Updated how we handle auth

ChilliCream · Apr 6, 2020 · 2e8b7b2 · 2e8b7b2
1 parent c37c8bd
commit 2e8b7b2
Showing 1 changed file with 16 additions and 8 deletions.
diff --git a/src/Server/AspNetCore.Authorization/AuthorizeMiddleware.cs b/src/Server/AspNetCore.Authorization/AuthorizeMiddleware.cs
@@ -29,8 +29,7 @@ public AuthorizeMiddleware(FieldDelegate next)
 
         public async Task InvokeAsync(IDirectiveContext context)
         {
-            AuthorizeDirective directive = context.Directive
-                .ToObject<AuthorizeDirective>();
+            AuthorizeDirective directive = context.Directive.ToObject<AuthorizeDirective>();
 
             ClaimsPrincipal principal = null;
             var allowed = false;
@@ -41,8 +40,19 @@ public async Task InvokeAsync(IDirectiveContext context)
                 && o is ClaimsPrincipal p)
             {
                 principal = p;
-                authenticated = allowed =
-                    p.Identities.Any(t => t.IsAuthenticated);
+
+                #if !ASPNETCLASSIC
+                if (NeedsPolicyValidation(directive))
+                {
+                    authenticated = allowed = true;
+                }
+                else
+                {
+                    authenticated = allowed = p.Identities.Any(t => t.IsAuthenticated);
+                }
+                #else
+                authenticated = allowed = p.Identities.Any(t => t.IsAuthenticated);
+                #endif
             }
 
             allowed = allowed && IsInAnyRole(principal, directive.Roles);
@@ -94,11 +104,9 @@ private static bool IsInAnyRole(
         }
 #if !ASPNETCLASSIC
 
-        private static bool NeedsPolicyValidation(
-            AuthorizeDirective directive)
+        private static bool NeedsPolicyValidation(AuthorizeDirective directive)
         {
-            return directive.Roles.Count == 0
-                || !string.IsNullOrEmpty(directive.Policy);
+            return directive.Roles.Count == 0 || !string.IsNullOrEmpty(directive.Policy);
         }
 
         private static async Task<bool> AuthorizeWithPolicyAsync(