[Feature Request] Enable web APIs called by daemon apps to control tokens without roles claim

[jmprieur]

Why?

Is your feature request related to a problem? Please describe.
Microsoft.Identity.Web enforces that a token has scopes (for delegated permissions) or roles (when called by daemon apps), however there is another mechanism: the ACL-based authorization pattern to control tokens without roles claim.

Describe the solution you'd like
Have a way to specify that the application can bypass the following test, to support the ACL-based authorization for the web API called by daemons:

microsoft-identity-web/src/Microsoft.Identity.Web/WebApiExtensions/MicrosoftIdentityWebApiAuthenticationBuilderExtensions.cs

Lines 222 to 229 in 158636e

	// This check is required to ensure that the web API only accepts tokens from tenants where it has been consented and provisioned.
	if (!context.Principal.Claims.Any(x => x.Type == ClaimConstants.Scope)
	&& !context.Principal.Claims.Any(y => y.Type == ClaimConstants.Scp)
	&& !context.Principal.Claims.Any(y => y.Type == ClaimConstants.Roles)
	&& !context.Principal.Claims.Any(y => y.Type == ClaimConstants.Role))
	{
	throw new UnauthorizedAccessException(IDWebErrorMessage.NeitherScopeOrRolesClaimFoundInToken);
	}

Describe alternatives you've considered
None. See the discussion here: #691

Proposed design:

• Add a new bool property named AllowWebApiToBeAuthorizedByACL in the MicrosoftIdentityOptions, which would be false by default.
• If this property is true, then avoid throwing in

  microsoft-identity-web/src/Microsoft.Identity.Web/WebApiExtensions/MicrosoftIdentityWebApiAuthenticationBuilderExtensions.cs

  Lines 222 to 229 in 158636e

  	// This check is required to ensure that the web API only accepts tokens from tenants where it has been consented and provisioned.
  	if (!context.Principal.Claims.Any(x => x.Type == ClaimConstants.Scope)
  	&& !context.Principal.Claims.Any(y => y.Type == ClaimConstants.Scp)
  	&& !context.Principal.Claims.Any(y => y.Type == ClaimConstants.Roles)
  	&& !context.Principal.Claims.Any(y => y.Type == ClaimConstants.Role))
  	{
  	throw new UnauthorizedAccessException(IDWebErrorMessage.NeitherScopeOrRolesClaimFoundInToken);
  	}

[jmprieur]

@jennyf19 @TaranbirBhullar

[jmprieur]

Thanks @TaranbirBhullar for confirming that this works for you.

[jennyf19]

Included in 1.2.0 release.