Investigate AuthN/AuthZ metrics in ASP.NET Core

[JamesNK]

Issue #47536 adds metrics for existing counters.

We should investigate where adding new metrics makes sense in ASP.NET Core. Metrics are easier to add and test than old event counters. And tags make them more powerful.

Initial ideas:

• Rate limiting - queue counts
• Routing - match/fallback/no match counts
• AuthN/AuthZ - success/failure counts

---

AuthZ

• Number of requests that require authz
  • Policy name
  • Result (success/failure)

---

AuthN

• Challenge count
  • Scheme name
• Authenticated requests count - don't record for result
  • Scheme name
  • Result (success/failure/noop)

Sign in handler

• Sign in count
  • Scheme name

Sign out handler

• Sign out count
  • Scheme name

[mitchdenny]

Output Caching metrics might be another good idea. I'm also wondering whether anything makes sense around health checks - although they can probably be seen within the scope of the existing metrics.

[amcasey]

This is mostly for outside kestrel, right? #47831 covers the remaining work there?

[JamesNK]

Yes

[JamesNK]

cc @halter73 @JeremyLikness

[SeanFarrow]

As someone working in the authentication space and looking at metrics currently, I'd be interested in helping out with this.

[JamesNK]

The first step is to figure out what the metrics are. The issue includes some notes from discussing metrics with @halter73 @JeremyLikness. I think they're the folks that need to come up with what the spec is we want in .NET 9.