Any ways not to verify scope or role claim in the jwt token

Is your feature request related to a problem? Please describe. This library always verify scope or role whether inside a JWT token pass in Auth header, if they both not exist, it will throw exception:

IDW10201: Neither scope or roles claim was found in the bearer token.

However, we do not want to verify existence of this two claims, and didn’t find any configurations for it.

Describe the solution you’d like We want a simple config which can turn off or turn on this verification

Describe alternatives you’ve considered On way I consider is to override the token validation handler just like below:

services.Configure<JwtBearerOptions>(JwtBearerDefaults.AuthenticationScheme, options =>
{
    Configuration.GetSection("AzureAd").Bind(options);
    var existingOnTokenValidatedHandler = options.Events.OnTokenValidated;
    options.Events.OnTokenValidated = async context =>
    {
        // await existingOnTokenValidatedHandler(context);
    };
});

However, the code above would cause the exception below:

No account or login hint was passed to the AcquireTokenSilent call

Another way I think is to config AAD to append application role claim inside the JWT token. However, this need admin consent for the AAD, which is not acceptable.

[jmprieur]

@SLdragon : yes Access Control Lists. This is because you can secure your web API with ACLs. See control tokens without a roles claim

[jmprieur]

Yes, @SLdragon : the token validation will still happen, but the library won’t throw if your token has neither scope or roles (as this is a valid scenario if you protect your API by ACLs, or just enforce verifying roles/scopes in your controller actions/pages methods: see https://github.com/AzureAD/microsoft-identity-web/wiki/web-apis#verification-of-scopes-or-app-roles-in-the-controller-actions