Support for custom authentication scheme without adding data protection

[rocklan]

If you are building a custom authentication scheme that doesn't need data protection, there is currently no way to add authentication without adding data protection services. This means that at startup, keys are generated and logging is created (if they aren't persisted or encrypted) - when it's completely unnecessary.

This is because inside Microsoft.Extensions.DependencyInjection.AuthenticationServiceCollectionExtensions the code looks like this:

public static AuthenticationBuilder AddAuthentication(this IServiceCollection services)
{
    ...

    services.AddAuthenticationCore();
    services.AddDataProtection();
    services.AddWebEncoders();
    services.TryAddSingleton<ISystemClock, SystemClock>();
    return new AuthenticationBuilder(services);
}

The call to AddDataProtection is added indiscriminately. From a developers point of view this can be worked around by replicating this code and the call to AddDataProtection() is removed:

    services.AddAuthenticationCore();
    services.AddWebEncoders();
    services.TryAddSingleton<ISystemClock, SystemClock>();
    var authBuilder = new AuthenticationBuilder(services);

But I expect this code to break in the future as it's not documented or supported.

As a possible solution maybe a new boolean property named RequiresDataProtection that defaults to true could be added to the AuthenticationOptions class, and if set to false, Data Protection is not added?

[blowdart]

If the problem here is the key creating you can disable key creation

Copying the code out of the extension is unlikely to break, but we have data protection in there because we use it in a lot of places, from cookies to oauth to csrf. Its loaded at startup to avoid deadlocks on the first request that hits the service. It's unlikely that we'd consider a different extension method, because it's usually needed by other services, so you're a bit of an edge case. If we see more requests we can consider it.

[rocklan]

Disabling key creation still gives me a The key ring does not contain a valid default key, and the key manager is configured with auto-generation of keys disabled. error at startup because according to the code "The key ring must contain at least one active non-revoked key" - but appreciate the thought.

[blowdart]

Darn it. Well it was worth a shot.

[ghost]

This issue has been resolved and has not had any activity for 1 day. It will be closed for housekeeping purposes.

See our Issue Management Policies for more information.