asp net core project MVC controllers using Cookie Authentication and api end points using Bearer
<p>I am working on a project using ASP .net CORE, where we have Angular 2 and MVC and API, need to be protected by Azure AD.</p>

<p>Home/Index MVC controller will start the Angular 2 SPA and Home/Index need to be protected by cookie authentication. I manage to get the token using the OpenIdConnectAuthentication - OnAuthorizationCodeReceived event. </p>

<p>I need to protect the MVC controllers (there are few more controllers apart from Home/Index) using Cookie based Authentication and API using Bearer Authentication, I can get the token from API to Angular then use that token for each subsequent call to API.</p>

<p>In the near future there will be mobile apps calling the same API end points, using Bearer tokens.</p>

<p>This was my starting point:
<a href="https://docs.microsoft.com/en-us/azure/active-directory/active-directory-appmodel-v2-overview" rel="nofollow noreferrer">https://docs.microsoft.com/en-us/azure/active-directory/active-directory-appmodel-v2-overview</a></p>

<p><strong>Startup.cs</strong></p>

<pre><code>public void ConfigureServices(IServiceCollection services)
{
   services.AddMvc().AddJsonOptions(config =&gt; { config.SerializerSettings.ContractResolver = new DefaultContractResolver(); });

   services.AddAuthentication(sharedOptions =&gt; sharedOptions.SignInScheme = CookieAuthenticationDefaults.AuthenticationScheme);
}

public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerFactory loggerFactory)
{
   app.UseCookieAuthentication(new CookieAuthenticationOptions());

   Authority = $"https://login.microsoftonline.com/AAAAA}";
   ClientId = "BBBB";
   ClientSecret = "CCCC";
   Audience = "https://localhost:44333/";

   app.UseOpenIdConnectAuthentication(new OpenIdConnectOptions
   {
      ClientId = ClientId,
      Authority = Authority,
      PostLogoutRedirectUri = Audience,
      ResponseType = OpenIdConnectResponseType.CodeIdToken,
      GetClaimsFromUserInfoEndpoint = false,
      Events = new OpenIdConnectEvents
      {
        OnTokenValidated = TokenValidated,
        OnRemoteFailure = OnAuthenticationFailed,
        OnAuthorizationCodeReceived = OnAuthorizationCodeReceived
      }
   });

     app.UseMvc(....);
}
</code></pre>

<p><strong>Question:</strong></p>

<p>How can I configure the API to use just "Bearer" auth and MVC to use Cookies?</p>

<p><strong>Update</strong></p>

<p>Hi Adem
Thank you for your reply.</p>

<p>I never tired 1st option, will give it a go now.
but I have tired 2nd option earlier, and just tired it as below.</p>

<p>Added this below  app.UseOpenIdConnectAuthentication(...</p>

<pre><code>app.UseJwtBearerAuthentication(new JwtBearerOptions
{
   Authority = "https://login.microsoftonline.com/AAAA",
   Audience = "https://BBB.onmicrosoft.com/CCCC"
});
</code></pre>

<p>For API Controller <code>[Authorize(ActiveAuthenticationSchemes = "Bearer")]</code></p>

<p>For MVC Controller <code>[Authorize(ActiveAuthenticationSchemes = "Cookies")]</code></p>

<p>When it hits my Home Controller it get this error
Specified method is not supported.</p>

<p>this Stack Trace
at Microsoft.AspNetCore.Authentication.RemoteAuthenticationHandler<code>1.HandleSignInAsync(SignInContext context)
 at Microsoft.AspNetCore.Authentication.AuthenticationHandler</code>1.d__66.MoveNext()
 --- End of stack trace from previous location where exception was thrown ---
 at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
 at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
 at Microsoft.AspNetCore.Http.Authentication.Internal.DefaultAuthenticationManager.d__14.MoveNext()
 --- End of stack trace from previous location where exception was thrown ---
 at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
 at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
 at Microsoft.AspNetCore.Authentication.RemoteAuthenticationHandler<code>1.&lt;HandleRemoteCallbackAsync&gt;d__6.MoveNext()
 --- End of stack trace from previous location where exception was thrown ---
 at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
 at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
 at Microsoft.AspNetCore.Authentication.RemoteAuthenticationHandler</code>1.d__5.MoveNext()
 --- End of stack trace from previous location where exception was thrown ---
 at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
 at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
 at Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler.d__15.MoveNext()
 --- End of stack trace from previous location where exception was thrown ---
 at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
 at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
 at Microsoft.AspNetCore.Authentication.AuthenticationMiddleware<code>1.&lt;Invoke&gt;d__18.MoveNext()
 --- End of stack trace from previous location where exception was thrown ---
 at Microsoft.AspNetCore.Authentication.AuthenticationMiddleware</code>1.d__18.MoveNext()
 --- End of stack trace from previous location where exception was thrown ---
 at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
 at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
 at Microsoft.AspNetCore.Diagnostics.ExceptionHandlerMiddleware.d__6.MoveNext()</p>

<p>Update 2:
I have tired configuring 2 different auth for APIand MVC like below</p>

<pre><code>app.UseWhen(context =&gt; 
  context.Request.Path.StartsWithSegments("/api"), appBuilder =&gt;
  {
    app.UseJwtBearerAuthentication(new JwtBearerOptions
    {
      Authority = Authority,
      Audience = Configuration["Authentication:AzureAd:Audience"]
    });
  });
app.UseWhen(context =&gt; 
  !context.Request.Path.StartsWithSegments("/api"), appBuilder =&gt;
  {
    app.UseOpenIdConnectAuthentication(new OpenIdConnectOptions
    {
      ClientId = ClientId,
      Authority = Authority,
      PostLogoutRedirectUri = Audience,
      ResponseType = OpenIdConnectResponseType.CodeIdToken,
      GetClaimsFromUserInfoEndpoint = false,
      Events = new OpenIdConnectEvents
      {
        OnTokenValidated = TokenValidated,
        OnRemoteFailure = OnAuthenticationFailed,
        OnAuthorizationCodeReceived = OnAuthorizationCodeReceived
      }
  });
});
</code></pre>

<p>But API still seem to be using the cookie auth. I could still see the the request has cookies in the request.</p>

<p>Thank you
Asanka</p>