An authentication scheme reads the current identity to determine whether a user is authenticated. In the UI application, the default scheme is Cookies: it manages and validates authentication cookies. This is separate from the challenge scheme, which determines what happens when an unauthenticated user requests a protected resource. OpenID Connect (OIDC) is the default challenge scheme and redirects that user to authenticate. section 8.3
builder.Services.AddAuthentication(options =>
{
options.DefaultScheme =
CookieAuthenticationDefaults.AuthenticationScheme;
options.DefaultChallengeScheme =
OpenIdConnectDefaults.AuthenticationScheme;
})
.AddCookie(
CookieAuthenticationDefaults.AuthenticationScheme)
.AddOpenIdConnect()
.ConfigureWebAppOpenIdConnect();
The startup configuration sets the cookie scheme as DefaultScheme, the OIDC scheme as DefaultChallengeScheme, and registers both handlers. section 8.3
