AuthorizeFilter sets null Identity

[leastprivilege]

I think you have a bug here:

Mvc/src/Microsoft.AspNet.Mvc.Core/Filters/AuthorizeFilter.cs

Lines 35 to 47 in 64e726d

	// Build a ClaimsPrincipal with the Policy's required authentication types
	if (Policy.ActiveAuthenticationSchemes != null && Policy.ActiveAuthenticationSchemes.Any())
	{
	var newPrincipal = new ClaimsPrincipal();
	foreach (var scheme in Policy.ActiveAuthenticationSchemes)
	{
	var result = (await context.HttpContext.Authentication.AuthenticateAsync(scheme))?.Principal;
	if (result != null)
	{
	newPrincipal.AddIdentities(result.Identities);
	}
	}
	context.HttpContext.User = newPrincipal;

This will result in a null ClaimsPrincipal.Identity when the user is not authenticated.

You rather want to create an Identity that is not authenticated.

[danroth27]

@blowdart Can you take a look at this?

[blowdart]

I already pinged @HaoK.

[HaoK]

1ea1cc4

[vcsjones]

Is the milestone for this still beta5?

[danroth27]

Yup, the fix is in beta5.