diff --git a/src/Microsoft.AspNetCore.Mvc.Core/Authorization/AuthorizeFilter.cs b/src/Microsoft.AspNetCore.Mvc.Core/Authorization/AuthorizeFilter.cs
index 0d46ef88b0..25ca6d0b94 100644
--- a/src/Microsoft.AspNetCore.Mvc.Core/Authorization/AuthorizeFilter.cs
+++ b/src/Microsoft.AspNetCore.Mvc.Core/Authorization/AuthorizeFilter.cs
@@ -7,6 +7,7 @@ using System.Diagnostics;
 using System.Linq;
 using System.Security.Claims;
 using System.Threading.Tasks;
+using Microsoft.AspNetCore.Authentication;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc.Core;
 using Microsoft.AspNetCore.Mvc.Filters;
@@ -131,10 +132,10 @@ namespace Microsoft.AspNetCore.Mvc.Authorization
                 for (var i = 0; i < effectivePolicy.AuthenticationSchemes.Count; i++)
                 {
                     var scheme = effectivePolicy.AuthenticationSchemes[i];
-                    var result = await context.HttpContext.Authentication.AuthenticateAsync(scheme);
-                    if (result != null)
+                    var result = await context.HttpContext.AuthenticateAsync(scheme);
+                    if (result.Succeeded)
                     {
-                        newPrincipal = SecurityHelper.MergeUserPrincipal(newPrincipal, result);
+                        newPrincipal = SecurityHelper.MergeUserPrincipal(newPrincipal, result.Principal);
                     }
                 }
                 // If all schemes failed authentication, provide a default identity anyways
diff --git a/src/Microsoft.AspNetCore.Mvc.Core/ChallengeResult.cs b/src/Microsoft.AspNetCore.Mvc.Core/ChallengeResult.cs
index f0ba4407ce..7f7f0249ca 100644
--- a/src/Microsoft.AspNetCore.Mvc.Core/ChallengeResult.cs
+++ b/src/Microsoft.AspNetCore.Mvc.Core/ChallengeResult.cs
@@ -4,7 +4,7 @@
 using System;
 using System.Collections.Generic;
 using System.Threading.Tasks;
-using Microsoft.AspNetCore.Http.Authentication;
+using Microsoft.AspNetCore.Authentication;
 using Microsoft.AspNetCore.Mvc.Internal;
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Logging;
@@ -103,17 +103,16 @@ namespace Microsoft.AspNetCore.Mvc
 
             logger.ChallengeResultExecuting(AuthenticationSchemes);
 
-            var authentication = context.HttpContext.Authentication;
             if (AuthenticationSchemes != null && AuthenticationSchemes.Count > 0)
             {
                 foreach (var scheme in AuthenticationSchemes)
                 {
-                    await authentication.ChallengeAsync(scheme, Properties);
+                    await context.HttpContext.ChallengeAsync(scheme, Properties);
                 }
             }
             else
             {
-                await authentication.ChallengeAsync(Properties);
+                await context.HttpContext.ChallengeAsync(Properties);
             }
         }
     }
diff --git a/src/Microsoft.AspNetCore.Mvc.Core/ControllerBase.cs b/src/Microsoft.AspNetCore.Mvc.Core/ControllerBase.cs
index af3d9331c9..a18a5297f0 100644
--- a/src/Microsoft.AspNetCore.Mvc.Core/ControllerBase.cs
+++ b/src/Microsoft.AspNetCore.Mvc.Core/ControllerBase.cs
@@ -8,8 +8,8 @@ using System.Linq.Expressions;
 using System.Security.Claims;
 using System.Text;
 using System.Threading.Tasks;
+using Microsoft.AspNetCore.Authentication;
 using Microsoft.AspNetCore.Http;
-using Microsoft.AspNetCore.Http.Authentication;
 using Microsoft.AspNetCore.Mvc.Core;
 using Microsoft.AspNetCore.Mvc.ModelBinding;
 using Microsoft.AspNetCore.Mvc.ModelBinding.Internal;
@@ -1459,7 +1459,7 @@ namespace Microsoft.AspNetCore.Mvc
         /// </summary>
         /// <returns>The created <see cref="ChallengeResult"/> for the response.</returns>
         /// <remarks>
-        /// The behavior of this method depends on the <see cref="AuthenticationManager"/> in use.
+        /// The behavior of this method depends on the <see cref="IAuthenticationService"/> in use.
         /// <see cref="StatusCodes.Status401Unauthorized"/> and <see cref="StatusCodes.Status403Forbidden"/>
         /// are among likely status results.
         /// </remarks>
@@ -1473,7 +1473,7 @@ namespace Microsoft.AspNetCore.Mvc
         /// <param name="authenticationSchemes">The authentication schemes to challenge.</param>
         /// <returns>The created <see cref="ChallengeResult"/> for the response.</returns>
         /// <remarks>
-        /// The behavior of this method depends on the <see cref="AuthenticationManager"/> in use.
+        /// The behavior of this method depends on the <see cref="IAuthenticationService"/> in use.
         /// <see cref="StatusCodes.Status401Unauthorized"/> and <see cref="StatusCodes.Status403Forbidden"/>
         /// are among likely status results.
         /// </remarks>
@@ -1488,7 +1488,7 @@ namespace Microsoft.AspNetCore.Mvc
         /// challenge.</param>
         /// <returns>The created <see cref="ChallengeResult"/> for the response.</returns>
         /// <remarks>
-        /// The behavior of this method depends on the <see cref="AuthenticationManager"/> in use.
+        /// The behavior of this method depends on the <see cref="IAuthenticationService"/> in use.
         /// <see cref="StatusCodes.Status401Unauthorized"/> and <see cref="StatusCodes.Status403Forbidden"/>
         /// are among likely status results.
         /// </remarks>
@@ -1505,7 +1505,7 @@ namespace Microsoft.AspNetCore.Mvc
         /// <param name="authenticationSchemes">The authentication schemes to challenge.</param>
         /// <returns>The created <see cref="ChallengeResult"/> for the response.</returns>
         /// <remarks>
-        /// The behavior of this method depends on the <see cref="AuthenticationManager"/> in use.
+        /// The behavior of this method depends on the <see cref="IAuthenticationService"/> in use.
         /// <see cref="StatusCodes.Status401Unauthorized"/> and <see cref="StatusCodes.Status403Forbidden"/>
         /// are among likely status results.
         /// </remarks>
diff --git a/src/Microsoft.AspNetCore.Mvc.Core/DependencyInjection/MvcCoreMvcCoreBuilderExtensions.cs b/src/Microsoft.AspNetCore.Mvc.Core/DependencyInjection/MvcCoreMvcCoreBuilderExtensions.cs
index f550810bbb..641206da77 100644
--- a/src/Microsoft.AspNetCore.Mvc.Core/DependencyInjection/MvcCoreMvcCoreBuilderExtensions.cs
+++ b/src/Microsoft.AspNetCore.Mvc.Core/DependencyInjection/MvcCoreMvcCoreBuilderExtensions.cs
@@ -90,6 +90,7 @@ namespace Microsoft.Extensions.DependencyInjection
         // Internal for testing.
         internal static void AddAuthorizationServices(IServiceCollection services)
         {
+            services.AddAuthenticationCore();
             services.AddAuthorization();
 
             services.TryAddEnumerable(
diff --git a/src/Microsoft.AspNetCore.Mvc.Core/ForbidResult.cs b/src/Microsoft.AspNetCore.Mvc.Core/ForbidResult.cs
index 0b4f9d4a29..b967d74c08 100644
--- a/src/Microsoft.AspNetCore.Mvc.Core/ForbidResult.cs
+++ b/src/Microsoft.AspNetCore.Mvc.Core/ForbidResult.cs
@@ -4,7 +4,7 @@
 using System;
 using System.Collections.Generic;
 using System.Threading.Tasks;
-using Microsoft.AspNetCore.Http.Authentication;
+using Microsoft.AspNetCore.Authentication;
 using Microsoft.AspNetCore.Mvc.Internal;
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Logging;
@@ -103,18 +103,16 @@ namespace Microsoft.AspNetCore.Mvc
 
             logger.ForbidResultExecuting(AuthenticationSchemes);
 
-            var authentication = context.HttpContext.Authentication;
-
             if (AuthenticationSchemes != null && AuthenticationSchemes.Count > 0)
             {
                 for (var i = 0; i < AuthenticationSchemes.Count; i++)
                 {
-                    await authentication.ForbidAsync(AuthenticationSchemes[i], Properties);
+                    await context.HttpContext.ForbidAsync(AuthenticationSchemes[i], Properties);
                 }
             }
             else
             {
-                await authentication.ForbidAsync(Properties);
+                await context.HttpContext.ForbidAsync(Properties);
             }
         }
     }
diff --git a/src/Microsoft.AspNetCore.Mvc.Core/Microsoft.AspNetCore.Mvc.Core.csproj b/src/Microsoft.AspNetCore.Mvc.Core/Microsoft.AspNetCore.Mvc.Core.csproj
index 3c9f8b52ce..5474f98f1e 100644
--- a/src/Microsoft.AspNetCore.Mvc.Core/Microsoft.AspNetCore.Mvc.Core.csproj
+++ b/src/Microsoft.AspNetCore.Mvc.Core/Microsoft.AspNetCore.Mvc.Core.csproj
@@ -21,6 +21,7 @@ Microsoft.AspNetCore.Mvc.RouteAttribute</Description>
   <ItemGroup>
     <ProjectReference Include="..\Microsoft.AspNetCore.Mvc.Abstractions\Microsoft.AspNetCore.Mvc.Abstractions.csproj" />
 
+    <PackageReference Include="Microsoft.AspNetCore.Authentication.Core" Version="$(AspNetCoreVersion)" />
     <PackageReference Include="Microsoft.AspNetCore.Authorization" Version="$(AspNetCoreVersion)" />
     <PackageReference Include="Microsoft.AspNetCore.Hosting.Abstractions" Version="$(AspNetCoreVersion)" />
     <PackageReference Include="Microsoft.AspNetCore.Http" Version="$(AspNetCoreVersion)" />
diff --git a/src/Microsoft.AspNetCore.Mvc.Core/SignInResult.cs b/src/Microsoft.AspNetCore.Mvc.Core/SignInResult.cs
index 875a8f34e1..040bbe040d 100644
--- a/src/Microsoft.AspNetCore.Mvc.Core/SignInResult.cs
+++ b/src/Microsoft.AspNetCore.Mvc.Core/SignInResult.cs
@@ -4,7 +4,7 @@
 using System;
 using System.Security.Claims;
 using System.Threading.Tasks;
-using Microsoft.AspNetCore.Http.Authentication;
+using Microsoft.AspNetCore.Authentication;
 using Microsoft.AspNetCore.Mvc.Core;
 using Microsoft.AspNetCore.Mvc.Internal;
 using Microsoft.Extensions.DependencyInjection;
@@ -88,8 +88,7 @@ namespace Microsoft.AspNetCore.Mvc
 
             logger.SignInResultExecuting(AuthenticationScheme, Principal);
 
-            var authentication = context.HttpContext.Authentication;
-            await authentication.SignInAsync(AuthenticationScheme, Principal, Properties);
+            await context.HttpContext.SignInAsync(AuthenticationScheme, Principal, Properties);
         }
     }
 }
diff --git a/src/Microsoft.AspNetCore.Mvc.Core/SignOutResult.cs b/src/Microsoft.AspNetCore.Mvc.Core/SignOutResult.cs
index fff394a911..17e93b368a 100644
--- a/src/Microsoft.AspNetCore.Mvc.Core/SignOutResult.cs
+++ b/src/Microsoft.AspNetCore.Mvc.Core/SignOutResult.cs
@@ -4,7 +4,7 @@
 using System;
 using System.Collections.Generic;
 using System.Threading.Tasks;
-using Microsoft.AspNetCore.Http.Authentication;
+using Microsoft.AspNetCore.Authentication;
 using Microsoft.AspNetCore.Mvc.Core;
 using Microsoft.AspNetCore.Mvc.Internal;
 using Microsoft.Extensions.DependencyInjection;
@@ -106,11 +106,9 @@ namespace Microsoft.AspNetCore.Mvc
 
             logger.SignOutResultExecuting(AuthenticationSchemes);
 
-            var authentication = context.HttpContext.Authentication;
-            
             for (var i = 0; i < AuthenticationSchemes.Count; i++)
             {
-                await authentication.SignOutAsync(AuthenticationSchemes[i], Properties);
+                await context.HttpContext.SignOutAsync(AuthenticationSchemes[i], Properties);
             }
         }
     }
diff --git a/test/Microsoft.AspNetCore.Mvc.Core.Test/Authorization/AuthorizeFilterTest.cs b/test/Microsoft.AspNetCore.Mvc.Core.Test/Authorization/AuthorizeFilterTest.cs
index 77de8eb56e..9c57379b6d 100644
--- a/test/Microsoft.AspNetCore.Mvc.Core.Test/Authorization/AuthorizeFilterTest.cs
+++ b/test/Microsoft.AspNetCore.Mvc.Core.Test/Authorization/AuthorizeFilterTest.cs
@@ -5,9 +5,9 @@ using System;
 using System.Linq;
 using System.Security.Claims;
 using System.Threading.Tasks;
+using Microsoft.AspNetCore.Authentication;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Http;
-using Microsoft.AspNetCore.Http.Authentication;
 using Microsoft.AspNetCore.Mvc.Abstractions;
 using Microsoft.AspNetCore.Mvc.Filters;
 using Microsoft.AspNetCore.Routing;
@@ -482,10 +482,12 @@ namespace Microsoft.AspNetCore.Mvc.Authorization
 
             // ServiceProvider
             var serviceCollection = new ServiceCollection();
+            var auth = new Mock<IAuthenticationService>();
             if (registerServices != null)
             {
                 serviceCollection.AddOptions();
                 serviceCollection.AddLogging();
+                serviceCollection.AddSingleton(auth.Object);
                 registerServices(serviceCollection);
             }
 
@@ -493,17 +495,15 @@ namespace Microsoft.AspNetCore.Mvc.Authorization
 
             // HttpContext
             var httpContext = new Mock<HttpContext>();
-            var auth = new Mock<AuthenticationManager>();
-            httpContext.Setup(o => o.Authentication).Returns(auth.Object);
             httpContext.SetupProperty(c => c.User);
             if (!anonymous)
             {
                 httpContext.Object.User = validUser;
             }
             httpContext.SetupGet(c => c.RequestServices).Returns(serviceProvider);
-            auth.Setup(c => c.AuthenticateAsync("Bearer")).ReturnsAsync(bearerPrincipal);
-            auth.Setup(c => c.AuthenticateAsync("Basic")).ReturnsAsync(basicPrincipal);
-            auth.Setup(c => c.AuthenticateAsync("Fails")).ReturnsAsync(default(ClaimsPrincipal));
+            auth.Setup(c => c.AuthenticateAsync(httpContext.Object, "Bearer")).ReturnsAsync(AuthenticateResult.Success(new AuthenticationTicket(bearerPrincipal, "Bearer")));
+            auth.Setup(c => c.AuthenticateAsync(httpContext.Object, "Basic")).ReturnsAsync(AuthenticateResult.Success(new AuthenticationTicket(basicPrincipal, "Basic")));
+            auth.Setup(c => c.AuthenticateAsync(httpContext.Object, "Fails")).ReturnsAsync(AuthenticateResult.Fail("Fails"));
 
             // AuthorizationFilterContext
             var actionContext = new ActionContext(
diff --git a/test/Microsoft.AspNetCore.Mvc.Core.Test/ChallengeResultTest.cs b/test/Microsoft.AspNetCore.Mvc.Core.Test/ChallengeResultTest.cs
index af0a247c9d..289d4339a9 100644
--- a/test/Microsoft.AspNetCore.Mvc.Core.Test/ChallengeResultTest.cs
+++ b/test/Microsoft.AspNetCore.Mvc.Core.Test/ChallengeResultTest.cs
@@ -2,8 +2,8 @@
 // Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
 
 using System.Threading.Tasks;
+using Microsoft.AspNetCore.Authentication;
 using Microsoft.AspNetCore.Http;
-using Microsoft.AspNetCore.Http.Authentication;
 using Microsoft.AspNetCore.Mvc.Abstractions;
 using Microsoft.AspNetCore.Routing;
 using Microsoft.Extensions.DependencyInjection;
@@ -22,11 +22,11 @@ namespace Microsoft.AspNetCore.Mvc
             // Arrange
             var result = new ChallengeResult("", null);
 
-            var httpContext = new Mock<HttpContext>();
-            httpContext.SetupGet(c => c.RequestServices).Returns(CreateServices().BuildServiceProvider());
+            var auth = new Mock<IAuthenticationService>();
 
-            var auth = new Mock<AuthenticationManager>();
-            httpContext.Setup(o => o.Authentication).Returns(auth.Object);
+            var httpContext = new Mock<HttpContext>();
+            httpContext.SetupGet(c => c.RequestServices)
+                .Returns(CreateServices().AddSingleton(auth.Object).BuildServiceProvider());
 
             var routeData = new RouteData();
             routeData.Routers.Add(Mock.Of<IRouter>());
@@ -39,7 +39,7 @@ namespace Microsoft.AspNetCore.Mvc
             await result.ExecuteResultAsync(actionContext);
 
             // Assert
-            auth.Verify(c => c.ChallengeAsync("", null), Times.Exactly(1));
+            auth.Verify(c => c.ChallengeAsync(httpContext.Object, "", null, ChallengeBehavior.Automatic), Times.Exactly(1));
         }
 
         [Fact]
@@ -48,11 +48,10 @@ namespace Microsoft.AspNetCore.Mvc
             // Arrange
             var result = new ChallengeResult(new string[] { }, null);
 
+            var auth = new Mock<IAuthenticationService>();
             var httpContext = new Mock<HttpContext>();
-            httpContext.SetupGet(c => c.RequestServices).Returns(CreateServices().BuildServiceProvider());
-
-            var auth = new Mock<AuthenticationManager>();
-            httpContext.Setup(o => o.Authentication).Returns(auth.Object);
+            httpContext.SetupGet(c => c.RequestServices)
+                .Returns(CreateServices().AddSingleton(auth.Object).BuildServiceProvider());
 
             var routeData = new RouteData();
             routeData.Routers.Add(Mock.Of<IRouter>());
@@ -65,13 +64,14 @@ namespace Microsoft.AspNetCore.Mvc
             await result.ExecuteResultAsync(actionContext);
 
             // Assert
-            auth.Verify(c => c.ChallengeAsync((AuthenticationProperties)null), Times.Exactly(1));
+            auth.Verify(c => c.ChallengeAsync(httpContext.Object, null, null, ChallengeBehavior.Automatic), Times.Exactly(1));
         }
 
         private static IServiceCollection CreateServices()
         {
             var services = new ServiceCollection();
             services.AddSingleton<ILoggerFactory>(NullLoggerFactory.Instance);
+            services.AddAuthenticationCore();
             return services;
         }
     }
diff --git a/test/Microsoft.AspNetCore.Mvc.Core.Test/ForbidResultTest.cs b/test/Microsoft.AspNetCore.Mvc.Core.Test/ForbidResultTest.cs
index 08e119e276..2991dab6f0 100644
--- a/test/Microsoft.AspNetCore.Mvc.Core.Test/ForbidResultTest.cs
+++ b/test/Microsoft.AspNetCore.Mvc.Core.Test/ForbidResultTest.cs
@@ -3,8 +3,8 @@
 
 using System;
 using System.Threading.Tasks;
+using Microsoft.AspNetCore.Authentication;
 using Microsoft.AspNetCore.Http;
-using Microsoft.AspNetCore.Http.Authentication;
 using Microsoft.AspNetCore.Mvc.Abstractions;
 using Microsoft.AspNetCore.Mvc.Internal;
 using Microsoft.AspNetCore.Routing;
@@ -22,14 +22,13 @@ namespace Microsoft.AspNetCore.Mvc
         public async Task ExecuteResultAsync_InvokesForbidAsyncOnAuthenticationManager()
         {
             // Arrange
-            var authenticationManager = new Mock<AuthenticationManager>();
-            authenticationManager
-                .Setup(c => c.ForbidAsync("", null))
+            var httpContext = new Mock<HttpContext>();
+            var auth = new Mock<IAuthenticationService>();
+            auth
+                .Setup(c => c.ChallengeAsync(httpContext.Object, "", null, ChallengeBehavior.Forbidden))
                 .Returns(TaskCache.CompletedTask)
                 .Verifiable();
-            var httpContext = new Mock<HttpContext>();
-            httpContext.Setup(c => c.RequestServices).Returns(CreateServices());
-            httpContext.Setup(c => c.Authentication).Returns(authenticationManager.Object);
+            httpContext.Setup(c => c.RequestServices).Returns(CreateServices(auth.Object));
             var result = new ForbidResult("", null);
             var routeData = new RouteData();
 
@@ -42,26 +41,25 @@ namespace Microsoft.AspNetCore.Mvc
             await result.ExecuteResultAsync(actionContext);
 
             // Assert
-            authenticationManager.Verify();
+            auth.Verify();
         }
 
         [Fact]
         public async Task ExecuteResultAsync_InvokesForbidAsyncOnAllConfiguredSchemes()
         {
             // Arrange
-            var authProperties = new AuthenticationProperties();
-            var authenticationManager = new Mock<AuthenticationManager>();
-            authenticationManager
-                .Setup(c => c.ForbidAsync("Scheme1", authProperties))
-                .Returns(TaskCache.CompletedTask)
-                .Verifiable();
-            authenticationManager
-                .Setup(c => c.ForbidAsync("Scheme2", authProperties))
-                .Returns(TaskCache.CompletedTask)
-                .Verifiable();
             var httpContext = new Mock<HttpContext>();
-            httpContext.Setup(c => c.RequestServices).Returns(CreateServices());
-            httpContext.Setup(c => c.Authentication).Returns(authenticationManager.Object);
+            var authProperties = new AuthenticationProperties();
+            var auth = new Mock<IAuthenticationService>();
+            auth
+                .Setup(c => c.ChallengeAsync(httpContext.Object, "Scheme1", authProperties, ChallengeBehavior.Forbidden))
+                .Returns(TaskCache.CompletedTask)
+                .Verifiable();
+            auth
+                .Setup(c => c.ChallengeAsync(httpContext.Object, "Scheme2", authProperties, ChallengeBehavior.Forbidden))
+                .Returns(TaskCache.CompletedTask)
+                .Verifiable();
+            httpContext.Setup(c => c.RequestServices).Returns(CreateServices(auth.Object));
             var result = new ForbidResult(new[] { "Scheme1", "Scheme2" }, authProperties);
             var routeData = new RouteData();
 
@@ -74,7 +72,7 @@ namespace Microsoft.AspNetCore.Mvc
             await result.ExecuteResultAsync(actionContext);
 
             // Assert
-            authenticationManager.Verify();
+            auth.Verify();
         }
 
         public static TheoryData ExecuteResultAsync_InvokesForbidAsyncWithAuthPropertiesData =>
@@ -89,14 +87,13 @@ namespace Microsoft.AspNetCore.Mvc
         public async Task ExecuteResultAsync_InvokesForbidAsyncWithAuthProperties(AuthenticationProperties expected)
         {
             // Arrange
-            var authenticationManager = new Mock<AuthenticationManager>();
-            authenticationManager
-                .Setup(c => c.ForbidAsync(expected))
+            var httpContext = new Mock<HttpContext>();
+            var auth = new Mock<IAuthenticationService>();
+            auth
+                .Setup(c => c.ChallengeAsync(httpContext.Object, null, expected, ChallengeBehavior.Forbidden))
                 .Returns(TaskCache.CompletedTask)
                 .Verifiable();
-            var httpContext = new Mock<HttpContext>();
-            httpContext.Setup(c => c.RequestServices).Returns(CreateServices());
-            httpContext.Setup(c => c.Authentication).Returns(authenticationManager.Object);
+            httpContext.Setup(c => c.RequestServices).Returns(CreateServices(auth.Object));
             var result = new ForbidResult(expected);
             var routeData = new RouteData();
 
@@ -109,7 +106,7 @@ namespace Microsoft.AspNetCore.Mvc
             await result.ExecuteResultAsync(actionContext);
 
             // Assert
-            authenticationManager.Verify();
+            auth.Verify();
         }
 
         [Theory]
@@ -118,14 +115,13 @@ namespace Microsoft.AspNetCore.Mvc
             AuthenticationProperties expected)
         {
             // Arrange
-            var authenticationManager = new Mock<AuthenticationManager>();
-            authenticationManager
-                .Setup(c => c.ForbidAsync(expected))
+            var httpContext = new Mock<HttpContext>();
+            var auth = new Mock<IAuthenticationService>();
+            auth
+                .Setup(c => c.ChallengeAsync(httpContext.Object, null, expected, ChallengeBehavior.Forbidden))
                 .Returns(TaskCache.CompletedTask)
                 .Verifiable();
-            var httpContext = new Mock<HttpContext>();
-            httpContext.Setup(c => c.RequestServices).Returns(CreateServices());
-            httpContext.Setup(c => c.Authentication).Returns(authenticationManager.Object);
+            httpContext.Setup(c => c.RequestServices).Returns(CreateServices(auth.Object));
             var result = new ForbidResult(expected)
             {
                 AuthenticationSchemes = new string[0]
@@ -141,13 +137,14 @@ namespace Microsoft.AspNetCore.Mvc
             await result.ExecuteResultAsync(actionContext);
 
             // Assert
-            authenticationManager.Verify();
+            auth.Verify();
         }
 
-        private static IServiceProvider CreateServices()
+        private static IServiceProvider CreateServices(IAuthenticationService auth)
         {
             return new ServiceCollection()
                 .AddSingleton<ILoggerFactory>(NullLoggerFactory.Instance)
+                .AddSingleton(auth)
                 .BuildServiceProvider();
         }
     }
diff --git a/test/Microsoft.AspNetCore.Mvc.Core.Test/SignInResultTest.cs b/test/Microsoft.AspNetCore.Mvc.Core.Test/SignInResultTest.cs
index 73a5b910a3..42e24b5a58 100644
--- a/test/Microsoft.AspNetCore.Mvc.Core.Test/SignInResultTest.cs
+++ b/test/Microsoft.AspNetCore.Mvc.Core.Test/SignInResultTest.cs
@@ -4,8 +4,8 @@
 using System;
 using System.Security.Claims;
 using System.Threading.Tasks;
+using Microsoft.AspNetCore.Authentication;
 using Microsoft.AspNetCore.Http;
-using Microsoft.AspNetCore.Http.Authentication;
 using Microsoft.AspNetCore.Mvc.Abstractions;
 using Microsoft.AspNetCore.Mvc.Internal;
 using Microsoft.AspNetCore.Routing;
@@ -24,14 +24,13 @@ namespace Microsoft.AspNetCore.Mvc
         {
             // Arrange
             var principal = new ClaimsPrincipal();
-            var authenticationManager = new Mock<AuthenticationManager>();
-            authenticationManager
-                .Setup(c => c.SignInAsync("", principal, null))
+            var httpContext = new Mock<HttpContext>();
+            var auth = new Mock<IAuthenticationService>();
+            auth
+                .Setup(c => c.SignInAsync(httpContext.Object, "", principal, null))
                 .Returns(TaskCache.CompletedTask)
                 .Verifiable();
-            var httpContext = new Mock<HttpContext>();
-            httpContext.Setup(c => c.RequestServices).Returns(CreateServices());
-            httpContext.Setup(c => c.Authentication).Returns(authenticationManager.Object);
+            httpContext.Setup(c => c.RequestServices).Returns(CreateServices(auth.Object));
             var result = new SignInResult("", principal, null);
             var routeData = new RouteData();
 
@@ -44,7 +43,7 @@ namespace Microsoft.AspNetCore.Mvc
             await result.ExecuteResultAsync(actionContext);
 
             // Assert
-            authenticationManager.Verify();
+            auth.Verify();
         }
 
         [Fact]
@@ -53,14 +52,13 @@ namespace Microsoft.AspNetCore.Mvc
             // Arrange
             var principal = new ClaimsPrincipal();
             var authProperties = new AuthenticationProperties();
-            var authenticationManager = new Mock<AuthenticationManager>();
-            authenticationManager
-                .Setup(c => c.SignInAsync("Scheme1", principal, authProperties))
+            var httpContext = new Mock<HttpContext>();
+            var auth = new Mock<IAuthenticationService>();
+            auth
+                .Setup(c => c.SignInAsync(httpContext.Object, "Scheme1", principal, authProperties))
                 .Returns(TaskCache.CompletedTask)
                 .Verifiable();
-            var httpContext = new Mock<HttpContext>();
-            httpContext.Setup(c => c.RequestServices).Returns(CreateServices());
-            httpContext.Setup(c => c.Authentication).Returns(authenticationManager.Object);
+            httpContext.Setup(c => c.RequestServices).Returns(CreateServices(auth.Object));
             var result = new SignInResult("Scheme1", principal, authProperties);
             var routeData = new RouteData();
 
@@ -73,13 +71,14 @@ namespace Microsoft.AspNetCore.Mvc
             await result.ExecuteResultAsync(actionContext);
 
             // Assert
-            authenticationManager.Verify();
+            auth.Verify();
         }
 
-        private static IServiceProvider CreateServices()
+        private static IServiceProvider CreateServices(IAuthenticationService auth)
         {
             return new ServiceCollection()
                 .AddSingleton<ILoggerFactory>(NullLoggerFactory.Instance)
+                .AddSingleton(auth)
                 .BuildServiceProvider();
         }
     }
diff --git a/test/Microsoft.AspNetCore.Mvc.Core.Test/SignOutResultTest.cs b/test/Microsoft.AspNetCore.Mvc.Core.Test/SignOutResultTest.cs
index 2cbb348219..d73bd99e6c 100644
--- a/test/Microsoft.AspNetCore.Mvc.Core.Test/SignOutResultTest.cs
+++ b/test/Microsoft.AspNetCore.Mvc.Core.Test/SignOutResultTest.cs
@@ -3,8 +3,8 @@
 
 using System;
 using System.Threading.Tasks;
+using Microsoft.AspNetCore.Authentication;
 using Microsoft.AspNetCore.Http;
-using Microsoft.AspNetCore.Http.Authentication;
 using Microsoft.AspNetCore.Mvc.Abstractions;
 using Microsoft.AspNetCore.Mvc.Internal;
 using Microsoft.AspNetCore.Routing;
@@ -22,14 +22,13 @@ namespace Microsoft.AspNetCore.Mvc
         public async Task ExecuteResultAsync_InvokesSignOutAsyncOnAuthenticationManager()
         {
             // Arrange
-            var authenticationManager = new Mock<AuthenticationManager>();
-            authenticationManager
-                .Setup(c => c.SignOutAsync("", null))
+            var httpContext = new Mock<HttpContext>();
+            var auth = new Mock<IAuthenticationService>();
+            auth
+                .Setup(c => c.SignOutAsync(httpContext.Object, "", null))
                 .Returns(TaskCache.CompletedTask)
                 .Verifiable();
-            var httpContext = new Mock<HttpContext>();
-            httpContext.Setup(c => c.RequestServices).Returns(CreateServices());
-            httpContext.Setup(c => c.Authentication).Returns(authenticationManager.Object);
+            httpContext.Setup(c => c.RequestServices).Returns(CreateServices(auth.Object));
             var result = new SignOutResult("", null);
             var routeData = new RouteData();
 
@@ -42,7 +41,7 @@ namespace Microsoft.AspNetCore.Mvc
             await result.ExecuteResultAsync(actionContext);
 
             // Assert
-            authenticationManager.Verify();
+            auth.Verify();
         }
 
         [Fact]
@@ -50,18 +49,17 @@ namespace Microsoft.AspNetCore.Mvc
         {
             // Arrange
             var authProperties = new AuthenticationProperties();
-            var authenticationManager = new Mock<AuthenticationManager>();
-            authenticationManager
-                .Setup(c => c.SignOutAsync("Scheme1", authProperties))
-                .Returns(TaskCache.CompletedTask)
-                .Verifiable();
-            authenticationManager
-                .Setup(c => c.SignOutAsync("Scheme2", authProperties))
-                .Returns(TaskCache.CompletedTask)
-                .Verifiable();
             var httpContext = new Mock<HttpContext>();
-            httpContext.Setup(c => c.RequestServices).Returns(CreateServices());
-            httpContext.Setup(c => c.Authentication).Returns(authenticationManager.Object);
+            var auth = new Mock<IAuthenticationService>();
+            auth
+                .Setup(c => c.SignOutAsync(httpContext.Object, "Scheme1", authProperties))
+                .Returns(TaskCache.CompletedTask)
+                .Verifiable();
+            auth
+                .Setup(c => c.SignOutAsync(httpContext.Object, "Scheme2", authProperties))
+                .Returns(TaskCache.CompletedTask)
+                .Verifiable();
+            httpContext.Setup(c => c.RequestServices).Returns(CreateServices(auth.Object));
             var result = new SignOutResult(new[] { "Scheme1", "Scheme2" }, authProperties);
             var routeData = new RouteData();
 
@@ -74,13 +72,14 @@ namespace Microsoft.AspNetCore.Mvc
             await result.ExecuteResultAsync(actionContext);
 
             // Assert
-            authenticationManager.Verify();
+            auth.Verify();
         }
 
-        private static IServiceProvider CreateServices()
+        private static IServiceProvider CreateServices(IAuthenticationService auth)
         {
             return new ServiceCollection()
                 .AddSingleton<ILoggerFactory>(NullLoggerFactory.Instance)
+                .AddSingleton(auth)
                 .BuildServiceProvider();
         }
     }
diff --git a/test/WebSites/FiltersWebSite/AuthorizeBasicMiddleware.cs b/test/WebSites/FiltersWebSite/AuthorizeBasicMiddleware.cs
deleted file mode 100644
index 9937f1abb7..0000000000
--- a/test/WebSites/FiltersWebSite/AuthorizeBasicMiddleware.cs
+++ /dev/null
@@ -1,30 +0,0 @@
-// Copyright (c) .NET Foundation. All rights reserved.
-// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
-
-using System.Text.Encodings.Web;
-using Microsoft.AspNetCore.Authentication;
-using Microsoft.AspNetCore.Http;
-using Microsoft.Extensions.Logging;
-
-namespace FiltersWebSite
-{
-    public class AuthorizeBasicMiddleware : AuthenticationMiddleware<BasicOptions>
-    {
-        public AuthorizeBasicMiddleware(
-            RequestDelegate next,
-            ILoggerFactory loggerFactory,
-            UrlEncoder encoder,
-            string authScheme) :
-                base(next,
-                     new BasicOptions { AuthenticationScheme = authScheme },
-                     loggerFactory,
-                     encoder)
-        {
-        }
-
-        protected override AuthenticationHandler<BasicOptions> CreateHandler()
-        {
-            return new BasicAuthenticationHandler();
-        }
-    }
-}
\ No newline at end of file
diff --git a/test/WebSites/FiltersWebSite/BasicAuthenticationHandler.cs b/test/WebSites/FiltersWebSite/BasicAuthenticationHandler.cs
index 9b1f2d84b1..4bcf033daa 100644
--- a/test/WebSites/FiltersWebSite/BasicAuthenticationHandler.cs
+++ b/test/WebSites/FiltersWebSite/BasicAuthenticationHandler.cs
@@ -3,16 +3,21 @@
 
 using System;
 using System.Security.Claims;
+using System.Text.Encodings.Web;
 using System.Threading.Tasks;
 using Microsoft.AspNetCore.Authentication;
 using Microsoft.AspNetCore.Builder;
-using Microsoft.AspNetCore.Http.Authentication;
+using Microsoft.Extensions.Logging;
 using Microsoft.Extensions.Options;
 
 namespace FiltersWebSite
 {
     public class BasicAuthenticationHandler : AuthenticationHandler<BasicOptions>
     {
+        public BasicAuthenticationHandler(IOptionsSnapshot<BasicOptions> options, ILoggerFactory logger, UrlEncoder encoder, ISystemClock clock)
+            : base(options, logger, encoder, clock)
+        { }
+
         protected override Task<AuthenticateResult> HandleAuthenticateAsync()
         {
             var principal = new ClaimsPrincipal();
@@ -23,9 +28,9 @@ namespace FiltersWebSite
                     new Claim(ClaimTypes.Role, "Administrator"),
                     new Claim(ClaimTypes.NameIdentifier, "John")
                 },
-                Options.AuthenticationScheme));
+                Scheme.Name));
             return Task.FromResult(AuthenticateResult.Success(new AuthenticationTicket(principal, 
-                new AuthenticationProperties(), Options.AuthenticationScheme)));
+                new AuthenticationProperties(), Scheme.Name)));
         }
     }
 }
\ No newline at end of file
diff --git a/test/WebSites/FiltersWebSite/BasicOptions.cs b/test/WebSites/FiltersWebSite/BasicOptions.cs
index d7cb4c3f06..c85516a97c 100644
--- a/test/WebSites/FiltersWebSite/BasicOptions.cs
+++ b/test/WebSites/FiltersWebSite/BasicOptions.cs
@@ -6,17 +6,11 @@ using System.Security.Claims;
 using System.Threading.Tasks;
 using Microsoft.AspNetCore.Authentication;
 using Microsoft.AspNetCore.Builder;
-using Microsoft.AspNetCore.Http.Authentication;
 using Microsoft.Extensions.Options;
 
 namespace FiltersWebSite
 {
-    public class BasicOptions : AuthenticationOptions, IOptions<BasicOptions>
+    public class BasicOptions : AuthenticationSchemeOptions
     {
-        public BasicOptions()
-        {
-        }
-
-        public BasicOptions Value { get { return this; } }
     }
 }
\ No newline at end of file
diff --git a/test/WebSites/FiltersWebSite/Startup.cs b/test/WebSites/FiltersWebSite/Startup.cs
index 746f6543f4..cbe6e77996 100644
--- a/test/WebSites/FiltersWebSite/Startup.cs
+++ b/test/WebSites/FiltersWebSite/Startup.cs
@@ -16,6 +16,8 @@ namespace FiltersWebSite
         // Set up application services
         public void ConfigureServices(IServiceCollection services)
         {
+            services.AddScheme<BasicOptions, BasicAuthenticationHandler>("Interactive", _ => { });
+            services.AddScheme<BasicOptions, BasicAuthenticationHandler>("Api", _ => { });
             services.AddMvc();
             services.AddAuthorization(options =>
             {
@@ -60,8 +62,6 @@ namespace FiltersWebSite
         {
             app.UseCultureReplacer();
 
-            app.UseMiddleware<AuthorizeBasicMiddleware>("Interactive");
-            app.UseMiddleware<AuthorizeBasicMiddleware>("Api");
             app.UseMiddleware<ErrorReporterMiddleware>();
 
             app.UseMvcWithDefaultRoute();
diff --git a/test/WebSites/RazorPagesWebSite/Startup.cs b/test/WebSites/RazorPagesWebSite/Startup.cs
index 4a39e2f302..782112df88 100644
--- a/test/WebSites/RazorPagesWebSite/Startup.cs
+++ b/test/WebSites/RazorPagesWebSite/Startup.cs
@@ -11,6 +11,7 @@ namespace RazorPagesWebSite
         public void ConfigureServices(IServiceCollection services)
         {
             services
+                .AddCookieAuthentication(options => options.LoginPath = "/Login")
                 .AddMvc()
                 .AddCookieTempDataProvider()
                 .AddRazorPagesOptions(options =>
@@ -25,12 +26,7 @@ namespace RazorPagesWebSite
         {
             app.UseCultureReplacer();
 
-            app.UseCookieAuthentication(new CookieAuthenticationOptions
-            {
-                LoginPath = "/Login",
-                AutomaticAuthenticate = true,
-                AutomaticChallenge = true
-            });
+            app.UseAuthentication();
 
             app.UseStaticFiles();
 
diff --git a/test/WebSites/RazorPagesWebSite/StartupWithBasePath.cs b/test/WebSites/RazorPagesWebSite/StartupWithBasePath.cs
index 9295f0da80..4ad200c6be 100644
--- a/test/WebSites/RazorPagesWebSite/StartupWithBasePath.cs
+++ b/test/WebSites/RazorPagesWebSite/StartupWithBasePath.cs
@@ -11,6 +11,7 @@ namespace RazorPagesWebSite
         public void ConfigureServices(IServiceCollection services)
         {
             services
+                .AddCookieAuthentication(options => options.LoginPath = "/Login")
                 .AddMvc()
                 .AddCookieTempDataProvider()
                 .AddRazorPagesOptions(options =>
@@ -25,12 +26,7 @@ namespace RazorPagesWebSite
         {
             app.UseCultureReplacer();
 
-            app.UseCookieAuthentication(new CookieAuthenticationOptions
-            {
-                LoginPath = "/Login",
-                AutomaticAuthenticate = true,
-                AutomaticChallenge = true
-            });
+            app.UseAuthentication();
 
             app.UseStaticFiles();
 
diff --git a/test/WebSites/SecurityWebSite/Startup.cs b/test/WebSites/SecurityWebSite/Startup.cs
index c96227b635..9c2c9b2b20 100644
--- a/test/WebSites/SecurityWebSite/Startup.cs
+++ b/test/WebSites/SecurityWebSite/Startup.cs
@@ -14,19 +14,17 @@ namespace SecurityWebSite
             // Add framework services.
             services.AddMvc();
             services.AddAntiforgery();
-            services.AddAuthentication();
+            services.AddCookieAuthentication(options => 
+            {
+                options.LoginPath = "/Home/Login";
+                options.LogoutPath = "/Home/Logout";
+            });
         }
 
         // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
         public void Configure(IApplicationBuilder app)
         {
-            app.UseCookieAuthentication(new CookieAuthenticationOptions
-            {
-                LoginPath = "/Home/Login",
-                LogoutPath = "/Home/Logout",
-                AutomaticAuthenticate = true,
-                AutomaticChallenge = true
-            });
+            app.UseAuthentication();
 
             app.UseMvc(routes =>
             {