Split SignIn/SignOut into IAuthenticationStore interface

[HaoK]

After playing around with templates a bit, the configuration of the shread default schemes still is a bit complicated.

There are basically 3 kinds of auth handlers today

Store ones (Cookies/Bearer) that handle challenge/authenticate/forbid/sign in/sign out

Remote ones (OIDC/OAuth/Twitter) basically only support challenge/forbid, with authenticate forwarding to a store

Hosts support challenge/authenticate/forbid

So if we split things into

interface IAuthenticationHandler {
   Authenticate
   Challenge
   Forbid
}

interface IAuthenticationStore : IAuthenticationSignInHandler {
  SignIn
}

interface IAuthenticationStore : IAuthenticationSignOutHandler {
  SignOut
}

interface IAuthenticationRequestHandler : IAuthenticationHandler {
   HandleRequest
}

I think this factoring would let us improve the default Authenticate/SignInSchemes to only look for stores, which means for apps that are only using a single Cookie/Bearer scheme, it no longer would need to be configured.

@Tratcher thoughts?

[brockallen]

IIRC this is what I suggested way back when the Auth2 redesign started.

[Tratcher]

Bearer doesn't go with cookies, it goes into your Hosts category that should just be called HTTP Auth.

OIDC also implements SignOut to trigger a remote signout.

[HaoK]

@brockallen yeah it was something we considered early on but didn't find any compelling reason to do the split, assuming we get another feature milestone, this is something I'll prototype to see if it simplifies anything.

[HaoK]

@Tratcher So today cookies would be our only true 'store', that's really weird that OIDC implements SignOut but not SignIn... that messes things up if it is considered a store. I guess we can just make it granular IAuthenticationSignInHandler, IAuthenticationSignOutHandler for those two optional methods.

[brockallen]

This is why they should not derive from one another. They're different semantics.

[HaoK]

Are there any examples of auth schemes that don't support Authenticate/Challenge/Forbid? SignIn/SignOut/HandleRequest do seem like optional semantics that most/some handlers won't support

[Tratcher]

Remote providers don't really support Forbid. We fake it by passing through to the underlying cookie.

[HaoK]

Fair enough, can we just drop that support for remote auth and make forbid optional as well, I don't believe we have any real scenarios where people are forbidding Google/Facebook today anyways...

[HaoK]

This was done in 2.0 via aspnet/HttpAbstractions#873