Authorization: check application ID

The sandbox token format includes a applicationID field, but the ledger API does not use it to for validation - it is currently only read by the JSON ledger API.

We should add the application ID to Claims, then use it in the ledger API service auth validation if present.

[stefanobaghino-da]

My question was not regarding the missing applicationId from a request but the behavior of tokens with an applicationId against a service that does not have such a field. As I mentioned before, I will simply ignore it for the time being. If there are different requirements we can address them separately.

[rautenrieth-da]

@stefanobaghino-da IMO the ledger should behave as follows:

Field in token | Field in request | Action
---------------+------------------+---------------------------
 Present       | Present          | Authorize IFF values match
 Missing       | Present          | Authorize
 Present       | Missing          | Authorize
 Missing       | Missing          | Authorize
---------------|------------------+---------------------------

i.e.,

• missing fields in the token mean all values are authorized
• superfluous fields in the token are ignored