title: Possible Multiple AuthenticationSchemes in request header?
body: <p>I have two webapis A and B. From A i make a request to B. A contains user info from identityserver4 where i just need to pass the token to the request header. Beside identityserver token, A also uses AAD(Azure Active Directory) where i have registred B. So from A, i also check my AAD so that i can retrieve The token from Azure to send to B, This is just so B can trust that a request is coming from a trusted registred source. As you can understand From A i have two tokens, one to check the loged in user and the other to check registred application. My A startup class look like this:</p>
  <pre><code>public void ConfigureServices(IServiceCollection services)
          {
              Config = services.ConfigureAuthConfig&lt;AuthConfig&gt;(Configuration.GetSection(&quot;AuthConfig&quot;));
              services.TryAddSingleton&lt;IHttpContextAccessor, HttpContextAccessor&gt;();
              services.AddScoped&lt;ICurrentUser, CurrentUser&gt;();
              services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
            
             .AddIdentityServerAuthentication(//this coming with identityserver token and user info
                  idt =&gt;
                  {
                      idt.Authority = &quot;https://gnoauth.se:5005&quot;;
                      idt.ApiName = &quot;globalnetworkApi&quot;;
                      idt.SaveToken = true;
                      idt.RequireHttpsMetadata = true;
                  }
              );
  </code></pre>
  <p>So here is my A httpclienthelper, where i setup my client headers to send to B, As i already have the token and user from identity server so the other thing i do here is to send B authority, client id and secret to AAD for retrieving the second token:</p>
  <pre><code>var context = new HttpContextAccessor().HttpContext;
  var accessTokenFromIdentityserver = await 
                  context.GetTokenAsync(OpenIdConnectParameterNames.AccessToken);
  var tokenfromAAD = result.AccessToken;
  
  defaultRequestHeaders.Authorization = new 
                  AuthenticationHeaderValue(&quot;AAD_Authentication&quot;, tokenfromAAD);
  </code></pre>
  <p>from here i actualy have all i need, both the tokens and all claims. As you can see to the defaultrequestheaders i only cansend one token but i would like to send both tokens to B, how can i configure the request headers to be able to do that?</p>
  <p>So here is the B startup</p>
  <pre><code>services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
              .AddJwtBearer(&quot;AAD_Authentication&quot;, opt =&gt;
              {
                  opt.Audience = Configuration[&quot;AAD:ResourceId&quot;];
                  opt.Authority = $&quot;{Configuration[&quot;AAD:InstanceId&quot;]}{Configuration[&quot;AAD:TenantId&quot;]}&quot;;
                  opt.RequireHttpsMetadata = true;
              })
              .AddJwtBearer(&quot;IDS4_Authentication&quot;,
                  idt =&gt;
                  {
                      idt.Authority = &quot;https://gnoauth.se:5005&quot;;
                      idt.Audience = &quot;globalnetworkApi&quot;;
                      idt.SaveToken = true;
                      idt.RequireHttpsMetadata = true;
                  }
              );
  
              services.AddAuthorization(options =&gt;
          {
              options.DefaultPolicy = new AuthorizationPolicyBuilder()
                  .RequireAuthenticatedUser()
                  .AddAuthenticationSchemes(&quot;AAD_Authentication&quot;, &quot;IDS4_Authentication&quot;)
                  .Build();
  </code></pre>
  <p>But i also setup a policy so that from some of my controllers i need to authorize both logedin user and application registration like this</p>
  <pre><code>[Authorize(AuthenticationSchemes = &quot;AAD_Authentication,IDS4_Authentication&quot;, Policy = &quot;MyPolicy&quot;)]
  </code></pre>
  <p>the big problem i have been facing is how from A to send both tokens and how to setup authenticationschemes so that B actually get two bearer authenticationschemes</p>
  <p>ANY HELP PLEASE</p>