title: How to setup app.UseOAuthBearerAuthentication for handling different Azure B2C custom policies?
body: <p>I read this article: <a href="http://bitoftech.net/2016/08/24/secure-aspnet-web-api-2-azure-ad-b2c/" rel="nofollow noreferrer">Secure ASP.NET Web API 2 using Azure AD B2C – Part 2</a></p>
  
  <p>At step 3 <code>app.UseOAuthBearerAuthentication</code> is called 3 times... one for each policy.</p>
  
  <p>I'm testing with only 2 policies: <code>SignInPolicyId</code> and <code>SignUpPolicyId</code>.</p>
  
  <p>However when I do:</p>
  
  <pre class="lang-cs prettyprint-override"><code>app.UseOAuthBearerAuthentication(CreateBearerOptionsForPolicy(SignInPolicyId))  
  app.UseOAuthBearerAuthentication(CreateBearerOptionsForPolicy(SignUpPolicyId));
  </code></pre>
  
  <p>and pass a <code>Provider</code> with its <code>OnValidateIdentity</code> to deal with validating claims, etc. I then try to filter by the policy like this:</p>
  
  <pre class="lang-cs prettyprint-override"><code>private OAuthBearerAuthenticationOptions CreateBearerOptionsForPolicy(string policy)
  {
      var metadataEndpoint = string.Format(AadInstance, TenantId, policy);
  
      TokenValidationParameters tvps = new TokenValidationParameters
      {
          // This is where you specify that your API only accepts tokens from its own clients
          ValidAudience = ClientId,
          AuthenticationType = policy,
          NameClaimType = "http://schemas.microsoft.com/identity/claims/objectidentifier",
          ValidateIssuer = true
      };
  
      return new OAuthBearerAuthenticationOptions
      {
          AccessTokenFormat = new JwtFormat(tvps, new OpenIdConnectCachingSecurityTokenProvider(metadataEndpoint)),
  
          Provider = new OAuthBearerAuthenticationProvider
          {
              OnValidateIdentity = async context =&gt;
              {
                  try
                  {
                      var policyName = identity.FindFirst("http://schemas.microsoft.com/claims/authnclassreference")?.Value;
  
                      if (policyName == B2CSignInPolicyId.ToLower()) // Sign In Only policy...
                      {
                          // Run specific code here for the policy that just sent a token back to the application...
                      }
  </code></pre>
  
  <p><strong>Problem:</strong> the policy that is being executed @ Azure B2C, that is, the one that I'm calling is the <code>Sign In</code> policy, but the provider code is called twice. Once for each policy I registered including the <code>Sign Up</code> one.</p>
  
  <p><strong>Question:</strong> is there any better way of doing this so that we get the right Provider executed? If the <code>Sign In</code> policy is the one being called, execute just the <code>Sign In</code> provider and vice versa.</p>
  
  <p>Edit:</p>
  
  <p>I'm experiencing the same issue described here (sequence contains more than one element): <a href="http://bitoftech.net/2016/08/24/secure-aspnet-web-api-2-azure-ad-b2c/#comment-96913" rel="nofollow noreferrer">http://bitoftech.net/2016/08/24/secure-aspnet-web-api-2-azure-ad-b2c/#comment-96913</a></p>
  
  <p>This is the exception:</p>
  
  <blockquote>
    <p>at System.Linq.Enumerable.SingleOrDefault[TSource](IEnumerable`1
    source)\r\n   at
    Microsoft.Owin.Security.AuthenticationManager.d__20.MoveNext()\r\n---
    End of stack trace from previous location where exception was thrown
    ---\r\n   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task
    task)\r\n   at
    System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task
    task)\r\n   at
    System.Web.Http.HostAuthenticationFilter.d__4.MoveNext()\r\n---
    End of stack trace from previous location where exception was thrown
    ---\r\n   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task
    task)\r\n   at
    System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task
    task)\r\n   at
    System.Web.Http.Controllers.AuthenticationFilterResult.d__5.MoveNext()\r\n---
    End of stack trace from previous location where exception was thrown
    ---\r\n   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task
    task)\r\n   at
    System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task
    task)\r\n   at
    System.Web.Http.Controllers.ExceptionFilterResult.d__6.MoveNext()</p>
  </blockquote>