ASP .NET Core custom authentication scheme with external login

I tried with the code: In controller:

     [Authorize(AuthenticationSchemes = "Cookies,Bearer")]
                public IActionResult Index()
                {
                    
                    return View();
                }
    
        public IActionResult CreateToken()
                {
                    var claims = new Claim[]
                    {
                        new Claim(ClaimTypes.Name, "Jeffcky"),
                    };
                    var token = GenerateToken(claims);
                    Response.Cookies.Append("x-access-token", token);
                    return RedirectToAction("Login");
                 }
    
    private string GenerateToken(Claim[] claims)
                {
                    var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes("1234567890123456"));
        
                    var token = new JwtSecurityToken(
                      issuer: "http://localhost:5000",
                      audience: "http://localhost:5001",
                      claims: claims,
                      notBefore: DateTime.Now,
                      expires: DateTime.Now.AddMinutes(5),
                      signingCredentials: new SigningCredentials(key, SecurityAlgorithms.HmacSha256)
                    );
        
                    return new JwtSecurityTokenHandler().WriteToken(token);
                }

    [HttpPost]        
public async Task<IActionResult> Login(User user)
            {
    
                var token = Request.Cookies["x-access-token"];
                var jsonToken = new JwtSecurityTokenHandler().ReadToken(token) as JwtSecurityToken;
                var username = jsonToken.Claims.FirstOrDefault(m => m.Type == ClaimTypes.Name).Value;
                if (username!=user.Name)
                {
                    var claims = new Claim[]
                    {
                    new Claim(ClaimTypes.Name, "Jeffcky"),
                     };
                    var claimsIdentity = new ClaimsIdentity(claims, "Login");
                    await HttpContext.SignInAsync(CookieAuthenticationDefaults.AuthenticationScheme, new ClaimsPrincipal(claimsIdentity));
                }
                return RedirectToAction("Index");
            }

In startup:

services.AddAuthentication(options =>
            {
                options.DefaultAuthenticateScheme = CookieAuthenticationDefaults.AuthenticationScheme;
                options.DefaultChallengeScheme = CookieAuthenticationDefaults.AuthenticationScheme;
            })
            .AddCookie( m =>
            {
                m.LoginPath = new Microsoft.AspNetCore.Http.PathString("/Home/Login");
                m.AccessDeniedPath = new Microsoft.AspNetCore.Http.PathString("....");
                m.SlidingExpiration = true;
                m.ExpireTimeSpan = TimeSpan.FromMinutes(120);
            })
            .AddJwtBearer(options =>
             {
                 options.TokenValidationParameters = new TokenValidationParameters
                 {
                     ValidateIssuerSigningKey = true,
                     IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes("1234567890123456")),
                     ValidateIssuer = true,
                     ValidIssuer = "http://localhost:5000",
                     ValidateAudience = true,
                     ValidAudience = "http://localhost:5001",
                     ValidateLifetime = true,
                     ClockSkew = TimeSpan.FromMinutes(5)
                 };
                 options.Events = new JwtBearerEvents
                 {
                     OnMessageReceived = context =>
                     {
                         var accessToken = context.Request.Cookies["x-access-token"];

                         if (!string.IsNullOrEmpty(accessToken))
                         {
                             context.Token = accessToken;
                         }

                         return Task.CompletedTask;
                     }
                 };
             });

The Result:

you could modify the codes in login controller to pool data from database and varify the userinformation to meet your requirement.

And the Attribute[Authorize(AuthenticationSchemes = "Cookies,Bearer")] allows you Authentication with cookie or jwt,it may help in some situation

and if you want to logout,you could delete the cookie which strores the token or ticket

UpDate:

Accroding to your description,I think you could use jwt Authentication and set in your startup as follow:

options.Events = new JwtBearerEvents
                 {
                     OnMessageReceived = context =>
                     {

                         var accessToken = context.Request.Query["tookn"];

                         if (!string.IsNullOrEmpty(accessToken))
                         {
                             context.Token = accessToken;
                         }

                         return Task.CompletedTask;
                     }
                 };

Is it the result you excepted?

Full disclosure, I'm not very knowledgeable on the library you are using or on what exactly you are trying to do here, but I can tell you how these things work, generally speaking. Conceptually logging in and out on a web service works as follows:

1. Client sends authentication information to the server (Username, password hash, 2FA info, etc.)

2. The server checks the authentication information against the stored information about the user (e.g. compare password hash to the stored password hash)

3. If authentication is sucessful, the server creates and stores a cookie (a long randomly generated string). The server stores the cookie along with information such as the user who the cookie belongs to, and when the cookie was created.

4. The server sends the cookie to the client. The client is now "logged in".

5. Now when the client wants to send some http request to the web service, they send the cookie along with the request. The server then looks up who the cookie belongs to and handles the http request appropriately.

6. When the user wants to log out they send an http request to the server asking to log out, and pass the cookie along with the message. The server then invalidates the cookie, and further http requests are handled as if the user is logged out.