Why does my ServiceStack AuthProvider never call Authenticate(), even when IsAuthorized() returns false?

Question

I'm writing an AuthProvider for ServiceStack to authenticate against our own OAuth2 server, and having problems with the way ServiceStack interacts with my provider.

According to https://groups.google.com/d/msg/servicestack/e3kkh-qRDYs/DF9Y05ibl-MJ

There are generally 2 ways for extending, if you want to provide your own OAuth implementation you would sub class AuthProvider (or implement IAuthProvider) and override the Authenticate() method which holds the entire implementation of your service. The AuthService now has no real implementation of its own, it just checks the Auth Provider .IsAuthorized() method to see if the user is already authenticated, if not it calls the Authenticate() method. [my emphasis]

My entire auth provider right now looks like this:

using System;
using ServiceStack.ServiceInterface;
using ServiceStack.ServiceInterface.Auth;

namespace SpotAuth.ResourceServer.Services {
    public class SpotlightOAUthProvider : AuthProvider {
        public override bool IsAuthorized(IAuthSession session, IOAuthTokens tokens, Auth request = null) {
            return (false);
        }

        public override object Authenticate(IServiceBase authService, IAuthSession session, Auth request) {
            // A breakpoint on this line is never reached; the service just returns Unauthorized.
            throw new NotImplementedException();
        }
    }
}

Why is the Authenticate method never being called? The forum post linked above is nearly a year old but I can't find anything suggesting this behaviour has been deprecated.

Answer 1

This answer probably comes a bit late, but I just stumbled upon your question now.

A few weeks before you asked your question, I tried to implement my own AuthProvider and had a similar problem:
How to get ServiceStack authentication to work? (with iPhone clients)
(near the bottom of the question, there's my MyBasicAuthProvider)

In the end I found out what I did wrong, and I think you made the same mistake as I did:
I needed to override TryAuthenticate instead of Authenticate.

As soon as I changed that, my provider worked.