url":"https://api.github.com/users/BadriL/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/aspnet/Mvc/labels/0+-+Backlog","name":"0 - Backlog","color":"CCCCCC"}],"state":"closed","locked":false,"assignee":{"login":"HaoK","id":6537861,"avatar_url":"https://avatars.githubusercontent.com/u/6537861?v=3","gravatar_id":"","url":"https://api.github.com/users/HaoK","html_url":"https://github.com/HaoK","followers_url":"https://api.github.com/users/HaoK/followers","following_url":"https://api.github.com/users/HaoK/following{/other_user}","gists_url":"https://api.github.com/users/HaoK/gists{/gist_id}","starred_url":"https://api.github.com/users/HaoK/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/HaoK/subscriptions","organizations_url":"https://api.github.com/users/HaoK/orgs","repos_url":"https://api.github.com/users/HaoK/repos","events_url":"https://api.github.com/users/HaoK/events{/privacy}","received_events_url":"https://api.github.com/users/HaoK/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/aspnet/Mvc/milestones/7","labels_url":"https://api.github.com/repos/aspnet/Mvc/milestones/7/labels","id":668490,"number":7,"title":"6.0.0-beta3","description":"","creator":{"login":"yishaigalatzer","id":1238711,"avatar_url":"https://avatars.githubusercontent.com/u/1238711?v=3","gravatar_id":"","url":"https://api.github.com/users/yishaigalatzer","html_url":"https://github.com/yishaigalatzer","followers_url":"https://api.github.com/users/yishaigalatzer/followers","following_url":"https://api.github.com/users/yishaigalatzer/following{/other_user}","gists_url":"https://api.github.com/users/yishaigalatzer/gists{/gist_id}","starred_url":"https://api.github.com/users/yishaigalatzer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yishaigalatzer/subscriptions","organizations_url":"https://api.github.com/users/yishaigalatzer/orgs","repos_url":"https://api.github.com/users/yishaigalatzer/repos","events_url":"https://api.github.com/users/yishaigalatzer/events{/privacy}","received_events_url":"https://api.github.com/users/yishaigalatzer/received_events","type":"User","site_admin":false},"open_issues":39,"closed_issues":64,"state":"open","created_at":"2014-05-23T23:00:12Z","updated_at":"2015-01-16T07:56:58Z","due_on":"2015-01-19T08:00:00Z","closed_at":null},"comments":8,"created_at":"2014-11-20T04:45:15Z","updated_at":"2015-01-16T07:58:31Z","closed_at":"2015-01-16T07:56:58Z","body":"It is not clear how to call an authentication middleware configured to run in passive mode from MVC/Web API (or whatever). In the previous version, we used to have an authentication filter, specifically `HostAuthenticationFilter` that can do this out of box. In vNext, what is the recommended extension point to call `AuthenticateAsync` on the context, when an authentication filter is not available?\r\n\r\n#### Option 1: Use authorization filter\r\nI don't think we can use an action filter because authorization filters run before action filters. But we can use an authorization filter to do this. One good thing is that  we can specify the order of the filter. Hence, the authz filter calling `AuthenticateAsync` on the context can be made to run before other authorization filters. But this does not sound nice because we are re-purposing an authorization filter for authentication. This does not sound nice especially given the fact the earlier version of ASP.NET has a specific filter exactly for this case.\r\n\r\n#### Option 2: Don't bother about active/passive mode\r\nLet all the middleware components in the pipeline all run and establish identities. During authorization, be selective and look for a specific authentication type. In fact, the issue [432] (https://github.com/aspnet/Mvc/issues/432) is about introducing authentication type on authorization attribute for this purpose? If that is the case, will you remove the active/passive modes from authentication infrastructure [here] (https://github.com/aspnet/Security/blob/dev/src/Microsoft.AspNet.Security/Infrastructure/AuthenticationHandler.cs#L75)?\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/aspnet/Mvc/issues/comments/70219638","html_url":"https://github.com/aspnet/Mvc/issues/1601#issuecomment-70219638","issue_url":"https://api.github.com/repos/aspnet/Mvc/issues/1601","id":70219638,"user":{"login":"HaoK","id":6537861,"avatar_url":"https://avatars.githubusercontent.com/u/6537861?v=3","gravatar_id":"","url":"https://api.github.com/users/HaoK","html_url":"https://github.com/HaoK","followers_url":"https://api.github.com/users/HaoK/followers","following_url":"https://api.github.com/users/HaoK/following{/other_user}","gists_url":"https://api.github.com/users/HaoK/gists{/gist_id}","starred_url":"https://api.github.com/users/HaoK/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/HaoK/subscriptions","organizations_url":"https://api.github.com/users/HaoK/orgs","repos_url":"https://api.github.com/users/HaoK/repos","events_url":"https://api.github.com/users/HaoK/events{/privacy}","received_events_url":"https://api.github.com/users/HaoK/received_events","type":"User","site_admin":false},"created_at":"2015-01-16T07:58:31Z","updated_at":"2015-01-16T07:58:31Z","body":"At least this is the current state of AuthZ, we are in the early stages of iterating on this, so its still subject to change"}}