Application and User Authentication using ASP.NET Core : <p>Can anyone point me to some good documentation or provide good information on the best way to implement authentication and authorisation for an ASP.NET Core REST API.I need to authenticating and authorising the app first and then authenticate and authorise the user. </p>

<p>Ideally I want to be able restrict the controller method that an authenticated app and/or user can access. </p>

<p>I am thinking of using <a href="https://github.com/aspnet-contrib/AspNet.Security.OpenIdConnect.Server" rel="noreferrer">AspNet.Security.OpenIdConnect.Serverenter</a> for the App authentication but I am not sure then how best to perform the user authentication. Maybe reuse the OpenIdConnect authentication on a different endpoint for users with a different header to contain the user token.</p>

<p>Once authenticated I am thinking of just using roles base security to restrict which controllers methods can be accessed.</p>

<p>Is this the correct route to solving this problem?</p>
