Add clear documentation about claims type mapping

The original issue got closed without any useful resolution.

I understand the reluctance to make a breaking change (turning off mapping by default), but it should at least be clearly documented in a warning box in the documentation in one of the sections on authorization!!!

Edit: as an example, this page https://docs.microsoft.com/en-us/aspnet/core/security/authorization/claims?view=aspnetcore-2.2 shows how to require “EmployeeNumber” claim. When I paste my token in jwt.ms, it displays “scp” as the scope name. Then I added the code below, and did it work? NO!

---

From the original post.

Seriously, closed? I just lost two days trying to get the following to work

                opts.AddPolicy("ProjectAccessScope", policy => {
                    policy.RequireClaim("scp", Components.AppScopes.ProjectMember);
                });

It was constantly failing, I had to turn off policy-based authorization and inspect the token manually to discover that it has been renamed. And where is renaming of token types mentioned in the aspnet.core documentation? NOWHERE!

_Originally posted by @zvrba in https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/issues/415#issuecomment-507764708_

[brentschmaltz]

@zvrba @GeoK i’ll work on a wiki page that asp.net can link to if they choose. I agree this whole mapping issue is complicated.

[GeoK]

@zvrba - Thank you for raising this issue and for the suggestions. I’ll add this item as one of task for the next milestone.

To answer your other question, ClaimTypes class belongs to System.Security.Claims assembly which ships independently of IdentityModel extensions for .Net assemblies. The complete mapping of claim types is available here.