Remote auth expiration fix

[tuespetre]

Fixes #855, which documents a bug where the RemoteAuthenticationTimeout (intended to be used for a correlation cookie) also ends up getting used for the ExpiresUtc value of the AuthenticationProperties of the actual authentication ticket that gets issued.

I did not see a generic set of tests for RemoteAuthenticationHandler so I refrained from adding a test for now.

[dnfclas]

Hi @tuespetre, I'm your friendly neighborhood .NET Foundation Pull Request Bot (You can call me DNFBOT). Thanks for your contribution!
You've already signed the contribution license agreement. Thanks!

The agreement was validated by .NET Foundation and real humans are currently evaluating your PR.

TTYL, DNFBOT;

[Tratcher]

Notes: Moving ISystemClock to AuthenticationOptions should be OK, it was already on every child class in this repo.

[Tratcher]

Please add this to TwitterHandler.HandleUnauthorizedAsync as well.

[Tratcher]

pending the update to Twitter.

[tuespetre]

🆙📅

[HaoK]

Should we consider putting the system clock in DI as a service instead of hanging them off the options? Its not like we would ever expect more than one system clock across all the different middlewares, etc right?

[HaoK]

Basically what I'm suggesting instead of putting the clock in AuthenticationOptions, instead add it as a property to AuthenticationMiddleware/Handler that gets injected optionally (and defaults to a new instance of SystemClock same as today)

   // On AuthenticationMiddleware and AuthenticationHandler
   public virtual ISystemClock SystemClock { get; set; } = new SystemClock()

  // Invoke needs to set the system clock on AuthenticationHandler after its created (patching intialize basically)
        public async Task Invoke(HttpContext context)
        {
            var handler = CreateHandler();  
            handler.SystemClock = SystemClock;
            ...

  // Update all of the various AuthMiddleware ctors 
        public CookieAuthenticationMiddleware(
            RequestDelegate next,
            IDataProtectionProvider dataProtectionProvider,
            ILoggerFactory loggerFactory,
            UrlEncoder urlEncoder,
            IOptions<CookieAuthenticationOptions> options,
            ISystemClock clock = null)  
        if (clock != null) {
            SystemClock = clock;
        }
        ...

[Tratcher]

We've considered moving it to a service before, but it's only used for unit tests and its easier to set in options.