title: Authorize ASP.NET Core 2.1 controller with several schemes at once
body: <p>Lets assume that we are using authentication with "Abc" schema and respective handler and everything is great. We are able to secure controller simply with</p>
  
  <p><code>[Authorize(AuthenticationSchemes = "Abc", Roles = "admin")]</code> attribute</p>
  
  <p>But now appeared need to be able to secure controller's endpoints with "Xyz" schema as well (so request should correspond to demands of <strong>both</strong> schemes).
  So, I thought that registering new schema and handler are enough to be able to use <code>[Authorize]</code> as follows and receive <code>AND</code> logic:</p>
  
  <pre><code>[Authorize(AuthenticationSchemes = "Abc", Roles = "admin")]
  [Authorize(AuthenticationSchemes = "Xyz")]
  public class UserController : ControllerBase 
  {
  }
  </code></pre>
  
  <p>But instead valid request to controller results in <em>"Forbidden"</em> response status (note that not even in <em>"Unauthorized"</em>).</p>
  
  <p>Also I find it interesting, that when we are applying <code>[Authorize(AuthenticationSchemes = "Xyz")]</code> on action method instead of controller - everything works as desired.</p>
  
  <p>P.S: <code>MvcOptions.AllowCombiningAuthorizeFilters</code> in <code>Startup</code> is already set to <code>false</code>.</p>
  
  <p>I am guessing that it still somehow merges authorization logic when both of attributes present at same (controller in this case) level.</p>
  
  <p>Does anyone know what I'm missing?
  Probably I think in wrong direction at all and there is a appropriate way to do multi schema authentication
  So, please, feel free to provide your ideas.</p>