[Bug] GetEffectiveAuthenticationScheme change breaks a complex auth setup

[vvolodin]

Which version of Microsoft Identity Web are you using? 1.12.0

Where is the issue?

• Web app
  • [x ] Sign-in users
  • [x ] Sign-in users and call web APIs
• Web API
  • [ ] Protected web APIs (validating tokens)
  • [ ] Protected web APIs (validating scopes)
  • [ ] Protected web APIs call downstream web APIs
• Token cache serialization
  • [ ] In-memory caches
  • [ ] Session caches
  • [ ] Distributed caches
• Other (please describe)

Is this a new or an existing app? Existing

Repro

var authResult = await tokenAcquisition.GetAuthenticationResultForUserAsync(scopes, tenantId:tenantId, user: context.Principal);

or

var token = await _tokenAcquisition.GetAccessTokenForUserAsync(scopes, tenantId);

Expected behavior Return auth result

Actual behavior Null reference exception

Possible solution I've debugged a previous version of the library I've been using and GetAccessTokenForUserAsync worked correctly as its documentation stated - from the xml docs about authenticationScheme param: "Authentication scheme. If null, will use OpenIdConnectDefault.AuthenticationScheme if called from a web app, and JwtBearerDefault.AuthenticationScheme if called from a web API." But now the GetEffectiveAuthenticationScheme returns "Cookies" instead - my main authentication scheme causing GetAccessTokenForUserAsync to throw null reference because there's no client ID or secret defined in my Cookie options.

Additional context / logs / screenshots / link to code I have a complex setup of 4 authentication schemes: Cookies OpenIdConnect SharePoint (for logging in through sharepoint add-in system) External API key

Both OpenIdConnect and SharePoint use the same cookie authentication to persist login information, and everything worked fine for a while before this change to GetEffectiveAuthenticationScheme.

What is the rationale behind the change leading to this undocumented behavior and how to properly work around it in my setup?

[vvolodin]

I've used overloads that specify authentication scheme explicitly and it helped. But I still wonder if I'm missing something that will come up later.

[jennyf19]

In Startup.cs, you need to have services.AddAuthentication(OpenIdConnectDefaults.AuthenticationScheme) but you should just have services.AddAuthentication() for the cookies. Are you using 1.20 (latest version)?