title: Asp.Net Core custom authorization always ends with 401 Unauthorized
body: <p>I am trying to implement a custom Authentication/Authorization flow with asp.net core but fails to do so. The authentication seems to work ok: if I debug step by step I can see that an AuthenticationTicket is created from a ClaimsPrincipal that contains an identity with isAuthenticated to true:</p>
  
  <pre><code>public class MyAuthHandler : AuthenticationHandler&lt;MyAuthOptions&gt;
  {
      protected override Task&lt;AuthenticateResult&gt; HandleAuthenticateAsync()
      {
          // grab stuff from the HttpContext
          string authHeader = Request.Headers["Authorization"];
          // do some stuff that are successfull in my tests
          var cp = DoTokenBasedAuthentication(authHeader);
  
          var ticket = new AuthenticationTicket(cp,
              new AuthenticationProperties(), Options.AuthenticationScheme);
          return Task.FromResult(AuthenticateResult.Success(ticket));
      }
  }
  </code></pre>
  
  <p>However, I try to add a dummy AuthorizationHandler after that:</p>
  
  <pre><code>public class MyRequirement : IAuthorizationRequirement
  {
      public MyRequirement()
      {
      }
  }
  
  public class MyAuthRequirement : AuthorizationHandler&lt;MyRequirement&gt;
  {
      protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, MyRequirement requirement)
      {
          context.Succeed(requirement);
          return Task.CompletedTask;
      }
  }
  </code></pre>
  
  <p>And with this code in my startup file:</p>
  
  <pre><code>services.AddAuthorization(options =&gt;
  {
     options.AddPolicy("My",
        policy =&gt; policy.Requirements.Add(new MyRequirement()));
  });
  </code></pre>
  
  <p>But whenever I add "[Authorize("My")]" on a controller, then all calls always returns 401. And my AuthorizationHandler is never reached.
  This problem looks similar to <a href="https://stackoverflow.com/questions/37276005/asp-net-core-policy-based-authorization-ends-with-401-unauthorized">Asp.Net Core policy based authorization ends with 401 Unauthorized</a> but is slightly different as on my case I have a user that is authenticated. I am struggling to debug into asp.net MVC source code, so I do not really know what is going on.</p>