title: Configuring different authorization/authentication schemes
body: <p>I am implementing security on an ASP.NET Core 1.0.1 application, which is used as a Web API. I am trying to understand if and how to implement 2 different authentication schemes.<br>
  Ideally, I would like to allow authentication via Azure Active Directory or via username/password for specific back-end services that contact the application.<br>
  Is it possible to configure ASP.NET Core for such a setup where an endpoint either authenticates through Azure AD or JWT token?  </p>
  
  <p>I tried with something like this, but upon calling the generate token endpoint, I get a 500 with absolutely no information. Removing the Azure AD configuration makes the endpoint work perfectly:</p>
  
  <pre><code>services.AddAuthorization(configuration =&gt;
  {
      configuration.AddPolicy("Bearer", new AuthorizationPolicyBuilder()
          .AddAuthenticationSchemes(JwtBearerDefaults.AuthenticationScheme)
          .RequireAuthenticatedUser().Build());
  
      configuration.AddPolicy("OpenIdConnect", new AuthorizationPolicyBuilder()
          .AddAuthenticationSchemes(OpenIdConnectDefaults.AuthenticationScheme)
          .RequireAuthenticatedUser().Build());
  });
  
  app.UseOpenIdConnectAuthentication(new OpenIdConnectOptions
  {
      ClientId = Configuration["Authentication:AzureAD:ClientId"],
      Authority 
          = Configuration["Authentication:AzureAd:AADInstance"] 
          + Configuration["Authentication:AzureAd:TenantId"],
      ResponseType = OpenIdConnectResponseType.IdToken,
      SignInScheme = CookieAuthenticationDefaults.AuthenticationScheme
  });
  
  app.UseJwtBearerAuthentication(new JwtBearerOptions
  {
      TokenValidationParameters = new TokenValidationParameters
      {
          ClockSkew = TimeSpan.FromMinutes(1),
          IssuerSigningKey = TokenAuthenticationOptions.Credentials.Key,
          ValidateAudience = true,
          ValidateIssuer = true,
          ValidateLifetime = true,
          ValidateIssuerSigningKey = true,
          ValidAudience = TokenAuthenticationOptions.Audience,
          ValidIssuer = TokenAuthenticationOptions.Issuer
       }
  });
  </code></pre>