[Authorize] fails for OpenIdConnect

[brentschmaltz]

There are two problems:

1. OpenIdConnectHandler always expects 'Challenge' to be non-null. A change in the runtime requires that this cannot be expected.
2. OpenIdConnectHandler sets the AuthenticationTicket.Principal property. Later, the runtime should check if AT.Identities OR AT.Principal is set.

Without these fixes

1. [Authorize] attribute will have no effect for OIDC code.
2. Users who manage SSO, will never see the identity created by OIDCHandler.

[blowdart]

Why on earth does AuthorizeTicket have both an identities and a principal property?

A better fix for 2 would be to choose one or the other.

[HaoK]

I'm assuming this is fixed now?

[Eilon]

This is now fixed (as confirmed via the templates).