authorization - write single API accessible through asp.net identity user and bearer token both -

i have created asp.net mvc 6 application , configured asp.net identity users using entity framework 7 working fine. added aspnet.security.openidconnect.server token provider server working fine.

then created api controller follows:

 [route("api/[controller]")]     public class valuescontroller : controller     {         // get: api/values         [authorize(policy = "somepolicy")]         [httpget]         public ienumerable get()         {             return new string[] { "value1", "value2" };         }     } 

question: want configure authorization in such way either bearer token or asp.net identity user valid (and belong role), want allow user access api.

here tried in startup.cs:

  services.addauthorization(options => {                 // add new policy requiring "scope" claim                 // containing "api-resource-controller" value.                 options.addpolicy("api", policy => {                     policy.addauthenticationschemes(jwtbearerdefaults.authenticationscheme);                     policy.requireclaim(openidconnectconstants.claims.scope, "offline_access");                                                         });                             }); 

then if add [authorize(policy="api")] api controller, respecting bearer tokens, not identity users.

any appreciated!

policy.addauthenticationschemes supports multiple schemes, - in theory - that:

services.addauthorization(options => {     options.addpolicy("api", policy => {         policy.addauthenticationschemes(             /* scheme 1: */ jwtbearerdefaults.authenticationscheme,             /* scheme 2: */ typeof(identitycookieoptions).namespace + ".application");     }); }); 

note: typeof(identitycookieoptions).namespace + ".application" default authentication scheme used asp.net identity 3: https://github.com/aspnet/identity/blob/3.0.0-rc1/src/microsoft.aspnet.identity/identitycookieoptions.cs#l61

alternatively, remove policy.addauthenticationschemes call , configure bearer , cookies middleware use automatic authentication (automaticauthenticate = true, default value cookies middleware, not jwt middleware).

---

in practice, it's absolutely not recommended defeats whole purpose of using bearer-only authentication: mitigating xsrf attacks. if want support cookies + bearer authentication, should strongly consider implementing xsrf countermeasures.