Resolve Custom JWT auth provider to the registered Bearer scheme

[Souvik Ghosh (souvikghosh04)]

Summary

Fixes #3541.

Requests fail with Custom (and any non out‑of‑box JWT) authentication provider:

System.InvalidOperationException: No authentication handler is registered for the scheme
'OAuthAuthentication'. The registered schemes are: StaticWebAppsAuthentication,
AppServiceAuthentication, Bearer, SimulatorAuthentication.

This affects normal REST/GraphQL requests as well as the /api/openapi (Swagger) endpoint.

Root cause

An internal authentication‑scheme name mismatch:

• For a JWT‑configured provider (anything that isn't EasyAuth / Simulator / Unauthenticated —
  e.g. Custom), DAB registers the JWT bearer handler under
  JwtBearerDefaults.AuthenticationScheme ("Bearer") in both
  ConfigureAuthentication (production) and ConfigureAuthenticationV2 (development,
  AddJwtBearer() → "Bearer").
• At request time, ClientRoleHeaderAuthenticationMiddleware.ResolveConfiguredAuthNScheme
  returned GenericOAuthDefaults.AUTHENTICATIONSCHEME ("OAuthAuthentication") for Custom —
  a scheme that is never registered as a handler anywhere in the codebase.
• httpContext.AuthenticateAsync("OAuthAuthentication") therefore throws.

AzureAD / EntraID worked only because they explicitly returned the matching "Bearer"
scheme. Custom is equally a JWT‑bearer provider and must resolve to the same registered scheme.

Fix

• ResolveConfiguredAuthNScheme now resolves every JWT‑configured provider (AzureAD, EntraID,
  and any custom provider such as Custom) to JwtBearerDefaults.AuthenticationScheme,
  matching the handler registration.
• Removed the now‑unused GenericOAuthDefaults class (its "OAuthAuthentication" constant was
  never registered as a handler and was the sole source of the mismatch).

Tests

• Added JwtTokenAuthenticationUnitTests.TestValidToken_JwtConfiguredProviders, a regression
  test that validates a JWT through the middleware for Custom, AzureAD, and EntraID
  providers and asserts the request is authenticated (HTTP 200). Prior to the fix, the Custom
  case threw No authentication handler is registered for the scheme 'OAuthAuthentication'.
• All 15 tests in JwtTokenAuthenticationUnitTests pass; dotnet format --verify-no-changes
  is clean on the changed files.

[Copilot]

Copilot review overview

🟡 Changes recommended

Removing the public GenericOAuthDefaults type may break consumers; retain an obsolete compatibility shim.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 1

Open (1)

• Retain GenericOAuthDefaults as an obsolete compatibility shim · New

What changed in this PR

Fixes JWT authentication for custom providers by resolving them to the registered Bearer scheme.

Changes:

• Aligns JWT provider resolution with the registered bearer handler.
• Adds regression tests for Custom, AzureAD, and EntraID.
• Removes the unused OAuth scheme definition.

File	Description
src/​Service.Tests/​Authentication/​JwtTokenAuthenticationUnitTests.cs	Adds JWT provider regression coverage.
src/​Core/​AuthenticationHelpers/​GenericOAuthDefaults.cs	Removes the obsolete OAuth scheme definition.
src/​Core/​AuthenticationHelpers/​ClientRoleHeaderAuthenticationMiddleware.cs	Maps JWT providers to the registered bearer scheme.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[aaronburtle]

I noticed this as well, but I dont think it is an issue that will arise, as I doubt anyone it taking dependencies on this. We could document it however just so that it is made clear.

[aaronburtle]

Looks good, might want to document the change in pubic facing type.