what is ClaimsIdentity.AuthenticationType for ?

[omuleanu]

I'm refering to this page:
https://learn.microsoft.com/en-us/dotnet/api/system.security.claims.claimsidentity.authenticationtype?view=net-7.0#system-security-claims-claimsidentity-authenticationtype

I'm using it like this:

var identity = new ClaimsIdentity(
    new[] { new Claim(ClaimTypes.Name, id.ToString(CultureInfo.InvariantCulture)) },
    "ApplicationCookie", // not sure what this string should be, tried a random string and it worked
        ClaimTypes.Name, 
        ClaimTypes.Role);  

as you can see from my comments, I tried giving it a random string as value ( aasdf123 ), and it made no difference

Tagging subscribers to this area: @dotnet/area-system-security, @vcsjones
See info in area-owners.md if you want to be subscribed.

Issue Details

---

I'm refering to this page:
https://learn.microsoft.com/en-us/dotnet/api/system.security.claims.claimsidentity.authenticationtype?view=net-7.0#system-security-claims-claimsidentity-authenticationtype

I'm using it like this:

var identity = new ClaimsIdentity(
    new[] { new Claim(ClaimTypes.Name, id.ToString(CultureInfo.InvariantCulture)) },
    "ApplicationCookie", // not sure what this string should be, tried a random string and it worked
        ClaimTypes.Name, 
        ClaimTypes.Role);  

as you can see from my comments, I tried giving it a random string as value ( aasdf123 ), and it made no difference

Author:	omuleanu
Assignees:	-
Labels:	area-System.Security, untriaged, Pri3
Milestone:	-

[gfoidl]

You can have more than one authentication mechanisms configured. This is a way to difference between those different mechanisms, and also to track where the "ticket", etc. came from.

If there's only one auth-mechanism, as in the example you showed, then there's also only one choice to pick from.

[omuleanu]

@gfoidl so if there's just 1 auth mechanism, it doesn't matter what value we pass to AuthenticationType ?
I tried a random string "asda123" and made no difference

[gfoidl]

tried a random string "asda123" and made no difference

I don't know all the code that's in play here, but I guess the lookup is done only if there's more than one auth configured.
But for good hyginie and to prevent latent bugs, I'd use a proper value like descibed in IIdentity.AuthenticationType.

[omuleanu]

@gfoidl in there it says:
String
The type of authentication used to identify the user.
and that's it, no other links, possible values etc.

here https://stackoverflow.com/a/12733451/112100
it says that it's an arbitrary string

[gfoidl]

There's also a remarks section, that gives some examples.
The SO talsk basically about the same.

I think it would be good / clearer if that remarks from the base type are repeated on ClaimsIdentity.AuthenticationType and give some more example to make this clearer.

Do you think that's helpful too?

[omuleanu]

I think a very small example would help (not necessarily on that page).

I see "Basic authentication, NTLM, Kerberos, and Passport are examples of authentication types."
Does that mean the value "Basic" a possible value, perhaps.