//  认证服务
 services.AddAuthentication("token")
          .AddScheme<TokenAuthenticationOptions, TokenAuthenticationHandler>(TokenAuthenticationDefaults.AuthenticationScheme,
          option => {
              option.ClaimsIssuer = configuration.GetSection("AppKeys")["ClaimsIssuer"].ToString();
              option.ClientId = configuration.GetSection("AppKeys")["ClientId"].ToString();
              option.ClientSign = configuration.GetSection("AppKeys")["ClientSign"].ToString();
    });

// 授权服务
services.AddAuthorization(options =>{
         // 默认策略
         options.DefaultPolicy = new AuthorizationPolicyBuilder()
                .RequireAuthenticatedUser()
                .AddAuthenticationSchemes("token")
                 .Build();
});

既然现在.NET5推荐使用端点路由的形式，故针对我这个朴素的需求：

我理所当然会尝试使用在Controller端点上要求全局授权访问，对散落在各地的不需要授权的Controller添加[AllowAnonymous]特性。

 // 注册授权中间件
 app.UseAuthorization();
 app.UseEndpoints(endpoints =>
 {
     endpoints.MapHealthChecks("/healthz").AllowAnonymous().WithDisplayName("healthz");                  
     // 全局对所有api要求授权访问
     endpoints.MapControllers().RequireAuthorization().WithDisplayName("default");
 });

[AllowAnonymous]
[HttpGet]
[Route("triggerorder")]
public void TriggerOrder()
{
  ...
}