Thread.CurrentPrincipal已认证，但ClaimsPrincipal.Current未认证 [英] Thread.CurrentPrincipal is authenticated but ClaimsPrincipal.Current is not

问题描述

我正在WebApi项目中使用基于声明的授权，并且有一种方法可以检查当前身份是否已通过身份验证。当我使用 ClaimsPrincipal.Current 时，当前身份未经过身份验证，但是当我使用 Thread.CurrentPrincipal 时，身份是经过身份验证的。 p>

I'm using Claims based Authorization in my WebApi project and have a method where I check if the current Identity is authenticated. When I use ClaimsPrincipal.Current the current Identity is not authenticated but when I use Thread.CurrentPrincipal it is.

ClaimsPrincipal.Current.Identity.IsAuthenticated; //False
Thread.CurrentPrincipal.Identity.IsAuthenticated; //True

这似乎很奇怪，特别是因为 MSDN说 ClaimsPrincipal.Current仅返回Thread.CurrentPrincipal：

This seems strange especially since the MSDN says ClaimsPrincipal.Current just returns Thread.CurrentPrincipal:

备注

默认情况下，返回Thread.CurrentPrincipal。您可以通过设置ClaimsPrincipalSelector属性来指定要调用的
委托来确定当前委托人，来更改
的行为。

By default, Thread.CurrentPrincipal is returned. You can change this behavior by setting the ClaimsPrincipalSelector property to specify a delegate to be called to determine the current principal.

有人可以解释一下为什么 ClaimsPrincipal 没有经过身份验证，而理论上两者都包含相同的身份吗？

Can someone please explain me why ClaimsPrincipal is not authenticated, while both, in theory, contain the same Identity?

推荐答案

简而言之，该文档不正确地说默认情况下它返回 Thread.CurrentPrincipal 。

In short, the documentation is incorrect to say that it returns Thread.CurrentPrincipal by default.

它实际返回的是 ClaimsPrincipal 包装 Thread.CurrentPrincipal （如果实际上不是 ClaimsPrincipal ），则使用以下构造函数：

What it actually returns is a ClaimsPrincipal wrapping Thread.CurrentPrincipal (if it's not, actually, already a ClaimsPrincipal), using this constructor:

public ClaimsPrincipal(IPrincipal principal)
{
    this.m_version = "1.0";
    this.m_identities = new List<ClaimsIdentity>();
    if (principal == null)
    {
        throw new ArgumentNullException("principal");
    }
    ClaimsPrincipal principal2 = principal as ClaimsPrincipal;
    if (principal2 == null)
    {
        this.m_identities.Add(new ClaimsIdentity(principal.Identity));
    }
    else if (principal2.Identities != null)
    {
        this.m_identities.AddRange(principal2.Identities);
    }
}

反过来，如您所愿，返回的 ClaimsIdentity 包装委托人的身份（同样，如果实际上不是，则已经是 ClaimsIdentity ）。

This, in turn, as you can hopefully see, is returning a ClaimsIdentity that wraps the principal's identity (again, if it's not, actually, already a ClaimsIdentity).

在构造 ClaimsIdentity 时，我唯一能看到它结束的地方

In constructing the ClaimsIdentity, the only place I can see where it will end up not setting the authentication type (and thus creating an identity that's not authenticated) is here:

if(identity is WindowsIdentity)
{
   try
   {
      this.m_authenticationType = identity.AuthenticationType;
   }
   catch(UnauthorizedAccessException)
   {
      this.m_authenticationType = null;
   }
}

因此，如果您通过 Thread.CurrentPrincipal.Identity 访问的身份实际上是 WindowsIdentity 实例，并且在您所处的上下文中运行您具有受限权限的情况，构造的 ClaimsIdentity 实例将具有 IsAuthenticated 为false。

So, if the identity you access via Thread.CurrentPrincipal.Identity is actually a WindowsIdentity instance, and in the context in which you're running you've got restricted permissions, the constructed ClaimsIdentity instance will have IsAuthenticated as false.

这篇关于Thread.CurrentPrincipal已认证，但ClaimsPrincipal.Current未认证的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！