// Startup.cs public void Configure(IApplicationBuilder app, IWebHostEnvironment env) { // authentication has to come before authorization, or you get an infinite redirect! app.UseAuthentication() app.UseAuthorization() }