Add extension method on 'ClaimsPrincipal' for checking if it is an "app-only" principal/token

[julealgon]

There are a few cases where API code needs to know whether or not the current auth token being processed is a "daemon token" (app-only token) or a "user token". The most common scenario is when the same action should be available for both users and applications, but the authorization requirements should be different for each one (say, the user requires a scope, while the app requires an app role). The only way to conditionally validate these auth requirements is to actively check the token type and apply the specific validation.

MSDN does talk explicitly about these token checks here:

• Accepting app-only tokens if the web API should be called only by daemon apps

However, this check is quite a bit convoluted and verbose to be maintained by each consuming application that needs to differentiate the token types.

Would it make sense to just expose this logic in an extension, so that it can be called in the ClaimsPrincipal directly?

Related:

• .NET 5.0 protected web API - verify scopes or app roles in a single action #1302
• [Documentation] How to verify scope or app role in the same controller action #963
• Why does '[RequireScope]' check non-user token scopes? #1683