Change AuthenticationScheme to force another AuthenticationHandler to be fired - azure

Question

We need to be able to support both Basic Authentication and Bearer Authentication. Bearer Authentication being the preferred / default method. Basic is for some clients that cannot support Bearer Authentication.
We want to be able to manage privileges from a since source. The idea is that if a user is using Basic Auth, that user would actually send us his clientId/clientSecret and we will get the token for him.
In order to keep this hole as closed as possible, clientId needs to be validated versus a whitelist first. How can I do that without have to completely re-implement the Bearer Authentication. Even if we whitelisted the clientId we still want to validate the token exactly like if they would have sent it.
public class BasicAuthenticationHandler : AuthenticationHandler<AuthenticationSchemeOptions>
{
public const string AuthTypeName = "Basic ";
private const string _authHeaderName = "Authorization";
public BasicAuthenticationHandler(
IOptionsMonitor<AuthenticationSchemeOptions> options,
ILoggerFactory logger,
UrlEncoder encoder,
ISystemClock clock)
: base(options, logger, encoder, clock)
{
}
protected override async Task<AuthenticateResult> HandleAuthenticateAsync()
{
var authHeader = AuthenticationHeaderValue.Parse(Request.Headers[_authHeaderName]);
var (clientId, clientSecret) = DecodeUserIdAndPassword(authHeader.Parameter);
if (!clientIdIsWhiteListed.IsSatisfiedBy(clientId))
return AuthenticateResult.Fail("Invalid Credentials");
IConfidentialClientApplication app = ConfidentialClientApplicationBuilder.Create(clientId)
.WithTenantId(tenantId)
.WithClientSecret(clientSecret)
.Build();
string[] scopes = new string[] { "MyScope" };
var result = await app.AcquireTokenForClient(scopes)
.ExecuteAsync();
// Here is where I have no clue how to continue
Request.Headers[_authHeaderName] = $"Bearer {result.AccessToken}"; //?
return AuthenticateResult.NoResult(); //?
}
}

Answer 1

I was so close to the correct answer, well here is what I did and it works.
1 line change
public class BasicAuthenticationHandler : AuthenticationHandler<AuthenticationSchemeOptions>
{
public const string AuthTypeName = "Basic ";
private const string _authHeaderName = "Authorization";
public BasicAuthenticationHandler(
IOptionsMonitor<AuthenticationSchemeOptions> options,
ILoggerFactory logger,
UrlEncoder encoder,
ISystemClock clock)
: base(options, logger, encoder, clock)
{
}
protected override async Task<AuthenticateResult> HandleAuthenticateAsync()
{
var authHeader = AuthenticationHeaderValue.Parse(Request.Headers[_authHeaderName]);
var (clientId, clientSecret) = DecodeUserIdAndPassword(authHeader.Parameter);
if (!clientIdIsWhiteListed.IsSatisfiedBy(clientId))
return AuthenticateResult.Fail("Invalid Credentials");
IConfidentialClientApplication app = ConfidentialClientApplicationBuilder.Create(clientId)
.WithTenantId(tenantId)
.WithClientSecret(clientSecret)
.Build();
string[] scopes = new string[] { "MyScope" };
var result = await app.AcquireTokenForClient(scopes)
.ExecuteAsync();
Request.Headers[_authHeaderName] = $"Bearer {result.AccessToken}";
return await Context.AuthenticateAsync("Bearer");
}
}