title: Issue With ClaimsIdentity In .NET Core 2 Middleware Solution
body: <p>Just started on my first .net core 2 web app implementation. Unfortunately due to business requirements,the user has to authenticated via an legacy forms login, username/password is handled to an oracle db and when user is authenticated, a session id is generated and appended to the base url of the app that is launched. Very old school but it works.</p>
  
  <p>As you can imagine the session id expires so it must be validated by my app. Easy enough, I pass the session id that I retrieve from the querystring to my Oracle API and the response is a object that contains user information such as firstname, lastname, etc.</p>
  
  <p>After this API call completes successfully, I then create a new ClaimsIdentity and Principal and call the SignInAsync() method.</p>
  
  <p>I currently do this in custom middleware I have registered in my Startup.cs. I would handle this the usual way in a Login Controller method, but since there is no login in my app, I cannot see any other way but in the middleware I wrote.</p>
  
  <pre><code>public class AuthenticationHandler
  {
      private readonly RequestDelegate _next;
      private HttpService _httpService;
  
      public AuthenticationHandler(RequestDelegate next, HttpService httpService)
      {
          _httpService = httpService;
          _next = next;
      }
  
      public async Task Invoke(HttpContext context, [FromServices] HttpService httpService)
      {
          if (context.Request.Query.Count == 1)
          {
              var sessionId = context.Request.Query.FirstOrDefault().Value;
              var session = await _httpService.ValidateSession(sessionId);
  
              if (!string.IsNullOrEmpty(session?.UserId))
              {
                  var claims = new List&lt;Claim&gt;()
                  {
                      new Claim(CustomClaimTypes.UserId, session.UserId),
                      new Claim(CustomClaimTypes.BuId, session.BuId),
                      new Claim(CustomClaimTypes.SecurityLevel, session.SecurityLevel)
                  };
  
                  var identity = new ClaimsIdentity(claims, "TNReadyEVP");
                  var principal = new ClaimsPrincipal(identity);
  
                  await Microsoft.AspNetCore.Authentication.AuthenticationHttpContextExtensions.SignInAsync(context, principal);
  
                  var isIn = principal.Identity.IsAuthenticated;
                  var isAuthed = (context.User.Identity as ClaimsIdentity).IsAuthenticated;
                  await _next.Invoke(context);
              }
              else
              {
                  Terminate(context);
              }
          }
  
          return;
      }
  
      private async void Terminate(HttpContext context)
      {
          context.Response.StatusCode = 401;
          await context.Response.WriteAsync("Invalid User");
          return;
      }
  }
  
  public static class MiddlewareExtensions
  {
      public static IApplicationBuilder ValidateSession(this IApplicationBuilder builder)
      {
          return builder.UseMiddleware&lt;AuthenticationHandler&gt;();
      }
  }
  </code></pre>
  
  <p>So far so good, I believe this is the correct solution. However when I attempt to get claims via a small API I have in my app as seen below, the claims are empty and the User.Identity.Authenticated is false.</p>
  
  <p>What am I missing here? Thanks for the advice, this is one of those weird edge cases that I haven't had to deal with before...therefore the need for custom middleware.</p>
  
  <pre><code>    [HttpGet("claims")]
      public async Task&lt;IEnumerable&lt;Claim&gt;&gt; Get()
      {
          var claims = (User as ClaimsPrincipal).Claims;
          return await Task.FromResult(claims);
      }
  </code></pre>