asp.net core 3.0认证详解

整体概况

这篇文章前前后后改了很多次，都是根据自己对asp.net core认证过程的不断深入，删删减减。

 

整个asp.net core在StartUp类的Configure方法中使用一个UseAuthentication()的方式将认证这个中间件添加到了应用中。这个中间件的源码很短，如下：

注：认证中间件的整体流程是查找远程认证的IAuthenticationHandler,如果没有找到，则查找一个默认的handler，都是通过scheme来查找的，scheme这个东西出现的原因是它是IAthenticationHandler和相关Options的总称。

public class AuthenticationMiddleware
  {
    private readonly RequestDelegate _next;

    public AuthenticationMiddleware(RequestDelegate next, IAuthenticationSchemeProvider schemes)
    {
      if (next == null)
        throw new ArgumentNullException(nameof (next));
      if (schemes == null)
        throw new ArgumentNullException(nameof (schemes));
      this._next = next;
      this.Schemes = schemes;
    }

    public IAuthenticationSchemeProvider Schemes { get; set; }

    public async Task Invoke(HttpContext context)
    {
      context.Features.Set<IAuthenticationFeature>((IAuthenticationFeature) new AuthenticationFeature()
      {
        OriginalPath = context.Request.Path,
        OriginalPathBase = context.Request.PathBase
      });
      IAuthenticationHandlerProvider handlers = context.RequestServices.GetRequiredService<IAuthenticationHandlerProvider>();
      foreach (AuthenticationScheme authenticationScheme in await this.Schemes.GetRequestHandlerSchemesAsync())//GetReRequestHandlersAsync方法返回_requestHandlers字段保存的所有远程认证的Scheme
      {
        IAuthenticationRequestHandler handlerAsync = await handlers.GetHandlerAsync(context, authenticationScheme.Name) as IAuthenticationRequestHandler;
        bool flag = handlerAsync != null;
        if (flag)
          flag = await handlerAsync.HandleRequestAsync();
        if (flag)
          return;
      }
      AuthenticationScheme authenticateSchemeAsync = await this.Schemes.GetDefaultAuthenticateSchemeAsync();
      if (authenticateSchemeAsync != null)
      {
        AuthenticateResult authenticateResult = await context.AuthenticateAsync(authenticateSchemeAsync.Name);
        if (authenticateResult?.Principal != null)
          context.User = authenticateResult.Principal;
      }
      await this._next(context);
    }
  }

基本的流程是先找一个IAuthenticationRequestHandler，这个接口代表了远程认证，逻辑是①找到一个不为空的handler并执行HandlerRequestAsync；②如果执行结果为true，则返回，否则，继续下一个循环。如果没有找到任何IAuthenticationRequestHandler，则继续由GetDefaultAuthenticateSchemeAsync方法来找一个默认的本地认证Scheme，这个本地认证Scheme的逻辑是从AuthenticationOptions中先查看DefaultAuthenticationScheme是否有值（string），如果没有，再从DefaultScheme中查看是否有值（string)如果两者都没有，那么返回一个null。（注：认证中间件依赖一个IAuthenticationSchemeProvider(构造函数注入),后者的默认实现AuthenticationSchemeProvider依赖AuthenticationOptions类）。

整个asp.net core 认证的线索为IAuthenticationService，这个接口声明了5个动作方法，其中，具体的执行是由IAuthenticationHandler来执行的，这个接口定义了AuthenticateAsync()、ForbiddenAsync()和ChallengeAsync()。而SignInAsync和SignOutAsync则分别由IAuthenticationSignInHandler和IAuthenticationSignOutHandler来定义的。后两个接口也继承自IAuthenticationHandler，IAuthenticationHandler由IAuthenticationHandlerProvider来提供，IAuthenticationHandlerProvider使用IAuthenticationSchemeProvider来提供一个具体的AuthenticationScheme，AuthenticationScheme代表一个具体的方案，这个Scheme中包含了执行这个方案需要的HandlerType，也即是IAuthenticationHandler，从Scheme中拿到这个HandlerType之后，从DI或者ActivityUtils中得到具体的IAuthenticaitonHandler来执行最终逻辑。其他的诸如AuthenticateResult代表一个认证验证结果，他里面维护了一个AuthenticationTicket,还有一个AuthenticateProperties表示认证的一些特征，如颁发时间、过期时间等等。

这篇文章涉及的源码包括Microsoft.AspNETCore.Authentication.Abstraction、Microsoft.AspNETCore.Authentication.Core和Microsoft.AspNETCore.Authentication

认证和授权很相似，他们的英文也很相似，一个是Authentication认证，一个是Authorization授权。

asp.net core中的认证需要在Startup类中进行配置：

//ConfigureServices方法中：
 services.AddAuthentication(option =>
            {
                option.DefaultScheme = "Cookie";
                option.DefaultChallengeScheme = "Cookie";
                option.DefaultAuthenticateScheme = "Cookie";
                option.DefaultForbidScheme = "Cookie";
                option.DefaultSignInScheme = "Cookie";
                option.DefaultSignOutScheme = "Cookie";
            }).AddCookie("Cookie", option =>
            {
                option.LoginPath = "/Account/Login";
                option.AccessDeniedPath = "/Account/Forbidden";
                //.......
            });

//Configure方法中
 app.UseAuthentication();

看一看到如果需要认证的话是需要分别在ConfigureService方法和Configure方法中分别进行配置的。

我们看到上面在AddAuthentication方法中配置了一个option，这个option是一个Action<AuthenticationOption>,在里面，写了一堆scheme。这个scheme是什么意思呢？我们先解释一下在asp.neet core中发生的这几个动作。在asp.net core中是有5个动作要发生的：

1、登陆（Signin）：用户要进行登陆的动作。

2、登出（Signout）：用户要进行登出。

3、Challenge：这个不好翻译，意思当用户需要请求一个被保护的资源时，系统要求用户进行登陆。总之他也是一个登陆的动作，但是被动的登陆，一般返回401。

4、Authenticate：认证，系统将用户的信息从token/cookie中读取出来。和登陆这个动作正好相反。

5、Forbid：系统对用户执行了拒绝的操作。一般返回403

上面这些动作最后都是由一个Handler来执行的，这个handler就是一个IAuthenticationHandler的实现。

我们先给出了上面的总结，再看一下具体的情况。asp.net core2.0开始上面的这些动作的执行都是通过HttpContext的扩展方法来执行的。我们拿登陆来说，其他都大同小异。

先看HttpContext.SigninAsync这个方法：

            var claim = new Claim("name", "wallee");//claim相当于我的众多信息中的一个信息单元，还有年龄、性别、家庭等等
            var identity = new ClaimsIdentity("身份证");//identity表示一个claim集合，这个集合代表了一个完整的“证件信息”,比如我的身份证
            identity.AddClaim(claim);//将上面那个信息片段添加到我的身份证里面
            var me=new ClaimsPrincipal(identity);//将身份证作为我个人的初始化参数，初始化一个ClaimsPrincipal就代表了我这个主体。还可以添加其他的identity，如还有驾驶证、准考证、会计证、计算机二级证等等

            HttpContext.SignInAsync(me);//最后，利用这个主体，调用HttpContext的扩展方法进行登陆。

上面的代码中注释解释了一些和本文无关但又非常重要的信息，我们关键看最后哪一行：HttpContext.SigninAsync(principal)；这行代码实现了最终的登陆。现在我们看一下它的实现：

public static Task SignInAsync(this HttpContext context, string scheme, ClaimsPrincipal principal, AuthenticationProperties properties)
    {
      return context.RequestServices.GetRequiredService<IAuthenticationService>().SignInAsync(context, scheme, principal, properties);
}

其实针对HttpContext的扩展方法都是调用IAuthenticationService来执行的，IAuthenticationService里面定义了针对上面描述的所有动作方法：

/// <summary>Used to provide authentication.</summary>
  public interface IAuthenticationService
  {
    /// <summary>Authenticate for the specified authentication scheme.</summary>
    /// <param name="context">The <see cref="T:Microsoft.AspNetCore.Http.HttpContext" />.</param>
    /// <param name="scheme">The name of the authentication scheme.</param>
    /// <returns>The result.</returns>
    Task<AuthenticateResult> AuthenticateAsync(
      HttpContext context,
      string scheme);

    /// <summary>Challenge the specified authentication scheme.</summary>
    /// <param name="context">The <see cref="T:Microsoft.AspNetCore.Http.HttpContext" />.</param>
    /// <param name="scheme">The name of the authentication scheme.</param>
    /// <param name="properties">The <see cref="T:Microsoft.AspNetCore.Authentication.AuthenticationProperties" />.</param>
    /// <returns>A task.</returns>
    Task ChallengeAsync(
      HttpContext context,
      string scheme,
      AuthenticationProperties properties);

    /// <summary>Forbids the specified authentication scheme.</summary>
    /// <param name="context">The <see cref="T:Microsoft.AspNetCore.Http.HttpContext" />.</param>
    /// <param name="scheme">The name of the authentication scheme.</param>
    /// <param name="properties">The <see cref="T:Microsoft.AspNetCore.Authentication.AuthenticationProperties" />.</param>
    /// <returns>A task.</returns>
    Task ForbidAsync(HttpContext context, string scheme, AuthenticationProperties properties);

    /// <summary>
    /// Sign a principal in for the specified authentication scheme.
    /// </summary>
    /// <param name="context">The <see cref="T:Microsoft.AspNetCore.Http.HttpContext" />.</param>
    /// <param name="scheme">The name of the authentication scheme.</param>
    /// <param name="principal">The <see cref="T:System.Security.Claims.ClaimsPrincipal" /> to sign in.</param>
    /// <param name="properties">The <see cref="T:Microsoft.AspNetCore.Authentication.AuthenticationProperties" />.</param>
    /// <returns>A task.</returns>
    Task SignInAsync(
      HttpContext context,
      string scheme,
      ClaimsPrincipal principal,
      AuthenticationProperties properties);

    /// <summary>Sign out the specified authentication scheme.</summary>
    /// <param name="context">The <see cref="T:Microsoft.AspNetCore.Http.HttpContext" />.</param>
    /// <param name="scheme">The name of the authentication scheme.</param>
    /// <param name="properties">The <see cref="T:Microsoft.AspNetCore.Authentication.AuthenticationProperties" />.</param>
    /// <returns>A task.</returns>
    Task SignOutAsync(HttpContext context, string scheme, AuthenticationProperties properties);
  }

IAuthenticateService在services.AddAuthentication()方法中以scoped的生命周期被注入到了DI,表示针对每次请求的新的实例。同时还被注入的有另外几个比较关键的接口：

services.TryAddSingleton<IClaimsTransformation, NoopClaimsTransformation>();//ClaimsTransFormation用来在全局将ClaimsPrincipal添加一些新的Claims，默认注入的这个是啥都没干
services.TryAddScoped<IAuthenticationHandlerProvider, AuthenticationHandlerProvider>();//AuthenticationHandler的提供者，提供执行Authenticatoin、Forbidden和Challenge等动作的handler
services.TryAddSingleton<IAuthenticationSchemeProvider, AuthenticationSchemeProvider>();//AuthenticationScheme的提供者，AuthenticationScheme是对AuthenticationHandler的描述，通过Scheme找到相应的Handler

IAuthenticationService是对IAuthenticationSchemeProvider和IAuthenticationHandlerProvider的封装，它有一个AuthenticationService的实现：

/// <summary>
  /// Implements <see cref="T:Microsoft.AspNetCore.Authentication.IAuthenticationService" />.
  /// </summary>
  public class AuthenticationService : IAuthenticationService
  {
    /// <summary>Constructor.</summary>
    /// <param name="schemes">The <see cref="T:Microsoft.AspNetCore.Authentication.IAuthenticationSchemeProvider" />.</param>
    /// <param name="handlers">The <see cref="T:Microsoft.AspNetCore.Authentication.IAuthenticationRequestHandler" />.</param>
    /// <param name="transform">The <see cref="T:Microsoft.AspNetCore.Authentication.IClaimsTransformation" />.</param>
    public AuthenticationService(
      IAuthenticationSchemeProvider schemes,
      IAuthenticationHandlerProvider handlers,
      IClaimsTransformation transform)
    {
      this.Schemes = schemes;
      this.Handlers = handlers;
      this.Transform = transform;
    }

    /// <summary>Used to lookup AuthenticationSchemes.</summary>
    public IAuthenticationSchemeProvider Schemes { get; }

    /// <summary>Used to resolve IAuthenticationHandler instances.</summary>
    public IAuthenticationHandlerProvider Handlers { get; }

    /// <summary>Used for claims transformation.</summary>
    public IClaimsTransformation Transform { get; }

    /// <summary>Authenticate for the specified authentication scheme.</summary>
    /// <param name="context">The <see cref="T:Microsoft.AspNetCore.Http.HttpContext" />.</param>
    /// <param name="scheme">The name of the authentication scheme.</param>
    /// <returns>The result.</returns>
    public virtual async Task<AuthenticateResult> AuthenticateAsync(
      HttpContext context,
      string scheme)
    {
      if (scheme == null)
      {
        scheme = (await this.Schemes.GetDefaultAuthenticateSchemeAsync())?.Name;
        if (scheme == null)
          throw new InvalidOperationException("No authenticationScheme was specified, and there was no DefaultAuthenticateScheme found.");
      }
      IAuthenticationHandler handlerAsync = await this.Handlers.GetHandlerAsync(context, scheme);
      if (handlerAsync == null)
        throw await this.CreateMissingHandlerException(scheme);
      AuthenticateResult result = await handlerAsync.AuthenticateAsync();
      return result != null && result.Succeeded ? AuthenticateResult.Success(new AuthenticationTicket(await this.Transform.TransformAsync(result.Principal), result.Properties, result.Ticket.AuthenticationScheme)) : result;
    }

    /// <summary>Challenge the specified authentication scheme.</summary>
    /// <param name="context">The <see cref="T:Microsoft.AspNetCore.Http.HttpContext" />.</param>
    /// <param name="scheme">The name of the authentication scheme.</param>
    /// <param name="properties">The <see cref="T:Microsoft.AspNetCore.Authentication.AuthenticationProperties" />.</param>
    /// <returns>A task.</returns>
    public virtual async Task ChallengeAsync(
      HttpContext context,
      string scheme,
      AuthenticationProperties properties)
    {
      if (scheme == null)
      {
        scheme = (await this.Schemes.GetDefaultChallengeSchemeAsync())?.Name;
        if (scheme == null)
          throw new InvalidOperationException("No authenticationScheme was specified, and there was no DefaultChallengeScheme found.");
      }
      IAuthenticationHandler handlerAsync = await this.Handlers.GetHandlerAsync(context, scheme);
      if (handlerAsync == null)
        throw await this.CreateMissingHandlerException(scheme);
      await handlerAsync.ChallengeAsync(properties);
    }

    /// <summary>Forbid the specified authentication scheme.</summary>
    /// <param name="context">The <see cref="T:Microsoft.AspNetCore.Http.HttpContext" />.</param>
    /// <param name="scheme">The name of the authentication scheme.</param>
    /// <param name="properties">The <see cref="T:Microsoft.AspNetCore.Authentication.AuthenticationProperties" />.</param>
    /// <returns>A task.</returns>
    public virtual async Task ForbidAsync(
      HttpContext context,
      string scheme,
      AuthenticationProperties properties)
    {
      if (scheme == null)
      {
        scheme = (await this.Schemes.GetDefaultForbidSchemeAsync())?.Name;
        if (scheme == null)
          throw new InvalidOperationException("No authenticationScheme was specified, and there was no DefaultForbidScheme found.");
      }
      IAuthenticationHandler handlerAsync = await this.Handlers.GetHandlerAsync(context, scheme);
      if (handlerAsync == null)
        throw await this.CreateMissingHandlerException(scheme);
      await handlerAsync.ForbidAsync(properties);
    }

    /// <summary>
    /// Sign a principal in for the specified authentication scheme.
    /// </summary>
    /// <param name="context">The <see cref="T:Microsoft.AspNetCore.Http.HttpContext" />.</param>
    /// <param name="scheme">The name of the authentication scheme.</param>
    /// <param name="principal">The <see cref="T:System.Security.Claims.ClaimsPrincipal" /> to sign in.</param>
    /// <param name="properties">The <see cref="T:Microsoft.AspNetCore.Authentication.AuthenticationProperties" />.</param>
    /// <returns>A task.</returns>
    public virtual async Task SignInAsync(
      HttpContext context,
      string scheme,
      ClaimsPrincipal principal,
      AuthenticationProperties properties)
    {
      if (principal == null)
        throw new ArgumentNullException(nameof (principal));
      if (scheme == null)
      {
        scheme = (await this.Schemes.GetDefaultSignInSchemeAsync())?.Name;
        if (scheme == null)
          throw new InvalidOperationException("No authenticationScheme was specified, and there was no DefaultSignInScheme found.");
      }
      IAuthenticationHandler handlerAsync = await this.Handlers.GetHandlerAsync(context, scheme);
      if (handlerAsync == null)
        throw await this.CreateMissingSignInHandlerException(scheme);
      if (!(handlerAsync is IAuthenticationSignInHandler authenticationSignInHandler))
        throw await this.CreateMismatchedSignInHandlerException(scheme, handlerAsync);
      await authenticationSignInHandler.SignInAsync(principal, properties);
    }

    /// <summary>Sign out the specified authentication scheme.</summary>
    /// <param name="context">The <see cref="T:Microsoft.AspNetCore.Http.HttpContext" />.</param>
    /// <param name="scheme">The name of the authentication scheme.</param>
    /// <param name="properties">The <see cref="T:Microsoft.AspNetCore.Authentication.AuthenticationProperties" />.</param>
    /// <returns>A task.</returns>
    public virtual async Task SignOutAsync(
      HttpContext context,
      string scheme,
      AuthenticationProperties properties)
    {
      if (scheme == null)
      {
        scheme = (await this.Schemes.GetDefaultSignOutSchemeAsync())?.Name;
        if (scheme == null)
          throw new InvalidOperationException("No authenticationScheme was specified, and there was no DefaultSignOutScheme found.");
      }
      IAuthenticationHandler handlerAsync = await this.Handlers.GetHandlerAsync(context, scheme);
      if (handlerAsync == null)
        throw await this.CreateMissingSignOutHandlerException(scheme);
      if (!(handlerAsync is IAuthenticationSignOutHandler authenticationSignOutHandler))
        throw await this.CreateMismatchedSignOutHandlerException(scheme, handlerAsync);
      await authenticationSignOutHandler.SignOutAsync(properties);
    }

    private async Task<Exception> CreateMissingHandlerException(string scheme)
    {
      string str1 = string.Join(", ", (await this.Schemes.GetAllSchemesAsync()).Select<AuthenticationScheme, string>((Func<AuthenticationScheme, string>) (sch => sch.Name)));
      string str2 = string.Format(" Did you forget to call AddAuthentication().Add[SomeAuthHandler](\"{0}\",...)?", (object) scheme);
      return !string.IsNullOrEmpty(str1) ? (Exception) new InvalidOperationException(string.Format("No authentication handler is registered for the scheme '{0}'. The registered schemes are: {1}.", (object) scheme, (object) str1) + str2) : (Exception) new InvalidOperationException("No authentication handlers are registered." + str2);
    }

    private async Task<string> GetAllSignInSchemeNames()
    {
      return string.Join(", ", (await this.Schemes.GetAllSchemesAsync()).Where<AuthenticationScheme>((Func<AuthenticationScheme, bool>) (sch => typeof (IAuthenticationSignInHandler).IsAssignableFrom(sch.HandlerType))).Select<AuthenticationScheme, string>((Func<AuthenticationScheme, string>) (sch => sch.Name)));
    }

    private async Task<Exception> CreateMissingSignInHandlerException(string scheme)
    {
      string signInSchemeNames = await this.GetAllSignInSchemeNames();
      string str = string.Format(" Did you forget to call AddAuthentication().AddCookies(\"{0}\",...)?", (object) scheme);
      return !string.IsNullOrEmpty(signInSchemeNames) ? (Exception) new InvalidOperationException(string.Format("No sign-in authentication handler is registered for the scheme '{0}'. The registered sign-in schemes are: {1}.", (object) scheme, (object) signInSchemeNames) + str) : (Exception) new InvalidOperationException("No sign-in authentication handlers are registered." + str);
    }

    private async Task<Exception> CreateMismatchedSignInHandlerException(
      string scheme,
      IAuthenticationHandler handler)
    {
      string signInSchemeNames = await this.GetAllSignInSchemeNames();
      string str = string.Format("The authentication handler registered for scheme '{0}' is '{1}' which cannot be used for SignInAsync. ", (object) scheme, (object) handler.GetType().Name);
      return !string.IsNullOrEmpty(signInSchemeNames) ? (Exception) new InvalidOperationException(str + string.Format("The registered sign-in schemes are: {0}.", (object) signInSchemeNames)) : (Exception) new InvalidOperationException(str + "Did you forget to call AddAuthentication().AddCookies(\"Cookies\") and SignInAsync(\"Cookies\",...)?");
    }

    private async Task<string> GetAllSignOutSchemeNames()
    {
      return string.Join(", ", (await this.Schemes.GetAllSchemesAsync()).Where<AuthenticationScheme>((Func<AuthenticationScheme, bool>) (sch => typeof (IAuthenticationSignOutHandler).IsAssignableFrom(sch.HandlerType))).Select<AuthenticationScheme, string>((Func<AuthenticationScheme, string>) (sch => sch.Name)));
    }

    private async Task<Exception> CreateMissingSignOutHandlerException(string scheme)
    {
      string signOutSchemeNames = await this.GetAllSignOutSchemeNames();
      string str = string.Format(" Did you forget to call AddAuthentication().AddCookies(\"{0}\",...)?", (object) scheme);
      return !string.IsNullOrEmpty(signOutSchemeNames) ? (Exception) new InvalidOperationException(string.Format("No sign-out authentication handler is registered for the scheme '{0}'. The registered sign-out schemes are: {1}.", (object) scheme, (object) signOutSchemeNames) + str) : (Exception) new InvalidOperationException("No sign-out authentication handlers are registered." + str);
    }

    private async Task<Exception> CreateMismatchedSignOutHandlerException(
      string scheme,
      IAuthenticationHandler handler)
    {
      string signOutSchemeNames = await this.GetAllSignOutSchemeNames();
      string str = string.Format("The authentication handler registered for scheme '{0}' is '{1}' which cannot be used for {2}. ", (object) scheme, (object) handler.GetType().Name, (object) "SignOutAsync");
      return !string.IsNullOrEmpty(signOutSchemeNames) ? (Exception) new InvalidOperationException(str + string.Format("The registered sign-out schemes are: {0}.", (object) signOutSchemeNames)) : (Exception) new InvalidOperationException(str + string.Format("Did you forget to call AddAuthentication().AddCookies(\"Cookies\") and {0}(\"Cookies\",...)?", (object) "SignOutAsync"));
    }
  }

这个基本就是asp.net core 认证的整体概况了，先看一下整体的逻辑，在下一部分，我们再把一些相关的类型做一些补充说明。

可以看到AuthenticationService里面定义的这些AuthenticationAsync、ForbiddenAsync等等动作方法基本都遵循了一个逻辑：

①首先判断传入的scheme是否为null，如果为null，那么根据IAuthenticationSchemeProvider类型的Schemes属性来找出一个默认的scheme，如果上述两个都失败，则抛出异常。

②第一步成功的前提下，利用IAuthenticationHandlerProvider类型的Handlers属性根据找出的scheme来生成一个handler。

③在AuthenticationAsync、ForbiddenAsync和ChallengeAsync方法中，直接调用生成的handler的同名方法来执行最终的逻辑，而在SignInAsync和SignOutAsync中要判断拿到的这个Handler是否分别实现了IAuthenticationSignInHandler和IAuthenticationSignOutHandler这两个接口，如果没有实现，则爆出异常。

至于SignIn和SignOut这两个接口从IAuthenticatoinHandler中剥离出去是因为IAuthenticationHandler只是实现了对用户凭证的验证，至于SignIn和SignOut，现在大多数应用使用的登录方式都有所不同，况且这两个功能实现的是凭证的获取/发放，放在IAuthenticationHandler不合适。

public interface IAuthenticationSignInHandler : IAuthenticationSignOutHandler, IAuthenticationHandler
  {
    /// <summary>Handle sign in.</summary>
    /// <param name="user">The <see cref="T:System.Security.Claims.ClaimsPrincipal" /> user.</param>
    /// <param name="properties">The <see cref="T:Microsoft.AspNetCore.Authentication.AuthenticationProperties" /> that contains the extra meta-data arriving with the authentication.</param>
    /// <returns>A task.</returns>
    Task SignInAsync(ClaimsPrincipal user, AuthenticationProperties properties);
  }

public interface IAuthenticationSignOutHandler : IAuthenticationHandler
  {
    /// <summary>Signout behavior.</summary>
    /// <param name="properties">The <see cref="T:Microsoft.AspNetCore.Authentication.AuthenticationProperties" /> that contains the extra meta-data arriving with the authentication.</param>
    /// <returns>A task.</returns>
    Task SignOutAsync(AuthenticationProperties properties);
  }

关键类型

AuthenticationScheme

public class AuthenticationScheme
  {
    /// <summary>Constructor.</summary>
    /// <param name="name">The name for the authentication scheme.</param>
    /// <param name="displayName">The display name for the authentication scheme.</param>
    /// <param name="handlerType">The <see cref="T:Microsoft.AspNetCore.Authentication.IAuthenticationHandler" /> type that handles this scheme.</param>
    public AuthenticationScheme(string name, string displayName, Type handlerType)
    {
      if (name == null)
        throw new ArgumentNullException(nameof (name));
      if (handlerType == (Type) null)
        throw new ArgumentNullException(nameof (handlerType));
      if (!typeof (IAuthenticationHandler).IsAssignableFrom(handlerType))
        throw new ArgumentException("handlerType must implement IAuthenticationHandler.");
      this.Name = name;
      this.HandlerType = handlerType;
      this.DisplayName = displayName;
    }

    /// <summary>The name of the authentication scheme.</summary>
    public string Name { get; }

    /// <summary>
    /// The display name for the scheme. Null is valid and used for non user facing schemes.
    /// </summary>
    public string DisplayName { get; }

    /// <summary>
    /// The <see cref="T:Microsoft.AspNetCore.Authentication.IAuthenticationHandler" /> type that handles this scheme.
    /// </summary>
    public Type HandlerType { get; }
  }

一个AuthenticationScheme就是一个对IAuthenticationHandler的描述，它为一个特定的handlerType分配了一个名称（name）。它的构造函数接收三个参数了分别初始化了内部的三个属性，并对这三个参数做了严格的校验保证输入的参数有效。

AuthenticationSchemeBuilder

public class AuthenticationSchemeBuilder
  {
    /// <summary>Constructor.</summary>
    /// <param name="name">The name of the scheme being built.</param>
    public AuthenticationSchemeBuilder(string name)
    {
      this.Name = name;
    }

    /// <summary>The name of the scheme being built.</summary>
    public string Name { get; }

    /// <summary>The display name for the scheme being built.</summary>
    public string DisplayName { get; set; }

    /// <summary>
    /// The <see cref="T:Microsoft.AspNetCore.Authentication.IAuthenticationHandler" /> type responsible for this scheme.
    /// </summary>
    public Type HandlerType { get; set; }

    /// <summary>
    /// Builds the <see cref="T:Microsoft.AspNetCore.Authentication.AuthenticationScheme" /> instance.
    /// </summary>
    /// <returns></returns>
    public AuthenticationScheme Build()
    {
      return new AuthenticationScheme(this.Name, this.DisplayName, this.HandlerType);
    }
  }

从名字就能看出来它是AuthenticationScheme的建造者，它内部包含的三个属性和AuthenticationScheme是一样的。它的构造函数需要一个string类型的name参数来初始化name，没有对输入的参数做任何校验，另外毫无意外的它有一个Build方法，用自身的这三个属性来new一个AuthenticationScheme。

AutenticaitonOptions

public class AuthenticationOptions
  {
    private readonly IList<AuthenticationSchemeBuilder> _schemes = (IList<AuthenticationSchemeBuilder>) new List<AuthenticationSchemeBuilder>();

    /// <summary>
    /// Returns the schemes in the order they were added (important for request handling priority)
    /// </summary>
    public IEnumerable<AuthenticationSchemeBuilder> Schemes
    {
      get
      {
        return (IEnumerable<AuthenticationSchemeBuilder>) this._schemes;
      }
    }

    /// <summary>Maps schemes by name.</summary>
    public IDictionary<string, AuthenticationSchemeBuilder> SchemeMap { get; } = (IDictionary<string, AuthenticationSchemeBuilder>) new Dictionary<string, AuthenticationSchemeBuilder>((IEqualityComparer<string>) StringComparer.Ordinal);

    /// <summary>
    /// Adds an <see cref="T:Microsoft.AspNetCore.Authentication.AuthenticationScheme" />.
    /// </summary>
    /// <param name="name">The name of the scheme being added.</param>
    /// <param name="configureBuilder">Configures the scheme.</param>
    public void AddScheme(
      string name,
      Action<AuthenticationSchemeBuilder> configureBuilder)
    {
      if (name == null)
        throw new ArgumentNullException(nameof (name));
      if (configureBuilder == null)
        throw new ArgumentNullException(nameof (configureBuilder));
      if (this.SchemeMap.ContainsKey(name))
        throw new InvalidOperationException("Scheme already exists: " + name);
      AuthenticationSchemeBuilder authenticationSchemeBuilder = new AuthenticationSchemeBuilder(name);
      configureBuilder(authenticationSchemeBuilder);
      this._schemes.Add(authenticationSchemeBuilder);
      this.SchemeMap[name] = authenticationSchemeBuilder;
    }

    /// <summary>
    /// Adds an <see cref="T:Microsoft.AspNetCore.Authentication.AuthenticationScheme" />.
    /// </summary>
    /// <typeparam name="THandler">The <see cref="T:Microsoft.AspNetCore.Authentication.IAuthenticationHandler" /> responsible for the scheme.</typeparam>
    /// <param name="name">The name of the scheme being added.</param>
    /// <param name="displayName">The display name for the scheme.</param>
    public void AddScheme<THandler>(string name, string displayName) where THandler : IAuthenticationHandler
    {
      this.AddScheme(name, (Action<AuthenticationSchemeBuilder>) (b =>
      {
        b.DisplayName = displayName;
        b.HandlerType = typeof (THandler);
      }));
    }

    /// <summary>
    /// Used as the fallback default scheme for all the other defaults.
    /// </summary>
    public string DefaultScheme { get; set; }

    /// <summary>
    /// Used as the default scheme by <see cref="M:Microsoft.AspNetCore.Authentication.IAuthenticationService.AuthenticateAsync(Microsoft.AspNetCore.Http.HttpContext,System.String)" />.
    /// </summary>
    public string DefaultAuthenticateScheme { get; set; }

    /// <summary>
    /// Used as the default scheme by <see cref="M:Microsoft.AspNetCore.Authentication.IAuthenticationService.SignInAsync(Microsoft.AspNetCore.Http.HttpContext,System.String,System.Security.Claims.ClaimsPrincipal,Microsoft.AspNetCore.Authentication.AuthenticationProperties)" />.
    /// </summary>
    public string DefaultSignInScheme { get; set; }

    /// <summary>
    /// Used as the default scheme by <see cref="M:Microsoft.AspNetCore.Authentication.IAuthenticationService.SignOutAsync(Microsoft.AspNetCore.Http.HttpContext,System.String,Microsoft.AspNetCore.Authentication.AuthenticationProperties)" />.
    /// </summary>
    public string DefaultSignOutScheme { get; set; }

    /// <summary>
    /// Used as the default scheme by <see cref="M:Microsoft.AspNetCore.Authentication.IAuthenticationService.ChallengeAsync(Microsoft.AspNetCore.Http.HttpContext,System.String,Microsoft.AspNetCore.Authentication.AuthenticationProperties)" />.
    /// </summary>
    public string DefaultChallengeScheme { get; set; }

    /// <summary>
    /// Used as the default scheme by <see cref="M:Microsoft.AspNetCore.Authentication.IAuthenticationService.ForbidAsync(Microsoft.AspNetCore.Http.HttpContext,System.String,Microsoft.AspNetCore.Authentication.AuthenticationProperties)" />.
    /// </summary>
    public string DefaultForbidScheme { get; set; }
  }

这个类为添加Scheme提供了便利，它维护了一个AuthenticationSchemeBuilder的列表和一个同类型的字典。------------------------

IAuthenticationHandlerProvider

public interface IAuthenticationHandlerProvider 
{ 
Task<IAuthenticationHandler> GetHandlerAsync(HttpContext context, string authenticationScheme);
}

IAuthenticationHandler负责对用户的凭证进行校验，而这个Provider就是用来提供一个IAuthenticationHandler,它只有一个方法就是GetHandlerAsync(HttpContext context,string authenticationScheme)。从方法的参数传入也能知道IAuthenticationHnadlerProvider的实现依赖于AuthenticationScheme，确实，它的实现AuthenticationHandlerProvider里面确实维护了一个IAuthenticationSchemeProvider:

public class AuthenticationHandlerProvider : IAuthenticationHandlerProvider
  {
    private Dictionary<string, IAuthenticationHandler> _handlerMap = new Dictionary<string, IAuthenticationHandler>((IEqualityComparer<string>) StringComparer.Ordinal);

    /// <summary>Constructor.</summary>
    /// <param name="schemes">The <see cref="T:Microsoft.AspNetCore.Authentication.IAuthenticationHandlerProvider" />.</param>
    public AuthenticationHandlerProvider(IAuthenticationSchemeProvider schemes)
    {
      this.Schemes = schemes;
    }

    /// <summary>
    /// The <see cref="T:Microsoft.AspNetCore.Authentication.IAuthenticationHandlerProvider" />.
    /// </summary>
    public IAuthenticationSchemeProvider Schemes { get; }

    /// <summary>Returns the handler instance that will be used.</summary>
    /// <param name="context">The context.</param>
    /// <param name="authenticationScheme">The name of the authentication scheme being handled.</param>
    /// <returns>The handler instance.</returns>
    public async Task<IAuthenticationHandler> GetHandlerAsync(
      HttpContext context,
      string authenticationScheme)
    {
      if (this._handlerMap.ContainsKey(authenticationScheme))
        return this._handlerMap[authenticationScheme];
      AuthenticationScheme schemeAsync = await this.Schemes.GetSchemeAsync(authenticationScheme);
      if (schemeAsync == null)
        return (IAuthenticationHandler) null;
      if ((context.RequestServices.GetService(schemeAsync.HandlerType) ?? ActivatorUtilities.CreateInstance(context.RequestServices, schemeAsync.HandlerType)) is IAuthenticationHandler handler)
      {
        await handler.InitializeAsync(schemeAsync, context);
        this._handlerMap[authenticationScheme] = handler;
      }
      return handler;
    }
  }

IAuthenticationHandlerProvider的目的很明确，就是要提供一个IAuthenticationHandler，它的逻辑如下：

①首先根据authenticationScheme查看_handlerMap是否包含相应的handler如果包含直接返回这个handler。

②如果没有从第一步中找到，那么就从Schemes属性中根据authenticationScheme找出相应的AuthenticationScheme，如果这个Scheme为空，那么直接返回一个null。

③如果从Schemes属性中找出的AuthenticationScheme不为空，那么或者从传入的HttpContext类型的context.RequestServices.GetService方法中找Handler，或者使用ActivatorUtilities来创建一个，不管使用那种方式都是从拿到的scheme中记录的handlerType来获取handler的。如果是一个IAuthenticationHandler，那么调用handler. InitializeAsync方法(注一)来初始化本身，并将这个handler放入自身的_handlerMap字典中。最后将这个handler返回。

AuthenticateResult

public class AuthenticateResult
  {
    protected AuthenticateResult()
    {
    }

    /// <summary>
    /// If a ticket was produced, authenticate was successful.
    /// </summary>
    public bool Succeeded
    {
      get
      {
        return this.Ticket != null;
      }
    }

    /// <summary>The authentication ticket.</summary>
    public AuthenticationTicket Ticket { get; protected set; }

    /// <summary>
    /// Gets the claims-principal with authenticated user identities.
    /// </summary>
    public ClaimsPrincipal Principal
    {
      get
      {
        return this.Ticket?.Principal;
      }
    }

    /// <summary>
    /// Additional state values for the authentication session.
    /// </summary>
    public AuthenticationProperties Properties { get; protected set; }

    /// <summary>Holds failure information from the authentication.</summary>
    public Exception Failure { get; protected set; }

    /// <summary>
    /// Indicates that there was no information returned for this authentication scheme.
    /// </summary>
    public bool None { get; protected set; }

    /// <summary>Indicates that authentication was successful.</summary>
    /// <param name="ticket">The ticket representing the authentication result.</param>
    /// <returns>The result.</returns>
    public static AuthenticateResult Success(AuthenticationTicket ticket)
    {
      if (ticket == null)
        throw new ArgumentNullException(nameof (ticket));
      return new AuthenticateResult()
      {
        Ticket = ticket,
        Properties = ticket.Properties
      };
    }

    /// <summary>
    /// Indicates that there was no information returned for this authentication scheme.
    /// </summary>
    /// <returns>The result.</returns>
    public static AuthenticateResult NoResult()
    {
      return new AuthenticateResult() { None = true };
    }

    /// <summary>
    /// Indicates that there was a failure during authentication.
    /// </summary>
    /// <param name="failure">The failure exception.</param>
    /// <returns>The result.</returns>
    public static AuthenticateResult Fail(Exception failure)
    {
      return new AuthenticateResult() { Failure = failure };
    }

    /// <summary>
    /// Indicates that there was a failure during authentication.
    /// </summary>
    /// <param name="failure">The failure exception.</param>
    /// <param name="properties">Additional state values for the authentication session.</param>
    /// <returns>The result.</returns>
    public static AuthenticateResult Fail(
      Exception failure,
      AuthenticationProperties properties)
    {
      return new AuthenticateResult()
      {
        Failure = failure,
        Properties = properties
      };
    }

    /// <summary>
    /// Indicates that there was a failure during authentication.
    /// </summary>
    /// <param name="failureMessage">The failure message.</param>
    /// <returns>The result.</returns>
    public static AuthenticateResult Fail(string failureMessage)
    {
      return AuthenticateResult.Fail(new Exception(failureMessage));
    }

    /// <summary>
    /// Indicates that there was a failure during authentication.
    /// </summary>
    /// <param name="failureMessage">The failure message.</param>
    /// <param name="properties">Additional state values for the authentication session.</param>
    /// <returns>The result.</returns>
    public static AuthenticateResult Fail(
      string failureMessage,
      AuthenticationProperties properties)
    {
      return AuthenticateResult.Fail(new Exception(failureMessage), properties);
    }
  }

一个认证结果，表示AuthenticationService中的方法返回的结果。典型的状态模式。它内部维护一个AuthenticationTicket。可直接调用Success方法或这Fail方法来返回包含相应状态的Result。

AuthenticatoinTicket

public class AuthenticationTicket
  {
    /// <summary>
    /// Initializes a new instance of the <see cref="T:Microsoft.AspNetCore.Authentication.AuthenticationTicket" /> class
    /// </summary>
    /// <param name="principal">the <see cref="T:System.Security.Claims.ClaimsPrincipal" /> that represents the authenticated user.</param>
    /// <param name="properties">additional properties that can be consumed by the user or runtime.</param>
    /// <param name="authenticationScheme">the authentication middleware that was responsible for this ticket.</param>
    public AuthenticationTicket(
      ClaimsPrincipal principal,
      AuthenticationProperties properties,
      string authenticationScheme)
    {
      if (principal == null)
        throw new ArgumentNullException(nameof (principal));
      this.AuthenticationScheme = authenticationScheme;
      this.Principal = principal;
      this.Properties = properties ?? new AuthenticationProperties();
    }

    /// <summary>
    /// Initializes a new instance of the <see cref="T:Microsoft.AspNetCore.Authentication.AuthenticationTicket" /> class
    /// </summary>
    /// <param name="principal">the <see cref="T:System.Security.Claims.ClaimsPrincipal" /> that represents the authenticated user.</param>
    /// <param name="authenticationScheme">the authentication middleware that was responsible for this ticket.</param>
    public AuthenticationTicket(ClaimsPrincipal principal, string authenticationScheme)
      : this(principal, (AuthenticationProperties) null, authenticationScheme)
    {
    }

    /// <summary>Gets the authentication type.</summary>
    public string AuthenticationScheme { get; private set; }

    /// <summary>
    /// Gets the claims-principal with authenticated user identities.
    /// </summary>
    public ClaimsPrincipal Principal { get; private set; }

    /// <summary>
    /// Additional state values for the authentication session.
    /// </summary>
    public AuthenticationProperties Properties { get; private set; }
  }

表示一个经过认证后颁发的证书，里面包含ClaimsPrincipal、AuthenticationScheme和AuthenticationProperties三个属性，ClaimsPrincipal表示证书的主体，如姓名、电话等等信息，AuthenticationProperties表示证书的相关信息，如颁发时间、过期时间和重定向地址等等。

AuthenticationProperties

 public class AuthenticationProperties
  {
    internal const string IssuedUtcKey = ".issued";
    internal const string ExpiresUtcKey = ".expires";
    internal const string IsPersistentKey = ".persistent";
    internal const string RedirectUriKey = ".redirect";
    internal const string RefreshKey = ".refresh";
    internal const string UtcDateTimeFormat = "r";

    /// <summary>
    /// Initializes a new instance of the <see cref="T:Microsoft.AspNetCore.Authentication.AuthenticationProperties" /> class.
    /// </summary>
    public AuthenticationProperties()
      : this((IDictionary<string, string>) null, (IDictionary<string, object>) null)
    {
    }

    /// <summary>
    /// Initializes a new instance of the <see cref="T:Microsoft.AspNetCore.Authentication.AuthenticationProperties" /> class.
    /// </summary>
    /// <param name="items">State values dictionary to use.</param>
    public AuthenticationProperties(IDictionary<string, string> items)
      : this(items, (IDictionary<string, object>) null)
    {
    }

    /// <summary>
    /// Initializes a new instance of the <see cref="T:Microsoft.AspNetCore.Authentication.AuthenticationProperties" /> class.
    /// </summary>
    /// <param name="items">State values dictionary to use.</param>
    /// <param name="parameters">Parameters dictionary to use.</param>
    public AuthenticationProperties(
      IDictionary<string, string> items,
      IDictionary<string, object> parameters)
    {
      this.Items = items ?? (IDictionary<string, string>) new Dictionary<string, string>((IEqualityComparer<string>) StringComparer.Ordinal);
      this.Parameters = parameters ?? (IDictionary<string, object>) new Dictionary<string, object>((IEqualityComparer<string>) StringComparer.Ordinal);
    }

    /// <summary>State values about the authentication session.</summary>
    public IDictionary<string, string> Items { get; }

    /// <summary>
    /// Collection of parameters that are passed to the authentication handler. These are not intended for
    /// serialization or persistence, only for flowing data between call sites.
    /// </summary>
    public IDictionary<string, object> Parameters { get; }

    /// <summary>
    /// Gets or sets whether the authentication session is persisted across multiple requests.
    /// </summary>
    public bool IsPersistent
    {
      get
      {
        return this.GetString(".persistent") != null;
      }
      set
      {
        this.SetString(".persistent", value ? string.Empty : (string) null);
      }
    }

    /// <summary>
    /// Gets or sets the full path or absolute URI to be used as an http redirect response value.
    /// </summary>
    public string RedirectUri
    {
      get
      {
        return this.GetString(".redirect");
      }
      set
      {
        this.SetString(".redirect", value);
      }
    }

    /// <summary>
    /// Gets or sets the time at which the authentication ticket was issued.
    /// </summary>
    public DateTimeOffset? IssuedUtc
    {
      get
      {
        return this.GetDateTimeOffset(".issued");
      }
      set
      {
        this.SetDateTimeOffset(".issued", value);
      }
    }

    /// <summary>
    /// Gets or sets the time at which the authentication ticket expires.
    /// </summary>
    public DateTimeOffset? ExpiresUtc
    {
      get
      {
        return this.GetDateTimeOffset(".expires");
      }
      set
      {
        this.SetDateTimeOffset(".expires", value);
      }
    }

    /// <summary>
    /// Gets or sets if refreshing the authentication session should be allowed.
    /// </summary>
    public bool? AllowRefresh
    {
      get
      {
        return this.GetBool(".refresh");
      }
      set
      {
        this.SetBool(".refresh", value);
      }
    }

    /// <summary>
    /// Get a string value from the <see cref="P:Microsoft.AspNetCore.Authentication.AuthenticationProperties.Items" /> collection.
    /// </summary>
    /// <param name="key">Property key.</param>
    /// <returns>Retrieved value or <c>null</c> if the property is not set.</returns>
    public string GetString(string key)
    {
      string str;
      return !this.Items.TryGetValue(key, out str) ? (string) null : str;
    }

    /// <summary>
    /// Set a string value in the <see cref="P:Microsoft.AspNetCore.Authentication.AuthenticationProperties.Items" /> collection.
    /// </summary>
    /// <param name="key">Property key.</param>
    /// <param name="value">Value to set or <c>null</c> to remove the property.</param>
    public void SetString(string key, string value)
    {
      if (value != null)
      {
        this.Items[key] = value;
      }
      else
      {
        if (!this.Items.ContainsKey(key))
          return;
        this.Items.Remove(key);
      }
    }

    /// <summary>
    /// Get a parameter from the <see cref="P:Microsoft.AspNetCore.Authentication.AuthenticationProperties.Parameters" /> collection.
    /// </summary>
    /// <typeparam name="T">Parameter type.</typeparam>
    /// <param name="key">Parameter key.</param>
    /// <returns>Retrieved value or the default value if the property is not set.</returns>
    public T GetParameter<T>(string key)
    {
      object obj1;
      return this.Parameters.TryGetValue(key, out obj1) && obj1 is T obj2 ? obj2 : default (T);
    }

    /// <summary>
    /// Set a parameter value in the <see cref="P:Microsoft.AspNetCore.Authentication.AuthenticationProperties.Parameters" /> collection.
    /// </summary>
    /// <typeparam name="T">Parameter type.</typeparam>
    /// <param name="key">Parameter key.</param>
    /// <param name="value">Value to set.</param>
    public void SetParameter<T>(string key, T value)
    {
      this.Parameters[key] = (object) value;
    }

    /// <summary>
    /// Get a bool value from the <see cref="P:Microsoft.AspNetCore.Authentication.AuthenticationProperties.Items" /> collection.
    /// </summary>
    /// <param name="key">Property key.</param>
    /// <returns>Retrieved value or <c>null</c> if the property is not set.</returns>
    protected bool? GetBool(string key)
    {
      string str;
      bool result;
      return this.Items.TryGetValue(key, out str) && bool.TryParse(str, out result) ? new bool?(result) : new bool?();
    }

    /// <summary>
    /// Set a bool value in the <see cref="P:Microsoft.AspNetCore.Authentication.AuthenticationProperties.Items" /> collection.
    /// </summary>
    /// <param name="key">Property key.</param>
    /// <param name="value">Value to set or <c>null</c> to remove the property.</param>
    protected void SetBool(string key, bool? value)
    {
      if (value.HasValue)
      {
        this.Items[key] = value.Value.ToString();
      }
      else
      {
        if (!this.Items.ContainsKey(key))
          return;
        this.Items.Remove(key);
      }
    }

    /// <summary>
    /// Get a DateTimeOffset value from the <see cref="P:Microsoft.AspNetCore.Authentication.AuthenticationProperties.Items" /> collection.
    /// </summary>
    /// <param name="key">Property key.</param>
    /// <returns>Retrieved value or <c>null</c> if the property is not set.</returns>
    protected DateTimeOffset? GetDateTimeOffset(string key)
    {
      string input;
      DateTimeOffset result;
      return this.Items.TryGetValue(key, out input) && DateTimeOffset.TryParseExact(input, "r", (IFormatProvider) CultureInfo.InvariantCulture, DateTimeStyles.RoundtripKind, out result) ? new DateTimeOffset?(result) : new DateTimeOffset?();
    }

    /// <summary>
    /// Set a DateTimeOffset value in the <see cref="P:Microsoft.AspNetCore.Authentication.AuthenticationProperties.Items" /> collection.
    /// </summary>
    /// <param name="key">Property key.</param>
    /// <param name="value">Value to set or <c>null</c> to remove the property.</param>
    protected void SetDateTimeOffset(string key, DateTimeOffset? value)
    {
      if (value.HasValue)
      {
        this.Items[key] = value.Value.ToString("r", (IFormatProvider) CultureInfo.InvariantCulture);
      }
      else
      {
        if (!this.Items.ContainsKey(key))
          return;
        this.Items.Remove(key);
      }
    }
  }

IClaimsTransformation

 public interface IClaimsTransformation
  {
    /// <summary>
    /// Provides a central transformation point to change the specified principal.
    /// Note: this will be run on each AuthenticateAsync call, so its safer to
    /// return a new ClaimsPrincipal if your transformation is not idempotent.
    /// </summary>
    /// <param name="principal">The <see cref="T:System.Security.Claims.ClaimsPrincipal" /> to transform.</param>
    /// <returns>The transformed principal.</returns>
    Task<ClaimsPrincipal> TransformAsync(ClaimsPrincipal principal);
  }

这个接口可以为传入的principal提供转换，适合全局为principal添加一些额外的claim。