public class AuthenticationMiddleware
{
	private readonly RequestDelegate _next;
	public IAuthenticationSchemeProvider Schemes
	{
		get;
		set;
	}
	public AuthenticationMiddleware(RequestDelegate next, IAuthenticationSchemeProvider schemes)
	{
		if (next == null)
		{
			throw new ArgumentNullException("next");
		}
		if (schemes == null)
		{
			throw new ArgumentNullException("schemes");
		}
		_next = next;
		Schemes = schemes;
	}
	public async Task Invoke(HttpContext context)
	{
		context.Features.Set((IAuthenticationFeature)new AuthenticationFeature
		{
			OriginalPath = context.Request.Path,
			OriginalPathBase = context.Request.PathBase
		});
		IAuthenticationHandlerProvider handlers = context.RequestServices.GetRequiredService<IAuthenticationHandlerProvider>();
		foreach (AuthenticationScheme item in await Schemes.GetRequestHandlerSchemesAsync())
		{
			IAuthenticationRequestHandler authenticationRequestHandler = (await handlers.GetHandlerAsync(context, item.Name)) as IAuthenticationRequestHandler;
			bool flag = authenticationRequestHandler != null;
			if (flag)
			{
				flag = await authenticationRequestHandler.HandleRequestAsync();
			}
			if (flag)
			{
				return;
			}
		}
		AuthenticationScheme authenticationScheme = await Schemes.GetDefaultAuthenticateSchemeAsync();
		if (authenticationScheme != null)
		{
                        //內(nèi)部調(diào)用IAuthenticationService進(jìn)行認(rèn)證。
			AuthenticateResult authenticateResult = await context.AuthenticateAsync(authenticationScheme.Name);
			if (authenticateResult?.Principal != null)
			{
				context.User = authenticateResult.Principal;
			}
		}
		await _next(context);
	}
}

// Microsoft.AspNetCore.Authorization.AuthorizationMiddleware
using System;
using System.Collections.Generic;
using System.Linq;
using System.Threading.Tasks;
using Microsoft.AspNetCore.Authentication;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Authorization.Policy;
using Microsoft.AspNetCore.Http;
using Microsoft.Extensions.DependencyInjection;
public class AuthorizationMiddleware
{
	private const string AuthorizationMiddlewareInvokedWithEndpointKey = "__AuthorizationMiddlewareWithEndpointInvoked";
	private static readonly object AuthorizationMiddlewareWithEndpointInvokedValue = new object();
	private readonly RequestDelegate _next;
	private readonly IAuthorizationPolicyProvider _policyProvider;
	public AuthorizationMiddleware(RequestDelegate next, IAuthorizationPolicyProvider policyProvider)
	{
		_next = next ?? throw new ArgumentNullException("next");
		_policyProvider = policyProvider ?? throw new ArgumentNullException("policyProvider");
	}
	public async Task Invoke(HttpContext context)
	{
		if (context == null)
		{
			throw new ArgumentNullException("context");
		}
		Endpoint endpoint = context.GetEndpoint();
		if (endpoint != null)
		{
			context.Items["__AuthorizationMiddlewareWithEndpointInvoked"] = AuthorizationMiddlewareWithEndpointInvokedValue;
		}
                //獲取訪問當(dāng)前資源所需要的所有角色權(quán)限,及授權(quán)策略,以及訪問該資源時(shí)需要使用的認(rèn)證方案列表,并統(tǒng)一合并到一個(gè)AuthorizationPolicy對象中。
		IReadOnlyList<IAuthorizeData> authorizeData = endpoint?.Metadata.GetOrderedMetadata<IAuthorizeData>() ?? Array.Empty<IAuthorizeData>();
		AuthorizationPolicy policy = await AuthorizationPolicy.CombineAsync(_policyProvider, authorizeData);
		if (policy == null)
		{
			await _next(context);
			return;
		}
		IPolicyEvaluator policyEvaluator = context.RequestServices.GetRequiredService<IPolicyEvaluator>();
                //通過IPolicyEvaluator.AuthenticateAsync()方法,對當(dāng)前訪問者進(jìn)行認(rèn)證,至于使用哪種方案認(rèn)證,根據(jù)該資源要求使用的認(rèn)證方案來,如果沒有指定,
                //則使用默認(rèn)認(rèn)證方案進(jìn)行認(rèn)證。
		AuthenticateResult authenticationResult = await policyEvaluator.AuthenticateAsync(policy, context);
                //如果包含實(shí)現(xiàn)了IAllowAnonymous接口的特性,則不進(jìn)行授權(quán)檢查。
		if (endpoint?.Metadata.GetMetadata<IAllowAnonymous>() != null)
		{
			await _next(context);
			return;
		}
                //這里調(diào)用AuthorizeAsync進(jìn)行授權(quán)檢查,注意,這里將上一步認(rèn)證結(jié)果authenticationResult也傳到了授權(quán)檢查方法內(nèi)部。
		PolicyAuthorizationResult policyAuthorizationResult = await policyEvaluator.AuthorizeAsync(policy, authenticationResult, context, endpoint);
		//檢查授權(quán)結(jié)果,如果是未登錄,則返回401未認(rèn)證,讓用戶進(jìn)行登錄,如果該資源指定了特定的認(rèn)證方案,則調(diào)用特定認(rèn)證方案的Challenge方法，
                //否則調(diào)用默認(rèn)認(rèn)證方案的Challenge方法，通常Challenge做的事情就是重定向用戶的瀏覽器到登錄頁面或者對于ajax異步請求返回401.
                if (policyAuthorizationResult.Challenged)
		{
			if (policy.AuthenticationSchemes.Any())
			{
				foreach (string authenticationScheme in policy.AuthenticationSchemes)
				{
					await context.ChallengeAsync(authenticationScheme);
				}
			}
			else
			{
				await context.ChallengeAsync();
			}
		}
                //如果當(dāng)前訪問者用戶身份認(rèn)證通過,但是不被允許訪問該資源的權(quán)限,那么默認(rèn)返回401(禁止訪問)給瀏覽器端,通常對于未授權(quán)的訪問請求,應(yīng)用常常的做法是將用戶的瀏覽器重定向到禁止訪問的提示頁面,或者對于ajax異步請求來說,通常返回403狀態(tài)碼，和上面未認(rèn)證情況一樣，如果該資源指定了特定的認(rèn)證方案，那么會(huì)調(diào)用特定認(rèn)證方案的Forbid方法，否則調(diào)用默認(rèn)認(rèn)證方案的Forbid方法。
		else if (policyAuthorizationResult.Forbidden)
		{
			if (policy.AuthenticationSchemes.Any())
			{
				foreach (string authenticationScheme2 in policy.AuthenticationSchemes)
				{
					await context.ForbidAsync(authenticationScheme2);
				}
			}
			else
			{
				await context.ForbidAsync();
			}
		}
		else
		{
			await _next(context);
		}
	}
}

// Microsoft.AspNetCore.Authorization.Policy.PolicyEvaluator
using System;
using System.Security.Claims;
using System.Threading.Tasks;
using Microsoft.AspNetCore.Authentication;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Authorization.Policy;
using Microsoft.AspNetCore.Http;
using Microsoft.Extensions.Internal;
public class PolicyEvaluator : IPolicyEvaluator
{
	private readonly IAuthorizationService _authorization;
	public PolicyEvaluator(IAuthorizationService authorization)
	{
		_authorization = authorization;
	}
	public virtual async Task<AuthenticateResult> AuthenticateAsync(AuthorizationPolicy policy, HttpContext context)
	{
                //這里去判斷當(dāng)前資源是否有要求特定的認(rèn)證方案進(jìn)行認(rèn)證,如果有指定特定的認(rèn)證方案,則分別對每個(gè)認(rèn)證方案進(jìn)行認(rèn)證,并把認(rèn)證后的用戶信息進(jìn)行合并
                //最終存儲(chǔ)到HttpContext.User屬性中,并返回認(rèn)證成功，如果沒有指定認(rèn)證方案，則使用認(rèn)證流程中已經(jīng)認(rèn)證的用戶信息作為認(rèn)證結(jié)果返回，
                //從這里可以看出，認(rèn)證流程還是很有必要的，在資源沒有指定認(rèn)證方案的前提下，認(rèn)證流程為授權(quán)流程提供當(dāng)前訪問者的身份信息，以便執(zhí)行是否具備相應(yīng)資源的訪問權(quán)限檢查，否則就直接進(jìn)入Challenge流程將要求用戶先進(jìn)行身份認(rèn)證了
		if (policy.AuthenticationSchemes != null && policy.AuthenticationSchemes.Count > 0)
		{
			ClaimsPrincipal newPrincipal = null;
			foreach (string authenticationScheme in policy.AuthenticationSchemes)
			{
				AuthenticateResult authenticateResult = await context.AuthenticateAsync(authenticationScheme);
				if (authenticateResult != null && authenticateResult.Succeeded)
				{
					newPrincipal = SecurityHelper.MergeUserPrincipal(newPrincipal, authenticateResult.Principal);
				}
			}
			if (newPrincipal != null)
			{
				context.User = newPrincipal;
				return AuthenticateResult.Success(new AuthenticationTicket(newPrincipal, string.Join(";", policy.AuthenticationSchemes)));
			}
			context.User = new ClaimsPrincipal(new ClaimsIdentity());
			return AuthenticateResult.NoResult();
		}
		return (context.User?.Identity?.IsAuthenticated).GetValueOrDefault() ? AuthenticateResult.Success(new AuthenticationTicket(context.User, "context.User")) : AuthenticateResult.NoResult();
	}
        //resource為EndPoint對象。
	public virtual async Task<PolicyAuthorizationResult> AuthorizeAsync(AuthorizationPolicy policy, AuthenticateResult authenticationResult, HttpContext context, object resource)
	{
		if (policy == null)
		{
			throw new ArgumentNullException("policy");
		}
                //這里調(diào)用IAuthorizationService.AuthorizeAsync方法進(jìn)行授權(quán)檢查，默認(rèn)實(shí)現(xiàn)類為:DefaultAuthorizationService。
		if ((await _authorization.AuthorizeAsync(context.User, resource, policy)).Succeeded)
		{
			return PolicyAuthorizationResult.Success();
		}
                //下面這句表示如果授權(quán)檢查失敗的情況下是進(jìn)入Forbid流程還是進(jìn)入Challenge流程,可以看到如果認(rèn)證成功,那么表示無權(quán)限訪問進(jìn)入Forbid流程。
                //如果未認(rèn)證，則進(jìn)入Challenge流程，引導(dǎo)用戶登錄認(rèn)證。
		return authenticationResult.Succeeded ? PolicyAuthorizationResult.Forbid() : PolicyAuthorizationResult.Challenge();
	}
}