This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
Download Microsoft Edge
More info about Internet Explorer and Microsoft Edge
For an introduction to authentication schemes in ASP.NET Core, see
Authentication scheme
.
In some scenarios, such as Single Page Applications (SPAs), it's common to use multiple authentication methods. For example, the app may use cookie-based authentication to log in and JWT bearer authentication for JavaScript requests. In some cases, the app may have multiple instances of an authentication handler. For example, two cookie handlers where one contains a basic identity and one is created when a multi-factor authentication (MFA) has been triggered. MFA may be triggered because the user requested an operation that requires extra security. For more information on enforcing MFA when a user requests a resource that requires MFA, see the GitHub issue
Protect section with MFA
.
An authentication scheme is named when the authentication service is configured during authentication. For example:
using Microsoft.AspNetCore.Authentication;
var builder = WebApplication.CreateBuilder(args);
builder.Services.AddAuthentication()
.AddCookie(options =>
options.LoginPath = "/Account/Unauthorized/";
options.AccessDeniedPath = "/Account/Forbidden/";
.AddJwtBearer(options =>
options.Audience = "http://localhost:5001/";
options.Authority = "http://localhost:5000/";
builder.Services.AddAuthentication()
.AddIdentityServerJwt();
builder.Services.AddControllersWithViews();
builder.Services.AddRazorPages();
var app = builder.Build();
if (app.Environment.IsDevelopment())
app.UseMigrationsEndPoint();
app.UseHsts();
app.UseHttpsRedirection();
app.UseStaticFiles();
app.UseRouting();
app.UseAuthentication();
app.UseIdentityServer();
app.UseAuthorization();
app.MapDefaultControllerRoute();
app.MapRazorPages();
app.MapFallbackToFile("index.html");
app.Run();
In the preceding code, two authentication handlers have been added: one for cookies and one for bearer.
Specifying the default scheme results in the HttpContext.User property being set to that identity. If that behavior isn't desired, disable it by invoking the parameterless form of AddAuthentication.
Selecting the scheme with the Authorize attribute
At the point of authorization, the app indicates the handler to be used. Select the handler with which the app will authorize by passing a comma-delimited list of authentication schemes to [Authorize]. The [Authorize] attribute specifies the authentication scheme or schemes to use regardless of whether a default is configured. For example:
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Authentication.Cookies;
using Microsoft.AspNetCore.Authentication.JwtBearer;
using Microsoft.AspNetCore.Mvc;
namespace AuthScheme.Controllers;
[Authorize(AuthenticationSchemes = AuthSchemes)]
public class MixedController : Controller
private const string AuthSchemes =
CookieAuthenticationDefaults.AuthenticationScheme + "," +
JwtBearerDefaults.AuthenticationScheme;
public ContentResult Index() => Content(MyWidgets.GetMyContent());
In the preceding example, both the cookie and bearer handlers run and have a chance to create and append an identity for the current user. By specifying a single scheme only, the corresponding handler runs:
[Authorize(AuthenticationSchemes=JwtBearerDefaults.AuthenticationScheme)]
public class Mixed2Controller : Controller
public ContentResult Index() => Content(MyWidgets.GetMyContent());
In the preceding code, only the handler with the "Bearer" scheme runs. Any cookie-based identities are ignored.
Selecting the scheme with policies
If you prefer to specify the desired schemes in policy, you can set the AuthenticationSchemes collection when adding a policy:
using Microsoft.AspNetCore.Authentication;
using Microsoft.AspNetCore.Authentication.JwtBearer;
var builder = WebApplication.CreateBuilder(args);
builder.Services.AddAuthorization(options =>
options.AddPolicy("Over18", policy =>
policy.AuthenticationSchemes.Add(JwtBearerDefaults.AuthenticationScheme);
policy.RequireAuthenticatedUser();
policy.Requirements.Add(new MinimumAgeRequirement(18));
builder.Services.AddAuthentication()
.AddIdentityServerJwt();
builder.Services.AddControllersWithViews();
builder.Services.AddRazorPages();
var app = builder.Build();
if (app.Environment.IsDevelopment())
app.UseMigrationsEndPoint();
app.UseHsts();
app.UseHttpsRedirection();
app.UseStaticFiles();
app.UseRouting();
app.UseAuthentication();
app.UseIdentityServer();
app.UseAuthorization();
app.MapDefaultControllerRoute();
app.MapRazorPages();
app.MapFallbackToFile("index.html");
app.Run();
In the preceding example, the "Over18" policy only runs against the identity created by the "Bearer" handler. Use the policy by setting the [Authorize] attribute's Policy property:
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;
namespace AuthScheme.Controllers;
[Authorize(Policy = "Over18")]
public class RegistrationController : Controller
// Do Registration
Use multiple authentication schemes
Some apps may need to support multiple types of authentication. For example, your app might authenticate users from Azure Active Directory and from a users database. Another example is an app that authenticates users from both Active Directory Federation Services and Azure Active Directory B2C. In this case, the app should accept a JWT bearer token from several issuers.
Add all authentication schemes you'd like to accept. For example, the following code adds two JWT bearer authentication schemes with different issuers:
using Microsoft.AspNetCore.Authentication;
using Microsoft.AspNetCore.Authentication.JwtBearer;
using Microsoft.AspNetCore.Authorization;
var builder = WebApplication.CreateBuilder(args);
// Authentication
builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
.AddJwtBearer(options =>
options.Audience = "https://localhost:5000/";
options.Authority = "https://localhost:5000/identity/";
.AddJwtBearer("AzureAD", options =>
options.Audience = "https://localhost:5000/";
options.Authority = "https://login.microsoftonline.com/eb971100-7f436/";
// Authorization
builder.Services.AddAuthorization(options =>
var defaultAuthorizationPolicyBuilder = new AuthorizationPolicyBuilder(
JwtBearerDefaults.AuthenticationScheme,
"AzureAD");
defaultAuthorizationPolicyBuilder =
defaultAuthorizationPolicyBuilder.RequireAuthenticatedUser();
options.DefaultPolicy = defaultAuthorizationPolicyBuilder.Build();
builder.Services.AddAuthentication()
.AddIdentityServerJwt();
builder.Services.AddControllersWithViews();
builder.Services.AddRazorPages();
var app = builder.Build();
if (app.Environment.IsDevelopment())
app.UseMigrationsEndPoint();
app.UseHsts();
app.UseHttpsRedirection();
app.UseStaticFiles();
app.UseRouting();
app.UseAuthentication();
app.UseIdentityServer();
app.UseAuthorization();
app.MapDefaultControllerRoute();
app.MapRazorPages();
app.MapFallbackToFile("index.html");
app.Run();
Only one JWT bearer authentication is registered with the default authentication scheme JwtBearerDefaults.AuthenticationScheme. Additional authentication has to be registered with a unique authentication scheme.
Update the default authorization policy to accept both authentication schemes. For example:
using Microsoft.AspNetCore.Authentication;
using Microsoft.AspNetCore.Authentication.JwtBearer;
using Microsoft.AspNetCore.Authorization;
var builder = WebApplication.CreateBuilder(args);
// Authentication
builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
.AddJwtBearer(options =>
options.Audience = "https://localhost:5000/";
options.Authority = "https://localhost:5000/identity/";
.AddJwtBearer("AzureAD", options =>
options.Audience = "https://localhost:5000/";
options.Authority = "https://login.microsoftonline.com/eb971100-7f436/";
// Authorization
builder.Services.AddAuthorization(options =>
var defaultAuthorizationPolicyBuilder = new AuthorizationPolicyBuilder(
JwtBearerDefaults.AuthenticationScheme,
"AzureAD");
defaultAuthorizationPolicyBuilder =
defaultAuthorizationPolicyBuilder.RequireAuthenticatedUser();
options.DefaultPolicy = defaultAuthorizationPolicyBuilder.Build();
builder.Services.AddAuthentication()
.AddIdentityServerJwt();
builder.Services.AddControllersWithViews();
builder.Services.AddRazorPages();
var app = builder.Build();
if (app.Environment.IsDevelopment())
app.UseMigrationsEndPoint();
app.UseHsts();
app.UseHttpsRedirection();
app.UseStaticFiles();
app.UseRouting();
app.UseAuthentication();
app.UseIdentityServer();
app.UseAuthorization();
app.MapDefaultControllerRoute();
app.MapRazorPages();
app.MapFallbackToFile("index.html");
app.Run();
As the default authorization policy is overridden, it's possible to use the [Authorize] attribute in controllers. The controller then accepts requests with JWT issued by the first or second issuer.
See this GitHub issue on using multiple authentication schemes.
The following example uses Azure Active Directory B2C and another Azure Active Directory tenant:
using Microsoft.AspNetCore.Authentication;
using Microsoft.IdentityModel.Tokens;
using Microsoft.Net.Http.Headers;
using System.IdentityModel.Tokens.Jwt;
var builder = WebApplication.CreateBuilder(args);
// Authentication
builder.Services.AddAuthentication(options =>
options.DefaultScheme = "B2C_OR_AAD";
options.DefaultChallengeScheme = "B2C_OR_AAD";
.AddJwtBearer("B2C", jwtOptions =>
jwtOptions.MetadataAddress = "B2C-MetadataAddress";
jwtOptions.Authority = "B2C-Authority";
jwtOptions.Audience = "B2C-Audience";
.AddJwtBearer("AAD", jwtOptions =>
jwtOptions.MetadataAddress = "AAD-MetadataAddress";
jwtOptions.Authority = "AAD-Authority";
jwtOptions.Audience = "AAD-Audience";
jwtOptions.TokenValidationParameters = new TokenValidationParameters
ValidateIssuer = true,
ValidateAudience = true,
ValidateIssuerSigningKey = true,
ValidAudiences = builder.Configuration.GetSection("ValidAudiences").Get<string[]>(),
ValidIssuers = builder.Configuration.GetSection("ValidIssuers").Get<string[]>()
.AddPolicyScheme("B2C_OR_AAD", "B2C_OR_AAD", options =>
options.ForwardDefaultSelector = context =>
string authorization = context.Request.Headers[HeaderNames.Authorization];
if (!string.IsNullOrEmpty(authorization) && authorization.StartsWith("Bearer "))
var token = authorization.Substring("Bearer ".Length).Trim();
var jwtHandler = new JwtSecurityTokenHandler();
return (jwtHandler.CanReadToken(token) && jwtHandler.ReadJwtToken(token).Issuer.Equals("B2C-Authority"))
? "B2C" : "AAD";
return "AAD";
builder.Services.AddAuthentication()
.AddIdentityServerJwt();
builder.Services.AddControllersWithViews();
builder.Services.AddRazorPages();
var app = builder.Build();
if (app.Environment.IsDevelopment())
app.UseMigrationsEndPoint();
app.UseHsts();
app.UseHttpsRedirection();
app.UseStaticFiles();
app.UseRouting();
app.UseAuthentication();
app.UseIdentityServer();
app.UseAuthorization();
app.MapDefaultControllerRoute().RequireAuthorization();
app.MapRazorPages().RequireAuthorization();
app.MapFallbackToFile("index.html");
app.Run();
In the preceding code, ForwardDefaultSelector is used to select a default scheme for the current request that authentication handlers should forward all authentication operations to by default. The default forwarding logic checks the most specific ForwardAuthenticate, ForwardChallenge, ForwardForbid, ForwardSignIn, and ForwardSignOut setting first, followed by checking the ForwardDefaultSelector, followed by ForwardDefault. The first non null result is used as the target scheme to forward to. For more information, see Policy schemes in ASP.NET Core.
For an introduction to authentication schemes in ASP.NET Core, see Authentication scheme.
In some scenarios, such as Single Page Applications (SPAs), it's common to use multiple authentication methods. For example, the app may use cookie-based authentication to log in and JWT bearer authentication for JavaScript requests. In some cases, the app may have multiple instances of an authentication handler. For example, two cookie handlers where one contains a basic identity and one is created when a multi-factor authentication (MFA) has been triggered. MFA may be triggered because the user requested an operation that requires extra security. For more information on enforcing MFA when a user requests a resource that requires MFA, see the GitHub issue Protect section with MFA.
An authentication scheme is named when the authentication service is configured during authentication. For example:
public void ConfigureServices(IServiceCollection services)
// Code omitted for brevity
services.AddAuthentication()
.AddCookie(options => {
options.LoginPath = "/Account/Unauthorized/";
options.AccessDeniedPath = "/Account/Forbidden/";
.AddJwtBearer(options => {
options.Audience = "http://localhost:5001/";
options.Authority = "http://localhost:5000/";
In the preceding code, two authentication handlers have been added: one for cookies and one for bearer.
Specifying the default scheme results in the HttpContext.User property being set to that identity. If that behavior isn't desired, disable it by invoking the parameterless form of AddAuthentication.
Selecting the scheme with the Authorize attribute
At the point of authorization, the app indicates the handler to be used. Select the handler with which the app will authorize by passing a comma-delimited list of authentication schemes to [Authorize]. The [Authorize] attribute specifies the authentication scheme or schemes to use regardless of whether a default is configured. For example:
[Authorize(AuthenticationSchemes = AuthSchemes)]
public class MixedController : Controller
// Requires the following imports:
// using Microsoft.AspNetCore.Authentication.Cookies;
// using Microsoft.AspNetCore.Authentication.JwtBearer;
private const string AuthSchemes =
CookieAuthenticationDefaults.AuthenticationScheme + "," +
JwtBearerDefaults.AuthenticationScheme;
In the preceding example, both the cookie and bearer handlers run and have a chance to create and append an identity for the current user. By specifying a single scheme only, the corresponding handler runs.
[Authorize(AuthenticationSchemes =
JwtBearerDefaults.AuthenticationScheme)]
public class MixedController : Controller
In the preceding code, only the handler with the "Bearer" scheme runs. Any cookie-based identities are ignored.
Selecting the scheme with policies
If you prefer to specify the desired schemes in policy, you can set the AuthenticationSchemes collection when adding your policy:
services.AddAuthorization(options =>
options.AddPolicy("Over18", policy =>
policy.AuthenticationSchemes.Add(JwtBearerDefaults.AuthenticationScheme);
policy.RequireAuthenticatedUser();
policy.Requirements.Add(new MinimumAgeRequirement());
In the preceding example, the "Over18" policy only runs against the identity created by the "Bearer" handler. Use the policy by setting the [Authorize] attribute's Policy property:
[Authorize(Policy = "Over18")]
public class RegistrationController : Controller
Use multiple authentication schemes
Some apps may need to support multiple types of authentication. For example, your app might authenticate users from Azure Active Directory and from a users database. Another example is an app that authenticates users from both Active Directory Federation Services and Azure Active Directory B2C. In this case, the app should accept a JWT bearer token from several issuers.
Add all authentication schemes you'd like to accept. For example, the following code in Startup.ConfigureServices adds two JWT bearer authentication schemes with different issuers:
public void ConfigureServices(IServiceCollection services)
// Code omitted for brevity
services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
.AddJwtBearer(options =>
options.Audience = "https://localhost:5000/";
options.Authority = "https://localhost:5000/identity/";
.AddJwtBearer("AzureAD", options =>
options.Audience = "https://localhost:5000/";
options.Authority = "https://login.microsoftonline.com/eb971100-6f99-4bdc-8611-1bc8edd7f436/";
Only one JWT bearer authentication is registered with the default authentication scheme JwtBearerDefaults.AuthenticationScheme. Additional authentication has to be registered with a unique authentication scheme.
The next step is to update the default authorization policy to accept both authentication schemes. For example:
public void ConfigureServices(IServiceCollection services)
// Code omitted for brevity
services.AddAuthorization(options =>
var defaultAuthorizationPolicyBuilder = new AuthorizationPolicyBuilder(
JwtBearerDefaults.AuthenticationScheme,
"AzureAD");
defaultAuthorizationPolicyBuilder =
defaultAuthorizationPolicyBuilder.RequireAuthenticatedUser();
options.DefaultPolicy = defaultAuthorizationPolicyBuilder.Build();
As the default authorization policy is overridden, it's possible to use the [Authorize] attribute in controllers. The controller then accepts requests with JWT issued by the first or second issuer.
See this GitHub issue on using multiple authentication schemes.
