How to handle resource-based authorization for mixed user/daemon token access?

[julealgon]

I have an API where the caller can create some resources, and I want to ensure that only the "owner" of the resource can manipulate it after creation. I initially persisted the User.Identity.Name as the "owner" and then checked it in my resource authorization handler to see whether or not the current user owned the resource before allowing him to edit/delete it.

This works fine for user flows (user tokens), but fails miserably for daemon app flows (application tokens). App tokens do not have the underlying claim used by Identity.Name and uses other things, like "appid" claims with guids in it.

If I want to keep enforcing resource-based ownership for application access, should I conditionally persist/check the "appid" (or similar claim) instead of checking the Identity.Name property when I detect the token to be an "application token"?

Are there any best practices surrounding this scenario of resource-based authorization with both users and applications managing resources at the same time?

Related:

• Add extension method on 'ClaimsPrincipal' for checking if it is an "app-only" principal/token #1684