c# - Umbraco Web API - Cookie Authentication -

i'm using umbraco 7.5 owin startup class.

despite shortcomings using cookie auth, i'm trying share cookie auth between both mvc , web api.

i have in owin startup class:

private static void configureauth(iappbuilder app) {     app.setdefaultsigninasauthenticationtype(cookieauthenticationdefaults.authenticationtype);      cookiesecureoption securecookieoption = cookiesecureoption.sameasrequest; #if debug     securecookieoption = cookiesecureoption.never; #endif      app.usecookieauthentication(new cookieauthenticationoptions     {         authenticationtype = cookieauthenticationdefaults.authenticationtype,         authenticationmode = authenticationmode.active,         loginpath = new pathstring("/account/login"),         cookiesecure = securecookieoption,         cookiemanager = new chunkingcookiemanager(),         provider = new cookieauthenticationprovider()         }, pipelinestage.authenticate);      //configure b2c oauth middleware     foreach (string policy in appsettings.b2cpolicies)     {         app.useopenidconnectauthentication(createbeareroptionsfrompolicy(policy));     }      // use cookie temporarily store information user logging in third party login provider     app.useexternalsignincookie(defaultauthenticationtypes.externalcookie); } 

this works fine far umbraco & custom mvc pages concerned - current user identity available , umbraco helper methods work expected.

however web api controllers - whether derived umbracoapicontroller or apicontroller, current user identity on http context null. have checked browser request being sent api controllers, , aspnet identity cookie included, i'm confused why doesn't translate user identity on thread & httpcontext. able shed light on that?

edit: more info on this- tried creating own custom cookie authentication middleware , replaced standard ms cookieauthenticationhandler custom implementation trace calls through it. interestingly, normal mvc page, authenticatecoreasync method invoked page loads, reads cookie , returns valid authentication ticket. web api call, authenticatecoreasync method not invoked @ before api method hit.

i found answer - nothing owin, , web api initialization code. mixing code required self-hosting web api code required web api running part of mvc app. instead of iappbuilder.usewebapi() should have been using globalconfiguration.configure()

so working code looks this:

public static void configure(iappbuilder app) {     globalconfiguration.configure(register); }  private static void register(httpconfiguration config) {     configurehttproutes(config);      configureformatters(config);      //etc... } 

a similar issue encountered in this question.