asp.net core 2.1认证

整体概况

整个asp.net core在StartUp类的Configure方法中使用一个UseAuthentication()的方式将认证这个中间件添加到了应用中。这个中间件的源码很短，如下：

public class AuthenticationMiddleware
  {
    private readonly RequestDelegate _next;

    public AuthenticationMiddleware(RequestDelegate next, IAuthenticationSchemeProvider schemes)
    {
      if (next == null)
        throw new ArgumentNullException(nameof (next));
      if (schemes == null)
        throw new ArgumentNullException(nameof (schemes));
      this._next = next;
      this.Schemes = schemes;
    }

    public IAuthenticationSchemeProvider Schemes { get; set; }

    public async Task Invoke(HttpContext context)
    {
      context.Features.Set<IAuthenticationFeature>((IAuthenticationFeature) new AuthenticationFeature()
      {
        OriginalPath = context.Request.Path,
        OriginalPathBase = context.Request.PathBase
      });
      IAuthenticationHandlerProvider handlers = context.RequestServices.GetRequiredService<IAuthenticationHandlerProvider>();
      foreach (AuthenticationScheme authenticationScheme in await this.Schemes.GetRequestHandlerSchemesAsync())//GetReRequestHandlersAsync方法返回_requestHandlers字段保存的所有远程认证的Scheme
      {
        IAuthenticationRequestHandler handlerAsync = await handlers.GetHandlerAsync(context, authenticationScheme.Name) as IAuthenticationRequestHandler;
        bool flag = handlerAsync != null;
        if (flag)
          flag = await handlerAsync.HandleRequestAsync();
        if (flag)
          return;
      }
      AuthenticationScheme authenticateSchemeAsync = await this.Schemes.GetDefaultAuthenticateSchemeAsync();
      if (authenticateSchemeAsync != null)
      {
        AuthenticateResult authenticateResult = await context.AuthenticateAsync(authenticateSchemeAsync.Name);
        if (authenticateResult?.Principal != null)
          context.User = authenticateResult.Principal;
      }
      await this._next(context);
    }
  }

基本的流程是先找一个IAuthenticationRequestHandler，这个接口代表了远程认证，逻辑是①找到一个不为空的handler并执行HandlerRequestAsync；②如果执行结果为true，则返回，否则，继续下一个循环。如果没有找到任何IAuthenticationRequestHandler，则继续由GetDefaultAuthenticateSchemeAsync方法来找一个默认的本地认证Scheme，这个本地认证Scheme的逻辑是从AuthenticationOptions中先查看DefaultAuthenticationScheme是否有值（string），如果没有，再从DefaultScheme中查看是否有值（string)如果两者都没有，那么返回一个null。（注：认证中间件依赖一个IAuthenticationSchemeProvider(构造函数注入),后者的默认实现AuthenticationSchemeProvider依赖AuthenticationOptions类）。

整个asp.net core 认证的线索为IAuthenticationService，这个接口声明了5个动作方法，其中，具体的执行是由IAuthenticationHandler来执行的，这个接口定义了AuthenticateAsync()、ForbiddenAsync()和ChallengeAsync()。而SignInAsync和SignOutAsync则分别由IAuthenticationSignInHandler和IAuthenticationSignOutHandler来定义的。后两个接口也继承自IAuthenticationHandler，IAuthenticationHandler由IAuthenticationHandlerProvider来提供，IAuthenticationHandlerProvider使用IAuthenticationSchemeProvider来提供一个具体的AuthenticationScheme，AuthenticationScheme代表一个具体的方案，这个Scheme中包含了执行这个方案需要的HandlerType，也即是IAuthenticationHandler，从Scheme中拿到这个HandlerType之后，从DI或者ActivityUtils中得到具体的IAuthenticaitonHandler来执行最终逻辑。其他的诸如AuthenticateResult代表一个认证验证结果，他里面维护了一个AuthenticationTicket,还有一个AuthenticateProperties表示认证的一些特征，如颁发时间、过期时间等等。

这篇文章涉及的源码包括Microsoft.AspNETCore.Authentication.Abstraction、Microsoft.AspNETCore.Authentication.Core和Microsoft.AspNETCore.Authentication

认证和授权很相似，他们的英文也很相似，一个是Authentication认证，一个是Authorization授权。

asp.net core中的认证需要在Startup类中进行配置：

//ConfigureServices方法中：
 services.AddAuthentication(option =>
            {
                option.DefaultScheme = "Cookie";
                option.DefaultChallengeScheme = "Cookie";
                option.DefaultAuthenticateScheme = "Cookie";
                option.DefaultForbidScheme = "Cookie";
                option.DefaultSignInScheme = "Cookie";
                option.DefaultSignOutScheme = "Cookie";
            }).AddCookie("Cookie", option =>
            {
                option.LoginPath = "/Account/Login";
                option.AccessDeniedPath = "/Account/Forbidden";
                //.......
            });

//Configure方法中
 app.UseAuthentication();

看一看到如果需要认证的话是需要分别在ConfigureService方法和Configure方法中分别进行配置的。

我们看到上面在AddAuthentication方法中配置了一个option，这个option是一个Action<AuthenticationOption>,在里面，写了一堆scheme。这个scheme是什么意思呢？我们先解释一下在asp.neet core中发生的这几个动作。在asp.net core中是有5个动作要发生的：

1、登陆（Signin）：用户要进行登陆的动作。

2、登出（Signout）：用户要进行登出。

3、Challenge：这个不好翻译，意思当用户需要请求一个被保护的资源时，系统要求用户进行登陆。总之他也是一个登陆的动作，但是被动的登陆，一般返回401。

4、Authenticate：认证，系统将用户的信息从token/cookie中读取出来。和登陆这个动作正好相反。

5、Forbid：系统对用户执行了拒绝的操作。一般返回403

上面这些动作最后都是由一个Handler来执行的，这个handler就是一个IAuthenticationHandler的实现。

我们先给出了上面的总结，再看一下具体的情况。asp.net core2.0开始上面的这些动作的执行都是通过HttpContext的扩展方法来执行的。我们拿登陆来说，其他都大同小异。

先看HttpContext.SigninAsync这个方法：

            var claim = new Claim("name", "wallee");//claim相当于我的众多信息中的一个信息单元，还有年龄、性别、家庭等等
            var identity = new ClaimsIdentity("身份证");//identity表示一个claim集合，这个集合代表了一个完整的“证件信息”,比如我的身份证
            identity.AddClaim(claim);//将上面那个信息片段添加到我的身份证里面
            var me=new ClaimsPrincipal(identity);//将身份证作为我个人的初始化参数，初始化一个ClaimsPrincipal就代表了我这个主体。还可以添加其他的identity，如还有驾驶证、准考证、会计证、计算机二级证等等

            HttpContext.SignInAsync(me);//最后，利用这个主体，调用HttpContext的扩展方法进行登陆。

上面的代码中注释解释了一些和本文无关但又非常重要的信息，我们关键看最后哪一行：HttpContext.SigninAsync(principal)；这行代码实现了最终的登陆。现在我们看一下它的实现：

public static Task SignInAsync(this HttpContext context, string scheme, ClaimsPrincipal principal, AuthenticationProperties properties)
    {
      return context.RequestServices.GetRequiredService<IAuthenticationService>().SignInAsync(context, scheme, principal, properties);
}

其实针对HttpContext的扩展方法都是调用IAuthenticationService来执行的，IAuthenticationService里面定义了针对上面描述的所有动作方法：

 /// <summary>Used to provide authentication.</summary>
   public interface IAuthenticationService
   {
     /// <summary>Authenticate for the specified authentication scheme.</summary>
     /// <param name="context">The <see cref="T:Microsoft.AspNetCore.Http.HttpContext" />.</param>
     /// <param name="scheme">The name of the authentication scheme.</param>
     /// <returns>The result.</returns>
     Task<AuthenticateResult> AuthenticateAsync(
       HttpContext context,
       string scheme);

     /// <summary>Challenge the specified authentication scheme.</summary>
     /// <param name="context">The <see cref="T:Microsoft.AspNetCore.Http.HttpContext" />.</param>
     /// <param name="scheme">The name of the authentication scheme.</param>
     /// <param name="properties">The <see cref="T:Microsoft.AspNetCore.Authentication.AuthenticationProperties" />.</param>
     /// <returns>A task.</returns>
     Task ChallengeAsync(
       HttpContext context,
       string scheme,
       AuthenticationProperties properties);

     /// <summary>Forbids the specified authentication scheme.</summary>
     /// <param name="context">The <see cref="T:Microsoft.AspNetCore.Http.HttpContext" />.</param>
     /// <param name="scheme">The name of the authentication scheme.</param>
     /// <param name="properties">The <see cref="T:Microsoft.AspNetCore.Authentication.AuthenticationProperties" />.</param>
     /// <returns>A task.</returns>
     Task ForbidAsync(HttpContext context, string scheme, AuthenticationProperties properties);

     /// <summary>
     /// Sign a principal in for the specified authentication scheme.
     /// </summary>
     /// <param name="context">The <see cref="T:Microsoft.AspNetCore.Http.HttpContext" />.</param>
     /// <param name="scheme">The name of the authentication scheme.</param>
     /// <param name="principal">The <see cref="T:System.Security.Claims.ClaimsPrincipal" /> to sign in.</param>
     /// <param name="properties">The <see cref="T:Microsoft.AspNetCore.Authentication.AuthenticationProperties" />.</param>
     /// <returns>A task.</returns>
     Task SignInAsync(
       HttpContext context,
       string scheme,
       ClaimsPrincipal principal,
       AuthenticationProperties properties);

     /// <summary>Sign out the specified authentication scheme.</summary>
     /// <param name="context">The <see cref="T:Microsoft.AspNetCore.Http.HttpContext" />.</param>
     /// <param name="scheme">The name of the authentication scheme.</param>
     /// <param name="properties">The <see cref="T:Microsoft.AspNetCore.Authentication.AuthenticationProperties" />.</param>
     /// <returns>A task.</returns>
     Task SignOutAsync(HttpContext context, string scheme, AuthenticationProperties properties);
   }

IAuthenticateService在services.AddAuthentication()方法中以scoped的生命周期被注入到了DI,表示针对每次请求的新的实例。同时还被注入的有另外几个比较关键的接口：

services.TryAddSingleton<IClaimsTransformation, NoopClaimsTransformation>();//ClaimsTransFormation用来在全局将ClaimsPrincipal添加一些新的Claims，默认注入的这个是啥都没干
services.TryAddScoped<IAuthenticationHandlerProvider, AuthenticationHandlerProvider>();//AuthenticationHandler的提供者，提供执行Authenticatoin、Forbidden和Challenge等动作的handler
services.TryAddSingleton<IAuthenticationSchemeProvider, AuthenticationSchemeProvider>();//AuthenticationScheme的提供者，AuthenticationScheme是对AuthenticationHandler的描述，通过Scheme找到相应的Handler

IAuthenticationService是对IAuthenticationSchemeProvider和IAuthenticationHandlerProvider的封装，它有一个AuthenticationService的实现：

 /// <summary>
   /// Implements <see cref="T:Microsoft.AspNetCore.Authentication.IAuthenticationService" />.
   /// </summary>
   public class AuthenticationService : IAuthenticationService
   {
     /// <summary>Constructor.</summary>
     /// <param name="schemes">The <see cref="T:Microsoft.AspNetCore.Authentication.IAuthenticationSchemeProvider" />.</param>
     /// <param name="handlers">The <see cref="T:Microsoft.AspNetCore.Authentication.IAuthenticationRequestHandler" />.</param>
     /// <param name="transform">The <see cref="T:Microsoft.AspNetCore.Authentication.IClaimsTransformation" />.</param>
     public AuthenticationService(
       IAuthenticationSchemeProvider schemes,
       IAuthenticationHandlerProvider handlers,
       IClaimsTransformation transform)
     {
       this.Schemes = schemes;
       this.Handlers = handlers;
       this.Transform = transform;
     }

     /// <summary>Used to lookup AuthenticationSchemes.</summary>
     public IAuthenticationSchemeProvider Schemes { get; }

     /// <summary>Used to resolve IAuthenticationHandler instances.</summary>
     public IAuthenticationHandlerProvider Handlers { get; }

     /// <summary>Used for claims transformation.</summary>
     public IClaimsTransformation Transform { get; }

     /// <summary>Authenticate for the specified authentication scheme.</summary>
     /// <param name="context">The <see cref="T:Microsoft.AspNetCore.Http.HttpContext" />.</param>
     /// <param name="scheme">The name of the authentication scheme.</param>
     /// <returns>The result.</returns>
     public virtual async Task<AuthenticateResult> AuthenticateAsync(
       HttpContext context,
       string scheme)
     {
       if (scheme == null)
       {
         scheme = (await this.Schemes.GetDefaultAuthenticateSchemeAsync())?.Name;
         if (scheme == null)
           throw new InvalidOperationException("No authenticationScheme was specified, and there was no DefaultAuthenticateScheme found.");
       }
       IAuthenticationHandler handlerAsync = await this.Handlers.GetHandlerAsync(context, scheme);
       if (handlerAsync == null)
         throw await this.CreateMissingHandlerException(scheme);
       AuthenticateResult result = await handlerAsync.AuthenticateAsync();
       return result != null && result.Succeeded ? AuthenticateResult.Success(new AuthenticationTicket(await this.Transform.TransformAsync(result.Principal), result.Properties, result.Ticket.AuthenticationScheme)) : result;
     }

     /// <summary>Challenge the specified authentication scheme.</summary>
     /// <param name="context">The <see cref="T:Microsoft.AspNetCore.Http.HttpContext" />.</param>
     /// <param name="scheme">The name of the authentication scheme.</param>
     /// <param name="properties">The <see cref="T:Microsoft.AspNetCore.Authentication.AuthenticationProperties" />.</param>
     /// <returns>A task.</returns>
     public virtual async Task ChallengeAsync(
       HttpContext context,
       string scheme,
       AuthenticationProperties properties)
     {
       if (scheme == null)
       {
         scheme = (await this.Schemes.GetDefaultChallengeSchemeAsync())?.Name;
         if (scheme == null)
           throw new InvalidOperationException("No authenticationScheme was specified, and there was no DefaultChallengeScheme found.");
       }
       IAuthenticationHandler handlerAsync = await this.Handlers.GetHandlerAsync(context, scheme);
       if (handlerAsync == null)
         throw await this.CreateMissingHandlerException(scheme);
       await handlerAsync.ChallengeAsync(properties);
     }

     /// <summary>Forbid the specified authentication scheme.</summary>
     /// <param name="context">The <see cref="T:Microsoft.AspNetCore.Http.HttpContext" />.</param>
     /// <param name="scheme">The name of the authentication scheme.</param>
     /// <param name="properties">The <see cref="T:Microsoft.AspNetCore.Authentication.AuthenticationProperties" />.</param>
     /// <returns>A task.</returns>
     public virtual async Task ForbidAsync(
       HttpContext context,
       string scheme,
       AuthenticationProperties properties)
     {
       if (scheme == null)
       {
         scheme = (await this.Schemes.GetDefaultForbidSchemeAsync())?.Name;
         if (scheme == null)
           throw new InvalidOperationException("No authenticationScheme was specified, and there was no DefaultForbidScheme found.");
       }
       IAuthenticationHandler handlerAsync = await this.Handlers.GetHandlerAsync(context, scheme);
       if (handlerAsync == null)
         throw await this.CreateMissingHandlerException(scheme);
       await handlerAsync.ForbidAsync(properties);
     }

     /// <summary>
     /// Sign a principal in for the specified authentication scheme.
     /// </summary>
     /// <param name="context">The <see cref="T:Microsoft.AspNetCore.Http.HttpContext" />.</param>
     /// <param name="scheme">The name of the authentication scheme.</param>
     /// <param name="principal">The <see cref="T:System.Security.Claims.ClaimsPrincipal" /> to sign in.</param>
     /// <param name="properties">The <see cref="T:Microsoft.AspNetCore.Authentication.AuthenticationProperties" />.</param>
     /// <returns>A task.</returns>
     public virtual async Task SignInAsync(
       HttpContext context,
       string scheme,
       ClaimsPrincipal principal,
       AuthenticationProperties properties)
     {
       if (principal == null)
         throw new ArgumentNullException(nameof (principal));
       if (scheme == null)
       {
         scheme = (await this.Schemes.GetDefaultSignInSchemeAsync())?.Name;
         if (scheme == null)
           throw new InvalidOperationException("No authenticationScheme was specified, and there was no DefaultSignInScheme found.");
       }
       IAuthenticationHandler handlerAsync = await this.Handlers.GetHandlerAsync(context, scheme);
       if (handlerAsync == null)
         throw await this.CreateMissingSignInHandlerException(scheme);
       if (!(handlerAsync is IAuthenticationSignInHandler authenticationSignInHandler))
         throw await this.CreateMismatchedSignInHandlerException(scheme, handlerAsync);
       await authenticationSignInHandler.SignInAsync(principal, properties);
     }

     /// <summary>Sign out the specified authentication scheme.</summary>
     /// <param name="context">The <see cref="T:Microsoft.AspNetCore.Http.HttpContext" />.</param>
     /// <param name="scheme">The name of the authentication scheme.</param>
     /// <param name="properties">The <see cref="T:Microsoft.AspNetCore.Authentication.AuthenticationProperties" />.</param>
     /// <returns>A task.</returns>
     public virtual async Task SignOutAsync(
       HttpContext context,
       string scheme,
       AuthenticationProperties properties)
     {
       if (scheme == null)
       {
         scheme = (await this.Schemes.GetDefaultSignOutSchemeAsync())?.Name;
         if (scheme == null)
           throw new InvalidOperationException("No authenticationScheme was specified, and there was no DefaultSignOutScheme found.");
       }
       IAuthenticationHandler handlerAsync = await this.Handlers.GetHandlerAsync(context, scheme);
       if (handlerAsync == null)
         throw await this.CreateMissingSignOutHandlerException(scheme);
       if (!(handlerAsync is IAuthenticationSignOutHandler authenticationSignOutHandler))
         throw await this.CreateMismatchedSignOutHandlerException(scheme, handlerAsync);
       await authenticationSignOutHandler.SignOutAsync(properties);
     }

     private async Task<Exception> CreateMissingHandlerException(string scheme)
     {
       string str1 = string.Join(", ", (await this.Schemes.GetAllSchemesAsync()).Select<AuthenticationScheme, string>((Func<AuthenticationScheme, string>) (sch => sch.Name)));
       string str2 = string.Format(" Did you forget to call AddAuthentication().Add[SomeAuthHandler](\"{0}\",...)?", (object) scheme);
       return !string.IsNullOrEmpty(str1) ? (Exception) new InvalidOperationException(string.Format("No authentication handler is registered for the scheme '{0}'. The registered schemes are: {1}.", (object) scheme, (object) str1) + str2) : (Exception) new InvalidOperationException("No authentication handlers are registered." + str2);
     }

     private async Task<string> GetAllSignInSchemeNames()
     {
       return string.Join(", ", (await this.Schemes.GetAllSchemesAsync()).Where<AuthenticationScheme>((Func<AuthenticationScheme, bool>) (sch => typeof (IAuthenticationSignInHandler).IsAssignableFrom(sch.HandlerType))).Select<AuthenticationScheme, string>((Func<AuthenticationScheme, string>) (sch => sch.Name)));
     }

     private async Task<Exception> CreateMissingSignInHandlerException(string scheme)
     {
       string signInSchemeNames = await this.GetAllSignInSchemeNames();
       string str = string.Format(" Did you forget to call AddAuthentication().AddCookies(\"{0}\",...)?", (object) scheme);
       return !string.IsNullOrEmpty(signInSchemeNames) ? (Exception) new InvalidOperationException(string.Format("No sign-in authentication handler is registered for the scheme '{0}'. The registered sign-in schemes are: {1}.", (object) scheme, (object) signInSchemeNames) + str) : (Exception) new InvalidOperationException("No sign-in authentication handlers are registered." + str);
     }

     private async Task<Exception> CreateMismatchedSignInHandlerException(
       string scheme,
       IAuthenticationHandler handler)
     {
       string signInSchemeNames = await this.GetAllSignInSchemeNames();
       string str = string.Format("The authentication handler registered for scheme '{0}' is '{1}' which cannot be used for SignInAsync. ", (object) scheme, (object) handler.GetType().Name);
       return !string.IsNullOrEmpty(signInSchemeNames) ? (Exception) new InvalidOperationException(str + string.Format("The registered sign-in schemes are: {0}.", (object) signInSchemeNames)) : (Exception) new InvalidOperationException(str + "Did you forget to call AddAuthentication().AddCookies(\"Cookies\") and SignInAsync(\"Cookies\",...)?");
     }

     private async Task<string> GetAllSignOutSchemeNames()
     {
       return string.Join(", ", (await this.Schemes.GetAllSchemesAsync()).Where<AuthenticationScheme>((Func<AuthenticationScheme, bool>) (sch => typeof (IAuthenticationSignOutHandler).IsAssignableFrom(sch.HandlerType))).Select<AuthenticationScheme, string>((Func<AuthenticationScheme, string>) (sch => sch.Name)));
     }

     private async Task<Exception> CreateMissingSignOutHandlerException(string scheme)
     {
       string signOutSchemeNames = await this.GetAllSignOutSchemeNames();
       string str = string.Format(" Did you forget to call AddAuthentication().AddCookies(\"{0}\",...)?", (object) scheme);
       return !string.IsNullOrEmpty(signOutSchemeNames) ? (Exception) new InvalidOperationException(string.Format("No sign-out authentication handler is registered for the scheme '{0}'. The registered sign-out schemes are: {1}.", (object) scheme, (object) signOutSchemeNames) + str) : (Exception) new InvalidOperationException("No sign-out authentication handlers are registered." + str);
     }

     private async Task<Exception> CreateMismatchedSignOutHandlerException(
       string scheme,
       IAuthenticationHandler handler)
     {
       string signOutSchemeNames = await this.GetAllSignOutSchemeNames();
       string str = string.Format("The authentication handler registered for scheme '{0}' is '{1}' which cannot be used for {2}. ", (object) scheme, (object) handler.GetType().Name, (object) "SignOutAsync");
       return !string.IsNullOrEmpty(signOutSchemeNames) ? (Exception) new InvalidOperationException(str + string.Format("The registered sign-out schemes are: {0}.", (object) signOutSchemeNames)) : (Exception) new InvalidOperationException(str + string.Format("Did you forget to call AddAuthentication().AddCookies(\"Cookies\") and {0}(\"Cookies\",...)?", (object) "SignOutAsync"));
     }
   }

这个基本就是asp.net core 认证的整体概况了，先看一下整体的逻辑，在下一部分，我们再把一些相关的类型做一些补充说明。

可以看到AuthenticationService里面定义的这些AuthenticationAsync、ForbiddenAsync等等动作方法基本都遵循了一个逻辑：

①首先判断传入的scheme是否为null，如果为null，那么根据IAuthenticationSchemeProvider类型的Schemes属性来找出一个默认的scheme，如果上述两个都失败，则抛出异常。

②第一步成功的前提下，利用IAuthenticationHandlerProvider类型的Handlers属性根据找出的scheme来生成一个handler。

③在AuthenticationAsync、ForbiddenAsync和ChallengeAsync方法中，直接调用生成的handler的同名方法来执行最终的逻辑，而在SignInAsync和SignOutAsync中要判断拿到的这个Handler是否分别实现了IAuthenticationSignInHandler和IAuthenticationSignOutHandler这两个接口，如果没有实现，则爆出异常。

至于SignIn和SignOut这两个接口从IAuthenticatoinHandler中剥离出去是因为IAuthenticationHandler只是实现了对用户凭证的验证，至于SignIn和SignOut，现在大多数应用使用的登录方式都有所不同，况且这两个功能实现的是凭证的获取/发放，放在IAuthenticationHandler不合适。

public interface IAuthenticationSignInHandler : IAuthenticationSignOutHandler, IAuthenticationHandler
  {
    /// <summary>Handle sign in.</summary>
    /// <param name="user">The <see cref="T:System.Security.Claims.ClaimsPrincipal" /> user.</param>
    /// <param name="properties">The <see cref="T:Microsoft.AspNetCore.Authentication.AuthenticationProperties" /> that contains the extra meta-data arriving with the authentication.</param>
    /// <returns>A task.</returns>
    Task SignInAsync(ClaimsPrincipal user, AuthenticationProperties properties);
  }

public interface IAuthenticationSignOutHandler : IAuthenticationHandler
  {
    /// <summary>Signout behavior.</summary>
    /// <param name="properties">The <see cref="T:Microsoft.AspNetCore.Authentication.AuthenticationProperties" /> that contains the extra meta-data arriving with the authentication.</param>
    /// <returns>A task.</returns>
    Task SignOutAsync(AuthenticationProperties properties);
  }

关键类型

AuthenticationScheme

 public class AuthenticationScheme
   {
     /// <summary>Constructor.</summary>
     /// <param name="name">The name for the authentication scheme.</param>
     /// <param name="displayName">The display name for the authentication scheme.</param>
     /// <param name="handlerType">The <see cref="T:Microsoft.AspNetCore.Authentication.IAuthenticationHandler" /> type that handles this scheme.</param>
     public AuthenticationScheme(string name, string displayName, Type handlerType)
     {
       if (name == null)
         throw new ArgumentNullException(nameof (name));
       if (handlerType == (Type) null)
         throw new ArgumentNullException(nameof (handlerType));
       if (!typeof (IAuthenticationHandler).IsAssignableFrom(handlerType))
         throw new ArgumentException("handlerType must implement IAuthenticationHandler.");
       this.Name = name;
       this.HandlerType = handlerType;
       this.DisplayName = displayName;
     }

     /// <summary>The name of the authentication scheme.</summary>
     public string Name { get; }

     /// <summary>
     /// The display name for the scheme. Null is valid and used for non user facing schemes.
     /// </summary>
     public string DisplayName { get; }

     /// <summary>
     /// The <see cref="T:Microsoft.AspNetCore.Authentication.IAuthenticationHandler" /> type that handles this scheme.
     /// </summary>
     public Type HandlerType { get; }
   }

一个AuthenticationScheme就是一个对IAuthenticationHandler的描述，它为一个特定的handlerType分配了一个名称（name）。它的构造函数接收三个参数了分别初始化了内部的三个属性，并对这三个参数做了严格的校验保证输入的参数有效。

AuthenticationSchemeBuilder

 public class AuthenticationSchemeBuilder
   {
     /// <summary>Constructor.</summary>
     /// <param name="name">The name of the scheme being built.</param>
     public AuthenticationSchemeBuilder(string name)
     {
       this.Name = name;
     }

     /// <summary>The name of the scheme being built.</summary>
     public string Name { get; }

     /// <summary>The display name for the scheme being built.</summary>
     public string DisplayName { get; set; }

     /// <summary>
     /// The <see cref="T:Microsoft.AspNetCore.Authentication.IAuthenticationHandler" /> type responsible for this scheme.
     /// </summary>
     public Type HandlerType { get; set; }

     /// <summary>
     /// Builds the <see cref="T:Microsoft.AspNetCore.Authentication.AuthenticationScheme" /> instance.
     /// </summary>
     /// <returns></returns>
     public AuthenticationScheme Build()
     {
       return new AuthenticationScheme(this.Name, this.DisplayName, this.HandlerType);
     }
   }

从名字就能看出来它是AuthenticationScheme的建造者，它内部包含的三个属性和AuthenticationScheme是一样的。它的构造函数需要一个string类型的name参数来初始化name，没有对输入的参数做任何校验，另外毫无意外的它有一个Build方法，用自身的这三个属性来new一个AuthenticationScheme。

AutenticaitonOptions

 public class AuthenticationOptions
   {
     private readonly IList<AuthenticationSchemeBuilder> _schemes = (IList<AuthenticationSchemeBuilder>) new List<AuthenticationSchemeBuilder>();

     /// <summary>
     /// Returns the schemes in the order they were added (important for request handling priority)
     /// </summary>
     public IEnumerable<AuthenticationSchemeBuilder> Schemes
     {
       get
       {
         return (IEnumerable<AuthenticationSchemeBuilder>) this._schemes;
       }
     }

     /// <summary>Maps schemes by name.</summary>
     public IDictionary<string, AuthenticationSchemeBuilder> SchemeMap { get; } = (IDictionary<string, AuthenticationSchemeBuilder>) new Dictionary<string, AuthenticationSchemeBuilder>((IEqualityComparer<string>) StringComparer.Ordinal);

     /// <summary>
     /// Adds an <see cref="T:Microsoft.AspNetCore.Authentication.AuthenticationScheme" />.
     /// </summary>
     /// <param name="name">The name of the scheme being added.</param>
     /// <param name="configureBuilder">Configures the scheme.</param>
     public void AddScheme(
       string name,
       Action<AuthenticationSchemeBuilder> configureBuilder)
     {
       if (name == null)
         throw new ArgumentNullException(nameof (name));
       if (configureBuilder == null)
         throw new ArgumentNullException(nameof (configureBuilder));
       if (this.SchemeMap.ContainsKey(name))
         throw new InvalidOperationException("Scheme already exists: " + name);
       AuthenticationSchemeBuilder authenticationSchemeBuilder = new AuthenticationSchemeBuilder(name);
       configureBuilder(authenticationSchemeBuilder);
       this._schemes.Add(authenticationSchemeBuilder);
       this.SchemeMap[name] = authenticationSchemeBuilder;
     }

     /// <summary>
     /// Adds an <see cref="T:Microsoft.AspNetCore.Authentication.AuthenticationScheme" />.
     /// </summary>
     /// <typeparam name="THandler">The <see cref="T:Microsoft.AspNetCore.Authentication.IAuthenticationHandler" /> responsible for the scheme.</typeparam>
     /// <param name="name">The name of the scheme being added.</param>
     /// <param name="displayName">The display name for the scheme.</param>
     public void AddScheme<THandler>(string name, string displayName) where THandler : IAuthenticationHandler
     {
       this.AddScheme(name, (Action<AuthenticationSchemeBuilder>) (b =>
       {
         b.DisplayName = displayName;
         b.HandlerType = typeof (THandler);
       }));
     }

     /// <summary>
     /// Used as the fallback default scheme for all the other defaults.
     /// </summary>
     public string DefaultScheme { get; set; }

     /// <summary>
     /// Used as the default scheme by <see cref="M:Microsoft.AspNetCore.Authentication.IAuthenticationService.AuthenticateAsync(Microsoft.AspNetCore.Http.HttpContext,System.String)" />.
     /// </summary>
     public string DefaultAuthenticateScheme { get; set; }

     /// <summary>
     /// Used as the default scheme by <see cref="M:Microsoft.AspNetCore.Authentication.IAuthenticationService.SignInAsync(Microsoft.AspNetCore.Http.HttpContext,System.String,System.Security.Claims.ClaimsPrincipal,Microsoft.AspNetCore.Authentication.AuthenticationProperties)" />.
     /// </summary>
     public string DefaultSignInScheme { get; set; }

     /// <summary>
     /// Used as the default scheme by <see cref="M:Microsoft.AspNetCore.Authentication.IAuthenticationService.SignOutAsync(Microsoft.AspNetCore.Http.HttpContext,System.String,Microsoft.AspNetCore.Authentication.AuthenticationProperties)" />.
     /// </summary>
     public string DefaultSignOutScheme { get; set; }

     /// <summary>
     /// Used as the default scheme by <see cref="M:Microsoft.AspNetCore.Authentication.IAuthenticationService.ChallengeAsync(Microsoft.AspNetCore.Http.HttpContext,System.String,Microsoft.AspNetCore.Authentication.AuthenticationProperties)" />.
     /// </summary>
     public string DefaultChallengeScheme { get; set; }

     /// <summary>
     /// Used as the default scheme by <see cref="M:Microsoft.AspNetCore.Authentication.IAuthenticationService.ForbidAsync(Microsoft.AspNetCore.Http.HttpContext,System.String,Microsoft.AspNetCore.Authentication.AuthenticationProperties)" />.
     /// </summary>
     public string DefaultForbidScheme { get; set; }
   }

这个类为添加Scheme提供了便利，它维护了一个AuthenticationSchemeBuilder的列表和一个同类型的字典。------------------------

IAuthenticationHandlerProvider

public interface IAuthenticationHandlerProvider
{
Task<IAuthenticationHandler> GetHandlerAsync(HttpContext context, string authenticationScheme);
}

IAuthenticationHandler负责对用户的凭证进行校验，而这个Provider就是用来提供一个IAuthenticationHandler,它只有一个方法就是GetHandlerAsync(HttpContext context,string authenticationScheme)。从方法的参数传入也能知道IAuthenticationHnadlerProvider的实现依赖于AuthenticationScheme，确实，它的实现AuthenticationHandlerProvider里面确实维护了一个IAuthenticationSchemeProvider:

 public class AuthenticationHandlerProvider : IAuthenticationHandlerProvider
   {
     private Dictionary<string, IAuthenticationHandler> _handlerMap = new Dictionary<string, IAuthenticationHandler>((IEqualityComparer<string>) StringComparer.Ordinal);

     /// <summary>Constructor.</summary>
     /// <param name="schemes">The <see cref="T:Microsoft.AspNetCore.Authentication.IAuthenticationHandlerProvider" />.</param>
     public AuthenticationHandlerProvider(IAuthenticationSchemeProvider schemes)
     {
       this.Schemes = schemes;
     }

     /// <summary>
     /// The <see cref="T:Microsoft.AspNetCore.Authentication.IAuthenticationHandlerProvider" />.
     /// </summary>
     public IAuthenticationSchemeProvider Schemes { get; }

     /// <summary>Returns the handler instance that will be used.</summary>
     /// <param name="context">The context.</param>
     /// <param name="authenticationScheme">The name of the authentication scheme being handled.</param>
     /// <returns>The handler instance.</returns>
     public async Task<IAuthenticationHandler> GetHandlerAsync(
       HttpContext context,
       string authenticationScheme)
     {
       if (this._handlerMap.ContainsKey(authenticationScheme))
         return this._handlerMap[authenticationScheme];
       AuthenticationScheme schemeAsync = await this.Schemes.GetSchemeAsync(authenticationScheme);
       if (schemeAsync == null)
         return (IAuthenticationHandler) null;
       if ((context.RequestServices.GetService(schemeAsync.HandlerType) ?? ActivatorUtilities.CreateInstance(context.RequestServices, schemeAsync.HandlerType)) is IAuthenticationHandler handler)
       {
         await handler.InitializeAsync(schemeAsync, context);
         this._handlerMap[authenticationScheme] = handler;
       }
       return handler;
     }
   }

IAuthenticationHandlerProvider的目的很明确，就是要提供一个IAuthenticationHandler，它的逻辑如下：

①首先根据authenticationScheme查看_handlerMap是否包含相应的handler如果包含直接返回这个handler。

②如果没有从第一步中找到，那么就从Schemes属性中根据authenticationScheme找出相应的AuthenticationScheme，如果这个Scheme为空，那么直接返回一个null。

③如果从Schemes属性中找出的AuthenticationScheme不为空，那么或者从传入的HttpContext类型的context.RequestServices.GetService方法中找Handler，或者使用ActivatorUtilities来创建一个，不管使用那种方式都是从拿到的scheme中记录的handlerType来获取handler的。如果是一个IAuthenticationHandler，那么调用handler. InitializeAsync方法(注一)来初始化本身，并将这个handler放入自身的_handlerMap字典中。最后将这个handler返回。

AuthenticateResult

 public class AuthenticateResult
   {
     protected AuthenticateResult()
     {
     }

     /// <summary>
     /// If a ticket was produced, authenticate was successful.
     /// </summary>
     public bool Succeeded
     {
       get
       {
         return this.Ticket != null;
       }
     }

     /// <summary>The authentication ticket.</summary>
     public AuthenticationTicket Ticket { get; protected set; }

     /// <summary>
     /// Gets the claims-principal with authenticated user identities.
     /// </summary>
     public ClaimsPrincipal Principal
     {
       get
       {
         return this.Ticket?.Principal;
       }
     }

     /// <summary>
     /// Additional state values for the authentication session.
     /// </summary>
     public AuthenticationProperties Properties { get; protected set; }

     /// <summary>Holds failure information from the authentication.</summary>
     public Exception Failure { get; protected set; }

     /// <summary>
     /// Indicates that there was no information returned for this authentication scheme.
     /// </summary>
     public bool None { get; protected set; }

     /// <summary>Indicates that authentication was successful.</summary>
     /// <param name="ticket">The ticket representing the authentication result.</param>
     /// <returns>The result.</returns>
     public static AuthenticateResult Success(AuthenticationTicket ticket)
     {
       if (ticket == null)
         throw new ArgumentNullException(nameof (ticket));
       return new AuthenticateResult()
       {
         Ticket = ticket,
         Properties = ticket.Properties
       };
     }

     /// <summary>
     /// Indicates that there was no information returned for this authentication scheme.
     /// </summary>
     /// <returns>The result.</returns>
     public static AuthenticateResult NoResult()
     {
       return new AuthenticateResult() { None = true };
     }

     /// <summary>
     /// Indicates that there was a failure during authentication.
     /// </summary>
     /// <param name="failure">The failure exception.</param>
     /// <returns>The result.</returns>
     public static AuthenticateResult Fail(Exception failure)
     {
       return new AuthenticateResult() { Failure = failure };
     }

     /// <summary>
     /// Indicates that there was a failure during authentication.
     /// </summary>
     /// <param name="failure">The failure exception.</param>
     /// <param name="properties">Additional state values for the authentication session.</param>
     /// <returns>The result.</returns>
     public static AuthenticateResult Fail(
       Exception failure,
       AuthenticationProperties properties)
     {
       return new AuthenticateResult()
       {
         Failure = failure,
         Properties = properties
       };
     }

     /// <summary>
     /// Indicates that there was a failure during authentication.
     /// </summary>
     /// <param name="failureMessage">The failure message.</param>
     /// <returns>The result.</returns>
     public static AuthenticateResult Fail(string failureMessage)
     {
       return AuthenticateResult.Fail(new Exception(failureMessage));
     }

     /// <summary>
     /// Indicates that there was a failure during authentication.
     /// </summary>
     /// <param name="failureMessage">The failure message.</param>
     /// <param name="properties">Additional state values for the authentication session.</param>
     /// <returns>The result.</returns>
     public static AuthenticateResult Fail(
       string failureMessage,
       AuthenticationProperties properties)
     {
       return AuthenticateResult.Fail(new Exception(failureMessage), properties);
     }
   }

一个认证结果，表示AuthenticationService中的方法返回的结果。典型的状态模式。它内部维护一个AuthenticationTicket。可直接调用Success方法或这Fail方法来返回包含相应状态的Result。

AuthenticatoinTicket

 public class AuthenticationTicket
   {
     /// <summary>
     /// Initializes a new instance of the <see cref="T:Microsoft.AspNetCore.Authentication.AuthenticationTicket" /> class
     /// </summary>
     /// <param name="principal">the <see cref="T:System.Security.Claims.ClaimsPrincipal" /> that represents the authenticated user.</param>
     /// <param name="properties">additional properties that can be consumed by the user or runtime.</param>
     /// <param name="authenticationScheme">the authentication middleware that was responsible for this ticket.</param>
     public AuthenticationTicket(
       ClaimsPrincipal principal,
       AuthenticationProperties properties,
       string authenticationScheme)
     {
       if (principal == null)
         throw new ArgumentNullException(nameof (principal));
       this.AuthenticationScheme = authenticationScheme;
       this.Principal = principal;
       this.Properties = properties ?? new AuthenticationProperties();
     }

     /// <summary>
     /// Initializes a new instance of the <see cref="T:Microsoft.AspNetCore.Authentication.AuthenticationTicket" /> class
     /// </summary>
     /// <param name="principal">the <see cref="T:System.Security.Claims.ClaimsPrincipal" /> that represents the authenticated user.</param>
     /// <param name="authenticationScheme">the authentication middleware that was responsible for this ticket.</param>
     public AuthenticationTicket(ClaimsPrincipal principal, string authenticationScheme)
       : this(principal, (AuthenticationProperties) null, authenticationScheme)
     {
     }

     /// <summary>Gets the authentication type.</summary>
     public string AuthenticationScheme { get; private set; }

     /// <summary>
     /// Gets the claims-principal with authenticated user identities.
     /// </summary>
     public ClaimsPrincipal Principal { get; private set; }

     /// <summary>
     /// Additional state values for the authentication session.
     /// </summary>
     public AuthenticationProperties Properties { get; private set; }
   }

表示一个经过认证后颁发的证书，里面包含ClaimsPrincipal、AuthenticationScheme和AuthenticationProperties三个属性，ClaimsPrincipal表示证书的主体，如姓名、电话等等信息，AuthenticationProperties表示证书的相关信息，如颁发时间、过期时间和重定向地址等等。

AuthenticationProperties

  public class AuthenticationProperties
   {
     internal const string IssuedUtcKey = ".issued";
     internal const string ExpiresUtcKey = ".expires";
     internal const string IsPersistentKey = ".persistent";
     internal const string RedirectUriKey = ".redirect";
     internal const string RefreshKey = ".refresh";
     internal const string UtcDateTimeFormat = "r";

     /// <summary>
     /// Initializes a new instance of the <see cref="T:Microsoft.AspNetCore.Authentication.AuthenticationProperties" /> class.
     /// </summary>
     public AuthenticationProperties()
       : this((IDictionary<string, string>) null, (IDictionary<string, object>) null)
     {
     }

     /// <summary>
     /// Initializes a new instance of the <see cref="T:Microsoft.AspNetCore.Authentication.AuthenticationProperties" /> class.
     /// </summary>
     /// <param name="items">State values dictionary to use.</param>
     public AuthenticationProperties(IDictionary<string, string> items)
       : this(items, (IDictionary<string, object>) null)
     {
     }

     /// <summary>
     /// Initializes a new instance of the <see cref="T:Microsoft.AspNetCore.Authentication.AuthenticationProperties" /> class.
     /// </summary>
     /// <param name="items">State values dictionary to use.</param>
     /// <param name="parameters">Parameters dictionary to use.</param>
     public AuthenticationProperties(
       IDictionary<string, string> items,
       IDictionary<string, object> parameters)
     {
       this.Items = items ?? (IDictionary<string, string>) new Dictionary<string, string>((IEqualityComparer<string>) StringComparer.Ordinal);
       this.Parameters = parameters ?? (IDictionary<string, object>) new Dictionary<string, object>((IEqualityComparer<string>) StringComparer.Ordinal);
     }

     /// <summary>State values about the authentication session.</summary>
     public IDictionary<string, string> Items { get; }

     /// <summary>
     /// Collection of parameters that are passed to the authentication handler. These are not intended for
     /// serialization or persistence, only for flowing data between call sites.
     /// </summary>
     public IDictionary<string, object> Parameters { get; }

     /// <summary>
     /// Gets or sets whether the authentication session is persisted across multiple requests.
     /// </summary>
     public bool IsPersistent
     {
       get
       {
         return this.GetString(".persistent") != null;
       }
       set
       {
         this.SetString(".persistent", value ? string.Empty : (string) null);
       }
     }

     /// <summary>
     /// Gets or sets the full path or absolute URI to be used as an http redirect response value.
     /// </summary>
     public string RedirectUri
     {
       get
       {
         return this.GetString(".redirect");
       }
       set
       {
         this.SetString(".redirect", value);
       }
     }

     /// <summary>
     /// Gets or sets the time at which the authentication ticket was issued.
     /// </summary>
     public DateTimeOffset? IssuedUtc
     {
       get
       {
         return this.GetDateTimeOffset(".issued");
       }
       set
       {
         this.SetDateTimeOffset(".issued", value);
       }
     }

     /// <summary>
     /// Gets or sets the time at which the authentication ticket expires.
     /// </summary>
     public DateTimeOffset? ExpiresUtc
     {
       get
       {
         return this.GetDateTimeOffset(".expires");
       }
       set
       {
         this.SetDateTimeOffset(".expires", value);
       }
     }

     /// <summary>
     /// Gets or sets if refreshing the authentication session should be allowed.
     /// </summary>
     public bool? AllowRefresh
     {
       get
       {
         return this.GetBool(".refresh");
       }
       set
       {
         this.SetBool(".refresh", value);
       }
     }

     /// <summary>
     /// Get a string value from the <see cref="P:Microsoft.AspNetCore.Authentication.AuthenticationProperties.Items" /> collection.
     /// </summary>
     /// <param name="key">Property key.</param>
     /// <returns>Retrieved value or <c>null</c> if the property is not set.</returns>
     public string GetString(string key)
     {
       string str;
       return !this.Items.TryGetValue(key, out str) ? (string) null : str;
     }

     /// <summary>
     /// Set a string value in the <see cref="P:Microsoft.AspNetCore.Authentication.AuthenticationProperties.Items" /> collection.
     /// </summary>
     /// <param name="key">Property key.</param>
     /// <param name="value">Value to set or <c>null</c> to remove the property.</param>
     public void SetString(string key, string value)
     {
       if (value != null)
       {
         this.Items[key] = value;
       }
       else
       {
         if (!this.Items.ContainsKey(key))
           return;
         this.Items.Remove(key);
       }
     }

     /// <summary>
     /// Get a parameter from the <see cref="P:Microsoft.AspNetCore.Authentication.AuthenticationProperties.Parameters" /> collection.
     /// </summary>
     /// <typeparam name="T">Parameter type.</typeparam>
     /// <param name="key">Parameter key.</param>
     /// <returns>Retrieved value or the default value if the property is not set.</returns>
     public T GetParameter<T>(string key)
     {
       object obj1;
       return this.Parameters.TryGetValue(key, out obj1) && obj1 is T obj2 ? obj2 : default (T);
     }

     /// <summary>
     /// Set a parameter value in the <see cref="P:Microsoft.AspNetCore.Authentication.AuthenticationProperties.Parameters" /> collection.
     /// </summary>
     /// <typeparam name="T">Parameter type.</typeparam>
     /// <param name="key">Parameter key.</param>
     /// <param name="value">Value to set.</param>
     public void SetParameter<T>(string key, T value)
     {
       this.Parameters[key] = (object) value;
     }

     /// <summary>
     /// Get a bool value from the <see cref="P:Microsoft.AspNetCore.Authentication.AuthenticationProperties.Items" /> collection.
     /// </summary>
     /// <param name="key">Property key.</param>
     /// <returns>Retrieved value or <c>null</c> if the property is not set.</returns>
     protected bool? GetBool(string key)
     {
       string str;
       bool result;
       return this.Items.TryGetValue(key, out str) && bool.TryParse(str, out result) ? new bool?(result) : new bool?();
     }

     /// <summary>
     /// Set a bool value in the <see cref="P:Microsoft.AspNetCore.Authentication.AuthenticationProperties.Items" /> collection.
     /// </summary>
     /// <param name="key">Property key.</param>
     /// <param name="value">Value to set or <c>null</c> to remove the property.</param>
     protected void SetBool(string key, bool? value)
     {
       if (value.HasValue)
       {
         this.Items[key] = value.Value.ToString();
       }
       else
       {
         if (!this.Items.ContainsKey(key))
           return;
         this.Items.Remove(key);
       }
     }

     /// <summary>
     /// Get a DateTimeOffset value from the <see cref="P:Microsoft.AspNetCore.Authentication.AuthenticationProperties.Items" /> collection.
     /// </summary>
     /// <param name="key">Property key.</param>
     /// <returns>Retrieved value or <c>null</c> if the property is not set.</returns>
     protected DateTimeOffset? GetDateTimeOffset(string key)
     {
       string input;
       DateTimeOffset result;
       return this.Items.TryGetValue(key, out input) && DateTimeOffset.TryParseExact(input, "r", (IFormatProvider) CultureInfo.InvariantCulture, DateTimeStyles.RoundtripKind, out result) ? new DateTimeOffset?(result) : new DateTimeOffset?();
     }

     /// <summary>
     /// Set a DateTimeOffset value in the <see cref="P:Microsoft.AspNetCore.Authentication.AuthenticationProperties.Items" /> collection.
     /// </summary>
     /// <param name="key">Property key.</param>
     /// <param name="value">Value to set or <c>null</c> to remove the property.</param>
     protected void SetDateTimeOffset(string key, DateTimeOffset? value)
     {
       if (value.HasValue)
       {
         this.Items[key] = value.Value.ToString("r", (IFormatProvider) CultureInfo.InvariantCulture);
       }
       else
       {
         if (!this.Items.ContainsKey(key))
           return;
         this.Items.Remove(key);
       }
     }
   }

IClaimsTransformation

  public interface IClaimsTransformation
   {
     /// <summary>
     /// Provides a central transformation point to change the specified principal.
     /// Note: this will be run on each AuthenticateAsync call, so its safer to
     /// return a new ClaimsPrincipal if your transformation is not idempotent.
     /// </summary>
     /// <param name="principal">The <see cref="T:System.Security.Claims.ClaimsPrincipal" /> to transform.</param>
     /// <returns>The transformed principal.</returns>
     Task<ClaimsPrincipal> TransformAsync(ClaimsPrincipal principal);
   }

这个接口可以为传入的principal提供转换，适合全局为principal添加一些额外的claim。