Add a feature for accessing the AuthenticateResult

[BrennanConroy]

• Add the IAuthenticateResult feature
• Add a class to keep User and AuthenticateResult consistent
• Add ExpiresUtc value to ticket properties (easiest property to reason about with multiple schemes)

TODO: Add tests

Fixes #20847

Authentication.Abstractions package

namespace Microsoft.AspNetCore.Authentication
{
    public interface IAuthenticateResultFeature
    {
        AuthenticateResult? AuthenticateResult { get; set; }
    }
}

[Tratcher]

You've got a workable setup, time for some tests.

[Kahbazi]

Should this feature also set here :

aspnetcore/src/Security/Authentication/Core/src/AuthenticationMiddleware.cs

Lines 66 to 74 in 52eff90

	var defaultAuthenticate = await Schemes.GetDefaultAuthenticateSchemeAsync();
	if (defaultAuthenticate != null)
	{
	var result = await context.AuthenticateAsync(defaultAuthenticate.Name);
	if (result?.Principal != null)
	{
	context.User = result.Principal;
	}
	}

[Tratcher]

Should this feature also set here :

aspnetcore/src/Security/Authentication/Core/src/AuthenticationMiddleware.cs

Lines 66 to 74 in 52eff90

	var defaultAuthenticate = await Schemes.GetDefaultAuthenticateSchemeAsync();
	if (defaultAuthenticate != null)
	{
	var result = await context.AuthenticateAsync(defaultAuthenticate.Name);
	if (result?.Principal != null)
	{
	context.User = result.Principal;
	}
	}

@BrennanConroy we talked about this didn't we? Why didn't we do it? It would be nice to have.

[BrennanConroy]

@BrennanConroy we talked about this didn't we? Why didn't we do it? It would be nice to have.

We might have but I don't remember what was said. Main issue is we'll need to write some ugly code in Authorization middleware to check if the AuthenticationFeatures class has been set on the features by the Authentication middleware.

[Tratcher]

Authorization can ignore and replace whatever the Authentication did. Authentication only applies to the default auth scheme.

[ghost]

Thank you for submitting this for API review. This will be reviewed by @dotnet/aspnet-api-review at the next meeting of the ASP.NET Core API Review group. Please ensure you take a look at the API review process documentation and ensure that:

• The PR contains changes to the reference-assembly that describe the API change. Or, you have included a snippet of reference-assembly-style code that illustrates the API change.
• The PR describes the impact to users, both positive (useful new APIs) and negative (breaking changes).
• Someone is assigned to "champion" this change in the meeting, and they understand the impact and design of the change.

[davidfowl]

Allocations!

[BrennanConroy]

Don't look at the rest of the Auth middleware stuff then 😢