I am porting a site from v7 to v8. In v7 there is a IHttpHandler that performs access control of file requests.

I could probably use the same implementation in v8 but I would rather do it in an Owin middleware. I have a simple middleware running and I am able to see the requests in my code. To do the access control I need to get the authenticated user but it does not seem to be set.

public override async Task Invoke(IOwinContext context)
{
   var user = context.Authentication.User; 
   // user == null
}

Can this have to do with the order in which the different middlewares are executed and if so, how would I change it?

The middleware is wired in the UmbracoDefaultOwinStartup.MiddlewareConfigured event handler.