title: Azure API App with mixed Authentication
body: <p>I have a Azure API App in .NET with exposes multiple controllers. I would like to secure all controllers with ActiveDirectory and a single controller with basic authentication.
  When I test it locally on my machine the basic authentication works fine (AD Authentication doesn't work, since I'm not redirected to the AD Login). After deployinig to Azure the AD authentication works fine, but even for the "basic auth" controller I get redirected to the Login Page (which I don't want). 
  How do I correctly configure this? Is there even a way to do it?
  BR,
  Daniel</p>
  
  <p><strong>UPDATE:</strong>
  I activated Active Directory Authentication via Visual Studio (right-click project --> "Configure Azure AD Authentication"). This adds a partial to the Startup class implementing:</p>
  
  <pre><code>public void ConfigureAuth(IAppBuilder app)
  {
      app.UseWindowsAzureActiveDirectoryBearerAuthentication(
          new WindowsAzureActiveDirectoryBearerAuthenticationOptions
          {
              Tenant = ConfigurationManager.AppSettings["ida:Tenant"],
              TokenValidationParameters = new TokenValidationParameters
              {
                  ValidAudience = ConfigurationManager.AppSettings["ida:Audience"]
              },
          });
  } 
  </code></pre>
  
  <p>For the Basic Authentication I implemented a very basic IAuthenticationFilter:</p>
  
  <pre><code>public class BasicAuthenticationAttribute : Attribute, IAuthenticationFilter
  {
      public async Task AuthenticateAsync(HttpAuthenticationContext context, CancellationToken cancellationToken)
      {
          HttpRequestMessage request = context.Request;
          AuthenticationHeaderValue authorization = request.Headers.Authorization;
  
          if (authorization != null &amp;&amp;
              authorization.Scheme == "Basic")
          {
              if (authorization.Parameter == "someincrediblethingy")
              {
                  context.Principal = new ClaimsPrincipal(new[] { new ClaimsIdentity(null, "Basic") });
              }
              else
              {
                  context.ErrorResult = new AuthenticationFailureResult("Wrong APPKEY", request);
              }
          }
      }
  
      public Task ChallengeAsync(System.Web.Http.Filters.HttpAuthenticationChallengeContext context, System.Threading.CancellationToken cancellationToken)
      {
          return Task.FromResult(0);
      }
  
      public virtual bool AllowMultiple
      {
          get { return false; }
      }
  }
  </code></pre>
  
  <p>All controllers are marked with [Authorize] and a single controller additionally with [BasicAuthentication].</p>