[release/8.0] Extract IsAuthenticated helper method

[Copilot]

Backporting #68645 to release/8.0

Extract IsAuthenticated helper method

Centralize IsAuthenticated implementation and use it in all places that need it.

Description

Some callsites didn't have an accurate implementation. So this is a bugfix. The check was also added in the past in servicing.

Fixes #68474

Customer Impact

A claims principal with multiple identities when the first identity is not authenticated but another identity is authenticated would have been considered as not authenticated. With the fix, we look at all identities and consider it authenticated when any identity is authenticated.

Regression?

No

Risk

Low. The change is straightforward and in an area that was touched in servicing in the past.

Verification

Automated. Added unit tests for that.

Packaging changes reviewed?

N/A

[dotnet-policy-service]

Hi @copilot. Please make sure you've updated the PR description to use the Shiproom Template. Also, make sure this PR is not marked as a draft and is ready-to-merge.

To learn more about how to prepare a servicing PR click here.

[Copilot]

Pull request overview

Backports a shared SecurityHelper.IsAuthenticated implementation to release/8.0 and updates call sites to use aggregate “any identity authenticated” semantics, aligning output-caching and other features with authorization behavior.

Changes:

• Added SecurityHelper.IsAuthenticated(ClaimsPrincipal?) with aggregate identity semantics plus unit tests.
• Updated DenyAnonymousAuthorizationRequirement, OutputCaching DefaultPolicy, and Blazor Server revalidation logic to use the shared helper.
• Linked the shared helper into additional projects via .csproj compile includes, and added OutputCaching regression tests.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
src/Shared/test/Shared.Tests/SecurityHelperTests.cs	Adds unit tests covering null/no identities and non-primary authenticated identity scenarios.
src/Shared/SecurityHelper/SecurityHelper.cs	Introduces shared IsAuthenticated helper with aggregate identity semantics.
src/Security/Authorization/Core/src/Microsoft.AspNetCore.Authorization.csproj	Includes shared SecurityHelper sources in the Authorization Core build.
src/Security/Authorization/Core/src/DenyAnonymousAuthorizationRequirement.cs	Uses shared SecurityHelper.IsAuthenticated to match authorization semantics.
src/Middleware/OutputCaching/test/OutputCachePolicyProviderTests.cs	Adds regression tests to ensure authenticated (including non-primary identity) disables output caching.
src/Middleware/OutputCaching/src/Policies/DefaultPolicy.cs	Switches authenticated checks to shared helper for request/response phases.
src/Middleware/OutputCaching/src/Microsoft.AspNetCore.OutputCaching.csproj	Includes shared SecurityHelper sources in the OutputCaching build.
src/Components/Server/src/Microsoft.AspNetCore.Components.Server.csproj	Includes shared SecurityHelper sources in the Components Server build.
src/Components/Server/src/Circuits/RevalidatingServerAuthenticationStateProvider.cs	Uses shared helper when deciding whether to enter the revalidation loop.

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.