IPrincipal应该是ClaimsPrincipal但是WindowsPrincipal

Question

我有一个带有3个动作方法的控制器，其中两个是常规OData调用，第三个是函数。使用Azure AD和ADAL保护WebAPI。

CustomAuthAttribute （IsAppAuthorizing只是检查web.config条目）

public class OpsmApiAuthorizeAttribute : AuthorizeAttribute
{
    /// <summary>
    /// Returns whether or not the user has authenticated with ADFS and whehter ornot we are configured to do authorization
    /// </summary>
    /// <param name="actionContext"></param>
    /// <returns></returns>
    protected override bool IsAuthorized(System.Web.Http.Controllers.HttpActionContext actionContext)
    {
        if (HttpContext.Current.IsAppAuthorizing())
            return base.IsAuthorized(actionContext);

        return true;
    }
}

Startup.Auth.cs

    public void ConfigureAuth(IAppBuilder app)
    {
        app.UseWindowsAzureActiveDirectoryBearerAuthentication(
            new WindowsAzureActiveDirectoryBearerAuthenticationOptions
            {
                Tenant = ConfigurationManager.AppSettings["ida:Tenant"],
                TokenValidationParameters = new TokenValidationParameters
            {
                ValidAudience = ConfigurationManager.AppSettings["ida:Audience"],
            },
                MetadataAddress = ConfigurationManager.AppSettings["ida:MetadataEndpoint"],
            });
    }

控制器（ByUser是没有获得正确IPrincple信息的OData函数，其他两种方法工作正常）

[OpsmApiAuthorizeAttribute]
public class ProjectsController : BaseController
{
    /// <summary>
    /// Get a Project Detail for a given project id
    /// </summary>
    /// <returns>json</returns>
    [EnableQuery]
    public IQueryable<OPSM.DataAccess.Database.OpsM.PRJ> Get([FromODataUri] string key)
    {
       ...
    }
    /// <summary>
    /// Get all Projects 
    /// </summary>
    /// <returns>json</returns>
    [EnableQuery]
    public IQueryable<OPSM.DataAccess.Database.OpsM.PRJ> Get()
    {
        ...
    }

    [HttpGet]
    //[CacheOutput(ServerTimeSpan = 60 * 60)]
    public IHttpActionResult ByUser([FromODataUri]string userId)
    {
       ...
    }
}